DynaTrust: Defending Multi-Agent Systems Against Sleeper Agents via Dynamic Trust Graphs

• URL: http://arxiv.org/abs/2603.15661v1
• Date: Mon, 09 Mar 2026 05:53:16 GMT
• Title: DynaTrust: Defending Multi-Agent Systems Against Sleeper Agents via Dynamic Trust Graphs
• Abstract summary: We propose DynaTrust, a novel defense method against sleeper agents.<n> DynaTrust treats trust as a continuous, evolving process rather than a static attribute.<n>It dynamically updates the trust of each agent based on its historical behaviors and the confidence of selected expert agents.
• Score: 17.988939054544243
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Large Language Model-based Multi-Agent Systems (MAS) have demonstrated remarkable collaborative reasoning capabilities but introduce new attack surfaces, such as the sleeper agent, which behave benignly during routine operation and gradually accumulate trust, only revealing malicious behaviors when specific conditions or triggers are met. Existing defense works primarily focus on static graph optimization or hierarchical data management, often failing to adapt to evolving adversarial strategies or suffering from high false-positive rates (FPR) due to rigid blocking policies. To address this, we propose DynaTrust, a novel defense method against sleeper agents. DynaTrust models MAS as a dynamic trust graph~(DTG), and treats trust as a continuous, evolving process rather than a static attribute. It dynamically updates the trust of each agent based on its historical behaviors and the confidence of selected expert agents. Instead of simply blocking, DynaTrust autonomously restructures the graph to isolate compromised agents and restore task connectivity to ensure the usability of MAS. To assess the effectiveness of DynaTrust, we evaluate it on mixed benchmarks derived from AdvBench and HumanEval. The results demonstrate that DynaTrust outperforms the state-of-the-art method AgentShield by increasing the defense success rate by 41.7%, achieving rates exceeding 86% under adversarial conditions. Furthermore, it effectively balances security with utility by significantly reducing FPR, ensuring uninterrupted system operations through graph adaptation.

Related papers

• EvoSafeHarness: Evolving Model- and Domain-Specific Harnesses for Securing Agents [74.54929751174289]
  EvoSafeHarness is a safety-specific optimization framework that synthesizes a deployable harness for a frozen model in a target domain.<n>It reduces average attack success rate from 45.6% to 10.0% at a 3.3-point utility cost.<n>It also achieves the best score on Agent-SafetyBench for every victim.
  arXiv  Detail & Related papers  (2026-09-05T05:56:41Z)
• On-Policy Self-Evolution via Failure Trajectories for Agentic Safety Alignment [54.30690671490447]
  Existing safety-alignment signals are largely response-level or off-policy.<n>FATE transforms verifier-scored failures into repair supervision without expert demonstrations.<n>FATE reduces attack success rate by 33.5%, harmful compliance by 82.6%, and improves external trajectory-safety diagnosis by 6.5%.
  arXiv  Detail & Related papers  (2026-05-12T09:56:28Z)
• Robust Multi-Agent LLMs under Byzantine Faults [12.778788735297288]
  Large language model (LLM) agents increasingly collaborate over peer-to-peer networks to improve their reliability.<n> unreliable or Byzantine agents may sway neighboring agents toward incorrect conclusions and degrade overall system performance.<n>Existing methods rely on leader-based coordination or self-reported confidence, both of which are susceptible to adversarial manipulation.
  arXiv  Detail & Related papers  (2026-05-09T17:37:43Z)
• Dynamic Meta-Layer Aggregation for Byzantine-Robust Federated Learning [0.0]
  Federated Learning systems are susceptible to Byzantine adversaries that inject malicious updates.<n>We propose FedAOT, a novel defense mechanism that counters multi-label flipping and untargeted poisoning attacks.<n>We show that FedAOT substantially improves model accuracy and resilience while maintaining computational efficiency.
  arXiv  Detail & Related papers  (2026-03-17T17:54:00Z)
• DGTEN: A Robust Deep Gaussian based Graph Neural Network for Dynamic Trust Evaluation with Uncertainty-Quantification Support [2.4897847232811716]
  DGTEN (Deep Gaussian-based Trust Evaluation Network) introduces a unified graph framework.<n>It combines uncertainty-aware message passing, expressive temporal modeling, and built-in defenses against trust-targeted attacks.<n>On two signed Bitcoin trust networks, DGTEN delivers significant improvements.
  arXiv  Detail & Related papers  (2025-10-08T23:38:55Z)
• Alignment Tipping Process: How Self-Evolution Pushes LLM Agents Off the Rails [103.05296856071931]
  We identify the Alignment Tipping Process (ATP), a critical post-deployment risk unique to self-evolving Large Language Model (LLM) agents.<n>ATP arises when continual interaction drives agents to abandon alignment constraints established during training in favor of reinforced, self-interested strategies.<n>Our experiments show that alignment benefits erode rapidly under self-evolution, with initially aligned models converging toward unaligned states.
  arXiv  Detail & Related papers  (2025-10-06T14:48:39Z)
• A biologically Inspired Trust Model for Open Multi-Agent Systems that is Resilient to Rapid Performance Fluctuations [0.0]
  Existing trust models face challenges related to agent mobility, changing behaviors, and the cold start problem.<n>We introduce a biologically inspired trust model in which trustees assess their own capabilities and store trust data locally.<n>This design improves mobility support, reduces communication overhead, resists disinformation, and preserves privacy.
  arXiv  Detail & Related papers  (2025-04-17T08:21:54Z)
• Dissecting Adversarial Robustness of Multimodal LM Agents [70.2077308846307]
  We manually create 200 targeted adversarial tasks and evaluation scripts in a realistic threat model on top of VisualWebArena.<n>We find that we can successfully break latest agents that use black-box frontier LMs, including those that perform reflection and tree search.<n>We also use ARE to rigorously evaluate how the robustness changes as new components are added.
  arXiv  Detail & Related papers  (2024-06-18T17:32:48Z)
• Perturbation-Invariant Adversarial Training for Neural Ranking Models: Improving the Effectiveness-Robustness Trade-Off [107.35833747750446]
  adversarial examples can be crafted by adding imperceptible perturbations to legitimate documents. This vulnerability raises significant concerns about their reliability and hinders the widespread deployment of NRMs. In this study, we establish theoretical guarantees regarding the effectiveness-robustness trade-off in NRMs.
  arXiv  Detail & Related papers  (2023-12-16T05:38:39Z)
• TrustGuard: GNN-based Robust and Explainable Trust Evaluation with Dynamicity Support [59.41529066449414]
  We propose TrustGuard, a GNN-based accurate trust evaluation model that supports trust dynamicity. TrustGuard is designed with a layered architecture that contains a snapshot input layer, a spatial aggregation layer, a temporal aggregation layer, and a prediction layer. Experiments show that TrustGuard outperforms state-of-the-art GNN-based trust evaluation models with respect to trust prediction across single-timeslot and multi-timeslot.
  arXiv  Detail & Related papers  (2023-06-23T07:39:12Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.