NetSafe: Exploring the Topological Safety of Multi-agent Networks
On the map: LLM agents and tool use → Agent threats, guardrails and governance
Abstract (arXiv)
Large language models (LLMs) have empowered nodes within multi-agent networks with intelligence, showing growing applications in both academia and industry. However, how to prevent these networks from generating malicious information remains unexplored with previous research on single LLM's safety be challenging to transfer. In this paper, we focus on the safety of multi-agent networks from a topological perspective, investigating which topological properties contribute to safer networks. To this end, we propose a general framework, NetSafe along with an iterative RelCom interaction to unify existing diverse LLM-based agent frameworks, laying the foundation for generalized topological safety research. We identify several critical phenomena when multi-agent networks are exposed to attacks involving misinformation, bias, and harmful information, termed as Agent Hallucination and Aggregation Safety. Furthermore, we find that highly connected networks are more susceptible to the spread of adversarial attacks, with task performance in a Star Graph Topology decreasing by 29.7%. Besides, our proposed static metrics aligned more closely with real-world dynamic evaluations than traditional graph-theoretic metrics, indicating that networks with greater average distances from attackers exhibit enhanced safety. In conclusion, our work introduces a new topological perspective on the safety of LLM-based multi-agent networks and discovers several unreported phenomena, paving the way for future research to explore the safety of such networks.
Key facts. Cited by 29 papers in the map (data through 14 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 51 of its 95 references that are in the map. First posted on arXiv 21 Oct 2024.
Builds on
51 of 95 references.
Closest ancestors · 3
Same direction, newest first
- 2024The Wolf Within: Covert Injection of Malice into MLLM Societies via an MLLM Operative20 Feb
- 2024Agent Smith: A Single Image Can Jailbreak One Million Multimodal LLM Agents Exponentially Fast13 Feb
- 2024Combating Adversarial Attacks with Multi-Agent Debate11 Jan
Other references · 48
- 2020Language Models are Few-Shot Learnerscited by 32,419
- 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 13,028
- 2021Training Verifiers to Solve Math Word Problemscited by 10,109
- 2022ReAct: Synergizing Reasoning and Acting in Language Modelscited by 8,695
- 2023Direct Preference Optimization: Your Language Model is Secretly a Reward Modelcited by 8,065
- 2023Toolformer: Language Models Can Teach Themselves to Use Toolscited by 4,182
- 2023Self-Refine: Iterative Refinement with Self-Feedbackcited by 3,442
- 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 3,104
- 2020Learning to summarize from human feedbackcited by 2,588
- 2023A Survey on Large Language Model based Autonomous Agentscited by 2,242
- 2019Language Models as Knowledge Bases?cited by 1,936
- 2022Language Models (Mostly) Know What They Knowcited by 1,856
36 more
- 2018CommonsenseQA: A Question Answering Challenge Targeting Commonsense Knowledgecited by 1,822
- 2023MetaGPT: Meta Programming for A Multi-Agent Collaborative Frameworkcited by 1,808
- 2023Jailbreaking Black Box Large Language Models in Twenty Queriescited by 1,420
- 2023CAMEL: Communicative Agents for "Mind" Exploration of Large Language Model Societycited by 1,395
- 2023MemGPT: Towards LLMs as Operating Systemscited by 1,389
- 2020RealToxicityPrompts: Evaluating Neural Toxic Degeneration in Language Modelscited by 1,255
- 2023HuggingGPT: Solving AI Tasks with ChatGPT and its Friends in Hugging Facecited by 1,190
- 2023LIMA: Less Is More for Alignmentcited by 1,100
- 2023Encouraging Divergent Thinking in Large Language Models through Multi-Agent Debatecited by 1,011
- 2020How Much Knowledge Can You Pack Into the Parameters of a Language Model?cited by 719
- 2023Tree of Attacks: Jailbreaking Black-Box LLMs Automaticallycited by 672
- 2023Safe RLHF: Safe Reinforcement Learning from Human Feedbackcited by 656
- 2023ViperGPT: Visual Inference via Python Execution for Reasoningcited by 603
- 2023AgentVerse: Facilitating Multi-Agent Collaboration and Exploring Emergent Behaviorscited by 598
- 2019Defending Against Neural Fake Newscited by 559
- 2022Using Large Language Models to Simulate Multiple Humans and Replicate Human Subject Studiescited by 515
- 2023MedAgents: Large Language Models as Collaborators for Zero-shot Medical Reasoningcited by 316
- 2023Poisoning Language Models During Instruction Tuningcited by 269
- 2023Certifying LLM Safety against Adversarial Promptingcited by 266
- 2023Self-collaboration Code Generation via ChatGPTcited by 258
- 2023GPT4Tools: Teaching Large Language Model to Use Tools via Self-instructioncited by 248
- 2023LLM Self Defense: By Self Examination, LLMs Know They Are Being Trickedcited by 244
- 2023Exploring Large Language Models for Communication Games: An Empirical Study on Werewolfcited by 241
- 2023Building Cooperative Embodied Agents Modularly with Large Language Modelscited by 237
- 2023Exploring Collaboration Mechanisms for LLM Agents: A Social Psychology Viewcited by 222
- 2023AutoAgents: A Framework for Automatic Agent Generationcited by 216
- 2023LoRA Fine-tuning Efficiently Undoes Safety Training in Llama 2-Chat 70Bcited by 195
- 2023War and Peace (WarAgent): Large Language Model-based Multi-Agent Simulation of World Warscited by 145
- 2023Explore, Establish, Exploit: Red Teaming Language Models from Scratchcited by 114
- 2023Scalable Multi-Robot Collaboration with Large Language Models: Centralized or Decentralized Systems?cited by 106
- 2023Avalon's Game of Thoughts: Battle Against Deception through Recursive Contemplationcited by 104
- 2023Scaling Transformer to 1M tokens and beyond with RMTcited by 98
- 2024Here Comes The AI Worm: Unleashing Zero-click Worms that Target GenAI-Powered Applicationscited by 59
- 2024Emulated Disalignment: Safety Alignment for Large Language Models May Backfire!cited by 37
- 2024LLM Harmony: Multi-Agent Communication for Problem Solvingcited by 35
- 2023Evaluating Language Models for Knowledge Base Completioncited by 20
Built on by
Citing papers per year: 2024: 1; 2025: 18; 2026: 10.
29 papers.
Sort:
By area:
- 2025Large Language Model Agent: A Survey on Methodology, Applications and Challengescited by 205
- 2025A Comprehensive Survey in LLM(-Agent) Full Stack Safety: Data, Training and Deploymentcited by 116
- 2025A Survey of LLM-Driven AI Agent Communication: Protocols, Security Risks, and Defense Countermeasurescited by 57
- 2025We Should Identify and Mitigate Third-Party Safety Risks in MCP-Powered Agent Systemscited by 27
- 2025Graphs Meet AI Agents: Taxonomy, Progress, and Future Opportunitiescited by 23
- 2025Aegis: Automated Error Generation and Attribution for Multi-Agent Systemscited by 22
- 2025Ten Challenging Problems in Federated Foundation Modelscited by 20
- 2026Colosseum: Auditing Collusion in Cooperative Multi-Agent Systemscited by 18
- 2025Rethinking the Reliability of Multi-agent System: A Perspective from Byzantine Fault Tolerancecited by 17
- 2025Graph-Augmented Large Language Model Agents: Current Progress and Future Prospectscited by 14
- 2025From LLMs to MLLMs to Agents: A Survey of Emerging Paradigms in Jailbreak Attacks and Defenses within LLM Ecosystemcited by 12
- 2026Robust Multi-Agent LLMs under Byzantine Faultscited by 10
17 more
- 2025IP Leakage Attacks Targeting LLM-Based Multi-Agent Systemscited by 8
- 2025When AI Agents Collude Online: Financial Fraud Risks by Collaborative LLM Agents on Social Platformscited by 8
- 2024LLM-Virus: Evolutionary Jailbreak Attack on Large Language Modelscited by 7
- 2025Metacognitive Self-Correction for Multi-Agent System via Prototype-Guided Next-Execution Reconstructioncited by 7
- 2025Assessing and Enhancing the Robustness of LLM-based Multi-Agent Systems Through Chaos Engineeringcited by 6
- 2025Topological Structure Learning Should Be A Research Priority for LLM-Based Multi-Agent Systemscited by 5
- 2025AdvEvo-MARL: Shaping Internalized Safety through Adversarial Co-Evolution in Multi-Agent Reinforcement Learningcited by 5
- 2026Don't Trust Stubborn Neighbors: A Security Framework for Agentic Networkscited by 4
- 2025Extending the OWASP Multi-Agentic System Threat Modeling Guide: Insights from Multi-Agent Security Researchcited by 3
- 2026Cost and Accuracy of Long-Term Memory in Distributed Multi-Agent Systems Based on Large Language Modelscited by 2
- 2026GAMMAF: A Common Framework for Graph-Based Anomaly Monitoring Benchmarking in LLM Multi-Agent Systemscited by 2
- 2026When Child Inherits: Modeling and Exploiting Subagent Spawn in Multi-Agent Networkscited by 2
- 2026From Secure Agentic AI to Secure Agentic Web: Challenges, Threats, and Future Directionscited by 1
- 2026When Agents Go Rogue: Activation-Based Detection of Malicious Behaviors in Multi-Agent Systemscited by 1
- 2026Norm Enforcement for AI Agents: Robustly Shaping Behavior in Multi-Agent Systemscited by 1
- 2025Multi-scale Temporal Prediction via Incremental Generation and Multi-agent Collaborationcited by 0
- 2026MESA: Prioritizing Vulnerable Communication Channels for Securing Multi-Agent Systemscited by 0
- 2026Norm Enforcement for AI Agents: Robustly Shaping Behavior in Multi-Agent Systems7 Jul 2026
- 2026When Agents Go Rogue: Activation-Based Detection of Malicious Behaviors in Multi-Agent Systems7 Jul 2026
- 2026MESA: Prioritizing Vulnerable Communication Channels for Securing Multi-Agent Systems29 Jun 2026
- 2026Robust Multi-Agent LLMs under Byzantine Faults9 May 2026
- 2026When Child Inherits: Modeling and Exploiting Subagent Spawn in Multi-Agent Networks8 May 2026
- 2026GAMMAF: A Common Framework for Graph-Based Anomaly Monitoring Benchmarking in LLM Multi-Agent Systems27 Apr 2026
- 2026Don't Trust Stubborn Neighbors: A Security Framework for Agentic Networks16 Mar 2026
- 2026From Secure Agentic AI to Secure Agentic Web: Challenges, Threats, and Future Directions2 Mar 2026
- 2026Colosseum: Auditing Collusion in Cooperative Multi-Agent Systems16 Feb 2026
- 2026Cost and Accuracy of Long-Term Memory in Distributed Multi-Agent Systems Based on Large Language Models12 Jan 2026
- 2025Rethinking the Reliability of Multi-agent System: A Perspective from Byzantine Fault Tolerance13 Nov 2025
- 2025When AI Agents Collude Online: Financial Fraud Risks by Collaborative LLM Agents on Social Platforms9 Nov 2025
17 more
- 2025Metacognitive Self-Correction for Multi-Agent System via Prototype-Guided Next-Execution Reconstruction16 Oct 2025
- 2025AdvEvo-MARL: Shaping Internalized Safety through Adversarial Co-Evolution in Multi-Agent Reinforcement Learning2 Oct 2025
- 2025Multi-scale Temporal Prediction via Incremental Generation and Multi-agent Collaboration22 Sep 2025
- 2025Aegis: Automated Error Generation and Attribution for Multi-Agent Systems17 Sep 2025
- 2025Extending the OWASP Multi-Agentic System Threat Modeling Guide: Insights from Multi-Agent Security Research13 Aug 2025
- 2025Graph-Augmented Large Language Model Agents: Current Progress and Future Prospects29 Jul 2025
- 2025A Survey of LLM-Driven AI Agent Communication: Protocols, Security Risks, and Defense Countermeasures24 Jun 2025
- 2025Graphs Meet AI Agents: Taxonomy, Progress, and Future Opportunities22 Jun 2025
- 2025From LLMs to MLLMs to Agents: A Survey of Emerging Paradigms in Jailbreak Attacks and Defenses within LLM Ecosystem18 Jun 2025
- 2025We Should Identify and Mitigate Third-Party Safety Risks in MCP-Powered Agent Systems16 Jun 2025
- 2025Topological Structure Learning Should Be A Research Priority for LLM-Based Multi-Agent Systems28 May 2025
- 2025IP Leakage Attacks Targeting LLM-Based Multi-Agent Systems18 May 2025
- 2025Assessing and Enhancing the Robustness of LLM-based Multi-Agent Systems Through Chaos Engineering6 May 2025
- 2025A Comprehensive Survey in LLM(-Agent) Full Stack Safety: Data, Training and Deployment22 Apr 2025
- 2025Large Language Model Agent: A Survey on Methodology, Applications and Challenges27 Mar 2025
- 2025Ten Challenging Problems in Federated Foundation Models14 Feb 2025
- 2024LLM-Virus: Evolutionary Jailbreak Attack on Large Language Models28 Dec 2024
- 2025Large Language Model Agent: A Survey on Methodology, Applications and Challengescited by 205
- 2025A Survey of LLM-Driven AI Agent Communication: Protocols, Security Risks, and Defense Countermeasurescited by 57
- 2025We Should Identify and Mitigate Third-Party Safety Risks in MCP-Powered Agent Systemscited by 27
- 2025Graphs Meet AI Agents: Taxonomy, Progress, and Future Opportunitiescited by 23
- 2025Aegis: Automated Error Generation and Attribution for Multi-Agent Systemscited by 22
- 2026Colosseum: Auditing Collusion in Cooperative Multi-Agent Systemscited by 18
- 2025Graph-Augmented Large Language Model Agents: Current Progress and Future Prospectscited by 14
- 2025From LLMs to MLLMs to Agents: A Survey of Emerging Paradigms in Jailbreak Attacks and Defenses within LLM Ecosystemcited by 12
- 2026Robust Multi-Agent LLMs under Byzantine Faultscited by 10
- 2025IP Leakage Attacks Targeting LLM-Based Multi-Agent Systemscited by 8
- 2025When AI Agents Collude Online: Financial Fraud Risks by Collaborative LLM Agents on Social Platformscited by 8
- 2025Metacognitive Self-Correction for Multi-Agent System via Prototype-Guided Next-Execution Reconstructioncited by 7
12 most cited of 25 All 25 (JSON)
- 2026Norm Enforcement for AI Agents: Robustly Shaping Behavior in Multi-Agent Systems7 Jul 2026
- 2026When Agents Go Rogue: Activation-Based Detection of Malicious Behaviors in Multi-Agent Systems7 Jul 2026
- 2026MESA: Prioritizing Vulnerable Communication Channels for Securing Multi-Agent Systems29 Jun 2026
- 2026Robust Multi-Agent LLMs under Byzantine Faults9 May 2026
- 2026When Child Inherits: Modeling and Exploiting Subagent Spawn in Multi-Agent Networks8 May 2026
- 2026GAMMAF: A Common Framework for Graph-Based Anomaly Monitoring Benchmarking in LLM Multi-Agent Systems27 Apr 2026
- 2026Don't Trust Stubborn Neighbors: A Security Framework for Agentic Networks16 Mar 2026
- 2026From Secure Agentic AI to Secure Agentic Web: Challenges, Threats, and Future Directions2 Mar 2026
- 2026Colosseum: Auditing Collusion in Cooperative Multi-Agent Systems16 Feb 2026
- 2026Cost and Accuracy of Long-Term Memory in Distributed Multi-Agent Systems Based on Large Language Models12 Jan 2026
- 2025When AI Agents Collude Online: Financial Fraud Risks by Collaborative LLM Agents on Social Platforms9 Nov 2025
- 2025Metacognitive Self-Correction for Multi-Agent System via Prototype-Guided Next-Execution Reconstruction16 Oct 2025
12 newest of 25 All 25 (JSON)
- 2025Ten Challenging Problems in Federated Foundation Models14 Feb 2025
- 2024LLM-Virus: Evolutionary Jailbreak Attack on Large Language Models28 Dec 2024
Similar, not cited
Close in wording, no citation either way
- 2025G-Safeguard: A Topology-Guided Security Lens and Treatment on LLM-based Multi-agent Systems
- 2026Position: Safety and Fairness in Agentic AI Depend on Interaction Topology, Not on Model Scale or Alignment
- 2025GUARDIAN: Safeguarding LLM Multi-Agent Collaborations with Temporal Graph Modeling
- 2026When Embedding-Based Defenses Fail: Rethinking Safety in LLM-Based Multi-Agent Systems
- 2026From Spark to Fire: Modeling and Mitigating Error Cascades in LLM-Based Multi-Agent Collaboration
- 2025Topology Matters: Measuring Memory Leakage in Multi-Agent LLMs
- 2025TAMAS: Benchmarking Adversarial Risks in Multi-Agent LLM Systems
- 2025MASTER: Multi-Agent Security Through Exploration of Roles and Topological Structures -- A Comprehensive Framework