Multi agent systems security improves with combined rules and judges
Where Rules End and Judges Begin: Measuring the Judgment Boundary in Multi-Agent Systems Security
Artificial IntelligenceComputation and LanguageCryptography and SecurityMultiagent Systems
Summary
Multi-agent systems using large language models can face tricky attacks that are hard to block when defenses only check one type of attack at a time. The authors created a system called DEFER that uses many automatic checks to block clear attacks and sends the rest to a group of judges for decisions. This approach reduced successful attacks from about 30% to 3%. The study shows that clear rules spot obvious threats, while human-like judges help with more subtle cases, although both parts have some weaknesses.
What this means in practice
- •For security operations teams: Reduce multi-agent system vulnerabilities by implementing a layered defense that combines automatic rules and human-like judgment panels.
- •For multi-agent system developers: Build more robust multi-agent platforms that manage adversarial content by integrating cascaded checks with selective human review.
Authors
Shaswata Mitra, Raj Patel, Subash Neupane, Sudip Mittal, Md Rayhanur Rahman, Shahram Rahimi
Abstract
LLM-based multi-agent systems (MAS) engage tools, share memory, and delegate tasks, often encountering adversarial content. Current defenses for MAS are typically evaluated in isolation, focusing on one attack type at a time, which can lead to costly and hard-to-audit outcomes. This study organizes defenses into five principles, implementing them as DEFER1 (DEterministic-First Enforcement with Residual judgment), which includes a cascade of 28 checks that blocks what it can and refers the rest to a panel of four judges. In independent testing across four domains, attack success rates drop from about 30.0% to approximately 3.0%, with 78% of blocked attacks handled by deterministic checks. Only a quarter of proposals reach the judges in the security-operations domain, illustrating that the rules provide security for attacks violating clear policies, while judges manage those that only misrepresent intent. Both systems have weaknesses, such as a risk-score approval gate that inaccurately approves most attack proposals but few legitimate ones, highlighting the challenges in assessing threats accurately.