At a Glance
A game-theoretic controller keeps evolving multi-agent conversation memory stable: it stopped controller-level prompt injections and kept context drift near zero in 99.6% of turns.
ON THIS PAGE
Key Findings
A controller that treats conversation history as a state to be managed—rather than just filtering individual messages—prevents adversarial fragments from quietly corrupting future reasoning. It runs three different language models on the same input, extracts atomic claims, builds a causal graph of supported claims, and picks the answer that scores best on causal grounding, peer agreement, and how much it would change the stored context. When large deviations occur, a rollback-based recovery isolates suspicious fragments and restores a validated checkpoint. Agentic RAG Pattern
Data Highlights
199.6% of interaction turns had near-zero contextual drift (498 of 500 turns).
2Recovery triggered in only 0.4% of turns (2 of 500), with small rollback depth and quarantine sizes.
30% controller-level injection success; selected-output stability (win rates) remained above 98% under the tested attacks.
Implications
Engineers building multi-agent assistants and tool-enabled chat systems should care because persistent context corruption is a real attack vector that standard input filters miss. Security teams and platform architects should consider a trajectory-level controller to protect long-lived conversational memory and maintain reliable agent behavior. Byzantine-Resilient Consensus Pattern
Explore evaluation patternsSee how to apply these findings
Key Figures
Fig 1: Figure 1 : Layered GT-MCP architecture for closed-loop context stabilization. The controller separates validated context from untrusted inflows, coordinates heterogeneous LLM agents, scores candidate outputs using causal consistency, cross-agent agreement, and contextual drift, and updates persistent memory only via validated selections.
Fig 2: Figure 2 : Distribution of selected-output contextual drift across 500 interaction turns.
Fig 3: Figure 3 : Relationship between selected-output contextual drift and utility.
Fig 4: Figure 4 : Utility distribution of selected outputs by agent.
Ready to evaluate your AI agents?
Learn how ReputAgent helps teams build trustworthy AI through systematic evaluation.
Learn MoreYes, But...
Evaluation used a fixed trio of language models and an adaptive-but-limited adversary, so results may change with more varied or coordinated compromises. Structural grounding and agreement are useful proxies but do not guarantee factual correctness when the validated memory itself is incomplete or wrong. The controller adds extra processing (claim extraction, graph maintenance, drift checks), so teams must trade some compute and latency for long-horizon safety. Context Drift
The Details
GT-MCP implements a lightweight control layer that separates validated memory from untrusted inflows, runs three heterogeneous language models on the same query-plus-context, and extracts atomic claims from each candidate answer. Those claims are canonicalized into a causal context graph that records which claims support others and assigns confidence weights. Each candidate is scored on (1) how well its claims are supported by the causal graph, (2) semantic agreement with peer agents, and (3) how much selecting it would shift the persistent context (contextual drift). The controller picks the highest-trust candidate; if drift is too large, a rollback and quarantine mechanism restores a prior checkpoint and isolates low-support fragments. Defense in Depth Pattern Agent Registry Pattern
Need expert guidance?We can help implement this
Credibility Assessment:
Mix of moderate h-index authors (one ~16) and several lower h-index authors; reasonable but not from top labs or venues.