Don't Trust Stubborn Neighbors: A Security Framework for Agentic Networks

• URL: http://arxiv.org/abs/2603.15809v1
• Date: Mon, 16 Mar 2026 18:41:21 GMT
• Title: Don't Trust Stubborn Neighbors: A Security Framework for Agentic Networks
• Abstract summary: Malicious or compromised agents can exploit communication channels to propagate misinformation and manipulate collective outcomes.<n>We study how such manipulation can arise and spread by borrowing the Friedkin-Johnsen opinion formation model from social sciences.<n>We propose a new mechanism to mitigate threats by a trust-adaptive defense that dynamically adjusts inter-agent trust to limit adversarial influence.
• Score: 32.791374704820925
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Large Language Model (LLM)-based Multi-Agent Systems (MASs) are increasingly deployed for agentic tasks, such as web automation, itinerary planning, and collaborative problem solving. Yet, their interactive nature introduces new security risks: malicious or compromised agents can exploit communication channels to propagate misinformation and manipulate collective outcomes. In this paper, we study how such manipulation can arise and spread by borrowing the Friedkin-Johnsen opinion formation model from social sciences to propose a general theoretical framework to study LLM-MAS. Remarkably, this model closely captures LLM-MAS behavior, as we verify in extensive experiments across different network topologies and attack and defense scenarios. Theoretically and empirically, we find that a single highly stubborn and persuasive agent can take over MAS dynamics, underscoring the systems' high susceptibility to attacks by triggering a persuasion cascade that reshapes collective opinion. Our theoretical analysis reveals three mechanisms to increase system security: a) increasing the number of benign agents, b) increasing the innate stubbornness or peer-resistance of agents, or c) reducing trust in potential adversaries. Because scaling is computationally expensive and high stubbornness degrades the network's ability to reach consensus, we propose a new mechanism to mitigate threats by a trust-adaptive defense that dynamically adjusts inter-agent trust to limit adversarial influence while maintaining cooperative performance. Extensive experiments confirm that this mechanism effectively defends against manipulation.

Related papers

• MAStrike: Shapley-Guided Collusive Red-Teaming on Multi-Agent Systems [26.889808672555393]
  Hierarchical multi-agent systems (MAS) are rapidly being deployed in high-stakes domains such as finance and software engineering.<n>Existing red-teaming approaches for MAS rely on selection of target agents and isolated message streams.<n>We propose MAStrike, a closed-loop framework for collusive red-teaming in hierarchical MAS.
  arXiv  Detail & Related papers  (2026-06-11T05:21:39Z)
• Provably Secure Agent Guardrail [89.79561918065122]
  Existing defense architectures rely on empirical semantic guardrails and probabilistic large model adjudicators.<n>This paper proposes a new security paradigm for agents based on the fundamental limitations of logical reasoning.
  arXiv  Detail & Related papers  (2026-05-28T02:12:41Z)
• Breaking the Secret: Economic Interventions for Combating Collusion in Embodied Multi-Agent Systems [22.697901881084068]
  Collusion among autonomous agents poses a critical security threat in embodied multi-agent systems.<n>We propose an incentive intervention approach that mitigates collusion by reshaping agents' payoff structures.<n> Experimental results show that our method effectively suppresses collusion by inducing defection, while preserving system efficiency.
  arXiv  Detail & Related papers  (2026-04-26T03:13:47Z)
• Reward Hacking in the Era of Large Models: Mechanisms, Emergent Misalignment, Challenges [87.04241991512386]
  We propose the Proxy Compression Hypothesis (PCH) as a unifying framework for understanding reward hacking.<n>Under this view, reward hacking arises from the interaction of objective compression, optimization amplification, and evaluator--policy co-adaptation.<n>This perspective unifies empirical phenomena across RLHF, RLAIF, and RLVR regimes, and explains how local shortcut learning can generalize into broader forms of misalignment.
  arXiv  Detail & Related papers  (2026-04-15T08:11:34Z)
• CIA: Inferring the Communication Topology from LLM-based Multi-Agent Systems [52.48183625867145]
  Multi-Agent Systems (MAS) have demonstrated remarkable capabilities in solving complex tasks.<n>Central to MAS is the communication topology which governs how agents exchange information internally.<n>In this paper, we investigate a critical privacy risk: MAS communication topologies can be inferred under a restrictive black-box setting.
  arXiv  Detail & Related papers  (2026-04-14T08:48:15Z)
• OMNI-LEAK: Orchestrator Multi-Agent Network Induced Data Leakage [59.3826294523924]
  We investigate the security vulnerabilities of a popular multi-agent pattern known as the orchestrator setup.<n>We report the susceptibility of frontier models to different categories of attacks, finding that both reasoning and non-reasoning models are vulnerable.
  arXiv  Detail & Related papers  (2026-02-13T21:32:32Z)
• SoK: Trust-Authorization Mismatch in LLM Agent Interactions [16.633676842555044]
  Large Language Models (LLMs) are rapidly evolving into autonomous agents capable of interacting with the external world.<n>This paper provides a unifying formal lens for agent-interaction security.<n>We introduce a novel risk analysis model centered on the trust-authorization gap.
  arXiv  Detail & Related papers  (2025-12-07T16:41:02Z)
• SentinelNet: Safeguarding Multi-Agent Collaboration Through Credit-Based Dynamic Threat Detection [22.242243610133215]
  Malicious agents pose significant threats to the reliability and decision-making capabilities of Multi-Agent Systems (MAS) powered by Large Language Models (LLMs)<n>We propose SentinelNet, the first decentralized framework for proactively detecting and mitigating malicious behaviors in multi-agent collaboration.<n> Experiments on MAS benchmarks show SentinelNet achieves near-perfect detection of malicious agents, close to 100% within two debate rounds, and recovers 95% of system accuracy from compromised baselines.
  arXiv  Detail & Related papers  (2025-10-17T21:10:35Z)
• Disagreements in Reasoning: How a Model's Thinking Process Dictates Persuasion in Multi-Agent Systems [49.69773210844221]
  This paper challenges the prevailing hypothesis that persuasive efficacy is primarily a function of model scale.<n>Through a series of multi-agent persuasion experiments, we uncover a fundamental trade-off we term the Persuasion Duality.<n>Our findings reveal that the reasoning process in LRMs exhibits significantly greater resistance to persuasion, maintaining their initial beliefs more robustly.
  arXiv  Detail & Related papers  (2025-09-25T12:03:10Z)
• Can an Individual Manipulate the Collective Decisions of Multi-Agents? [53.01767232004823]
  M-Spoiler is a framework that simulates agent interactions within a multi-agent system to generate adversarial samples.<n>M-Spoiler introduces a stubborn agent that actively aids in optimizing adversarial samples.<n>Our findings confirm the risks posed by the knowledge of an individual agent in multi-agent systems.
  arXiv  Detail & Related papers  (2025-09-20T01:54:20Z)
• BlindGuard: Safeguarding LLM-based Multi-Agent Systems under Unknown Attacks [58.959622170433725]
  BlindGuard is an unsupervised defense method that learns without requiring any attack-specific labels or prior knowledge of malicious behaviors.<n>We show that BlindGuard effectively detects diverse attack types (i.e., prompt injection, memory poisoning, and tool attack) across multi-agent systems.
  arXiv  Detail & Related papers  (2025-08-11T16:04:47Z)
• When Autonomy Goes Rogue: Preparing for Risks of Multi-Agent Collusion in Social Systems [78.04679174291329]
  We introduce a proof-of-concept to simulate the risks of malicious multi-agent systems (MAS)<n>We apply this framework to two high-risk fields: misinformation spread and e-commerce fraud.<n>Our findings show that decentralized systems are more effective at carrying out malicious actions than centralized ones.
  arXiv  Detail & Related papers  (2025-07-19T15:17:30Z)
• Who's the Mole? Modeling and Detecting Intention-Hiding Malicious Agents in LLM-Based Multi-Agent Systems [25.6233463223145]
  We study intention-hiding threats in multi-agent systems powered by Large Language Models (LLM-MAS)<n>We design four representative attack paradigms that subtly disrupt task completion while maintaining a high degree of stealth.<n>To counter these threats, we propose AgentXposed, a psychology-inspired detection framework.
  arXiv  Detail & Related papers  (2025-07-07T07:34:34Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.