PaperlayerView exact revision on arXiv

Source-linked AI summary

Large Model Based Agents: State-of-the-Art, Cooperation Paradigms, Security and Privacy, and Future Trends

Yuntao Wang, Yanghe Pan, Zhou Su, Yi Deng, Quan Zhao, Linkang Du, Tom H. Luan, Jiawen Kang, Dusit Niyato

arXiv:2409.14457v3cs.AI

TL;DR

LM-agent ecosystems need frameworks for autonomous collaboration that address both collective intelligence and security/privacy risks. This survey synthesizes architectures, cooperation paradigms, threats, countermeasures, applications, and future directions for robust LM-agent systems.

Abstract

from arXiv · show

With the rapid advancement of large models (LMs), the development of general-purpose intelligent agents powered by LMs has become a reality. It is foreseeable that in the near future, LM-driven general AI agents will serve as essential tools in production tasks, capable of autonomous communication and collaboration without human intervention. This paper investigates scenarios involving the autonomous collaboration of future LM agents. We review the current state of LM agents, the key technologies enabling LM agent collaboration, and the security and privacy challenges they face during cooperative operations. To this end, we first explore the foundational principles of LM agents, including their general architecture, key components, enabling technologies, and modern applications. We then discuss practical collaboration paradigms from data, computation, and knowledge perspectives to achieve connected intelligence among LM agents. After that, we analyze the security vulnerabilities and privacy risks associated with LM agents, particularly in multi-agent settings, examining underlying mechanisms and reviewing current and potential countermeasures. Lastly, we propose future research directions for building robust and secure LM agent ecosystems.

I. INTRODUCTION

LM agents extend AI systems with general-purpose capabilities and can operate as virtual or embodied agents, while connected agents share data, knowledge, and computation. This survey focuses on networked collaboration paradigms and the security, privacy, and reliability challenges of LM-agent ecosystems.

A. Background of Large Model Based Agents

  • LM agents use large models as a foundation for interaction, planning, contextual understanding, knowledge retention, and general-purpose task solving across physical, virtual, and mixed-reality environments.They include virtual agents that use tools and embodied agents that perceive and act in the physical world.Source: A. Background of Large Model Based… · p. 1

B. Motivation of LM Agent Networks

  • Connected LM agents combine cloud-based brains with physical or digital bodies, sharing sensory data, task knowledge, and inference results through intra-agent and inter-agent communications.Cloud-edge-end deployment can offload compute-intensive tasks while local brains handle local inference.Source: B. Motivation of LM Agent Networks · p. 2, Figure 3 · p. 2
  • LM agent networks must address dynamic topology, heterogeneous resources, collaborative service provisioning, resource optimization, and secure, privacy-preserving coordination.Key approaches include model lightweighting, model sharding, role assignment, and distributed consensus across cloud-edge-end environments.Source: B. Motivation of LM Agent Networks · pp. 2–3

C. Motivation of Securing LM Agent Networks

  • Multi-agent collaboration introduces reliability, security, and privacy risks, including hallucinations, adversarial manipulation, poisoning, backdoors, data misuse, and leakage of memorized or confidential information.Interconnected cyber-physical-social systems can enlarge the attack surface and amplify consequences across domains.Source: C. Motivation of Securing LM Agent… · p. 3

D. Related Surveys and Our Contributions

  • Unlike prior surveys centered on agent frameworks or applications, this work surveys LM-agent networking, cooperation paradigms, security and privacy threats, countermeasures, and future directions.Its coverage spans agent construction, cloud-edge-end data/computation/knowledge cooperation, interaction strategies, and security mechanisms.Source: D. Related Surveys and Our Contributions · pp. 4–5

E. Paper Organization

The paper surveys LM-agent fundamentals, standards, architecture, modules, applications, collaboration, security, privacy, and future directions. This overview introduces two standards and a three-layer operating-system architecture for LM agents.

E. Paper Organization

  • The paper surveys single LM agents, networking, security and privacy threats, countermeasures, and future research directions.Its organization covers an overview of single agents, networking fundamentals, security and privacy taxonomies, countermeasures, open issues, and conclusions.Source: E. Paper Organization · p. 5

II. AN OVERVIEW OF LARGE MODEL AGENTS

  • The overview introduces standards, an operating-system architecture, constructing modules, prototypes, and modern applications of LM agents.Source: §II · p. 5

A. Standards of LM Agents

  • IEEE SA-P3394 specifies natural-language interfaces, interaction protocols, prompt and thought-chain integration, and plugin authentication and authorization.The standard is intended to improve interoperability, LM practicality, agent functionality, and user experience.Source: A. Standards of LM Agents · p. 5
  • IEEE SA-P3428 targets interoperable LLM agents in education while addressing integration, bias, transparency, and accountability.It covers interaction with adaptive instructional systems and aims to support personalized, efficient, and ethically sound educational applications.Source: A. Standards of LM Agents · p. 6

B. Operating System (OS) of LM Agents

  • The LM-agent operating system has application, kernel, and hardware layers, with the kernel adding agent-specific management capabilities.The application layer hosts agents and SDKs; the kernel handles reasoning, planning, memory, tools, scheduling, and privacy; hardware supplies physical resources through OS calls.Source: B. Operating System (OS) of LM Agents · p. 6, Figure 6 · p. 6

C. Constructing Modules of LM Agents

LM agents combine planning, action, memory, interaction, and security modules to perceive, reason, act, learn, collaborate, and operate safely. The survey reviews planning paradigms, memory types, embodied and tool-based action, interaction modes, and security concerns.

C. Constructing Modules of LM Agents

  • Five modules—planning, action, memory, interaction, and security—jointly support LM agents’ perception, decision-making, execution, learning, collaboration, and protection.Planning uses memory for informed decisions, action adapts to feedback, interaction connects agents with people and environments, and security protects data and processes.Source: C. Constructing Modules of LM Agents · p. 6, Figure 8 · p. 7

1) Planning Module:

  • Planning methods range from feedback-free CoT, ToT, and GoT reasoning to feedback-enhanced, multi-persona, and grounded planning.These approaches respectively structure reasoning paths, incorporate reflection and execution feedback, simulate diverse personas, or refine plans in real or simulated environments.Source: 1) Planning Module · p. 7, Figure 9 · p. 8

2) Memory Module:

  • Memory accumulates interactions, thoughts, actions, observations, and experiences, using short-term, long-term, or hybrid forms to guide future decisions.Hybrid memory combines a recent-interaction scratchpad with retrieval of relevant long-term examples, while RAG accesses external knowledge.Source: 2) Memory Module · p. 7

3) Action Module:

  • Action modules support embodied behavior and tool use, translating plans into executable actions and selecting external tools for complex tasks.VirtualHome evaluations report executability improvements ranging from 18% to 79% over a baseline LLM; SayCan grounds high-level instructions in feasible robotic actions.Source: 3) Action Module · p. 8

4) Interaction Module:

  • Interaction modules support agent-agent coordination, agent-human assistance, and agent-environment operation across physical, virtual, and mixed-reality settings.Theory-of-mind representations support teamwork, tree-structured personas address role maintenance, and AutoWebGLM supports web-browsing tasks.Source: 4) Interaction Module · pp. 8–9, Figure 12 · p. 9
  • Security modules monitor actions, interactions, and decisions while addressing threats including hallucination, memorization, bias, and privacy risks.They can use LM-based defenses, learn from new incidents, integrate security and privacy updates, and incorporate ethical guidelines and bias mitigation.Source: 5) Security Module · p. 9

5) Security Module:

The paper reviews LM-agent components, applications, and lessons for building collaborative agent networks. It highlights five core modules, broad industrial use, embodied-agent infrastructure needs, and persistent challenges in scalability and adoption.

D. Modern Prototypes & Applications of LM Agents

4) Autonomous Driving:

  • GPT-4 successfully exploited 87% of vulnerabilities in tests on 15 real-world vulnerability datasets, outperforming other tools.The cited cybersecurity applications include automated vulnerability scanning, exploitation, and attack generation.Source: 5) Autonomous attack-defense… · p. 10

5) Security Module:

  • Five interconnected modules—planning, action, memory, interaction, and security—support LM-agent operation, with security integrated across execution.Planning uses memory, action adapts through feedback, and interaction supplies additional data and context.Source: 5) Security Module · p. 9, E. Summary and Lessons Learned · p. 10

E. Summary and Lessons Learned

  • ROS-based operating systems and machine-centric communications are identified as key infrastructure for embodied agents in UAVs, autonomous vehicles, and robots.The recommendation extends beyond general-purpose operating systems to robotic environments.Source: E. Summary and Lessons Learned · p. 11
  • Existing prototypes often run in isolated, single-device ecosystems and face cost-effectiveness, cross-domain adaptability, and scalability challenges.The paper identifies further research and innovation as necessary for broader real-world implementation.Source: E. Summary and Lessons Learned · p. 11

III. LARGE MODEL AGENT NETWORKS: WORKING PRINCIPLES

  • LM-agent networks organize collaboration through data, computation, and knowledge sharing across connected agents.The section introduces network architecture, communication modes, cloud-edge-end cooperation, and cooperation, partial cooperation, and competition strategies.Source: §III · p. 11

A. General Architecture of LM Agent Networks

LM agent networks connect specialized agents across human, physical, and cyber worlds, combining foundation models, knowledge technologies, interaction, digital twins, and collaboration. Their operation depends on semantic-aware, persistent, memory-based, heterogeneous, and hierarchically distributed communication.

A. General Architecture of LM Agent Networks

2) Engine of LM Agent Networks:

  • Five technologies power the networks: foundation models, knowledge-related technologies, interaction, digital twins, and multi-agent collaboration.Foundation models provide reasoning and planning; knowledge systems add contextual information; digital twins synchronize physical and digital states.Source: 2) Engine of LM Agent Networks · pp. 11–13
  • Knowledge sharing, fusion, and retrieval integrate private experience and external sources such as knowledge graphs, vector databases, and RAG systems.These mechanisms support synchronized updates, comprehensive knowledge bases, and contextually relevant outputs.Source: 2) Engine of LM Agent Networks · p. 12

B. Key Characteristics of LM Agent Networks

  • Network characteristics include heterogeneity, spatiotemporal dynamics, semantic-aware communication, information-centric routing, and hierarchical cloud-edge-end collaboration.Agents vary in resources, services, protocols, and topology, requiring resilience and flexible coordination.Source: B. Key Characteristics of LM Agent… · pp. 13–14
  • Computing-oriented, persistent, and memory-based communication transmits task-critical abstractions, maintains shared context, and compresses sequential information.Semantic-aware intra-agent and inter-agent communication improves prediction and action accuracy by transmitting contextually relevant information.Source: B. Key Characteristics of LM Agent… · p. 13

C. Communication Mode of LM Agents

LM agents communicate internally between brain and body and externally among agents using semantic-aware exchanges and standardized protocols. Cloud-edge-end cooperation addresses latency, bandwidth, computational, and privacy constraints in applications such as autonomous driving.

C. Communication Mode of LM Agents

  • Intra-agent communication synchronizes an LM agent’s planning, action, memory, interaction, and security modules with its physical or software body.For embodied agents, ROS provides a pub/sub framework connecting sensors, actuators, planning, and memory components.Source: C. Communication Mode of LM Agents · p. 14
  • Inter-agent communication supports task allocation, resource sharing, and coordinated actions, requiring shared conceptual understanding and mutually intelligible message encoding.Protocols specify communication language, syntax, and interaction strategies.Source: C. Communication Mode of LM Agents · p. 14
  • Agent protocols face a versatility-efficiency-portability trilemma, motivating combinations of standardized routines, natural language, and LLM-written routines.Agora addresses different communication frequencies with different mechanisms, while MCP and ANP provide additional protocol options.Source: C. Communication Mode of LM Agents · pp. 14–15

D. Cloud-Edge-End Cooperative Framework for LM Agent Networking

  • Autonomous driving requires low-latency processing because 3GPP specifies end-to-end latency as low as 10 ms, while cloud centralization can expose sensitive location data.Vehicle sensors can generate up to 4TB/day, making centralized cloud processing costly for bandwidth and privacy.Source: 1) Illustrating Example in Autonomous… · p. 15

1) Illustrating Example in Autonomous Driving:

2) Cloud-Edge-End Cooperative Framework Design:

The cloud-edge-end framework assigns complementary LM responsibilities across cloud, edge, and end devices, while connected agents cooperate through distributed, role-based, and model-segmentation strategies. These designs balance computational efficiency, latency, scalability, adaptability, security, and privacy against communication, heterogeneity, and deployment challenges.

2) Cloud-Edge-End Cooperative Framework Design:

  • The cloud hosts full-scale LMs and global coordination, edge nodes provide contextual intermediate intelligence, and end devices handle lightweight real-time tasks and sensitive local processing.Cloud, edge, and end layers use different model scales and responsibilities, including centralized training, localized fine-tuning, contextual inference, and immediate sensing or action.Source: 2) Cloud-Edge-End Cooperative… · pp. 15–16
  • Hierarchical collaboration distributes workloads across layers, reducing latency and bandwidth for localized tasks while synchronizing global knowledge through the cloud.Compute-intensive work can be offloaded to cloud servers, while edge and end devices manage less demanding or latency-sensitive operations.Source: 3) Advantages · p. 16

3) Advantages:

  • The architecture improves scalability, efficiency, adaptability, and security by distributing workloads, coordinating across dynamic layers, and processing sensitive data locally.Localized end-layer processing reduces exposure of sensitive data, while cloud and edge nodes support cross-layer security mechanisms.Source: 3) Advantages · p. 16

E. Interaction Strategies of Connected LM Agents

1) Distributed Cooperation:

  • Distributed fine-tuning uses split learning or federated edge learning, while cooperative inference uses MoE, split inference, and role-playing to address resource and privacy constraints.Split learning partitions models across devices and servers; federated fine-tuning adapts models locally; MoE activates selected experts, and split inference keeps raw data on devices while offloading computation.Source: 1) Distributed Cooperation · pp. 16–17
  • These cooperative methods face substantial communication overhead, target-token privacy leakage, heterogeneous edge-device constraints, dynamic expert downloading and selection, and privacy disclosure; split learning can transmit approximately 400 MB per training round for GPT-3 Medium with 100 samples of 1024 tokens.Source: 1) Distributed Cooperation · pp. 17–18
  • Role-playing enables agents to divide planning, execution, verification, and control responsibilities, supporting instruction-following and instruction-free collaboration.Examples include task-specifier and user-assistant dialogues, ChatDev’s role-based software development, ProAgent’s planner-verificator-controller structure, and collaborative novel writing.Source: 1) Distributed Cooperation · p. 18, Figure 20 · p. 18

2) Distributed Competition:

LM-agent competition includes structured debate and non-cooperative games, while partial cooperation supports limited collaboration when agents retain autonomous or competing interests. These paradigms use communication structure, strategic incentives, and agent selection to balance collective performance with individual objectives.

2) Distributed Competition:

  • Multi-agent debate uses structured arguments and mutual feedback to challenge biases, rigidity, and thought degeneration in LM reasoning.Debate strategies include sequential replies, asynchronous simultaneous responses, and simultaneous discussion summarized into a shared context.Source: 2) Distributed Competition · p. 19
  • Non-cooperative games model agents seeking strategic equilibria through mechanisms such as Nash bargaining, auctions, and matching games.One example uses an auction mechanism based on a deep Q-network to incentivize network operators for cached model resources.Source: 2) Distributed Competition · p. 19

3) Partial Cooperation:

  • Partial cooperation combines limited resource or information sharing with retained autonomy when agents’ interests overlap but are not fully aligned.DyLAN uses multiround interactions, rank-based deactivation, Byzantine-consensus early stopping, and automatic agent selection for collaborative reasoning and code generation.Source: 3) Partial Cooperation · p. 19
  • Hierarchical games and coalition formation model cooperation at one level and competition at another, producing stable coalitions with intra-coalition cooperation and inter-coalition competition.These models represent partial cooperation as a structured balance between collaboration and strategic rivalry.Source: 3) Partial Cooperation · pp. 19–20
  • Effective cloud-edge collaboration must jointly optimize model segmentation, placement, replacement, routing, and knowledge caching under heterogeneous and changing edge conditions.The paper identifies seamless integration of these techniques as a future requirement for efficient, scalable LM-agent deployment.Source: 4) Lessons Learned · p. 20

4) Lessons Learned:

Connected LM agents cooperate through data, computation, and knowledge exchange, using multimodal and spatio-temporal fusion, parallel or sequential task decomposition, and knowledge synchronization, fusion, and retrieval. These paradigms improve collective processing but remain bounded by scale, coordination, error propagation, and practical deployment constraints.

1) Data Cooperation for LM Agents:

2) Computation Cooperation for LM Agents:

1) Data Cooperation for LM Agents:

  • Spatio-temporal cooperation improves accuracy and robustness through temporal semantic cues, diverse-agent spatial information, and adaptive multi-source representation fusion.The cited SCOPE mechanism mainly addresses small-scale scenarios, leaving broader-scale deployment as a limitation.Source: 1) Data Cooperation for LM Agents · pp. 20–21

2) Computation Cooperation for LM Agents:

  • Hybrid collaboration coordinates parallel evaluation with sequential integration, and reported collaborative scaling follows a logistic growth pattern as agents are added.The cited DAG framework supports collaboration among thousands of agents and reports collaborative emergence faster than neural emergence.Source: 2) Computation Cooperation for LM Agents · p. 21

3) Knowledge Cooperation for LM Agents:

  • Knowledge cooperation transfers and updates explicit or implicit knowledge through parameter transfer, knowledge alignment, continual learning, and growing-memory correction.These methods address cross-agent consistency and adaptation as new tasks and data arrive.Source: 3) Knowledge Cooperation for LM Agents · p. 22
  • Knowledge fusion integrates model outputs or completes and verifies knowledge graphs to build more robust shared knowledge bases.LLM-blender aggregates multiple model outputs, implicit fusion trains a target model from predictive distributions, and LLMs support semantic KG completion and verification.Source: 3) Knowledge Cooperation for LM Agents · p. 22
  • Knowledge retrieval uses RAG over static or dynamic sources, including real-time driving data, past multi-agent memories, and self-guided external-resource access.RAG first retrieves relevant content and then generates answers grounded in the retrieved information.Source: 3) Knowledge Cooperation for LM Agents · pp. 22–23

G. Summary and Lessons Learned

LM agent networks combine cloud-edge-end resources, modular collaboration, and knowledge synchronization to support scalable task execution, while introducing substantial security and coordination challenges. The security review categorizes threats across authentication, denial of service, adversarial inputs, poisoning, and backdoors.

G. Summary and Lessons Learned

  • Horizontal, vertical, and hybrid collaboration distribute fine-tuning, inference, and edge caching across agents to improve coordination, latency, and access efficiency.The paradigms combine distributed and sequential task processing for complex workloads.Source: G. Summary and Lessons Learned · p. 23
  • Synchronizing implicit experiential knowledge with explicit structured knowledge improves agents’ adaptability and reliability in dynamic environments.Implicit knowledge supports rapid responses to unforeseen situations, whereas explicit knowledge supports decisions grounded in defined facts and rules.Source: G. Summary and Lessons Learned · p. 23
  • Cloud-edge-end LM agent networks support scalable task allocation and collaboration among heterogeneous software and hardware agents, but require capability discovery, orchestration, routing, communication, security, and privacy mechanisms.These networks promote modular, task-specific agents that dynamically share capabilities across diverse scenarios.Source: G. Summary and Lessons Learned · p. 23

IV. SECURITY THREATS & COUNTERMEASURES TO LARGE MODEL AGENT NETWORKS

  • LM agent networks face life-cycle security risks because their decentralized three-tier architecture complicates secure and reliable collaboration.The review organizes threats and countermeasures for LM agent networks, beginning with authentication threats.Source: §IV · p. 23, Figure 24 · p. 24

A. Authentication Threats in LM Agent Networks

1) User-Agent Authentication Threats:

Authentication failures can expose private user and corporate data, corrupt multi-agent collaboration, or compromise interactions with third-party services. LM-enabled attacks intensify these risks, motivating adaptive and cooperative authentication alongside defenses against resource-exhaustion attacks.

1) User-Agent Authentication Threats:

  • Authentication attacks can expose private user and corporate data through identity forgery, credential theft, bypassing, or privilege abuse, with LM-generated digital replicas increasing potential harm.The paper highlights forged voice, appearance, and behavior as a route around multi-factor authentication.Source: 1) User-Agent Authentication Threats · p. 24

2) Agent-Agent Authentication Threats:

  • Agent spoofing and collusion can corrupt horizontal or vertical workflows by impersonating legitimate agents, injecting misinformation, and undermining consensus, accuracy, and task outcomes.Compromised agents may become malicious entities within collaborative inference processes.Source: 2) Agent-Agent Authentication Threats · pp. 24–25
  • Agent-TPSP authentication must verify both agent authorization and service legitimacy because intercepted communications can enable response alteration, data injection, session hijacking, or API misuse.The relevant credentials include API keys or tokens.Source: 3) Agent-TPSP Authentication Threats · p. 25

4) Countermeasures to Authentication Threats in LM Agent Networks:

  • Existing encryption, certificates, MFA, and key management become less effective as LM collaboration and automated attacks grow more complex, requiring adaptive and collaborative authentication.The paper frames automated attacks and defenses as a dual-edged dynamic that increases security complexity.Source: 4) Countermeasures to Authentication… · p. 25
  • Multi-agent cooperative authentication verifies outputs or requests independently and admits them only after a predefined threshold of agents confirms reliability, reducing single-point failures and adversarial manipulation.The approach targets long-term collaboration among LM agents.Source: 4) Countermeasures to Authentication… · p. 25

B. Denial-of-Service (DoS) Attacks in LM Agent Networks

3) Countermeasures to DoS Attacks in LM Agent Networks:

LM-agent defenses address DoS and adversarial attacks through input controls, adversarial training, filtering, robust optimization, auditing, and multi-agent defense. The review also shows that prompt manipulation can compromise both generated content and embodied actions.

3) Countermeasures to DoS Attacks in LM Agent Networks:

  • DoS defenses combine passive detection and filtering with active honeypots that divert attacks from critical agents and support behavioral analysis.Input thresholds can limit inference energy consumption, while honeypot traces inform later defenses.Source: 3) Countermeasures to DoS Attacks in… · pp. 25–26

C. Adversarial Attacks in LM Agent Networks

2) Prompt Hacking Attacks:

  • Jailbreaks pose additional risks for embodied agents through cascading vulnerability propagation, cross-domain safety misalignment, and conceptual deception.An agent may reject a harmful command linguistically yet execute equivalent harmful actions through indirect instructions.Source: 2) Prompt Hacking Attacks · pp. 26–27

3) Countermeasures to Adversarial Attacks in LM Agent Networks:

  • Adversarial defenses include adversarial training, input/output filtering, robust optimization, and auditing or red teaming, with multi-agent systems providing context-aware safety analysis.AutoDefense reduced GPT-3.5’s ASR from 55.74% to 7.95% and achieved 92.91% defense accuracy using LLaMA-2-13b.Source: 3) Countermeasures to Adversarial… · p. 27

D. Poisoning & Backdoor Attacks in LM Agent Networks

Poisoning and backdoor attacks manipulate data, models, retrieved knowledge, agents, or training and inference triggers to degrade or redirect LM-agent behavior. Countermeasures identify and filter poisoned samples, add differential privacy, invert triggers, or prune responsive neurons.

1) Poisoning Attacks:

  • Poisoning attacks use toxic information to reduce generalization or trigger targeted errors, spanning data, model, RAG, and agent poisoning in LM-agent systems.These forms exploit web data, user interactions, distributed training, external knowledge bases, and multi-agent orchestration.Source: 1) Poisoning Attacks · pp. 27–28
  • Distributed collaborative training is vulnerable when malicious edge agents impersonate benign participants and inject poisoned updates that degrade the global LM.The risk is specifically associated with cloud-edge collaborative fine-tuning and inference paradigms such as federated learning.Source: 1) Poisoning Attacks · p. 28
  • RAG poisoning manipulates external or private knowledge so agents generate flawed responses, while memory poisoning covertly corrupts retrieval databases through prompt and memory vulnerabilities.A poisoned knowledge base can induce invalid conclusions such as treating division by zero as valid.Source: 1) Poisoning Attacks · p. 28
  • Agent poisoning and chained poisoned instructions can progressively undermine multi-agent reasoning, task outcomes, and decision quality.AgentMonitor reduced harmful content by 6.2% while increasing helpful content by 1.8%.Source: 1) Poisoning Attacks · p. 28

2) Backdoor Attacks:

  • Backdoors embed triggers during pre-training, alignment, instruction tuning, or inference so models retain normal behavior while producing attacker-specified outputs for trigger inputs.Examples include jailbreak backdoors, plan-of-thought backdoors, and BadChain’s injected reasoning step.Source: 2) Backdoor Attacks · pp. 28–29

3) Countermeasures to Poisoning & Backdoor Attacks in LM Agent Networks:

  • Countermeasures identify and filter poisoned samples, apply differential privacy during training, invert anomalous triggers, and prune neurons that respond strongly to backdoor triggers.These strategies target poisoning and backdoor risks across training data, gradients, inputs, and model structure.Source: 3) Countermeasures to Poisoning &… · p. 29

E. Summary and Lessons Learned

LM agent networks introduce privacy risks from memorization, extraction, membership inference, and attribute inference, while existing threats and countermeasures remain active research areas.

A. LM Memorization Threats to LM Agent Networks

  • LM memorization risks arise because large models can retain sensitive training details, including personally identifiable and preference information.Training data may contain names, contact information, medical or financial records, and personal preferences.Source: A. LM Memorization Threats to LM Agent… · p. 30

E. Summary and Lessons Learned

  • Privacy threats from LM memorization motivate countermeasures spanning data sanitization, differential privacy, knowledge transfer, and pre-deployment leakage assessment.The section frames these measures as approaches to reducing memorization and detecting privacy risks before deployment.Source: A. LM Memorization Threats to LM Agent… · p. 30

1) Data Extraction Attacks:

  • Data extraction attacks use crafted prompts in black-box interactions to elicit private information memorized by deployed LM agents.Reported factors increasing extraction likelihood include model scale, duplicated data, and longer context,.Source: 1) Data Extraction Attacks · p. 30

2) Membership Inference Attacks (MIAs):

  • Membership inference attacks determine whether particular samples appeared in training data, covering both pre-training and fine-tuning settings.Fine-tuned models can be more susceptible because their datasets are smaller, domain-specific, and privacy-sensitive; head fine-tuning increases susceptibility relative to adapter-based approaches.Source: 2) Membership Inference Attacks (MIAs) · p. 31
  • Attribute inference attacks recover sensitive properties represented in training data, including identity, genome, healthcare, location, and artistic-style attributes.Studies report susceptibility across general-purpose language and generative models,.Source: 2) Membership Inference Attacks (MIAs) · p. 31

4) Countermeasures to LM Memorization Risks in LM Agent Networks:

LM-agent privacy protection combines training-time mitigation, IP safeguards, and interaction security, but conventional protections remain incomplete for complex multi-agent services.

4) Countermeasures to LM Memorization Risks in LM Agent Networks:

B. LM Stealing & Prompt Stealing Attacks to LM Agent Networks

3) Countermeasures to Model & Prompt Stealing Attacks in LM Agent Networks:

  • Model watermarking, blockchain, and adversarial perturbations are countermeasures for IP verification and attack defense; blockchain cannot prevent model-functionality theft, and PromptShield requires whitebox access to the attack model, which may be impractical.Source: 3) Countermeasures to Model & Prompt… · pp. 32–33

C. Other Privacy Threats to LM Agent Networks •

  • Sensitive user queries and multi-agent communication can expose confidential information through accidental memorization, eavesdropping, compromised agents, or man-in-the-middle attacks.Semantically rich natural-language interactions make conventional secure computation and homomorphic encryption difficult to apply effectively.Source: C. Other Privacy Threats to LM Agent… · p. 33

D. Summary and Lessons Learned

  • LM privacy risks comprise memorization and IP-related threats, while conventional privacy methods may be insufficient for connected agents.The survey calls for privacy techniques tailored to connected-agent settings alongside legal protections for privacy and IP.Source: D. Summary and Lessons Learned · p. 33

VI. RELIABILITY ISSUES & COUNTERMEASURES TO LARGE MODEL AGENT NETWORKS

  • Reliability failures include input-, context-, knowledge-, and fact-conflicting hallucinations, with multi-agent interactions able to amplify errors.The reliability taxonomy is presented in Fig. 36.Source: §VI · pp. 33–34

A. Causes of Hallucinations of LM Agent Networks

Hallucinations originate in data and knowledge, model training and inference, and multi-agent interactions; proposed mitigations span data, modeling, detection, retrieval, and coordination.

1) Hallucination from Data and Knowledge:

  • Hallucinations arise from irrelevant annotations, distribution imbalance, duplicated data, and biased, outdated, fabricated, or anomalous retrieved knowledge.These data and knowledge problems can cause models to reproduce or amplify unreliable content –.Source: 1) Hallucination from Data and Knowledge · p. 34

2) Hallucination from Training and Inference:

  • Training and inference contribute through defective encoders or decoders, random sampling, biased parametric knowledge, flawed alignment, sycophancy, and error snowballing.Hallucinations may occur even when training data is nearly unbiased.Source: 2) Hallucination from Training and… · pp. 34–35

3) Hallucination from Multi-agent Interactions:

  • Multi-agent communication introduces conflicting outputs and cascading hallucinations, requiring both agent-level correction and inter-agent validation.Misinformation accepted by one agent can propagate across the network, particularly in vertical collaboration paradigms,.Source: 3) Hallucination from Multi-agent… · p. 35

B. Countermeasures to Reliability Issues in LM Agent Networks

  • Countermeasures include meta-programming, data sanitization, reinforcement learning, hallucination detection, truthful retrieval, and instruction tuning, which guide agents, filter data, constrain rewards, detect inconsistencies, anchor knowledge, and reduce hallucinations.Hallucination detection techniques such as SelfCheckGPT and INSIDE assess consistency across multiple generated responses, while truthful RAG incorporates verified external knowledge to reduce hallucinations.Source: B. Countermeasures to Reliability… · pp. 35–36

C. Summary and Lessons Learned

The survey concludes that LM-agent ecosystems require advances in sustainable operation, fairness, explainability, cyber-physical-social security, and interoperable value exchange.

A. Energy-Efficient and Green LM Agents

  • Energy-efficient LM agents can use compression, edge computing, federated learning, and efficient hardware, but compression may reduce accuracy or complex-task capability.Energy must be managed across training, deployment, and operation through energy-aware algorithms.Source: A. Energy-Efficient and Green LM Agents · p. 36

B. Fair and Explainable LM Agents

  • Fair and explainable agents require debiasing and XAI, while balancing model complexity, evolving fairness criteria, performance, and efficiency remains difficult.Relevant techniques include adversarial debiasing, reweighting, fairness constraints, LIME, SHAP, and counterfactual explanations, –.Source: B. Fair and Explainable LM Agents · p. 36

C. Cyber-Physical-Social Secure LM Agent Systems

  • Secure cyber-physical-social systems can use zero-trust architectures and embedded legal reasoning, but heterogeneous and dynamic environments create cascading security challenges.Security measures must adapt across cyber, physical, and social domains while remaining resilient to new threats.Source: C. Cyber-Physical-Social Secure LM… · pp. 36–37

D. Value Ecosystem of LM Agents

  • Blockchain, smart contracts, and oracles can support transparent autonomous value exchange, while interoperability, cross-contract security, and scalability remain unresolved.Most blockchains operate in silos, complicating transfers across networks.Source: D. Value Ecosystem of LM Agents · p. 37

VIII. CONCLUSION

  • The survey covers LM-agent architectures, cooperation paradigms, security and privacy threats, countermeasures, and future trends.Its conclusion frames these topics as the state of the art for LM agent networks.Source: §VIII · p. 37

Related papers

Loading 2409.14457v3…