| Challenge: | Large Language Model (LLM)-driven multi-agent systems (MAS) are rapidly gaining popularity, and its inherent security risks are rapidly becoming a concern. |
| Approach: | They propose a novel attack manipulating unique structures of web links to deceive MAS by using homoglyph deception, sub-directory nesting, and parameter obfuscation. |
| Outcome: | The proposed attacks exploit unique structures of web links to deceive MAS . they exhibit significant destructive potential across different MAS architectures . |
Similar Papers
MASTER: Multi-Agent Security Through Exploration of Roles and Topological Structures - A Comprehensive Framework (2025.findings-emnlp)
Copied to clipboard
| Challenge: | Large Language Models (LLMs)-based Multi-Agent Systems (MAS) exhibit remarkable problem-solving and task planning capabilities across diverse domains . |
| Approach: | They propose a security research framework for LLM-based multi-agent systems . they propose corresponding defense strategies to address MAS security risks . |
| Outcome: | The proposed framework amplifies the severity of security risks under MAS attacks . it offers an automated construction process for different MAS setups and an interaction paradigm . |
Breaking Agents: Compromising Autonomous LLM Agents Through Malfunction Amplification (2025.emnlp-main)
Copied to clipboard
| Challenge: | Recent advances in large language models (LLMs) have increased the vulnerability of LLMs, but they can cause more severe damage than standalone systems if compromised. |
| Approach: | They propose a new type of attack that induces malfunctions by misleading the agent into executing repetitive or irrelevant actions. |
| Outcome: | The proposed attacks induce failure rates exceeding 80% in multiple scenarios, highlighting the substantial risks associated with this vulnerability. |
Conjunctive Prompt Attacks in Multi-Agent LLM Systems (2026.acl-long)
Copied to clipboard
| Challenge: | Existing defenses do not reliably stop the attack because no single component appears malicious in isolation. |
| Approach: | They study conjunctive prompt attacks where trigger key and adversarial template appear benign alone but activate harmful behavior when routing brings them together. |
| Outcome: | The proposed model significantly improves performance over baselines while keeping false activations low. |
The Dangers of Indirect Prompt Injection Attacks on LLM-based Autonomous Web Navigation Agents: A Demonstration (2025.emnlp-demos)
Copied to clipboard
| Challenge: | Large Language Model (LLM)-integrated applications are becoming more popular to support, augment, and automate tasks. |
| Approach: | They propose to embed universal adversarial triggers in webpage HTML to hijack agents . they also use a browser-gym agent powered by Llama-3.1 to test their system . |
| Outcome: | The proposed system software is released under the MIT License . |
BlindGuard: Safeguarding LLM-based Multi-Agent Systems under Unknown Attacks (2026.acl-long)
Copied to clipboard
| Challenge: | Existing supervised defense methods rely on labeled malicious agents to train a supervised model of malicious behavior. |
| Approach: | They propose an unsupervised defense method that learns without requiring any attack-specific labels or prior knowledge of malicious behaviors. |
| Outcome: | The proposed method detects diverse attack types across MAS with various communication patterns while maintaining superior generalizability compared to baselines. |
Fraud-R1 : A Multi-Round Benchmark for Assessing the Robustness of LLM Against Augmented Fraud and Phishing Inducements (2025.findings-acl)
Copied to clipboard
Shu Yang, Shenzhe Zhu, Zeyu Wu, Keyu Wang, Junchi Yao, Junchao Wu, Lijie Hu, Mengdi Li, Derek F. Wong, Di Wang
| Challenge: | Existing fraud detection benchmarks focus on single-turn classification tasks, failing to capture dynamic nature of real-world fraud attempts. |
| Approach: | They propose a bilingual benchmark to assess LLMs' ability to resist fraud and phishing attacks across five key fraud categories: Fraudulent Services, Impersonation, Phishing Scams, Fake Job Postings, and Online Relationships. |
| Outcome: | The proposed model improves in role-play settings and in e-commerce and recommendation systems. |
Red-Teaming LLM Multi-Agent Systems via Communication Attacks (2025.findings-acl)
Copied to clipboard
| Challenge: | Large Language Model-based Multi-Agent Systems (LLM-MAS) have revolutionized complex problem-solving capability by enabling agent collaboration through message-based communications. |
| Approach: | They propose an attack that exploits communication mechanisms in Large Language Model-based Multi-Agent Systems (LLM-MAS) by intercepting and manipulating inter-agent messages. |
| Outcome: | The proposed attack exploits communication mechanisms in large language model-based multi-agent systems by intercepting and manipulating inter-agencies. |
Don’t Click That: Teaching Web Agents to Resist Deceptive Interfaces (2026.acl-long)
Copied to clipboard
| Challenge: | Existing approaches to deception detection and defenses are inadequate . Existing methods do not integrate with agent decision-making . |
| Approach: | They propose a framework that integrates hybrid-reward learning with asymmetric penalties and experience summarization to distill failure patterns into transferable guidance. |
| Outcome: | The proposed framework reduces deception susceptibility by 53.8% while maintaining task performance, establishing an effective foundation for robust web agent deployment. |
NetSafe: Exploring the Topological Safety of Multi-agent System (2025.findings-acl)
Copied to clipboard
Miao Yu, Shilong Wang, Guibin Zhang, Junyuan Mao, Chenlong Yin, Qijiong Liu, Kun Wang, Qingsong Wen, Yang Wang
| Challenge: | Large language models (LLMs) have fueled significant progress in intelligent Multi-agent Systems (MAS), with expanding academic and industrial applications. |
| Approach: | They propose a framework that unifies diverse MAS workflows via iterative RelCom interactions to enable generalized analysis. |
| Outcome: | The proposed framework unifies diverse MAS workflows via iterative RelCom interactions to enable generalized analysis. |
BadAgent: Inserting and Activating Backdoor Attacks in LLM Agents (2024.acl-long)
Copied to clipboard
| Challenge: | Xi et al., 2023) show that LLM-based intelligent agents are vulnerable to backdoor attacks. |
| Approach: | They propose to build LLM-based intelligent agents using trained LLMs and fine-tune them on data for the agent task. |
| Outcome: | The proposed methods are robust even after fine-tuning on trusted data. |