PaperlayerView exact revision on arXiv

Source-linked AI summary

BlindGuard: Safeguarding LLM-based Multi-Agent Systems under Unknown Attacks

Rui Miao, Yixin Liu, Yili Wang, Xu Shen, Yue Tan, Yiwei Dai, Shirui Pan, Xin Wang

arXiv:2508.08127v2cs.AI

TL;DR

Malicious agents can distort collective decisions through inter-agent messages, while supervised defenses rely on labeled malicious agents and may not generalize to novel attacks. BlindGuard trains an unsupervised detector from normal interaction data using hierarchical agent representations and corruption-guided contrastive learning. It detects diverse attacks across topologies, with evaluation limited to simulated MAS and mitigation occurring after intrusion.

  • Problem

    Malicious agents can propagate misleading messages that harm collective decisions, while supervised defenses require labeled malicious agents and may target specific behaviors rather than novel attacks.

    Source: §1 · p. 1

  • Method

    BlindGuard uses a hierarchical agent encoder and corruption-guided detector trained without attack labels or prior attack knowledge.

    Source: §1 · p. 2

  • Results

    BlindGuard effectively mitigates diverse attacks across various topologies while maintaining scalability.

    Source: §5 · p. 9

  • Takeaways & Limitations

    BlindGuard is presented as a practical, attack-agnostic defense solution for LLM-based MAS.

    Source: §5 · p. 9

    Evaluation is limited to simulated MAS, and BlindGuard mitigates propagation after intrusion rather than preventing malicious agents from entering the system.

    Source: Limitations · p. 9

Abstract

from arXiv · show

The security of LLM-based multi-agent systems (MAS) is critically threatened by propagation vulnerability, where malicious agents can distort collective decision-making through inter-agent message interactions. While existing supervised defense methods demonstrate promising performance, they may be impractical in real-world scenarios due to their heavy reliance on labeled malicious agents to train a supervised malicious detection model. To enable practical and generalizable MAS defenses, in this paper, we propose BlindGuard, an unsupervised defense method that learns without requiring any attack-specific labels or prior knowledge of malicious behaviors. To this end, we establish a hierarchical agent encoder to capture individual, neighborhood, and global interaction patterns of each agent, providing a comprehensive understanding for malicious agent detection. Meanwhile, we design a corruption-guided detector that consists of directional noise injection and contrastive learning, allowing effective detection model training solely on normal agent behaviors. Extensive experiments show that BlindGuard effectively detects diverse attack types (i.e., prompt injection, memory poisoning, and tool attack) across MAS with various communication patterns while maintaining superior generalizability compared to supervised baselines. The code is available at: https://github.com/MR9812/BlindGuard.

1 Introduction

Inter-agent messages can let malicious agents distort collective decisions, while supervised defenses depend on labeled malicious agents and may not generalize to novel attacks. BlindGuard uses an unsupervised, hierarchical detection approach and is evaluated across multiple MAS structures and attack strategies.

1 Introduction

  • Malicious messages can propagate through collaborative reasoning and negatively affect collective decisions in MAS.Inter-agent communication also introduces security risks involving sensitive data and information flow.Source: §1 · p. 1
  • Supervised graph anomaly detection can be impractical when malicious-agent labels are scarce and binary detectors target specific behaviors rather than novel attacks.Real-world attacks may be sparse and camouflaged, making annotated training examples difficult to obtain.Source: §1 · p. 2
  • BlindGuard is trained without labeled data or prior attack knowledge, using a hierarchical encoder and corruption-guided detector.The encoder combines individual, neighborhood, and global context; semantic-level corruption supports supervised contrastive learning, and training requires a small amount of normal MAS interaction data.Source: §1 · p. 2
  • BlindGuard demonstrates competitive performance across four MAS structures and three attack strategies.The introduction reports this evaluation as evidence of the method's performance.Source: §1 · p. 2

2 Preliminary

The preliminary section represents MAS as directed agent-interaction graphs, describes three attack modalities, and outlines supervised defenses based on labeled agents.

MAS as Graphs

  • MAS is modeled as a directed graph whose vertices are LLM-based agents and whose edges encode message-passing channels.The adjacency entry Aij = 1 indicates a channel from agent vj to vi; agents process queries and neighboring responses, and the system outputs a final response after multiple interaction rounds.Source: §2 · p. 2

MAS Attack

  • The paper considers prompt injection, memory poisoning, and tool exploitation, which can make a subset of agents adversarial while they appear operationally normal.These attacks target prompts or inputs, agent memory or external knowledge, and external plugins, respectively.Source: §2 · p. 3

Supervised Defense Paradigm

  • Supervised defenses train graph anomaly detectors on attacked MAS with agents labeled normal or malicious, then use anomaly scores for remediation.Remediation can include isolating malicious nodes or pruning suspicious communication links.Source: §2 · p. 3

3 Methodology

BlindGuard trains an unsupervised detector from normal MAS interactions, encoding agents at multiple interaction levels, simulating corruption, and pruning edges connected to detected anomalies.

3 Methodology

  • BlindGuard combines an unsupervised detection model with pruning-based remediation to address attacks without labeled malicious agents or prior attack knowledge.Its components are a hierarchical agent encoder, corruption-guided detector, and pruning-based remediation.Source: §3 · p. 3

3.1 Unsupervised Defense Paradigm

  • The defense trains on normal MAS interactions and later scores agents in attacked systems, while existing unsupervised GAD methods may miss multi-level interactions or assume misaligned anomaly patterns.Agents with high anomaly scores can be isolated with edge pruning.Source: §3.1 · p. 3

3.2 Hierarchical Agent Encoder

  • The hierarchical encoder represents each agent using its semantic features, directly connected neighbors, and global MAS context.SentenceBERT response embeddings are kept frozen and used as node features; the resulting representations support detection of isolated attackers and coordinated groups.Source: §3.2 · pp. 4–5

3.3 Corruption-Guided Attack Detector

  • The detector simulates abnormal features by adding magnitude-scaled directional noise to selected agents, then uses supervised contrastive learning to separate normal and corrupted representations.At inference, it scores agents by their negative average similarity to other agents; α controls corruption intensity.Source: §3.3 · pp. 5–6

3.4 Pruning-based Remediation

  • Bidirectional edge pruning removes connections to and from detected anomalous agents while preserving interactions among normal agents.Agents then update using messages only from trusted neighbors in the pruned topology.Source: §3.4 · p. 6

4 Experiments

Experiments evaluate BlindGuard against multiple attacks, communication topologies, and LLM backbones. The reported results cover defense performance, generalization, scalability, and the contribution of neighborhood and global context.

4.1 Experimental Setups

  • Tests span prompt, tool, and memory attacks across four topologies and multiple LLM backbones, comparing unsupervised GAD methods with labeled-data G-Safeguard.The evaluation uses AUC and ASR@3; G-Safeguard serves as an upper bound because it trains on ground-truth attacked-agent data.Source: §4.1 · p. 6, §4 · p. 6

4.2 Experimental Results

  • BlindGuard outperforms other unsupervised methods, performs comparably to the labeled-data upper bound in most cases, and improves MAS response accuracy under attack.G-Safeguard achieves the best overall defense performance; BlindGuard achieves AUC > 80% in most cases, while undetected attacks cause accuracy to decline as dialogue turns increase.Source: §4.2 · p. 7, Table 1 · p. 7, Figure 3 · p. 7
  • Across DeepSeek-V3 and Qwen3-30B-A3B backbones, BlindGuard maintains robust ASR@3 and AUC; on CSQA memory attacks, it outperforms G-Safeguard across most topologies.The CSQA memory-attack comparison tests a model trained on prompt injection against an unseen attack type.Source: §4.2 · pp. 7–8, Figure 4 · p. 8, Table 2 · p. 8
  • On systems with 20 and 50 agents, BlindGuard consistently mitigates adversarial impact across rounds R1–R3.The authors attribute scaling to a topology-agnostic design without dependencies on fixed agent numbers or interaction patterns.Source: §4.2 · p. 8, Table 3 · p. 8
  • Removing neighborhood or global context features degrades PoisonRAG detection, and removing both causes a severe drop.The global feature adds a reference axis for system-wide alignment rather than node-unique information.Source: §4.2 · pp. 8–9, Figure 5 · p. 8

5 Conclusion

BlindGuard combines an unsupervised defense with a hierarchical agent encoder and corruption-guided detector. The paper reports protection against diverse attacks across topologies while maintaining scalability.

5 Conclusion

  • BlindGuard integrates a hierarchical agent encoder with a corruption-guided attack detector for unsupervised defense of LLM-based MAS.The encoder fuses agent-level, neighborhood, and global information without attack-specific training data.Source: §5 · p. 9
  • The reported experiments show effective mitigation of diverse attacks across varied topologies while maintaining scalability.Source: §5 · p. 9
  • The authors present BlindGuard as a practical, attack-agnostic defense solution for LLM-based MAS.Source: §5 · p. 9

Limitations

BlindGuard is evaluated only in simulated multi-agent environments and mitigates propagation after malicious agents have entered the system. The authors position it as a complement to preventive defenses and call for validation in open-world settings.

Limitations

  • The current evaluation is limited to simulated multi-agent environments, so validation in more diverse open-world scenarios remains future work.The authors identify this as necessary to better assess generalizability.Source: Limitations · p. 9
  • BlindGuard cannot prevent malicious agents from infiltrating a system; it mitigates adversarial propagation after intrusion.The authors position it as a complementary defense layer, operating after the first generation and before the next propagation.Source: Limitations · p. 9
  • The authors identify developing more adaptive defense strategies as an important direction for future research.Source: Limitations · p. 9

Ethical Considerations

The paper reports no human or animal subjects, sensitive data, or anticipated ethical risks. It situates BlindGuard amid security concerns in communicating LLM-based multi-agent systems and refers readers to Algorithm 1 for implementation details.

Ethical Considerations

  • The work uses synthetic or publicly available data in simulated environments and reports no human subjects, animal experiments, sensitive data, or anticipated ethical risks.The authors also report no conflicts of interest and a commitment to research integrity and ethical compliance.Source: Ethical Considerations · p. 9

A.1 LLM-based Multi-agent System

  • Graph-based multi-agent topologies remain vulnerable to adversarial manipulation of communication, which can inject misinformation, disrupt coordination, or compromise collective decisions.Source: §A.1 · p. 13

A.2 Security of LLM-based MAS

  • Existing defenses can rely heavily on labeled malicious agents or prior attack-pattern knowledge, resources that may be unavailable in real-world deployments.The related-work discussion describes NetSafe's study of bias propagation and G-Safeguard's supervised detection and topological remediation.Source: §A.2 · p. 13

B Algorithm

C Complexity Analysis

The analysis breaks BlindGuard's encoder into node-, neighbor-, and system-level computation, and reports a small measured runtime increase over the original system. It also notes a large-N scoring concern and practical mitigations.

C Complexity Analysis

  • The hierarchical encoder reuses agent embeddings at node level, aggregates neighbors, pools a global system representation, and fuses these representations with an MLP.The stated costs are O(1) per agent for node-level embeddings, O(Ed) for neighbor aggregation, and O(Nd) for global average pooling.Source: C Complexity Analysis · p. 14
  • For typical sparse collaboration graphs, the analysis says G-Safeguard's multiplicative L factor can make its practical cost exceed BlindGuard's additional cost.Source: C Complexity Analysis · p. 14
  • For large N, the authors propose block-wise similarity computation with top-k pruning, approximate nearest-neighbor search, and cluster-based scoring to reduce the practical cost.Source: C Complexity Analysis · p. 14
  • 0.03 minutes is the reported added cost for three dialogue rounds with BlindGuard: 0.56 minutes versus 0.53 minutes for the original system.The authors say most end-to-end latency comes from LLM generation.Source: C Complexity Analysis · p. 14

D Detailed Experimental Setups

The detailed setup fixes the detection budget to the number of compromised agents in test scenarios and specifies shared model and training settings. Inference scores agents, flags the top K, and prunes links to detected anomalies; additional experiments are also reported.

D Detailed Experimental Setups

  • K = 3 matches the three compromised agents in every test scenario; models use hidden dimension 512 and train on four NVIDIA L40 GPUs.Training uses Adam with initial learning rate 0.001, L2 weight decay, and cosine annealing.Source: D Detailed Experimental Setups · p. 14
  • At inference, BlindGuard scores each agent, flags the top K as malicious, and prunes communication links to detected anomalies.The monitoring representation combines each agent's reply with neighbor summaries and a global system view to assess contextual consistency without predefined attack signatures.Source: D Detailed Experimental Setups · p. 14

E Additional Experiments

E.1 Results with More LLMs

Across supplementary evaluations, BlindGuard maintains competitive detection and defense performance across additional LLMs, attacks, topologies, and remediation settings. The analyses also examine sensitivity to corruption intensity, encoder contribution, and clean-sample utility.

E.1 Results with More LLMs

  • BlindGuard retains AUC advantages across four topologies and two LLM backbones, and remains effective against multi-round propagation with weaker Qwen3-8B.The weaker backbone yields higher ASR than GPT-4o-mini, while AUC is similar; BlindGuard still reduces propagation relative to no defense and other unsupervised methods under that backbone.Source: §E.1 · pp. 14–15, Table 4 · p. 15

E.2 Hyperparameter Sensitivity Analysis

  • AUC is stable for corruption intensity α from 0.3–0.8, while very small or large values degrade performance.Small α weakens the directional margin, while large α over-distorts semantics; the experiments fix α = 0.8 across datasets and topologies.Source: §E.2 · p. 15, Table 5 · p. 15

E.3 Threshold-based Defense

  • With anomaly-score threshold 0.5, BlindGuard remains competitive under unknown-K remediation on CSQA prompt-injection and memory-poisoning settings.The threshold-based variant flags agents by score rather than requiring a fixed number of agents to remediate.Source: §E.3 · pp. 15–16, Table 6 · p. 15

E.4 Collusion Attacks

  • Under sacrificial-decoy collusion, BlindGuard achieves lower ASR across rounds and higher AUC than G-Safeguard.The analysis links attack-agnostic learning and node, neighbor, and global views to retaining separation for stealthy colluders despite a conspicuous decoy.Source: §E.4 · p. 16, Table 7 · p. 16

E.5 Adaptive Attacks

  • BlindGuard maintains low ASR and high detection AUC against an adaptive prompt-injection strategy designed to keep malicious responses semantically close to normal outputs.The attack embeds the correct answer and asks the agent to mimic its reasoning process.Source: §E.5 · pp. 16–17, Table 8 · p. 16

E.6 Encoder Contribution Analysis

  • Raw SentenceBERT features scored directly with Eq.(7) perform consistently worse than BlindGuard across four topologies on prompt-injection and memory-poisoning tasks.The authors attribute the gains to encoder training with semantics-aware directional negatives and margin separation.Source: §E.6 · p. 17, Table 9 · p. 17

E.7 Attack-free Evaluation

  • On attack-free CSQA samples, BlindGuard leaves accuracy essentially unchanged from no defense and comparable to G-Safeguard.This evaluation covers prompt injection and memory poisoning across four communication topologies.Source: §E.7 · p. 17, Table 10 · p. 17

E.8 Additional Results of BlindGuard

  • Across additional benchmarks, attack types, and topologies, BlindGuard outperforms Dominant, PREM, and TAM while approaching G-Safeguard; it also retains capability with detection budget K = 2.The additional comparisons cover multi-round ASR@3, and the constrained-budget results approach G-Safeguard’s effectiveness.Source: §E.8 · p. 17

F Topology-dependent Performance

BlindGuard’s defense performance varies with communication topology, as topology shapes both attack propagation and the interaction evidence available for detection. The section also contrasts its multi-level semantic approach with prior methods and explains the role and limits of directional negatives.

F Topology-dependent Performance

  • In chain and star topologies, BlindGuard lowers ASR@3 versus no defense; local shifts aid chain detection, while global context supports rapid containment at the star’s center.Pruning upstream chain edges reduces downstream exposure, and pruning the central star agent protects most spokes.Source: F Topology-dependent Performance · pp. 17–18, Table 11 · p. 18
  • Tree context helps detect globally misaligned colluding subtrees, while random connectivity dilutes neighbor evidence and makes prompt injection harder to contain.The global view stabilizes detection in random graphs, where BlindGuard remains strong on tool and memory attacks with more uniform semantic shifts.Source: F Topology-dependent Performance · p. 18, Table 12 · p. 19
  • In the star case study, pruning the benign center’s outgoing edges stopped redistribution despite a false positive, whereas random paths allowed spread after early misclassifications.The case analysis concludes that topology materially affects defense performance and attack success.Source: F Topology-dependent Performance · p. 18

G Key Differences from Prior Work

  • BlindGuard combines agent semantics, neighborhood context, and global system state to detect coordinated semantic anomalies that structural or static-feature methods may miss.The passage contrasts this with prior GAD methods for fixed graph settings and rule-based systems built around pre-specified communication formats.Source: G Key Differences from Prior Work · p. 19

H Directional Negative Justification

  • Semantics-aware directional negatives enforce an angular margin around normal behavior, targeting deviations from neighborhood and global context rather than isotropic noise.The authors note that carefully crafted perturbations remaining close to the normal manifold may still evade that margin.Source: H Directional Negative Justification · p. 19

I Failure Case Analysis

The failure analysis identifies errors in both directions: benign reasoning-style diversity can look anomalous, while on-topic malicious steering can remain aligned with context.

I Failure Case Analysis

  • Benign agents using atypical direct computations or extra heuristics can diverge from the group’s reasoning pattern and be flagged as outliers.The authors identify benign heterogeneity in reasoning style as a weakness of the context-alignment approach.Source: I Failure Case Analysis · p. 20
  • Malicious agents can evade detection by adding plausible, on-topic caveats that preserve semantic alignment with neighborhood and global context.Such manifold-preserving mimicry may not reduce alignment enough to cross the detection margin.Source: I Failure Case Analysis · p. 20
  • BlindGuard is strongest on off-manifold semantic deviation, with limits on stealthy on-topic attacks and benign stylistic variation.These are the two failure modes identified in the analysis.Source: I Failure Case Analysis · p. 20
Loading 2508.08127v2…