At a Glance
Treat 'infected' agents—benign agents that were misled—as a separate threat class; detecting and repairing them cuts attack success by about 4.5% on average and up to 12.9%.
ON THIS PAGE
What They Found
Malicious messages can convert otherwise-good agents into persistent spreaders of bad information; removing only the original attacker is not enough. Modeling infection as a dynamic process and using the communication graph helps spot both attackers and infected agents early. By replacing attackers and repairing infected agents, systems keep collaboration intact while substantially reducing successful attacks. Across tests, infection-aware defense outperforms baselines on multiple attack types and topologies.
Key Data
1Average reduction in Attack Success Rate (ASR) of 4.5% versus baselines, with gains up to 12.9% in some scenarios.
2Leaving infected agents unhandled raises ASR@3 by 11% for memory attacks and by 30% for tool-based attacks.
3Attack effects grow over rounds: ASR increased by 5% (tool attacks) and 7% (memory attacks) from iteration 1 to iteration 3 when infections were allowed to spread.
Implications
Engineers building cooperative AI agents should care because a single compromised agent can poison many collaborators; adding infection-aware checks reduces systemic failure. Technical leaders and SREs running multi-agent deployments can use these detections to prioritize which agents to replace versus which to repair, keeping team behavior diverse and usable. Researchers tracking multi-agent trust will get a practical way to evaluate agent-to-agent risk propagation.
Need expert guidance?We can help implement this
Key Figures
Fig 1: Figure 1: The paradigm comparison between existing MAS safeguards and our infection-aware safeguard.
Fig 2: Figure 2: Infected agents significantly increase security risks in MAS. Legends , , represent no defense, defending attack agents, and defending attack and infected agents, respectively.
Fig 3: Figure 3: An overview of our proposed method INFA-Guard .
Fig 4: Figure 4: Task-level systematic performance of MAS across successive dialogue iterations. AgentXposed-G and -K represent AgentXposed-Guide and -Kick.
Ready to evaluate your AI agents?
Learn how ReputAgent helps teams build trustworthy AI through systematic evaluation.
Learn MoreYes, But...
The method depends on labeled or synthesized training data, which can be costly or hard to obtain in new domains. It is a run-time defense that requires observing at least one dialogue round, so it does not prevent an initial single-step compromise. Performance may vary with graph visibility and the quality of message embeddings, and false positives could disrupt benign agents if thresholds are not tuned.
Methodology & More
In multi-agent AI teams, attacks spread when a malicious agent persuades others; those persuaded agents become “infected” and continue to propagate incorrect or malicious outputs even after the original attacker is removed. INFA-Guard treats infected agents as a separate, important threat class. It builds time-aware embeddings of each agent’s messages and the messages exchanged between agents, then uses a graph-based detection network with turn-specific branches to capture how agents’ behavior drifts over rounds. A dual-head classifier flags both originating attackers and infected agents, while a topology-aware loss leverages neighborhood structure to improve localization.
For remediation, INFA-Guard replaces identified attackers and refines infected agents (repairing their state) rather than simply cutting them off, preserving the team’s ability to collaborate. Evaluations used three attack types—prompt injection, tool-based attacks, and memory poisoning—across different network shapes. Results show average ASR reductions of 4.5% (up to 12.9% in the best cases) and demonstrate that leaving infected agents unhandled can increase attack success by double-digit percentages. The approach is practical for production monitoring of multi-agent systems, but requires at least one turn of observed dialogue and curated training signals to reach peak performance.
Need expert guidance?We can help implement this
Credibility Assessment:
Authors show low h-indices and no clear top-tier affiliations; arXiv preprint with no citations.