SoK: When Safe Agents Fail Together: The Security of Multi Agent LLM Systems

arXiv:2609.00595 · cs.CR, cs.AI · Submitted 2026-09-01 · Read on arXiv

cs.CR, cs.AI

Submitted: 2026-09-01

Updated: 2026-09-01

Terminology

• Multi-Agent System — 58× in this paper · explained in 6 episodes
• Trace — 39× in this paper · explained in 2 episodes
• Benchmark — 33× in this paper · explained in 2 episodes
• Provenance — 20× in this paper · explained in 3 episodes
• Robustness — 8× in this paper · explained in 5 episodes
• Steering — 7× in this paper · explained in 2 episodes
• AI Agents — 6× in this paper · explained in 2 episodes
• Agentic AI — 6× in this paper · explained in 1 episode
• Aggregation — 6× in this paper · explained in 1 episode
• RAG — 5× in this paper · explained in 3 episodes
• Accuracy — 4× in this paper · explained in 1 episode
• Multi-agent Collaboration — 4× in this paper · explained in 2 episodes
• Verification — 4× in this paper · explained in 2 episodes
• Benchmarking — 3× in this paper · explained in 3 episodes
• Information Leakage — 3× in this paper · explained in 2 episodes
• Verifier — 3× in this paper · explained in 2 episodes
• Adam — 2× in this paper · explained in 2 episodes
• Adversarial Co-evolution — 2× in this paper · explained in 1 episode
• Agent Interactions — 2× in this paper · explained in 1 episode
• Agentic AI systems — 2× in this paper · explained in 1 episode
• Agentic System — 2× in this paper · explained in 2 episodes
• Conference on Language Modeling — 2× in this paper
• Core — 2× in this paper · explained in 2 episodes
• Hallucination — 2× in this paper · explained in 3 episodes
• International Conference on Computer and Applications — 2× in this paper
• Interpretability — 2× in this paper · explained in 15 episodes
• Ablation — 1× in this paper · explained in 1 episode
• Adversarial Prompting — 1× in this paper · explained in 1 episode
• Adversarial Robustness — 1× in this paper · explained in 3 episodes
• Agent Harness — 1× in this paper · explained in 2 episodes
• Alignment — 1× in this paper · explained in 1 episode
• Attack Success Rate — 1× in this paper
• Attack Success Rate (ASR) — 1× in this paper · explained in 2 episodes
• Cooperation — 1× in this paper · explained in 2 episodes
• Differentially Private — 1× in this paper · explained in 3 episodes
• Elias — 1× in this paper · explained in 2 episodes
• Empirical Methods in Natural Language Processing — 1× in this paper
• Federated Learning — 1× in this paper · explained in 14 episodes
• Foundation Model — 1× in this paper · explained in 3 episodes
• Foundation Models — 1× in this paper · explained in 7 episodes
• Fourteenth International Conference on Learning Representations — 1× in this paper
• Hallucination Mitigation — 1× in this paper · explained in 2 episodes
• Kill-Chain Canaries — 1× in this paper · explained in 2 episodes
• Metacognition — 1× in this paper · explained in 5 episodes
• Multi-Agent Framework — 1× in this paper · explained in 3 episodes
• Pruning — 1× in this paper · explained in 4 episodes
• Redundancy — 1× in this paper · explained in 2 episodes
• Unified Framework — 1× in this paper · explained in 5 episodes

Sources

• LCGuard: Latent Communication Guard for Safe KV Sharing in Multi-Agent Systems
• SNEAK: Evaluating Strategic Communication and Information Leakage in Large Language Models
• Many-to-One Adversarial Consensus: Exposing Multi-Agent Collusion Risks in AI-Based Healthcare
• Institutional AI: Governing LLM Collusion in Multi-Agent Cournot Markets via Public Governance Graphs
• When Latent Agents Lie: KV-Cache Integrity in Multi-Agent LLM Collaboration
• Cross-Layer Semantic Flow Reconstruction for Attack Detection in Agentic Systems
• When Child Inherits: Modeling and Exploiting Subagent Spawn in Multi-Agent Networks
• Byzantine Fault-Tolerant Multi-Agent System for Healthcare: A Gossip Protocol Approach to Secure Medical Message Propagation
• When Persuasion Overrides Truth in Multi-Agent LLM Debates: Introducing a Confidence-Weighted Persuasion Override Rate (CW-POR)
• AgentMonitor: A Plug-and-Play Framework for Predictive and Secure Multi-Agent Systems
• Prompt Injection Mitigation with Agentic AI, Nested Learning, and AI Sustainability via Semantic Caching
• Agentic JWT: A Secure Delegation Protocol for Autonomous AI Agents
• Convergence dynamics of Agent-to-Agent Interactions with Misaligned objectives
• Architecture Matters for Multi-Agent Security
• Maris: A Formally Verifiable Privacy Policy Enforcement Paradigm for Multi-Agent Collaboration Systems
• MAD-Spear: A Conformity-Driven Prompt Injection Attack on Multi-Agent Debate Systems
• Byzantine Cheap Talk: Adversarial Resilience and Topology Effects in LLM Coordination Games
• A Survey of LLM-Driven AI Agent Communication: Protocols, Security Risks, and Defense Countermeasures
• Collective Hallucination in Multi-Agent LLMs:Modeling and Defense
• Architecture Matters: Comparing RAG Systems under Knowledge Base Poisoning

Related papers

• SoK: AI-Augmented Binary Reversing
• Relaxed Sender Anonymity for CBDC Interbank Settlement: A Zero-Knowledge Approach on Permissioned EVM
• Calibration-Family Overfit: Why Trusted Sabotage Monitors Don't Transfer Across Lineages
• Efficient Fuzzy PSI under One-Sided Assumptions
• Sealing the Audit-Runtime Gap for LLM Skills
• Token Composition: A Graph Based on EVM Logs