SoK: When Safe Agents Fail Together: The Security of Multi Agent LLM Systems

2026-08-31

AI Summary

研究通过执行层面分析多智能体语言模型系统的安全问题，提出A-I-R框架组织攻击机制，并系统化防御策略以应对交互接口、对手位置及系统级风险。

Abstract

Safe agents can fail together. Multi-agent LLM systems (MAS) move information, state, decisions, and authority across principal boundaries, creating failures that local checks may miss. Without an execution-level view, a multi-agent setting can easily be mistaken for evidence of a genuinely multi-agent security effect. We thus systematize MAS security through an execution-centered analysis of 197 works, covering six interaction interfaces, four adversary positions, seven system-level risks, and eight recurring attack paths. We introduce an A-I-R framework that organizes attacks by adversary position, interaction interface, and resulting system-level risk, unifying otherwise fragmented attack mechanisms across MAS. We organize defenses through a five-part contract covering path target, observation, intervention, trust boundary, and recovery, and identify path closure and recovery as key challenges. We audit 44 evaluation and benchmark works and identify open challenges in isolating interaction effects, designing comparable and diagnostic metrics, supporting reuse across MAS designs, and evaluating open-system operation. Together, these findings motivate an interaction-aware view of MAS security: trace attacks end to end, test whether defenses close those paths, and evaluate system-level effects with appropriate counterfactuals.

Problem

• Multi-agent LLM systems
• security
• execution-level view
• interaction interfaces
• adversary positions

Innovation

• A-I-R framework
• multi-agent LLM systems
• execution-centered analysis
• interaction-aware security