MAS-Guard improves safety across single and multi-agent AI systems
MAS-Guard: Unified Guardrails from Individual Agents to Multi-Agent LLM Systems
Cryptography and SecurityArtificial IntelligenceComputation and Language
Summary
AI agents that plan and execute tasks can sometimes act unsafe or get tricked by bad inputs. The authors created MAS-Guard, a system that watches over these AI agents, both when they act alone and when they work together with other agents. MAS-Guard checks what the agents do and communicate to block unsafe actions, ask for confirmation, or let safe actions proceed. Tests show MAS-Guard cuts down attacks by over 70% without stopping the agents from doing their jobs well.
What this means in practice
- •For enterprise ai teams: Protect AI-powered workflows in businesses by applying unified guardrails that prevent unsafe or malicious actions in single and multi-agent AI setups.
- •For cloud service providers: Offer customers more secure multi-agent AI environments by integrating MAS-Guard’s enforcement layers to reduce risks from compromised or opaque agents.$Commercial implications: Enables selling enhanced security features for multi-agent AI deployments to enterprises concerned with safety and compliance.
Authors
Mohammad Kachuee, Phu Mon Htut, Sheng Li, Nikolaos Pappas, Miguel Ballesteros Martinez, Yassine Benajiba, Sujith Ravi, Dan Roth
Abstract
Agentic AI extends large language models (LLMs) from generating responses to planning and executing complex workflows, substantially expanding their utility while exposing applications to unsafe actions, information leakage, and adversarial manipulation. Multi-agent systems further expand these capabilities through specialization and collaboration, but distributed authority, heterogeneous roles, and opaque or potentially compromised participants make safeguarding even more challenging. Existing defenses address important individual threats but provide fragmented coverage across local execution, system-level interactions, and enforcement mechanisms. We introduce MAS-Guard, a unified framework that closes this gap for safeguarding single- and multi-agent AI applications containing both instrumentable and opaque agents. Within instrumentable agents, the proposed local Agent Guardrail (A-Guard) layer applies task-specific experts to assess agentic events. At the system level, developer-owned Agent Charters and a Control Plane combine deterministic structural checks of routes, agent capabilities, and message formats with semantic assessments of roles and message content. These complementary layers enable enforcement through a shared set of interventions: allow, reflection, confirmation, and block. Evaluated across six benchmarks covering diverse single- and multi-agent scenarios with three agent LLMs from different providers, MAS-Guard reduces the overall attack success rate by 71.5-86.3% relative to unguarded agents, while meeting the utility reference criterion on benign tasks.