CoChat
Sign Up
PreprintCited by 23Adversarial Robustness in Machine LearningSecurity and Verification in ComputingAccess Control and Trust

A Survey of LLM-Driven AI Agent Communication: Protocols, Security Risks, and Defense Countermeasures

Open access
Kong, Dezhang, Lin, Shi, Xu, Zhenhua, Wang, Zhebo, Li, Minghao, Li, Yufeng, Zhang, Yilun, Peng, Hujin +11 more·2025·arXiv
DOI 10.48550/arxiv.2506.19676arXiv 2506.19676
Open this paper in CoChat — free accountOpen PDF

Abstract

In recent years, Large-Language-Model-driven AI agents have exhibited unprecedented intelligence and adaptability. Nowadays, agents are undergoing a new round of evolution. They no longer act as an isolated island like LLMs. Instead, they start to communicate with diverse external entities, such as other agents and tools, to perform complex tasks. Under this trend, agent communication is regarded as a foundational pillar of the next communication era, and many organizations have intensively begun to design related communication protocols (e.g., Anthropic's MCP and Google's A2A) within the past year. However, this new field exposes significant security hazards, which can cause severe damage to real-world scenarios. To help researchers quickly figure out this promising topic and benefit the future agent communication development, this paper presents a comprehensive survey of agent communication security. More precisely, we present the first clear definition of agent communication. Besides, we propose a framework that categorizes agent communication into three classes and uses a three-layered communication architecture to illustrate how each class works. Next, for each communication class, we dissect related communication protocols and analyze the security risks, illustrating which communication layer the risks arise from. Then, we provide an outlook on the possible defense countermeasures for each risk. In addition, we conduct experiments using MCP and A2A to help readers better understand the novel vulnerabilities brought by agent communication. Finally, we discuss open issues and future directions in this promising research field. We also publish a repository that maintains a list of related papers on https://github.com/theshi-1128/awesome-agent-communication-security.

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

DataCite · 10.48550/arxiv.2506.19676

Cites

2 of 2 references verified0 citation errors · 0 not checkable

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Cites

Flagged first, then by citations

Research works printed but not linked: 330

  1. [3][3] Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, et al. Gpt-4 technical report. arXiv preprint arXiv:2303.08774 , 2023. - · arXiv
  2. [9][9] Amir Alimohammadifar, Suryadipta Majumdar, Taous Madi, Yosr Jarraya, Makan Pourzandi, Lingyu Wang, and Mourad Debbabi. Stealthy probing-based verification (spv): An active approach to defending software defined networks against topology poisoning attacks. In ESORICS , pages 463-484. Springer, 2018. -
  3. [10][10] Meysam Alizadeh, Zeynab Samei, Daria Stetsenko, and Fabrizio Gilardi. Simple prompt injection attacks can leak personal data observed by llm agents during task execution. arXiv preprint arXiv:2506.01055 , 2025. - · arXiv
  4. [11][11] Maryam Amirizaniani, Elias Martin, Tanya Roosta, Aman Chadha, and Chirag Shah. Auditllm: a tool for auditing large language models using multiprobe approach. In Proceedings of the 33rd ACM International Conference on Information and Knowledge Management , pages 51745179, 2024. -
  5. [12][12] Bang An, Shiyue Zhang, and Mark Dredze. Rag llms are not safer: A safety analysis of retrieval-augmented generation for large language models. arXiv preprint arXiv:2504.18041 , 2025. - · arXiv
  6. [14][14] Jeffrey G Andrews, Stefano Buzzi, Wan Choi, Stephen V Hanly, Angel Lozano, Anthony CK Soong, and Jianzhong Charlie Zhang. What will 5g be? IEEE Journal on selected areas in communications , 32(6):10651082, 2014. -
  7. [21][21] Luigi Atzori, Antonio Iera, and Giacomo Morabito. The internet of things: A survey. Computer networks , 54(15):2787-2805, 2010. -
  8. [22][22] Reza Averly, Frazier N Baker, and Xia Ning. Liddia: Language-based intelligent drug discovery agent. arXiv preprint arXiv:2502.13959 , 2025. - · arXiv
  9. [24][24] Zaheed Ahmed Bhuiyan, Salekul Islam, Md Motaharul Islam, ABM Ahasan Ullah, Farha Naz, and Mohammad Shahriar Rahman. On the (in) security of the control plane of sdn architecture: A survey. IEEE Access , 11:91550-91582, 2023. -
  10. [25][25] Daniil A Boiko, Robert MacKnight, Ben Kline, and Gabe Gomes. Autonomous chemical research with large language models. Nature , 624(7992):570-578, 2023. -
  11. [26][26] Tom B Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, et al. Language models are few-shot learners. Advances in neural information processing systems , 33:1877-1901, 2020. -
  12. [27][27] Stefano Calzavara, Riccardo Focardi, Matus Nemec, Alvise Rabitti, and Marco Squarcina. Postcards from the post-http world: Amplification of https vulnerabilities in the web ecosystem. In 2019 IEEE Symposium on Security and Privacy (SP) , pages 281-298. IEEE, 2019. -
  13. [28][28] Li Changjiang, Liang Jiacheng, Cao Bochuan, Chen Jinghui, and Wang Ting. Your agent can defend itself against backdoor attacks. arXiv preprint arXiv:2506.08336 , 2025. - · arXiv
  14. [30][30] Harsh Chaudhari, Giorgio Severi, John Abascal, Matthew Jagielski, Christopher A Choquette-Choo, Milad Nasr, Cristina Nita-Rotaru, and Alina Oprea. Phantom: General trigger attacks on retrieval augmented language generation. arXiv preprint arXiv:2405.20485 , 2024. - · arXiv
  15. [31][31] Banghao Chen, Zhaofeng Zhang, Nicolas Langren´ e, and Shengxin Zhu. Unleashing the potential of prompt engineering in large language models: a comprehensive review. arXiv preprint arXiv:2310.14735 , 2023. - · arXiv
  16. [32][32] Jizhou Chen and Samuel Lee Cong. Agentguard: Repurposing agentic orchestrator for safety evaluation of tool orchestration. arXiv preprint arXiv:2502.09809 , 2025. - · arXiv
  17. [33][33] Junying Chen, Chi Gui, Anningzhe Gao, Ke Ji, Xidong Wang, Xiang Wan, and Benyou Wang. Cod, towards an interpretable medical agent using chain of diagnosis. arXiv preprint arXiv:2407.13301 , 2024. - · arXiv
  18. [34][34] Yongchao Chen, Jacob Arkin, Yang Zhang, Nicholas Roy, and Chuchu Fan. Scalable multi-robot collaboration with large language models: Centralized or decentralized systems? In 2024 IEEE International Conference on Robotics and Automation (ICRA) , pages 4311-4317. IEEE, 2024. -
  19. [35][35] Zhaoling Chen, Xiangru Tang, Gangda Deng, Fang Wu, Jialong Wu, Zhiwei Jiang, Viktor Prasanna, Arman Cohan, and Xingyao Wang. Locagent: Graph-guided llm agents for code localization. arXiv preprint arXiv:2503.09089 , 2025. - · arXiv
  20. [36][36] Zhaorun Chen, Zhen Xiang, Chaowei Xiao, Dawn Song, and Bo Li. Agentpoison: Red-teaming llm agents via poisoning memory or knowledge bases. Advances in Neural Information Processing Systems , 37:130185-130213, 2024. -
  21. [38][38] Jeffrey Yang Fan Chiang, Seungjae Lee, Jia-Bin Huang, Furong Huang, and Yizheng Chen. Why are web ai agents more vulnerable than standalone llms? a security analysis. arXiv preprint arXiv:2502.20383 , 2025. - · arXiv
  22. [39][39] Yuan Chiang, Elvis Hsieh, Chia-Hong Chou, and Janosh Riebesell. Llamp: Large language model made powerful for high-fidelity materials knowledge retrieval and distillation. arXiv preprint arXiv:2401.17244 , 2024. - · arXiv
  23. [40][40] Aakanksha Chowdhery, Sharan Narang, Jacob Devlin, Maarten Bosma, Gaurav Mishra, Adam Roberts, Paul Barham, Hyung Won Chung, Charles Sutton, Sebastian Gehrmann, et al. Palm: Scaling language modeling with pathways. arXiv preprint arXiv:2204.02311 , 2022. - · arXiv
  24. [42][42] Cody Clop and Yannick Teglia. Backdoored retrievers for prompt injection attacks on retrieval augmented generation of large language models. arXiv preprint arXiv:2410.14479 , 2024. - · arXiv
  25. [43][43] Stav Cohen, Ron Bitton, and Ben Nassi. Here comes the ai worm: Unleashing zero-click worms that target genai-powered applications. arXiv preprint arXiv:2403.02817 , 2024. - · arXiv
  26. [47][47] Kourosh Darvish, Marta Skreta, Yuchi Zhao, Naruki Yoshikawa, Sagnik Som, Miroslav Bogdanovic, Yang Cao, Han Hao, Haoping Xu, Al´ an Aspuru-Guzik, et al. Organa: a robotic assistant for automated chemistry experimentation and characterization. Matter , 8(2), 2025. -
  27. [48][48] Nilaksh Das, Madhuri Shanbhogue, Shang-Tse Chen, Fred Hohman, Li Chen, Michael E Kounavis, and Duen Horng Chau. Keeping the bad guys out: Protecting and vaccinating deep learning with jpeg compression. arXiv preprint arXiv:1705.02900 , 2017. - · arXiv
  28. [49][49] Saswat Das, Jameson Sandler, and Ferdinando Fioretto. Disclosure audits for llm agents. arXiv preprint arXiv:2506.10171 , 2025. - · arXiv
  29. [50][50] Gelei Deng, Yi Liu, Yuekang Li, Kailong Wang, Ying Zhang, Zefeng Li, Haoyu Wang, Tianwei Zhang, and Yang Liu. Masterkey: Automated jailbreaking of large language model chatbots. In Proc. ISOC NDSS , 2024. -
  30. [51][51] Gelei Deng, Yi Liu, Kailong Wang, Yuekang Li, Tianwei Zhang, and Yang Liu. Pandora: Jailbreak gpts by retrieval augmented generation poisoning. arXiv preprint arXiv:2402.08416 , 2024. - · arXiv
  31. [52][52] Yihe Deng and Paul Mineiro. Flow-dpo: Improving llm mathematical reasoning through online multi-agent learning. arXiv preprint arXiv:2410.22304 , 2024. - · arXiv
  32. [53][53] Zehang Deng, Yongjian Guo, Changzhou Han, Wanlun Ma, Junwu Xiong, Sheng Wen, and Yang Xiang. Ai agents under threat: A survey of key security challenges and future pathways. ACM Computing Surveys , 57(7):1-36, 2025. -
  33. [55][55] Darshan Deshpande, Varun Gangal, Hersh Mehta, Jitin Krishnan, Anand Kannappan, and Rebecca Qian. Trail: Trace reasoning and agentic issue localization. arXiv preprint arXiv:2505.08638 , 2025. - · arXiv
  34. [56][56] Ethan Dickey and Andres Bejarano. Gaide: A framework for using generative ai to assist in course content development. In 2024 IEEE Frontiers in Education Conference (FIE) , pages 1-9. IEEE, 2024. -
  35. [58][58] Shen Dong, Shaochen Xu, Pengfei He, Yige Li, Jiliang Tang, Tianming Liu, Hui Liu, and Zhen Xiang. A practical memory injection attack against llm agents. arXiv preprint arXiv:2503.03704 , 2025. - · arXiv
  36. [59][59] Lobna Dridi and Mohamed Faten Zhani. Sdn-guard: Dos attacks mitigation in sdn networks. In 2016 5th IEEE International Conference on Cloud Networking (Cloudnet) , pages 212-217. IEEE, 2016. -
  37. [60][60] Hongyi Du, Jiaqi Su, Jisen Li, Lijie Ding, Yingxuan Yang, Peixuan Han, Xiangru Tang, Kunlun Zhu, and Jiaxuan You. Which llm multiagent protocol to choose? arXiv preprint arXiv:2510.17149 , 2025. - · arXiv
  38. [61][61] Yuntao Du, Zitao Li, Bolin Ding, Yaliang Li, Hanshen Xiao, Jingren Zhou, and Ninghui Li. Automated profile inference with language model agents. arXiv preprint arXiv:2505.12402 , 2025. - · arXiv
  39. [62][62] Emmanuel Dumbuya. Personalized learning through artificial intelligence: Revolutionizing education. Available at SSRN 5023248 , 2023. -
  40. [64][64] Sana Ebrahimi, Mohsen Dehghankar, and Abolfazl Asudeh. An adversary-resistant multi-agent llm system via credibility scoring. arXiv preprint arXiv:2505.24239 , 2025. - · arXiv
  41. [65][65] Abul Ehtesham, Aditi Singh, Gaurav Kumar Gupta, and Saket Kumar. A survey of agent interoperability protocols: Model context protocol (mcp), agent communication protocol (acp), agent-to-agent protocol (a2a), and agent network protocol (anp). arXiv preprint arXiv:2505.02279 , 2025. - · arXiv
  42. [67][67] Jeffrey L Elman. Finding structure in time. Cognitive Science , 14(2):179-211, 1990. -
  43. [68][68] Ivan Evtimov, Arman Zharmagambetov, Aaron Grattafiori, Chuan Guo, and Kamalika Chaudhuri. Wasp: Benchmarking web agent security against prompt injection attacks. arXiv preprint arXiv:2504.18575 , 2025. - · arXiv
  44. [69][69] Kevin R Fall and W Richard Stevens. Tcp/ip illustrated , volume 1. Addison-Wesley Professional, 2012. -
  45. [70][70] Falong Fan and Xi Li. Peerguard: Defending multi-agent systems against backdoor attacks through mutual reasoning. arXiv preprint arXiv:2505.11642 , 2025. - · arXiv
  46. [71][71] Junfeng Fang, Zijun Yao, Ruipeng Wang, Haokai Ma, Xiang Wang, and Tat-Seng Chua. We should identify and mitigate third-party safety risks in mcp-powered agent systems. arXiv preprint arXiv:2506.13666 , 2025. - · arXiv
  47. [72][72] George Fatouros, Kostas Metaxas, John Soldatos, and Manos Karathanassis. Marketsenseai 2.0: Enhancing stock analysis through llm agents. arXiv preprint arXiv:2502.00415 , 2025. - · arXiv
  48. [73][73] Jinghao Feng, Qiaoyu Zheng, Chaoyi Wu, Ziheng Zhao, Ya Zhang, Yanfeng Wang, and Weidi Xie. Mˆ 3builder: A multi-agent system for automated machine learning in medical imaging. arXiv preprint arXiv:2502.20301 , 2025. - · arXiv
  49. [74][74] Mohamed Amine Ferrag, Norbert Tihanyi, and Merouane Debbah. From llm reasoning to autonomous ai agents: A comprehensive review. arXiv preprint arXiv:2504.19678 , 2025. - · arXiv
  50. [77][77] Parth Atulbhai Gandhi, Akansha Shukla, David Tayouri, Beni Ifland, Yuval Elovici, Rami Puzis, and Asaf Shabtai. Atag: Ai-agent application threat assessment with attack graphs. arXiv preprint arXiv:2506.02859 , 2025. - · arXiv
  51. [78][78] Ge Gao, Alexey Taymanov, Eduardo Salinas, Paul Mineiro, and Dipendra Misra. Aligning llm agents by learning latent preference from user edits. arXiv preprint arXiv:2404.15269 , 2024. - · arXiv
  52. [79][79] Hang Gao and Yongfeng Zhang. Memory sharing for large language model based agents. arXiv preprint arXiv:2404.09982 , 2024. - · arXiv
  53. [80][80] Kuofeng Gao, Tianyu Pang, Chao Du, Yong Yang, Shu-Tao Xia, and Min Lin. Denial-of-service poisoning attacks against large language models. arXiv preprint arXiv:2410.10760 , 2024. - · arXiv
  54. [81][81] Pengyu Gao, Jinming Zhao, Xinyue Chen, and Long Yilin. An efficient context-dependent memory framework for llm-centric agents. In Proceedings of the 2025 Conference of the Nations of the Americas Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 3: Industry Track) , pages 1055-1069, 2025. -
  55. [82][82] Xiaoxue Gao, Zexin Li, Yiming Chen, Cong Liu, and Haizhou Li. Transferable adversarial attacks against asr. IEEE Signal Processing Letters , 2024. -
  56. [83][83] Yunfan Gao, Yun Xiong, Xinyu Gao, Kangxiang Jia, Jinliu Pan, Yuxi Bi, Yixin Dai, Jiawei Sun, Haofen Wang, and Haofen Wang. Retrievalaugmented generation for large language models: A survey. arXiv preprint arXiv:2312.10997 , 2(1), 2023. - · arXiv
  57. [84][84] Louie Giray. Prompt engineering with chatgpt: a guide for academic writers. Annals of biomedical engineering , 51(12):2629-2633, 2023. -
  58. [86][86] Yichen Gong, Delong Ran, Jinyuan Liu, Conglei Wang, Tianshuo Cong, Anyu Wang, Sisi Duan, and Xiaoyun Wang. Figstep: Jailbreaking large vision-language models via typographic visual prompts. In Proceedings of the AAAI Conference on Artificial Intelligence , volume 39, pages 23951-23959, 2025. -
  59. [90][90] Zhibin Gou, Zhihong Shao, Yeyun Gong, Yelong Shen, Yujiu Yang, Minlie Huang, Nan Duan, and Weizhu Chen. Tora: A tool-integrated reasoning agent for mathematical problem solving. arXiv preprint arXiv:2309.17452 , 2023. - · arXiv
  60. [91][91] Tommaso Green, Martin Gubri, Haritz Puerto, Sangdoo Yun, and Seong Joon Oh. Leaky thoughts: Large reasoning models are not private thinkers. arXiv preprint arXiv:2506.15674 , 2025. - · arXiv
  61. [92][92] Kai Greshake, Sahar Abdelnabi, Shailesh Mishra, Christoph Endres, Thorsten Holz, and Mario Fritz. Not what you've signed up for: Compromising real-world llm-integrated applications with indirect prompt injection. In Proceedings of the 16th ACM Workshop on Artificial Intelligence and Security , pages 79-90, 2023. -
  62. [93][93] Anisha Gunjal, Jihan Yin, and Erhan Bas. Detecting and preventing hallucinations in large vision language models. In Proceedings of the AAAI Conference on Artificial Intelligence , volume 38, pages 1813518143, 2024. -
  63. [94][94] Daya Guo, Dejian Yang, Haowei Zhang, Junxiao Song, Ruoyu Zhang, Runxin Xu, Qihao Zhu, Shirong Ma, Peiyi Wang, Xiao Bi, et al. Deepseek-r1: Incentivizing reasoning capability in llms via reinforcement learning. arXiv preprint arXiv:2501.12948 , 2025. - · arXiv
  64. [95][95] Yongjian Guo, Puzhuo Liu, Wanlun Ma, Zehang Deng, Xiaogang Zhu, Peng Di, Xi Xiao, and Sheng Wen. Systematic analysis of mcp security. arXiv preprint arXiv:2508.12538 , 2025. - · arXiv
  65. [96][96] Zikang Guo, Benfeng Xu, Chiwei Zhu, Wentao Hong, Xiaorui Wang, and Zhendong Mao. Mcp-agentbench: Evaluating real-world language agent performance with mcp-mediated tools. arXiv preprint arXiv:2509.09734 , 2025. - · arXiv
  66. [97][97] Idan Habler, Ken Huang, Vineeth Sai Narajala, and Prashant Kulkarni. Building a secure agentic ai application leveraging a2a protocol. arXiv preprint arXiv:2504.16902 , 2025. - · arXiv
  67. [98][98] Lewis Hammond, Alan Chan, Jesse Clifton, Jason HoelscherObermaier, Akbir Khan, Euan McLean, Chandler Smith, Wolfram Barfuss, Jakob Foerster, Tom´ aˇ s Gavenˇ ciak, et al. Multi-agent risks from advanced ai. arXiv preprint arXiv:2502.14143 , 2025. - · arXiv
  68. [100][100] Shijie Han, Changhai Zhou, Yiqing Shen, Tianning Sun, Yuhua Zhou, Xiaoxia Wang, Zhixiao Yang, Jingshu Zhang, and Hongguang Li. Finsphere: A conversational stock analysis agent equipped with quantitative tools based on real-time database. arXiv preprint arXiv:2501.12399 , 2025. - · arXiv
  69. [101][101] Xuewen Han, Neng Wang, Shangkun Che, Hongyang Yang, Kunpeng Zhang, and Sean Xin Xu. Enhancing investment analysis: Optimizing ai-agent collaboration in financial research. In Proceedings of the 5th ACM International Conference on AI in Finance , pages 538-546, 2024. -
  70. [102][102] Li Hao and other. Drift: Dynamic rule-based defense with injection isolation for securing llm agents. arXiv preprint arXiv:2506.12104 , 2025. - · arXiv
  71. [103][103] Shuyang Hao, Bryan Hooi, Jun Liu, Kai-Wei Chang, Zi Huang, and Yujun Cai. Exploring visual vulnerabilities via multi-loss adversarial search for jailbreaking vision-language models. arXiv preprint arXiv:2411.18000 , 2024. - · arXiv
  72. [104][104] Mohammed Mehedi Hasan, Hao Li, Emad Fallahzadeh, Bram Adams, and Ahmed E Hassan. Model context protocol (mcp) at first glance: Studying the security and maintainability of mcp servers. arXiv preprint arXiv:2506.13538 , 2025. - · arXiv
  73. [105][105] Kostas Hatalis, Despina Christou, Joshua Myers, Steven Jones, Keith Lambert, Adam Amos-Binks, Zohreh Dannenhauer, and Dustin Dannenhauer. Memory matters: The need to improve long-term memory in llm-agents. In Proceedings of the AAAI Symposium Series , volume 2, pages 277-280, 2023. -
  74. [106][106] Feng He, Tianqing Zhu, Dayong Ye, Bo Liu, Wanlei Zhou, and Philip S Yu. The emerged security and privacy of llm agent: A survey with case studies. arXiv preprint arXiv:2407.19354 , 2024. - · arXiv
  75. [107][107] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition , pages 770-778, 2016. -
  76. [108][108] Pengfei He, Zhenwei Dai, Xianfeng Tang, Yue Xing, Hui Liu, Jingying Zeng, Qiankun Peng, Shrivats Agrawal, Samarth Varshney, Suhang Wang, et al. Attention knows whom to trust: Attention-based trust management for llm multi-agent systems. arXiv preprint arXiv:2506.02546 , 2025. - · arXiv
  77. [109][109] Yichen He, Guanhua Huang, Peiyuan Feng, Yuan Lin, Yuchen Zhang, Hang Li, et al. Pasa: An llm agent for comprehensive academic paper search. arXiv preprint arXiv:2501.10120 , 2025. - · arXiv
  78. [110][110] Yifeng He, Ethan Wang, Yuyang Rong, Zifei Cheng, and Hao Chen. Security of ai agents. In 2025 IEEE/ACM International Workshop on Responsible AI Engineering (RAIE) , pages 45-52. IEEE, 2025. -
  79. [111][111] Sepp Hochreiter and J¨ urgen Schmidhuber. Long short-term memory. Neural computation , 9(8):1735-1780, 1997. -
  80. [112][112] Sungmin Hong, Lei Xu, Haopei Wang, and Guofei Gu. Poisoning network visibility in software-defined networks: New attacks and countermeasures. In Ndss , volume 15, pages 8-11, 2015. -
  81. [113][113] Xinyi Hou, Yanjie Zhao, Shenao Wang, and Haoyu Wang. Model context protocol (mcp): Landscape, security threats, and future research directions. arXiv preprint arXiv:2503.23278 , 2025. - · arXiv
  82. [114][114] Zhipeng Hou, Junyi Tang, and Yipeng Wang. Halo: Hierarchical autonomous logic-oriented orchestration for multi-agent llm systems. arXiv preprint arXiv:2505.13516 , 2025. - · arXiv
  83. [115][115] Mengkang Hu, Yao Mu, Xinmiao Yu, Mingyu Ding, Shiguang Wu, Wenqi Shao, Qiguang Chen, Bin Wang, Yu Qiao, and Ping Luo. Treeplanner: Efficient close-loop task planning with large language models. arXiv preprint arXiv:2310.08582 , 2023. - · arXiv
  84. [116][116] Ruida Hu, Chao Peng, Xinchen Wang, and Cuiyun Gao. An llm-based agent for reliable docker environment configuration. arXiv preprint arXiv:2502.13681 , 2025. - · arXiv
  85. [117][117] Zhiqiang Hu, Lei Wang, Yihuai Lan, Wanyu Xu, Ee-Peng Lim, Lidong Bing, Xing Xu, Soujanya Poria, and Roy Ka-Wei Lee. Llm-adapters: An adapter family for parameter-efficient fine-tuning of large language models. arXiv preprint arXiv:2304.01933 , 2023. - · arXiv
  86. [118][118] Dong Huang, Jie M Zhang, Michael Luck, Qingwen Bu, Yuhao Qing, and Heming Cui. Agentcoder: Multi-agent-based code generation with iterative testing and optimisation. arXiv preprint arXiv:2312.13010 , 2023. - · arXiv
  87. [119][119] Jen-tse Huang, Jiaxu Zhou, Tailin Jin, Xuhui Zhou, Zixi Chen, Wenxuan Wang, Youliang Yuan, Maarten Sap, and Michael R Lyu. On the resilience of multi-agent systems with malicious agents. arXiv preprint arXiv:2408.00989 , 2024. - · arXiv
  88. [120][120] Lei Huang, Weijiang Yu, Weitao Ma, Weihong Zhong, Zhangyin Feng, Haotian Wang, Qianglong Chen, Weihua Peng, Xiaocheng Feng, Bing Qin, et al. A survey on hallucination in large language models: Principles, taxonomy, challenges, and open questions. ACM Transactions on Information Systems , 43(2):1-55, 2025. -
  89. [122][122] Andrew Ilyas, Shibani Santurkar, Dimitris Tsipras, Logan Engstrom, Brandon Tran, and Aleksander Madry. Adversarial examples are not bugs, they are features. Advances in neural information processing systems , 32, 2019. -
  90. [123][123] P Vimala Imogen 1 , J Sreenidhi, and V Nivedha. Ai-powered legal documentation assistant. Journal of Artificial Intelligence , 6(2):210226, 2024. -
  91. [124][124] Hakan Inan, Kartikeya Upasani, Jianfeng Chi, Rashi Rungta, Krithika Iyer, Yuning Mao, Michael Tontchev, Qing Hu, Brian Fuller, Davide Testuggine, et al. Llama guard: Llm-based input-output safeguard for human-ai conversations. arXiv preprint arXiv:2312.06674 , 2023. - · arXiv
  92. [125][125] Yoshitaka Inoue, Tianci Song, and Tianfan Fu. Drugagent: Explainable drug repurposing agent with large language model-based reasoning. arXiv preprint arXiv:2408.13378 , 2024. - · arXiv
  93. [126][126] Yoichi Ishibashi and Yoshimasa Nishimura. Self-organized agents: A llm multi-agent framework toward ultra large-scale code generation and optimization. arXiv preprint arXiv:2404.02183 , 2024. - · arXiv
  94. [127][127] Naman Jain, Jaskirat Singh, Manish Shetty, Liang Zheng, Koushik Sen, and Ion Stoica. R2e-gym: Procedural environments and hybrid verifiers for scaling open-weights swe agents. arXiv preprint arXiv:2504.07164 , 2025. - · arXiv
  95. [128][128] Neel Jain, Avi Schwarzschild, Yuxin Wen, Gowthami Somepalli, John Kirchenbauer, Ping-yeh Chiang, Micah Goldblum, Aniruddha Saha, Jonas Geiping, and Tom Goldstein. Baseline defenses for adversarial attacks against aligned language models. arXiv preprint arXiv:2309.00614 , 2023. - · arXiv
  96. [129][129] Shankar Kumar Jeyakumar, Alaa Alameer Ahmad, and Adrian Garret Gabriel. Advancing agentic systems: Dynamic task decomposition, tool integration and evaluation using novel metrics and dataset. In NeurIPS 2024 Workshop on Open-World Agents , 2024. -
  97. [130][130] Hongrui Jia, Jitong Liao, Xi Zhang, Haiyang Xu, Tianbao Xie, Chaoya Jiang, Ming Yan, Si Liu, Wei Ye, and Fei Huang. Osworld-mcp: Benchmarking mcp tool invocation in computer-use agents. arXiv preprint arXiv:2510.24563 , 2025. - · arXiv
  98. [131][131] Changyue Jiang, Xudong Pan, Geng Hong, Chenfu Bao, and Min Yang. Rag-thief: Scalable extraction of private data from retrievalaugmented generation applications with agent-based attacks. arXiv preprint arXiv:2411.14110 , 2024. - · arXiv
  99. [132][132] Changyue Jiang, Xudong Pan, and Min Yang. Think twice before you act: Enhancing agent behavioral safety with thought correction. arXiv preprint arXiv:2505.11063 , 2025. - · arXiv
  100. [133][133] Huihao Jing, Haoran Li, Wenbin Hu, Qi Hu, Heli Xu, Tianshu Chu, Peizhao Hu, and Yangqiu Song. Mcip: Protecting mcp safety via model contextual integrity protocol. arXiv preprint arXiv:2505.14590 , 2025. - · arXiv
  101. [135][135] Matthew Joslin, Neng Li, Shuang Hao, Minhui Xue, and Haojin Zhu. Measuring and analyzing search engine poisoning of linguistic collisions. In 2019 IEEE Symposium on Security and Privacy (SP) , pages 1311-1325. IEEE, 2019. -
  102. [136][136] Tianjie Ju, Yiting Wang, Xinbei Ma, Pengzhou Cheng, Haodong Zhao, Yulong Wang, Lifeng Liu, Jian Xie, Zhuosheng Zhang, and Gongshen Liu. Flooding spread of manipulated knowledge in llm-based multiagent communities. arXiv preprint arXiv:2407.07791 , 2024. - · arXiv
  103. [137][137] Mintong Kang, Chejian Xu, and Bo Li. Advwave: Stealthy adversarial jailbreak attack against large audio-language models. arXiv preprint arXiv:2412.08608 , 2024. - · arXiv
  104. [138][138] Shyam Sundar Kannan, Vishnunandan LN Venkatesh, and ByungCheol Min. Smart-llm: Smart multi-agent robot task planning using large language models. In 2024 IEEE/RSJ International Conference on Intelligent Robots and Systems (IROS) , pages 12140-12147. IEEE, 2024. -
  105. [139][139] Rana Muhammad Shahroz Khan, Zhen Tan, Sukwon Yun, Charles Flemming, and Tianlong Chen. Agents under siege: Breaking pragmatic multi-agent llm systems with optimized prompt attacks. arXiv preprint arXiv:2504.00218 , 2025. - · arXiv
  106. [140][140] Arsham Gholamzadeh Khoee, Shuai Wang, Yinan Yu, Robert Feldt, and Dhasarathy Parthasarathy. Gatelens: A reasoning-enhanced llm agent for automotive software release analytics. arXiv preprint arXiv:2503.21735 , 2025. - · arXiv
  107. [141][141] Tushar Khot, Harsh Trivedi, Matthew Finlayson, Yao Fu, Kyle Richardson, Peter Clark, and Ashish Sabharwal. Decomposed prompting: A modular approach for solving complex tasks. arXiv preprint arXiv:2210.02406 , 2022. - · arXiv
  108. [142][142] Juhee Kim, Woohyuk Choi, and Byoungyoung Lee. Prompt flow integrity to prevent privilege escalation in llm agents. arXiv preprint arXiv:2503.15547 , 2025. - · arXiv
  109. [143][143] Diederik P Kingma and Max Welling. Auto-encoding variational bayes. arXiv preprint arXiv:1312.6114 , 2013. - · arXiv
  110. [144][144] Thomas N Kipf and Max Welling. Semi-supervised classification with graph convolutional networks. arXiv preprint arXiv:1609.02907 , 2016. - · arXiv
  111. [145][145] Ronny Ko, Jiseong Jeong, Shuyuan Zheng, Chuan Xiao, Taewan Kim, Makoto Onizuka, and Wonyong Shin. Seven security challenges that must be solved in cross-domain multi-agent llm systems. arXiv preprint arXiv:2505.23847 , 2025. - · arXiv
  112. [146][146] Dezhang Kong, Xiang Chen, Chunming Wu, Yi Shen, Zhengyan Zhou, Qiumei Cheng, Xuan Liu, Mingliang Yang, Yubing Qiu, Dong Zhang, et al. Rdefender: A lightweight and robust defense against flow table overflow attacks in sdn. IEEE Transactions on Information Forensics and Security , 2024. -
  113. [147][147] Dezhang Kong, Hujin Peng, Yilun Zhang, Lele Zhao, Zhenhua Xu, Shi Lin, Changting Lin, and Meng Han. Web fraud attacks against llmdriven multi-agent systems. arXiv preprint arXiv:2509.01211 , 2025. - · arXiv
  114. [148][148] Dezhang Kong, Yi Shen, Xiang Chen, Qiumei Cheng, Hongyan Liu, Dong Zhang, Xuan Liu, Shuangxi Chen, and Chunming Wu. Combination attacks and defenses on sdn topology discovery. IEEE/ACM Transactions on Networking , 31(2):904-919, 2022. -
  115. [149][149] Diego Kreutz, Fernando MV Ramos, Paulo Esteves Verissimo, Christian Esteve Rothenberg, Siamak Azodolmolky, and Steve Uhlig. Software-defined networking: A comprehensive survey. Proceedings of the IEEE , 103(1):14-76, 2014. -
  116. [150][150] Naveen Krishnan. Advancing multi-agent systems through model context protocol: Architecture, implementation, and applications. arXiv preprint arXiv:2504.21030 , 2025. - · arXiv
  117. [151][151] Alex Krizhevsky, Ilya Sutskever, and Geoffrey E Hinton. Imagenet classification with deep convolutional neural networks. In Advances in neural information processing systems , volume 25, pages 1097-1105, 2012. -
  118. [152][152] Abhinav Kumar, Jaechul Roh, Ali Naseh, Marzena Karpinska, Mohit Iyyer, Amir Houmansadr, and Eugene Bagdasarian. Overthinking: Slowdown attacks on reasoning llms. arXiv preprint arXiv:2502.02542 , 2025. - · arXiv
  119. [153][153] Sonu Kumar, Anubhav Girdhar, Ritesh Patil, and Divyansh Tripathi. Mcp guardian: A security-first layer for safeguarding mcp-based ai system. arXiv preprint arXiv:2504.12757 , 2025. - · arXiv
  120. [154][154] Shrinidhi Kumbhar, Venkatesh Mishra, Kevin Coutinho, Divij Handa, Ashif Iquebal, and Chitta Baral. Hypothesis generation for materials discovery and design using goal-driven and constraint-guided llm agents. arXiv preprint arXiv:2501.13299 , 2025. - · arXiv
  121. [158][158] Hugo Laurenc ¸on, L´ eo Tronchon, Matthieu Cord, and Victor Sanh. What matters when building vision-language models? Advances in Neural Information Processing Systems , 37:87874-87907, 2024. -
  122. [160][160] Yann LeCun, Leon Bottou, Yoshua Bengio, and Patrick Haffner. Gradient-based learning applied to document recognition. Proceedings of the IEEE , 86(11):2278-2324, 1998. -
  123. [161][161] Donghyun Lee and Mo Tiwari. Prompt infection: Llm-to-llm prompt injection within multi-agent systems. arXiv preprint arXiv:2410.07283 , 2024. - · arXiv
  124. [162][162] Jingoo Lee, Kyungho Lim, Young-Chul Jung, and Byung-Hoon Kim. Psyche: A multi-faceted patient simulation framework for evaluation of psychiatric assessment conversational agents. arXiv preprint arXiv:2501.01594 , 2025. - · arXiv
  125. [164][164] Bin Lei, Yi Zhang, Shan Zuo, Ali Payani, and Caiwen Ding. Macm: Utilizing a multi-agent system for condition mining in solving complex mathematical problems. arXiv preprint arXiv:2404.04735 , 2024. - · arXiv
  126. [165][165] Patrick Lewis, Ethan Perez, Aleksandra Piktus, Fabio Petroni, Vladimir Karpukhin, Naman Goyal, Heinrich K¨ uttler, Mike Lewis, Wen-tau Yih, Tim Rockt¨ aschel, et al. Retrieval-augmented generation for knowledgeintensive nlp tasks. Advances in neural information processing systems , 33:9459-9474, 2020. -
  127. [166][166] Enhan Li, Hongyang Du, and Kaibin Huang. Netmcp: Network-aware model context protocol platform for llm capability extension. arXiv preprint arXiv:2510.13467 , 2025. - · arXiv
  128. [168][168] Minghao Li, Wenpeng Xing, Yong Liu, Wei Zhang, and Meng Han. Optimizing and attacking embodied intelligence: Instruction decomposition and adversarial robustness. In 2025 IEEE International Conference on Multimedia and Expo (ICME) , pages 1-6, 2025. -
  129. [169][169] Nian Li, Chen Gao, Mingyu Li, Yong Li, and Qingmin Liao. Econagent: large language model-empowered agents for simulating macroeconomic activities. arXiv preprint arXiv:2310.10436 , 2023. - · arXiv
  130. [170][170] Qiaomu Li and Ying Xie. From glue-code to protocols: A critical analysis of a2a and mcp integration for scalable agent systems. arXiv preprint arXiv:2505.03864 , 2025. - · arXiv
  131. [171][171] Rongchang Li, Minjie Chen, Chang Hu, Han Chen, Wenpeng Xing, and Meng Han. Gentel-safe: A unified benchmark and shielding framework for defending against prompt injection attacks. arXiv preprint arXiv:2409.19521 , 2024. - · arXiv
  132. [172][172] Xinzhe Li. A review of prominent paradigms for llm-based agents: Tool use (including rag), planning, and feedback learning. arXiv preprint arXiv:2406.05804 , 2024. - · arXiv
  133. [173][173] Xuan Li, Zhanke Zhou, Jianing Zhu, Jiangchao Yao, Tongliang Liu, and Bo Han. Deepinception: Hypnotize large language model to be jailbreaker. In Neurips Safe Generative AI Workshop 2024 , 2024. -
  134. [174][174] Yifan Li, Yifan Du, Kun Zhou, Jinpeng Wang, Wayne Xin Zhao, and Ji-Rong Wen. Evaluating object hallucination in large vision-language models. arXiv preprint arXiv:2305.10355 , 2023. - · arXiv
  135. [175][175] Yuanchun Li, Hao Wen, Weijun Wang, Xiangyu Li, Yizhen Yuan, Guohong Liu, Jiacheng Liu, Wenxing Xu, Xiang Wang, Yi Sun, et al. Personal llm agents: Insights and survey about the capability, efficiency and security. arXiv preprint arXiv:2401.05459 , 2024. - · arXiv
  136. [176][176] Zhihao Li, Kun Li, Boyang Ma, Minghui Xu, Yue Zhang, and Xiuzhen Cheng. We urgently need privilege management in mcp: A measurement of api usage in mcp ecosystems. arXiv preprint arXiv:2507.06250 , 2025. - · arXiv
  137. [177][177] Zhoubo Li, Ningyu Zhang, Yunzhi Yao, Mengru Wang, Xi Chen, and Huajun Chen. Unveiling the pitfalls of knowledge editing for large language models. arXiv preprint arXiv:2310.02129 , 2023. - · arXiv
  138. [178][178] Zeyi Liao, Lingbo Mo, Chejian Xu, Mintong Kang, Jiawei Zhang, Chaowei Xiao, Yuan Tian, Bo Li, and Huan Sun. Eia: Environmental injection attack on generalist web agents for privacy leakage. arXiv preprint arXiv:2409.11295 , 2024. - · arXiv
  139. [179][179] Bo Lin, Shangwen Wang, Liqian Chen, and Xiaoguang Mao. Exploring the security threats of knowledge base poisoning in retrieval-augmented code generation. arXiv preprint arXiv:2502.03233 , 2025. - · arXiv
  140. [180][180] Shi Lin, Rongchang Li, Xun Wang, Changting Lin, Wenpeng Xing, and Meng Han. Figure it out: Analyzing-based jailbreak attack on large language models. arXiv preprint arXiv:2407.16205 , 2024. - · arXiv
  141. [181][181] Xinyu Lin, Wenjie Wang, Yongqi Li, Shuo Yang, Fuli Feng, Yinwei Wei, and Tat-Seng Chua. Data-efficient fine-tuning for llm-based recommendation. In Proceedings of the 47th international ACM SIGIR conference on research and development in information retrieval , pages 365-374, 2024. -
  142. [182][182] Aixin Liu, Bei Feng, Bing Xue, Bingxuan Wang, Bochao Wu, Chengda Lu, Chenggang Zhao, Chengqi Deng, Chenyu Zhang, Chong Ruan, et al. Deepseek-v3 technical report. arXiv preprint arXiv:2412.19437 , 2024. - · arXiv
  143. [183][183] Haoyang Liu, Yijiang Li, Jinglin Jian, Yuxuan Cheng, Jianrong Lu, Shuyi Guo, Jinglei Zhu, Mianchen Zhang, Miantong Zhang, and Haohan Wang. Toward a team of ai-made scientists for scientific discovery from gene expression data. arXiv preprint arXiv:2402.12391 , 2024. - · arXiv
  144. [184][184] Pengfei Liu, Weizhe Yuan, Jinlan Fu, Zhengbao Jiang, Hiroaki Hayashi, and Graham Neubig. Pre-train, prompt, and predict: A systematic survey of prompting methods in natural language processing. ACM computing surveys , 55(9):1-35, 2023. -
  145. [185][185] Tong Liu, Yingjie Zhang, Zhe Zhao, Yinpeng Dong, Guozhu Meng, and Kai Chen. Making them ask and answer: Jailbreaking large language models in few queries via disguise and reconstruction. In 33rd USENIX Security Symposium (USENIX Security 24) , pages 4711-4728, 2024. -
  146. [186][186] Xiaogeng Liu, Nan Xu, Muhao Chen, and Chaowei Xiao. Autodan: Generating stealthy jailbreak prompts on aligned large language models. arXiv preprint arXiv:2310.04451 , 2023. - · arXiv
  147. [187][187] Xiaogeng Liu, Zhiyuan Yu, Yizhe Zhang, Ning Zhang, and Chaowei Xiao. Automatic and universal prompt injection attacks against large language models. arXiv preprint arXiv:2403.04957 , 2024. - · arXiv
  148. [188][188] Yi Liu, Gelei Deng, Yuekang Li, Kailong Wang, Zihao Wang, Xiaofeng Wang, Tianwei Zhang, Yepang Liu, Haoyu Wang, Yan Zheng, et al. Prompt injection attack against llm-integrated applications. arXiv preprint arXiv:2306.05499 , 2023. - · arXiv
  149. [189][189] Yi Liu, Gelei Deng, Zhengzi Xu, Yuekang Li, Yaowen Zheng, Ying Zhang, Lida Zhao, Tianwei Zhang, and Yang Liu. Jailbreaking chatgpt via prompt engineering: An empirical study. arXiv preprint arXiv:2305.13860 , 2023. - · arXiv
  150. [190][190] Yupei Liu, Yuqi Jia, Runpeng Geng, Jinyuan Jia, and Neil Zhenqiang Gong. Formalizing and benchmarking prompt injection attacks and defenses. In 33rd USENIX Security Symposium (USENIX Security 24) , pages 1831-1847, 2024. -
  151. [191][191] Ziwen Liu, Jian Mao, Jun Zeng, Jiawei Li, Qixiao Lin, Jiahao Liu, Jianwei Zhuge, and Zhenkai Liang. Provguard: Detecting sdn control policy manipulation via contextual semantics of provenance graphs. In NDSS , 2025. -
  152. [192][192] Yedidel Louck, Ariel Stulman, and Amit Dvir. Proposal for improving google a2a protocol: Safeguarding sensitive data in multi-agent systems. arXiv preprint arXiv:2505.12490 , 2025. - · arXiv
  153. [193][193] Jiarui Lu, Thomas Holleis, Yizhe Zhang, Bernhard Aumayer, Feng Nan, Felix Bai, Shuang Ma, Shen Ma, Mengyu Li, Guoli Yin, et al. Toolsandbox: A stateful, conversational, interactive evaluation benchmark for llm tool use capabilities. arXiv preprint arXiv:2408.04682 , 2024. - · arXiv
  154. [194][194] Yuxuan Lu, Bingsheng Yao, Hansu Gu, Jing Huang, Jessie Wang, Yang Li, Jiri Gesi, Qi He, Toby Jia-Jun Li, and Dakuo Wang. Uxagent: An llm agent-based usability testing framework for web design. arXiv preprint arXiv:2502.12561 , 2025. - · arXiv
  155. [195][195] Huijie Lv, Xiao Wang, Yuansen Zhang, Caishuang Huang, Shihan Dou, Junjie Ye, Tao Gui, Qi Zhang, and Xuanjing Huang. Codechameleon: Personalized encryption framework for jailbreaking large language models. arXiv preprint arXiv:2402.16717 , 2024. - · arXiv
  156. [196][196] Siyuan Ma, Weidi Luo, Yu Wang, and Xiaogeng Liu. Visual-roleplay: Universal jailbreak attack on multimodal large language models via role-playing image character. arXiv preprint arXiv:2405.20773 , 2024. - · arXiv
  157. [197][197] Yingzi Ma, Yulong Cao, Jiachen Sun, Marco Pavone, and Chaowei Xiao. Dolphins: Multimodal language model for driving. In European Conference on Computer Vision , pages 403-420. Springer, 2024. -
  158. [198][198] Adyasha Maharana, Dong-Ho Lee, Sergey Tulyakov, Mohit Bansal, Francesco Barbieri, and Yuwei Fang. Evaluating very long-term conversational memory of llm agents. arXiv preprint arXiv:2402.17753 , 2024. - · arXiv
  159. [199][199] Wuyuao Mai, Geng Hong, Pei Chen, Xudong Pan, Baojun Liu, Yuan Zhang, Haixin Duan, and Min Yang. You can't eat your cake and have it too: The performance degradation of llms with jailbreak defense. In Proceedings of the ACM on Web Conference 2025 , pages 872-883, 2025. -
  160. [200][200] Subhankar Maity and Aniket Deroy. Generative ai and its impact on personalized intelligent tutoring systems. arXiv preprint arXiv:2410.10650 , 2024. - · arXiv
  161. [201][201] Zhao Mandi, Shreeya Jain, and Shuran Song. Roco: Dialectic multirobot collaboration with large language models. In 2024 IEEE International Conference on Robotics and Automation (ICRA) , pages 286-299. IEEE, 2024. -
  162. [202][202] Jiageng Mao, Junjie Ye, Yuxi Qian, Marco Pavone, and Yue Wang. A language agent for autonomous driving. arXiv preprint arXiv:2311.10813 , 2023. - · arXiv
  163. [203][203] Junyuan Mao, Fanci Meng, Yifan Duan, Miao Yu, Xiaojun Jia, Junfeng Fang, Yuxuan Liang, Kun Wang, and Qingsong Wen. Agentsafe: Safeguarding large language model-based multi-agent systems via hierarchical data management. arXiv preprint arXiv:2503.04392 , 2025. - · arXiv
  164. [204][204] Ayman Maqsood, Chen Chen, and T Jesper Jacobsson. The future of material scientists in an age of artificial intelligence. Advanced Science , 11(19):2401401, 2024. -
  165. [205][205] Samuele Marro, Emanuele La Malfa, Jesse Wright, Guohao Li, Nigel Shadbolt, Michael Wooldridge, and Philip Torr. A scalable communication protocol for networks of large language models. arXiv preprint arXiv:2410.11905 , 2024. - · arXiv
  166. [206][206] Lauren Martin, Nick Whitehouse, Stephanie Yiu, Lizzie Catterson, and Rivindu Perera. Better call gpt, comparing large language models against lawyers. arXiv preprint arXiv:2401.16212 , 2024. - · arXiv
  167. [208][208] Sudhanshu Maurya, Arnav Kotiyal, Pankaj Prusty, Nilesh Shelke, Abhishek Bhattacherjee, and Tiyas Sarkar. Optimizing npc behavior in video games using unity ml-agents: A reinforcement learningbased approach. In 2025 3rd International Conference on Disruptive Technologies (ICDT) , pages 1601-1606. IEEE, 2025. -
  168. [209][209] Mantas Mazeika, Long Phan, Xuwang Yin, Andy Zou, Zifan Wang, Norman Mu, Elham Sakhaee, Nathaniel Li, Steven Basart, Bo Li, et al. Harmbench: A standardized evaluation framework for automated red teaming and robust refusal. arXiv preprint arXiv:2402.04249 , 2024. - · arXiv
  169. [210][210] Bertalan Mesk´ o. Prompt engineering as an important emerging skill for medical professionals: tutorial. Journal of medical Internet research , 25:e50638, 2023. -
  170. [211][211] Guozhao Mo, Wenliang Zhong, Jiawei Chen, Xuanang Chen, Yaojie Lu, Hongyu Lin, Ben He, Xianpei Han, and Le Sun. Livemcpbench: Can agents navigate an ocean of mcp tools? arXiv preprint arXiv:2508.01780 , 2025. - · arXiv
  171. [212][212] Kanghua Mo, Li Hu, Yucheng Long, and Zhihao Li. Attractive metadata attack: Inducing llm agents to invoke malicious tools. arXiv preprint arXiv:2508.02110 , 2025. - · arXiv
  172. [213][213] Jakob M¨ okander, Jonas Schuett, Hannah Rose Kirk, and Luciano Floridi. Auditing large language models: a three-layered approach. AI and Ethics , 4(4):1085-1115, 2024. -
  173. [214][214] Moritz M¨ oller, Gargi Nirmal, Dario Fabietti, Quintus Stierstorfer, Mark Zakhvatkin, Holger Sommerfeld, and Sven Sch¨ utt. Revolutionising distance learning: A comparative study of learning progress with aidriven tutoring. arXiv preprint arXiv:2403.14642 , 2024. - · arXiv
  174. [215][215] Vineeth Sai Narajala, Ken Huang, and Idan Habler. Securing genai multi-agent systems against tool squatting: A zero trust registry-based approach. arXiv preprint arXiv:2504.19951 , 2025. - · arXiv
  175. [218][218] Imran Nasim. Governance in agentic workflows: Leveraging llms as oversight agents. In AAAI 2025 Workshop on AI Governance: Alignment, Morality, and Law , 2025. -
  176. [219][219] Humza Naveed, Asad Ullah Khan, Shi Qiu, Muhammad Saqib, Saeed Anwar, Muhammad Usman, Naveed Akhtar, Nick Barnes, and Ajmal Mian. A comprehensive overview of large language models. ACM Transactions on Intelligent Systems and Technology , 16(5):1-72, 2025. -
  177. [220][220] Fatemeh Nazary, Yashar Deldjoo, and Tommaso di Noia. Poison-rag: Adversarial data poisoning attacks on retrieval-augmented generation in recommender systems. In European Conference on Information Retrieval , pages 239-251. Springer, 2025. -
  178. [221][221] Weili Nie, Brandon Guo, Yujia Huang, Chaowei Xiao, Arash Vahdat, and Anima Anandkumar. Diffusion models for adversarial purification. arXiv preprint arXiv:2205.07460 , 2022. - · arXiv
  179. [223][223] Izunna Okpala, Ashkan Golgoon, and Arjun Ravi Kannan. Agentic ai systems applied to tasks in financial services: Modeling and model risk management crews. arXiv preprint arXiv:2502.05439 , 2025. - · arXiv
  180. [226][226] Joshua Owotogbe. Assessing and enhancing the robustness of llmbased multi-agent systems through chaos engineering. arXiv preprint arXiv:2505.03096 , 2025. - · arXiv
  181. [228][228] Melissa Z Pan, Mert Cemri, Lakshya A Agrawal, Shuyi Yang, Bhavya Chopra, Rishabh Tiwari, Kurt Keutzer, Aditya Parameswaran, Kannan Ramchandran, Dan Klein, et al. Why do multiagent systems fail? In ICLR 2025 Workshop on Building Trust in Language Models and Applications , 2025. -
  182. [229][229] Ioannis Papadimitriou, Ilias Gialampoukidis, Stefanos Vrochidis, and Ioannis Kompatsiaris. Ai methods in materials design, discovery and manufacturing: A review. Computational Materials Science , 235:112793, 2024. -
  183. [231][231] Dario Pasquini, Evgenios M. Kornaropoulos, and Giuseppe Ateniese. LLMmap: Fingerprinting for Large Language Models. In Proceedings of the 34th { USENIX } Security Symposium , pages 299-318. { USENIX } Association. -
  184. [232][232] Hammond Pearce, Baleegh Ahmad, Benjamin Tan, Brendan DolanGavitt, and Ramesh Karri. Asleep at the keyboard? assessing the security of github copilot's code contributions. Communications of the ACM , 68(2):96-105, 2025. -
  185. [233][233] Keqin Peng, Liang Ding, Qihuang Zhong, Li Shen, Xuebo Liu, Min Zhang, Yuanxin Ouyang, and Dacheng Tao. Towards making the most of chatgpt for machine translation. arXiv preprint arXiv:2303.13780 , 2023. - · arXiv
  186. [234][234] F´ abio Perez and Ian Ribeiro. Ignore previous prompt: Attack techniques for language models. arXiv preprint arXiv:2211.09527 , 2022. - · arXiv
  187. [235][235] Samuele Poppi, Tobia Poppi, Federico Cocchi, Marcella Cornia, Lorenzo Baraldi, and Rita Cucchiara. Safe-clip: Removing nsfw concepts from vision-and-language models. In European Conference on Computer Vision , pages 340-356. Springer, 2024. -
  188. [236][236] Chengwei Qin, Aston Zhang, Zhuosheng Zhang, Jiaao Chen, Michihiro Yasunaga, and Diyi Yang. Is chatgpt a general-purpose natural language processing task solver? arXiv preprint arXiv:2302.06476 , 2023. - · arXiv
  189. [237][237] Yao Qin, Nicholas Carlini, Garrison Cottrell, Ian Goodfellow, and Colin Raffel. Imperceptible, robust, and targeted adversarial examples for automatic speech recognition. In International conference on machine learning , pages 5231-5240. PMLR, 2019. -
  190. [238][238] Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural language supervision. In International conference on machine learning , pages 8748-8763. PmLR, 2021. -
  191. [239][239] Alec Radford, Luke Metz, and Soumith Chintala. Unsupervised representation learning with deep convolutional generative adversarial networks. arXiv preprint arXiv:1511.06434 , 2015. - · arXiv
  192. [240][240] Brandon Radosevich and John Halloran. Mcp safety audit: Llms with the model context protocol allow major security exploits. arXiv preprint arXiv:2504.03767 , 2025. - · arXiv
  193. [241][241] Lokman Rahmani, David Minarsch, and Jonathan Ward. Peer-to-peer autonomous agent communication network. In Proceedings of the 20th International Conference on Autonomous Agents and MultiAgent Systems , AAMAS '21, page 1037-1045, Richland, SC, 2021. International Foundation for Autonomous Agents and Multiagent Systems. -
  194. [242][242] Rajesh Ranjan, Shailja Gupta, and Surya Narayan Singh. Loka protocol: A decentralized framework for trustworthy and ethical ai agent ecosystems. arXiv preprint arXiv:2504.10915 , 2025. - · arXiv
  195. [243][243] Charvi Rastogi, Marco Tulio Ribeiro, Nicholas King, Harsha Nori, and Saleema Amershi. Supporting human-ai collaboration in auditing llms with llms. In Proceedings of the 2023 AAAI/ACM Conference on AI, Ethics, and Society , pages 913-926, 2023. -
  196. [244][244] Partha Pratim Ray. A review on agent-to-agent protocol: Concept, state-of-the-art, challenges and future directions. Authorea Preprints , 2025. -
  197. [246][246] Matthew Renze and Erhan Guven. Self-reflection in llm agents: Effects on problem-solving performance. arXiv preprint arXiv:2405.06682 , 2024. - · arXiv
  198. [249][249] Jaechul Roh, Virat Shejwalkar, and Amir Houmansadr. Multilingual and multi-accent jailbreaking of audio llms. arXiv preprint arXiv:2504.01094 , 2025. - · arXiv
  199. [250][250] Daniel Rose, Chia-Chien Hung, Marco Lepri, Israa Alqassem, Kiril Gashteovski, and Carolin Lawrence. Meddxagent: A unified modular agent framework for explainable automatic differential diagnosis. arXiv preprint arXiv:2502.19175 , 2025. - · arXiv
  200. [251][251] Yixiang Ruan, Chenyin Lu, Ning Xu, Yuchen He, Yixin Chen, Jian Zhang, Jun Xuan, Jianzhang Pan, Qun Fang, Hanyu Gao, et al. An automatic end-to-end chemical synthesis development platform powered by large language models. Nature communications , 15(1):10160, 2024. -

200 of 330 shown

Cited by

Sorted by citations

Authors
Kong, D., Lin, S., Xu, Z., Wang, Z., Li, M., Li, Y., Zhang, Y., Peng, H., Chen, X., Sha, Z., Li, Y., Lin, C., Wang, X., Liu, X., Zhang, N., Chen, C., Wu, C., Khan, M. K., & Han, M.
Affiliations
Zhejiang University (CN)
ORCID
Venue
arXiv
Publisher
arXiv
Published
2025
ISSN
2331-8422 (ISSN-L)
DOI
10.48550/arxiv.2506.19676
arXiv
2506.19676
OpenAlex
W4416525356
Cited by
23
References
2
Citations by year
2026: 18 · 2025: 5
Type
posted content
Language
en
Open access
Licence
arxiv.org/licenses/nonexclusive-distrib/1.0/
Locations
  • arXiv (Cornell University) (submittedVersion)
  • arXiv (Cornell University)
Topics
  • Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
  • Physical Sciences › Computer Science › Artificial Intelligence › Security and Verification in Computing
  • Social Sciences › Sociology and Political Science › Access Control and Trust
Keywords
large language models, agent communication protocols, security risks, communication architecture, multi-agent systems, tool use

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review