CoChat
Sign Up
PreprintCited by 2Adversarial Robustness in Machine LearningPrivacy-Preserving Technologies in DataAccess Control and Trust

BlindGuard: Safeguarding LLM-based Multi-Agent Systems under Unknown Attacks

Open access
Miao, Rui, Liu, Yixin, Wang, Yili, Shen, Xu, Tan, Yue, Dai, Yiwei, Pan, Shirui, Wang, Xin·2025·arXiv
DOI 10.48550/arxiv.2508.08127arXiv 2508.08127
Open this paper in CoChat — free accountOpen PDF

Abstract

The security of LLM-based multi-agent systems (MAS) is critically threatened by propagation vulnerability, where malicious agents can distort collective decision-making through inter-agent message interactions. While existing supervised defense methods demonstrate promising performance, they may be impractical in real-world scenarios due to their heavy reliance on labeled malicious agents to train a supervised malicious detection model. To enable practical and generalizable MAS defenses, in this paper, we propose BlindGuard, an unsupervised defense method that learns without requiring any attack-specific labels or prior knowledge of malicious behaviors. To this end, we establish a hierarchical agent encoder to capture individual, neighborhood, and global interaction patterns of each agent, providing a comprehensive understanding for malicious agent detection. Meanwhile, we design a corruption-guided detector that consists of directional noise injection and contrastive learning, allowing effective detection model training solely on normal agent behaviors. Extensive experiments show that BlindGuard effectively detects diverse attack types (i.e., prompt injection, memory poisoning, and tool attack) across MAS with various communication patterns while maintaining superior generalizability compared to supervised baselines. The code is available at: https://github.com/MR9812/BlindGuard.

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

DataCite · 10.48550/arxiv.2508.08127

Cites

3 of 3 references verified0 citation errors · 0 not checkable

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Cites

Flagged first, then by citations

Research works printed but not linked: 47

  1. Maksym Andriushchenko, Alexandra Souly, Mateusz Dziemian, Derek Duenas, Maxwell Lin, Justin Wang, Dan Hendrycks, Andy Zou, J Zico Kolter, Matt Fredrikson, and 1 others. 2025. Agentharm: A bench- mark for measuring harmfulness of llm agents. In The Thirteenth International Conference on Learning Representations.
  2. Jinhe Bi, Danqi Yan, Yifan Wang, Wenke Huang, Haokun Chen, Guancheng Wan, Mang Ye, Xun Xiao, Hinrich Schuetze, Volker Tresp, and 1 others. 2025. Cot-kinetics: A theoretical modeling assessing lrm reasoning process. arXiv preprint arXiv:2505.13408. · arXiv
  3. Zhaorun Chen, Zhen Xiang, Chaowei Xiao, Dawn Song, and Bo Li. 2024. Agentpoison: Red-teaming llm agents via poisoning memory or knowledge bases. Advances in Neural Information Processing Systems, 37:130185-130213.
  4. Karl Cobbe, Vineet Kosaraju, Mohammad Bavarian, Mark Chen, Heewoo Jun, Lukasz Kaiser, Matthias Plappert, Jerry Tworek, Jacob Hilton, Reiichiro Nakano, and 1 others. 2021. Training verifiers to solve math word problems. arXiv preprint arXiv:2110.14168. · arXiv
  5. Kaize Ding, Jundong Li, Rohit Bhanushali, and Huan Liu. 2019. Deep anomaly detection on attributed networks. In Proceedings of the 2019 SIAM inter- national conference on data mining, pages 594-602.
  6. Taicheng Guo, Xiuying Chen, Yaqi Wang, Ruidi Chang, Shichao Pei, Nitesh V Chawla, Olaf Wiest, and Xi- angliang Zhang. 2024. Large language model based multi-agents: A survey of progress and challenges. arXiv preprint arXiv:2402.01680. · arXiv
  7. Pengfei He, Zhenwei Dai, Xianfeng Tang, Yue Xing, Hui Liu, Jingying Zeng, Qiankun Peng, Shrivats Agrawal, Samarth Varshney, Suhang Wang, and 1 oth- ers. 2025. Attention knows whom to trust: Attention- based trust management for llm multi-agent systems. arXiv preprint arXiv:2506.02546. · arXiv
  8. Dan Hendrycks, Collin Burns, Steven Basart, Andy Zou, Mantas Mazeika, Dawn Song, and Jacob Steinhardt. 2021. Measuring massive multitask language under- standing. In International Conference on Learning Representations.
  9. Xingyue Huang, Rishabh, Gregor Franke, Ziyi Yang, Jiamu Bai, Weijie Bai, Jinhe Bi, Zifeng Ding, Yiqun Duan, Chengyu Fan, Wendong Fan, Xin Gao, Ruohao Guo, Yuan He, Zhuangzhuang He, Xianglong Hu, Neil Johnson, Bowen Li, Fangru Lin, and 27 others. 2025. Loong: Synthesize long chain-of-thoughts at scale through verifiers. Preprint, arXiv:2509.03059. · arXiv
  10. Prannay Khosla, Piotr Teterwak, Chen Wang, Aaron Sarna, Yonglong Tian, Phillip Isola, Aaron Maschinot, Ce Liu, and Dilip Krishnan. 2020. Su- pervised contrastive learning. Advances in neural information processing systems, 33:18661-18673.
  11. Yubin Kim, Chanwoo Park, Hyewon Jeong, Yik S Chan, Xuhai Xu, Daniel McDuff, Hyeonhoon Lee, Marzyeh Ghassemi, Cynthia Breazeal, and Hae W Park. 2024. Mdagents: An adaptive collaboration of llms for med- ical decision-making. Advances in Neural Informa- tion Processing Systems, 37:79410-79452.
  12. Thomas N. Kipf and Max Welling. 2017. Semi- Supervised Classification with Graph Convolutional Networks. In Proceedings of the 5th International Conference on Learning Representations.
  13. Bin Lei, Yi Zhang, Shan Zuo, Ali Payani, and Caiwen Ding. 2024. Macm: Utilizing a multi-agent system for condition mining in solving complex mathemati- cal problems. Advances in Neural Information Pro- cessing Systems, 37:53418-53437.
  14. Shiyuan Li, Yixin Liu, Qingfeng Chen, Geoffrey I Webb, and Shirui Pan. 2024a. Noise-resilient unsupervised graph representation learning via multi-hop feature quality estimation. In Proceedings of the 33rd ACM International Conference on Information and Knowl- edge Management, pages 1255-1265.
  15. Shiyuan Li, Yixin Liu, Qingsong Wen, Chengqi Zhang, and Shirui Pan. 2026a. Assemble your crew: Auto- matic multi-agent communication topology design via autoregressive graph generation. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 40, pages 23142-23150.
  16. Shiyuan Li, Yixin Liu, Yu Zheng, Mei Li, Quoc Viet Hung Nguyen, and Shirui Pan. 2026b. OFA- MAS: One-for-all multi-agent system topology de- sign based on mixture-of-experts graph generative models. In Proceedings of the ACM Web Conference.
  17. Xinyi Li, Sai Wang, Siqi Zeng, Yu Wu, and Yi Yang. 2024b. A survey on llm-based multi-agent sys- tems: workflow, infrastructure, and challenges. Vici- nagearth, 1(1):9.
  18. Yunxuan Li, Yibing Du, Jiageng Zhang, Le Hou, Pe- ter Grabowski, Yeqing Li, and Eugene Ie. 2024c. Improving multi-agent debate with sparse commu- nication topology. In Findings of the Association for Computational Linguistics: EMNLP 2024, pages 7281-7294.
  19. Aixin Liu, Bei Feng, Bing Xue, Bingxuan Wang, Bochao Wu, Chengda Lu, Chenggang Zhao, Chengqi Deng, Chenyu Zhang, Chong Ruan, and 1 others. 2024. Deepseek-v3 technical report. arXiv preprint arXiv:2412.19437. · arXiv
  20. Yixin Liu, Shiyuan Li, Yu Zheng, Qingfeng Chen, Chengqi Zhang, Philip S Yu, and Shirui Pan. 2026a. From few-shot to zero-shot: Towards gen- eralist graph anomaly detection. arXiv preprint arXiv:2602.18793. · arXiv
  21. Yixin Liu, Zhao Li, Shirui Pan, Chen Gong, Chuan Zhou, and George Karypis. 2021. Anomaly detection on attributed networks via contrastive self-supervised learning. IEEE transactions on neural networks and learning systems, 33(6):2378-2392.
  22. Yixin Liu, Guibin Zhang, Kun Wang, Shiyuan Li, and Shirui Pan. 2026b. Graph-augmented large language model agents: Current progress and future prospects. IEEE Intelligent Systems.
  23. Rongrong Ma, Guansong Pang, Ling Chen, and Anton Van Den Hengel. 2022. Deep graph-level anomaly detection by glocal knowledge distillation. In Pro- ceedings of the fifteenth ACM international confer- ence on web search and data mining, pages 704-714.
  24. Rui Miao, Kaixiong Zhou, Yili Wang, Ninghao Liu, Ying Wang, and Xin Wang. 2024. Rethinking inde- pendent cross-entropy loss for graph-structured data. In Proceedings of the 41st International Conference on Machine Learning, volume 235, pages 35570- 35589.
  25. PMLR.
  26. Fatemeh Nazary, Yashar Deldjoo, and Tommaso di Noia. 2025. Poison-rag: Adversarial data poisoning attacks on retrieval-augmented generation in recommender systems. In European Conference on Information Retrieval, pages 239-251. Springer.
  27. Junjun Pan, Yixin Liu, Xin Zheng, Yizhen Zheng, Alan Wee-Chung Liew, Fuyi Li, and Shirui Pan. 2025a. A label-free heterophily-guided approach for unsu- pervised graph fraud detection. In Proceedings of the AAAI Conference on Artificial Intelligence, vol- ume 39, pages 12443-12451.
  28. Junjun Pan, Yixin Liu, Yizhen Zheng, and Shirui Pan. 2023. Prem: A simple yet effective approach for node-level graph anomaly detection. In 2023 IEEE International Conference on Data Mining (ICDM), pages 1253-1258. IEEE.
  29. Junjun Pan, Yixin Liu, Chuan Zhou, Fei Xiong, Alan Wee-Chung Liew, and Shirui Pan. 2026b. Correcting false alarms from unseen: Adapting graph anomaly detectors at test time. In Proceedings of the AAAI Conference on Artificial Intelligence.
  30. Junjun Pan, Yu Zheng, Yue Tan, and Yixin Liu. 2025b. A survey of generalization of graph anomaly detec- tion: From transfer learning to foundation models. In The 16th IEEE International Conference on Knowl- edge Graphs.
  31. Chen Qian, Wei Liu, Hongzhang Liu, Nuo Chen, Yufan Dang, Jiahao Li, Cheng Yang, Weize Chen, Yusheng Su, Xin Cong, and 1 others. 2023. Chatdev: Com- municative agents for software development. arXiv preprint arXiv:2307.07924. · arXiv
  32. Yanyu Qian, Yue Tan, Yixin Liu, Wang Yu, and Shirui Pan. 2026. Dynhd: Hallucination detection for diffu- sion large language models via denoising dynamics deviation learning. arXiv preprint arXiv:2603.16459. · arXiv
  33. Hezhe Qiao and Guansong Pang. 2023. Truncated affin- ity maximization: One-class homophily modeling for graph anomaly detection. Advances in Neural Information Processing Systems, 36:49490-49512.
  34. Hezhe Qiao, Hanghang Tong, Bo An, Irwin King, Charu Aggarwal, and Guansong Pang. 2024. Deep graph anomaly detection: A survey and new perspectives. arXiv preprint arXiv:2409.09957. · arXiv
  35. Nils Reimers and Iryna Gurevych. 2019. Sentence-bert: Sentence embeddings using siamese bert-networks. arXiv preprint arXiv:1908.10084. · arXiv
  36. Xu Shen, Yixin Liu, Yiwei Dai, Yili Wang, Rui Miao, Yue Tan, Shirui Pan, and Xin Wang. 2025a. Un- derstanding the information propagation effects of communication topologies in llm-based multi-agent systems. In Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing, pages 12358-12372.
  37. Xu Shen, Song Wang, Zhen Tan, Laura Yao, Xinyu Zhao, Kaidi Xu, Xin Wang, and Tianlong Chen. 2025b. Faithcot-bench: Benchmarking instance- level faithfulness of chain-of-thought reasoning. arXiv preprint arXiv:2510.04040. · arXiv
  38. Xu Shen, Qi Zhang, Song Wang, Zhen Tan, Xinyu Zhao, Laura Yao, Vaishnav Tadiparthi, Hos- sein Nourkhiz Mahjoub, Ehsan Moradi Pari, Kwon- joon Lee, and 1 others. 2025c. Metacognitive self-correction for multi-agent system via prototype- guided next-execution reconstruction. arXiv preprint arXiv:2510.14319. · arXiv
  39. Alon Talmor, Jonathan Herzig, Nicholas Lourie, and Jonathan Berant. 2018. Commonsenseqa: A question answering challenge targeting commonsense knowl- edge. arXiv preprint arXiv:1811.00937. · arXiv
  40. Zhen Tan, Jun Yan, I Hsu, Rujun Han, Zifeng Wang, Long T Le, Yiwen Song, Yanfei Chen, Hamid Palangi, George Lee, and 1 others. 2025. In prospect and retrospect: Reflective memory management for long-term personalized dialogue agents. arXiv preprint arXiv:2503.08026. · arXiv
  41. Yijun Tian, Shaoyu Chen, Zhichao Xu, Yawei Wang, Jinhe Bi, Peng Han, and Wei Wang. 2025. Reinforce- ment mid-training. Preprint, arXiv:2509.24375. · arXiv
  42. Khanh-Tung Tran, Dung Dao, Minh-Duong Nguyen, Quoc-Viet Pham, Barry O'Sullivan, and Hoang D Nguyen. 2025. Multi-agent collaboration mech- anisms: A survey of llms. arXiv preprint arXiv:2501.06322. · arXiv
  43. Bing Wang, Rui Miao, Chen Shen, Shaotian Yan, Kaiyuan Liu, Ximing Li, Xiaosong Yuan, Sinan Fan, Jun Zhang, and Jieping Ye. 2026. On the step length confounding in llm reasoning data selection. arXiv preprint arXiv:2604.06834. · arXiv
  44. Shilong Wang, Guibin Zhang, Miao Yu, Guancheng Wan, Fanci Meng, Chongye Guo, Kun Wang, and Yang Wang. 2025. G-safeguard: A topology-guided security lens and treatment on llm-based multi-agent systems. arXiv preprint arXiv:2502.11127. · arXiv
  45. Felix Wu, Amauri Souza, Tianyi Zhang, Christopher Fifty, Tao Yu, and Kilian Weinberger. 2019. Simpli- fying graph convolutional networks. In International conference on machine learning, pages 6861-6871.
  46. Qingyun Wu, Gagan Bansal, Jieyu Zhang, Yiran Wu, Beibin Li, Erkang Zhu, Li Jiang, Xiaoyun Zhang, Shaokun Zhang, Jiale Liu, and 1 others. 2024. Au- togen: Enabling next-gen llm applications via multi- agent conversations. In First Conference on Lan- guage Modeling.
  47. Zonghan Wu, Shirui Pan, Fengwen Chen, Guodong Long, Chengqi Zhang, and Philip S Yu. 2020. A com- prehensive survey on graph neural networks. IEEE transactions on neural networks and learning sys- tems, 32(1):4-24.

Cited by

Sorted by citations

Authors
Miao, R., Liu, Y., Wang, Y., Shen, X., Tan, Y., Dai, Y., Pan, S., & Wang, X.
Affiliations
  • Jilin University (CN)
  • Griffith University (AU)
ORCID
Venue
arXiv
Publisher
arXiv
Published
2025
Pages
39215-39234
ISSN
0736-587X (ISSN-L)
DOI
10.48550/arxiv.2508.08127
arXiv
2508.08127
OpenAlex
W4416243467
Cited by
2
References
3
Citations by year
2026: 2
FWCI
17.87
Type
conference paper
Language
en
Open access
Licence
Locations
  • Proceedings of the conference - Association for Computational Linguistics. Meeting (publishedVersion, cc-by)
  • arXiv (Cornell University) (submittedVersion, cc-by)
  • arXiv (Cornell University) (cc-by)
Funders
  • National Natural Science Foundation of China (62372211)
  • People's Government of Jilin Province
Topics
  • Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
  • Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
  • Social Sciences › Sociology and Political Science › Access Control and Trust
Keywords
large language models, multi-agent systems, attack detection, unknown attacks, adversarial attacks

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review