HARP: Measuring Harm Amplification in Multi-Agent LLM Systems

2026-05-26

AI Summary

This work addresses the critical yet underexplored risk that localized perturbations in multi-agent large language model systems can be amplified through inter-agent interactions into system-wide harms, a phenomenon inadequately quantified by existing evaluation methods. To bridge this gap, the authors propose HARP, a novel framework that introduces the first execution-trajectory-based metric for measuring local-to-global harm amplification. By comparing clean and perturbed execution trajectories, HARP tracks behavioral divergences in outputs, tool invocations, and memory operations to compute a harm amplification ratio. The study implements targeted attack mechanisms—including role-based perturbation injection, shared context manipulation, and temporal/memory persistence attacks—and introduces IntegrityGuard, a new defense strategy. Experiments on a seven-agent financial system demonstrate that single-point compromises can trigger maximal harm amplification, with shared context poisoning being the most effective attack vector; IntegrityGuard substantially mitigates global harm, albeit with trade-offs between utility and computational cost.

Abstract

Multi-agent LLM systems decompose workflows across agents, tools, shared context, memory, and decision gates. This modularity improves interpretability, but creates a propagation risk: a bounded perturbation to one component can be reused by other agents and amplified into system-level harm. We introduce HARP (Harm Amplification through Role Perturbation), a trace-first methodology for studying local-to-global harm amplification in multi-agent LLM systems. HARP compares paired clean and perturbed executions and records specialist outputs, tool calls, memory reads/writes, guard events, oracle logs, latency, token cost, and decisions. We define local harm as deviation from targeted agents or corrupted channels, global harm as deviation over the full trace, and harm amplification as (H_global/H_local). This complements attack success rate with a measure of how strongly orchestration spreads harm beyond the attack point. We instantiate HARP in a finance-oriented seven-agent system with a deterministic decision gate and configurable attack harness for specialist compromise, collusion, shared-context corruption, and temporal or memory-persistent attacks. Across five defenses, prompt-only defenses preserve benign utility but leave high success and stealth; pre-tool and step-level guards reduce some failures with utility or latency costs; and IntegrityGuard, a trace-consistency defense, achieves the lowest attack success and global harm but introduces utility/cost trade-offs. Results show that single-specialist compromise produces the strongest amplification, shared-context corruption yields the highest attack success, and temporal persistence produces the largest malicious impact. HARP argues that secure multi-agent evaluation must measure not only bypass, but propagation.

Problem

• Harm Amplification
• Multi-Agent LLM Systems
• Perturbation Propagation
• System-level Harm
• Role Perturbation

Innovation

• Harm Amplification
• Multi-Agent LLM Systems
• Trace-Based Evaluation
• Role Perturbation
• IntegrityGuard