mlsanityData to 7 Oct 2026

G-Safeguard: A Topology-Guided Security Lens and Treatment on LLM-based Multi-agent Systems

arXiv 2502.11127 ↗First posted 16 Feb 2025cs.CR cs.LG cs.MAcited by 56

On the map: LLM agents and tool use → Agent threats, guardrails and governance

Abstract (arXiv)

Large Language Model (LLM)-based Multi-agent Systems (MAS) have demonstrated remarkable capabilities in various complex tasks, ranging from collaborative problem-solving to autonomous decision-making. However, as these systems become increasingly integrated into critical applications, their vulnerability to adversarial attacks, misinformation propagation, and unintended behaviors have raised significant concerns. To address this challenge, we introduce G-Safeguard, a topology-guided security lens and treatment for robust LLM-MAS, which leverages graph neural networks to detect anomalies on the multi-agent utterance graph and employ topological intervention for attack remediation. Extensive experiments demonstrate that G-Safeguard: (I) exhibits significant effectiveness under various attack strategies, recovering over 40% of the performance for prompt injection; (II) is highly adaptable to diverse LLM backbones and large-scale MAS; (III) can seamlessly combine with mainstream MAS with security guarantees. The code is available at https://github.com/wslong20/G-safeguard.

Key facts. Cited by 56 papers in the map (data through 7 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 43 of its 58 references that are in the map. First posted on arXiv 16 Feb 2025.

Builds on

43 of 58 references.

Closest ancestors · 9

Same direction, newest first

  1. 2024Imprompter: Tricking LLM Agents into Improper Tool Use19 Oct
  2. 2024AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agents11 Oct
  3. 2024Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agents3 Oct
  4. 2024AgentPoison: Red-teaming LLM Agents via Poisoning Memory or Knowledge Bases17 Jul
  5. 2024InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents5 Mar
  6. 2024Agent Smith: A Single Image Can Jailbreak One Million Multimodal LLM Agents Exponentially Fast13 Feb
  7. 2024TrustAgent: Towards Safe and Trustworthy LLM-based Agents2 Feb
  8. 2024PsySafe: A Comprehensive Framework for Psychological-based Attack, Defense, and Evaluation of Multi-agent System Safety22 Jan
  9. 2023Evil Geniuses: Delving into the Safety of LLM-based Agents20 Nov

Other references · 34

  1. 2024The Llama 3 Herd of Modelscited by 14,192
  2. 2021Training Verifiers to Solve Math Word Problemscited by 9,743
  3. 2019Sentence-BERT: Sentence Embeddings using Siamese BERT-Networkscited by 9,049
  4. 2020Measuring Massive Multitask Language Understandingcited by 7,768
  5. 2023Generative Agents: Interactive Simulacra of Human Behaviorcited by 3,500
  6. 2019A Comprehensive Survey on Graph Neural Networkscited by 2,906
  7. 2023A Survey on Large Language Model based Autonomous Agentscited by 2,203
  8. 2018CommonsenseQA: A Question Answering Challenge Targeting Commonsense Knowledgecited by 1,793
  9. 2020MiniLM: Deep Self-Attention Distillation for Task-Agnostic Compression of Pre-Trained Transformerscited by 1,414
  10. 2023CAMEL: Communicative Agents for "Mind" Exploration of Large Language Model Societycited by 1,348
  11. 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,339
  12. 2023Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversationscited by 1,124
22 more
  1. 2022Ignore Previous Prompt: Attack Techniques For Language Modelscited by 760
  2. 2023ChatEval: Towards Better LLM-based Evaluators through Multi-Agent Debatecited by 724
  3. 2024A Survey on the Memory Mechanism of Large Language Model based Agentscited by 622
  4. 2023AgentVerse: Facilitating Multi-Agent Collaboration and Exploring Emergent Behaviorscited by 580
  5. 2023Prompt Injection attack against LLM-integrated Applicationscited by 568
  6. 2024WildGuard: Open One-Stop Moderation Tools for Safety Risks, Jailbreaks, and Refusals of LLMscited by 460
  7. 2023ToolAlpaca: Generalized Tool Learning for Language Models with 3000 Simulated Casescited by 383
  8. 2023Exploiting Programmatic Behavior of LLMs: Dual-Use Through Standard Security Attackscited by 268
  9. 2023LLM Self Defense: By Self Examination, LLMs Know They Are Being Trickedcited by 226
  10. 2024ToolACE: Winning the Points of LLM Function Callingcited by 204
  11. 2023LM vs LM: Detecting Factual Errors via Cross Examinationcited by 155
  12. 2023War and Peace (WarAgent): Large Language Model-based Multi-Agent Simulation of World Warscited by 143
  13. 2023Tensor Trust: Interpretable Prompt Injection Attacks from an Online Gamecited by 135
  14. 2024Attacks, Defenses and Evaluations for LLM Conversation Safety: A Surveycited by 124
  15. 2024Self-Organized Agents: A LLM Multi-Agent Framework toward Ultra Large-Scale Code Generation and Optimizationcited by 84
  16. 2023See and Think: Embodied Agent in Virtual Environmentcited by 54
  17. 2023GameGPT: Multi-agent Collaborative Framework for Game Developmentcited by 41
  18. 2025Poison-RAG: Adversarial Data Poisoning Attacks on Retrieval-Augmented Generation in Recommender Systemscited by 32
  19. 2024PARDEN, Can You Repeat That? Defending against Jailbreaks via Repetitioncited by 29
  20. 2024Protecting Your LLMs with Information Bottleneckcited by 26
  21. 2021Edge-Featured Graph Attention Networkcited by 18
  22. 2024Graph Sparsification via Mixture of Graphscited by 17

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2025: 22; 2026: 34.

56 papers.

Sort:

By area:

  1. 2025The Landscape of Agentic Reinforcement Learning for LLMs: A Surveycited by 195
  2. 2025Large Language Model Agent: A Survey on Methodology, Applications and Challengescited by 194
  3. 2025Advances and Challenges in Foundation Agents: From Brain-Inspired Intelligence to Evolutionary, Collaborative, and Safe Systemscited by 125
  4. 2025A Comprehensive Survey in LLM(-Agent) Full Stack Safety: Data, Training and Deploymentcited by 110
  5. 2026A Survey of Agentic Reasoning for Large Language Models: Towards Recursively Self-Improving and Collective Agentscited by 47
  6. 2025AGENTSAFE: Benchmarking the Safety of Embodied Agents on Hazardous Instructionscited by 33
  7. 2025We Should Identify and Mitigate Third-Party Safety Risks in MCP-Powered Agent Systemscited by 27
  8. 2025Graphs Meet AI Agents: Taxonomy, Progress, and Future Opportunitiescited by 23
  9. 2025Aegis: Automated Error Generation and Attribution for Multi-Agent Systemscited by 19
  10. 2025Attack the Messages, Not the Agents: A Multi-round Adaptive Stealthy Tampering Framework for LLM-MAScited by 17
  11. 2025SafeMobile: Chain-level Jailbreak Detection and Automated Evaluation for Multimodal Mobile Agentscited by 14
  12. 2025Graph-Augmented Large Language Model Agents: Current Progress and Future Prospectscited by 14
38 more
  1. 2025BlockA2A: Towards Secure and Verifiable Agent-to-Agent Interoperabilitycited by 14
  2. 2025Who's the Mole? Modeling and Detecting Intention-Hiding Malicious Agents in LLM-Based Multi-Agent Systemscited by 12
  3. 2025Pushing the Limits of Safety: A Technical Report on the ATLAS Challenge 2025cited by 11
  4. 2025Explainable and Fine-Grained Safeguarding of LLM Multi-Agent Systems via Bi-Level Graph Anomaly Detectioncited by 8
  5. 2026Conformity Dynamics in LLM Multi-Agent Systems: The Roles of Topology and Self-Social Weightingcited by 8
  6. 2026FlowSteer: Prompt-Only Workflow Steering Exposes Planning-Time Vulnerabilities in Multi-Agent LLM Systemscited by 7
  7. 2025Agentic Services Computingcited by 6
  8. 2025Metacognitive Self-Correction for Multi-Agent System via Prototype-Guided Next-Execution Reconstructioncited by 6
  9. 2026PrivAct: Internalizing Contextual Privacy Preservation via Multi-Agent Preference Trainingcited by 6
  10. 2026TodyComm: Task-Oriented Dynamic Communication for Multi-Round LLM-based Multi-Agent Systemcited by 5
  11. 2026Efficient Failure Management for Multi-Agent Systems with Reasoning Trace Representationcited by 5
  12. 2026VerifyMAS: Hypothesis Verification for Failure Attribution in LLM Multi-Agent Systemscited by 5
  13. 2025Evo-MARL: Co-Evolutionary Multi-Agent Reinforcement Learning for Internalized Safetycited by 4
  14. 2026Self-Evolving Agents as Dynamic Graph Transformation: A Survey and New Perspectivecited by 4
  15. 2025AdvEvo-MARL: Shaping Internalized Safety through Adversarial Co-Evolution in Multi-Agent Reinforcement Learningcited by 3
  16. 2025Securing Multi-Agent Systems Against Corruptions via Node Contribution Backpropagationcited by 3
  17. 2025Don't Trust Your Upstream: Exploiting LLM Multi-Agent System via Topology-Guided Adversarial Propagationcited by 3
  18. 2026CASPIAN: Online Detection and Attribution of Cascade Attacks in LLM Multi-Agent Systems via Cross-Channel Causal Monitoringcited by 3
  19. 2026MOC: Multi-Order Communication in LLM-based Multi-Agent Systemscited by 3
  20. 2026Cost and Accuracy of Long-Term Memory in Distributed Multi-Agent Systems Based on Large Language Modelscited by 2
  21. 2026MASRubric: Auditing Information Flow in Multi-Agent Systems with Failure-Distilled Pitfall Rubricscited by 2
  22. 2026GAMMAF: A Common Framework for Graph-Based Anomaly Monitoring Benchmarking in LLM Multi-Agent Systemscited by 2
  23. 2026When Embedding-Based Defenses Fail: Rethinking Safety in LLM-Based Multi-Agent Systemscited by 2
  24. 2026CatchBench: When Can an Agent Failure Be Caught?cited by 2
  25. 2025MAS2: Self-Generative, Self-Configuring, Self-Rectifying Multi-Agent Systemscited by 1
  26. 2026GAMBIT: A Three-Mode Benchmark for Adversarial Robustness in Multi-Agent LLM Collectivescited by 1
  27. 2026Skill Description Deception Attack against Task Routing in Internet of Agentscited by 1
  28. 2026AutoRAS: Learning Robust Agentic Systems with Primitive Representationscited by 1
  29. 2026When Agents Go Rogue: Activation-Based Detection of Malicious Behaviors in Multi-Agent Systemscited by 1
  30. 2026Blockchain Empowered Trustworthy Agent Networks: Foundations, Taxonomy, and Future Directionscited by 1
  31. 2026SoK: When Safe Agents Fail Together: The Security of Multi Agent LLM Systemscited by 1
  32. 2026Is Monitoring Enough? Strategic Agent Selection For Stealthy Attack in Multi-Agent Discussionscited by 0
  33. 2026Rethinking Agentic Reinforcement Learning In Large Language Modelscited by 0
  34. 2026MESA: Prioritizing Vulnerable Communication Channels for Securing Multi-Agent Systemscited by 0
  35. 2026OpenEvoShield: Dual Non-Stationary Continual Defense for Open-World Multi-Agent System Attackscited by 0
  36. 2026Beyond Component Testing: Validating Agentic AI Systemscited by 0
  37. 2026WebMCP-Phalanx: Enforcing and Characterizing Trust Boundaries for Browser-Integrated LLM Agentscited by 0
  38. 2026Agentic Societies Need a Social Harnesscited by 0

50 most cited of 56 All 56 (JSON)

Similar, not cited

Close in wording, no citation either way

  1. 2024NetSafe: Exploring the Topological Safety of Multi-agent Networks
  2. 2026Privacy-Preserving Topology-Guided Safety for LLM-Based Multi-Agent Systems via Federated Graph Learning
  3. 2025textitAgents Under Siege: Breaking Pragmatic Multi-Agent LLM Systems with Optimized Prompt Attacks
  4. 2026ResMAS: Resilience Optimization in LLM-based Multi-agent Systems
  5. 2025MASTER: Multi-Agent Security Through Exploration of Roles and Topological Structures -- A Comprehensive Framework
  6. 2025TAMAS: Benchmarking Adversarial Risks in Multi-Agent LLM Systems
  7. 2025Poster: Enhancing GNN Robustness for Network Intrusion Detection via Agent-based Analysis
  8. 2025Checkpoint-GCG: Auditing and Attacking Fine-Tuning-Based Prompt Injection Defenses