ACIArena: Toward Unified Evaluation for Agent Cascading Injection

Challenge:	Existing studies consider only limited attack strategies and simplified MAS settings, limiting their generalizability and comprehensive evaluation.
Approach:	They propose a framework to evaluate the robustness of Multi-Agent Systems (MAS) they propose unified evaluation suites spanning attack surfaces and attack objectives .
Outcome:	ACIArena provides a benchmark of 1,356 test cases for evaluating MAS robustness . it covers six widely used MAS implementations and provides measurable results .

Similar Papers

Overview

Challenge

Approach

Outcome

MASTER: Multi-Agent Security Through Exploration of Roles and Topological Structures - A Comprehensive Framework (2025.findings-emnlp)

Copied to clipboard

Yifan Zhu, Chao Zhang, Xin Shi, Xueqiao Zhang, Yi Yang, Yawei Luo

Robustness in NLP

Challenge:	Large Language Models (LLMs)-based Multi-Agent Systems (MAS) exhibit remarkable problem-solving and task planning capabilities across diverse domains .
Approach:	They propose a security research framework for LLM-based multi-agent systems . they propose corresponding defense strategies to address MAS security risks .
Outcome:	The proposed framework amplifies the severity of security risks under MAS attacks . it offers an automated construction process for different MAS setups and an interaction paradigm .

PIArena: A Platform for Prompt Injection Evaluation (2026.acl-long)

Copied to clipboard

Runpeng Geng, Chenlong Yin, Yanting Wang, Ying Chen, Jinyuan Jia

Responsible & Trustworthy NLP

Challenge:	OWASP identifies prompt injection as the top-1 security risk for large language models (LLMs).
Approach:	They propose a unified platform for prompt injection evaluation that integrates state-of-the-art attacks and defenses into a platform.
Outcome:	The proposed attack exploits state-of-the-art defenses and generalizes them on diverse datasets and attacks.

PEAR: Planner-Executor Agent Robustness Benchmark (2026.findings-eacl)

Copied to clipboard

Shen Dong, Mingxuan Zhang, Pengfei He, Li Ma, Bhavani Thuraisingham, Hui Liu, Yue Xing

Robustness in NLP

Challenge:	Existing studies examine isolated attack surfaces or specific scenarios, leaving a lack of holistic understanding of MAS vulnerabilities.
Approach:	They propose a benchmark to evaluate the utility and vulnerability of planner–executor MAS.
Outcome:	The proposed benchmark evaluates planner–executor MAS on a widely adopted design.

TAMAS: Benchmarking Adversarial Risks in Multi-Agent LLM Systems (2026.acl-long)

Copied to clipboard

Ishan Kavathekar, Hemang Jain, Ameya Rathod, Ponnurangam Kumaraguru, Tanuja Ganu

Robustness in NLP

Challenge:	Existing benchmarks and datasets focus on single-agent settings, failing to capture the unique vulnerabilities of multi-agend LLM dynamics and co-ordination.
Approach:	They propose a benchmark to evaluate the robustness and safety of multi-agent LLM systems.
Outcome:	The proposed benchmark evaluates the robustness and safety of multi-agent LLM systems.

NetSafe: Exploring the Topological Safety of Multi-agent System (2025.findings-acl)

Copied to clipboard

Miao Yu, Shilong Wang, Guibin Zhang, Junyuan Mao, Chenlong Yin, Qijiong Liu, Kun Wang, Qingsong Wen, Yang Wang

Challenge:	Large language models (LLMs) have fueled significant progress in intelligent Multi-agent Systems (MAS), with expanding academic and industrial applications.
Approach:	They propose a framework that unifies diverse MAS workflows via iterative RelCom interactions to enable generalized analysis.
Outcome:	The proposed framework unifies diverse MAS workflows via iterative RelCom interactions to enable generalized analysis.

Rethinking Assessments of Prompt Injection Attacks (2026.findings-acl)

Copied to clipboard

Chi Cui, Yixin Wu, Michael Backes, Yang Zhang

Responsible & Trustworthy NLP

Challenge:	Prompt injection attacks are recognized as one of the primary risks faced by LLM-integrated applications in recent years.
Approach:	They evaluate prompt injection attacks on LLM-integrated applications across 37 target tasks, 185 injected tasks, 21 attack instructions, and 143,745 queries.
Outcome:	The proposed framework provides a solid foundation for assessing vulnerabilities in LLM-integrated applications and evaluating the efficacy of defensive strategies.

G-Safeguard: A Topology-Guided Security Lens and Treatment on LLM-based Multi-agent Systems (2025.acl-long)

Copied to clipboard

Shilong Wang, Guibin Zhang, Miao Yu, Guancheng Wan, Fanci Meng, Chongye Guo, Kun Wang, Yang Wang

Robustness in NLP

Challenge:	Large Language Model (LLM)-based Multi-agent Systems (MAS) have demonstrated remarkable capabilities in various complex tasks, but their vulnerability to adversarial attacks, misinformation propagation, and unintended behaviors have raised significant concerns.
Approach:	They propose a topology-guided security lens and treatment for robust LLM-MAS that leverages graph neural networks to detect anomalies on the multi-agent utterance graph and employ topological intervention for attack remediation.
Outcome:	Experiments show that the proposed security lens recovers 40% of the performance under various attack strategies and integrates with mainstream MAS with security guarantees.

MASEval: Extending Multi-Agent Evaluation from Models to Systems (2026.acl-demo)

Copied to clipboard

Cornelius Emde, Alexander Rubinstein, Anmol Goel, Ahmed Heakl, Sangdoo Yun, Seong Joon Oh, Martin Gubri

Challenge:	MASEval provides a framework-agnostic, system-level comparison across any agent framework and benchmark.
Approach:	They propose a Python library that treats the entire agentic system as the unit of analysis.
Outcome:	The proposed framework treats the entire agentic system as the unit of analysis.

Superficial Success vs. Internal Breakdown: An Empirical Study of Generalization in Adaptive Multi-Agent Systems (2026.findings-acl)

Copied to clipboard

Namyeong So, Seokgyu Jang, Taeuk Kim

Challenge:	Adaptive multi-agent systems (MAS) are increasingly adopted as solutions to complex problems.
Approach:	They conduct extensive empirical study on adaptive multi-agent systems . they find they are prone to topological overfitting and exhibit illusory coordination . authors urge prioritization of generalization in MAS development and evaluation .
Outcome:	a new study shows adaptive multi-agent systems are prone to overfitting and lack coordination . the findings highlight the need to prioritize generalization in MAS development .

How Adversarial Environments Mislead Agentic AI? (2026.findings-acl)

Copied to clipboard

Zhonghao Zhan, Huichi Zhou, Zhenhao Li, Peiyuan Jing, Krinos Li, Hamed Haddadi

Robustness in NLP

Challenge:	Current evaluations benchmark capability in benign settings, but never "what if the tools lie" we formalize this vulnerability as Adversarial Environmental Injection (AEI) AEI constitutes environmental deception by constructing a "fake world" of poisoned search results .
Approach:	They propose an attack model where adversaries compromise tool outputs to deceive agents.
Outcome:	The proposed model exploits a trust gap between tool outputs and actual exposure to adversaries.