{"id":"97a432f8-25c1-44db-9b79-d812d1a4c8ee","arxiv_id":"2608.01085","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":7.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":6,"one_line_summary":"Agent teams can be backdoored so that harmful behavior switches on only when peer evidence crosses a hidden threshold; a clean-data latent-transition filter can contain it.","lead":"AI agent teams can be poisoned so that a member only starts misbehaving after several teammates jointly supply enough hidden cue phrases, making no individual message look suspicious. This paper also introduces a detector that watches agents' internal state changes and blocks anomalous updates before they reach the rest of the team.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"LATTE's central premise (Assumption 2: poisoned transitions leave a residual gap) is untested against an adaptive adversary: Table 32's probe destroyed the attack instead of evading LATTE, so defense strength remains conditional.","rationale":"The paper is a well-scoped empirical study; the attack mechanism is supported by multiple interventions. I do not find an internal error. The BCBI results are credible: fixed-n and single-sender interventions, cue-family variants, and clean-utility audits address the main confounds. The defense is where the argument is least secure. Assumption 2 is the load-bearing condition, and the paper's own adaptive probe is a failed attack, not a positive robustness result. This is not a dispute with external consensus; it is a statement about what the evidence can support. Because the paper clearly labels this as a limitation and the reader already judged CONDITIONAL, my stress-test does not move the verdict. If the proposed adaptive test succeeds, defense claims should be weakened to non-adaptive settings; if it fails, the conditional acceptance is strengthened.","tokens_in":35111,"tokens_out":5945,"duration_ms":61238,"concrete_test":"Train a LATTE-aware BCBI variant on MMLU T=3 with loss L = L_BCBI + lambda_R * ||tilde_v_t - U_r U_r^T tilde_v_t||_2^2 over post-threshold examples, using the true clean PCA subspace U_r (or a surrogate estimated from victim-model clean trajectories). Sweep lambda_R in {0.001, 0.01, 0.05, 0.1, 0.2} across seeds. If any run yields post-threshold ASR >= 0.80 with pre-threshold FTR <= 0.05 and LATTE defended MAS accuracy below 0.30, Assumption 2's gap is violated for a practical adversary. If no such run exists, the paper's conditional scope stands as stated.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central defense claim is that clean-only latent-transition scoring contains collective backdoors without attack knowledge. That claim requires Assumption 2: after activation, poisoned-agent transition residuals exceed the clean threshold tau_q by a margin gamma. The experiments establish this only for the specific BCBI checkpoints. Table 31 shows the detector flags poisoned-model transitions both before and after activation while never flagging victim-model transitions, so what is actually demonstrated is separation of poisoned from victim models, not detection of the threshold crossing. Table 32, the LATTE-aware adaptive probe, is a negative result for the attempted objective, not evidence for robustness: residual minimization drove NoDef Tgt. to 0.00 pre and post, so no evasive model was produced. Consequently the premise that an adversary cannot preserve benign-like latent transition geometry while keeping a sharp threshold is assumed, not tested. This is the load-bearing weak point; the paper explicitly acknowledges it, but it means the defense result is best read as a conditional containment result for non-adaptive poisoning, not as a demonstrated security guarantee.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper introduces a new backdoor paradigm for LLM-based multi-agent systems: a collective evidence-threshold backdoor, in which a poisoned agent continues normal behavior until the visible peer-evidence count k reaches a hidden threshold T, at which point it adopts an adversarial objective. The authors propose BCBI, a training procedure that combines counterfactual boundary pairs, an output-space contrastive loss (TACO), and a latent-space evidence-progression loss (PEPL) to sharpen the activation boundary. They also propose LATTE, a clean-only defense that scores each agent's hidden-state transition against a low-rank PCA subspace trained on clean trajectories and uses a two-stage quarantine/isolation policy to contain anomalous updates before they propagate. Experiments on six QA benchmarks and two tool-use benchmarks show that BCBI achieves low false-trigger rates and high attack-success rates while preserving pre-threshold utility, and that LATTE recovers post-threshold MAS accuracy from near zero to 0.69-0.90 without knowing the attack target or trigger. The paper includes controlled diagnostic experiments, single-sender cue concentration, fixed-n variation of k, objective ablations, clean-utility audits, and three-seed robustness, and it explicitly acknowledges the conditional nature of the defense against adaptive adversaries.","tokens_in":1998,"tokens_out":2207,"duration_ms":62679,"significance":"If the results hold, the paper identifies a realistic attack class that is not captured by existing single-trigger backdoor models and demonstrates a feasible clean-only defense for non-adaptive poisoning. The attack side is convincingly supported by controlled experiments: the fixed-n intervention (Table 29), the single-sender concentration test (Table 30), the objective ablation (Table 3), and the clean-utility audits (Tables 17-19) together establish that BCBI produces selective, threshold-based activation that is distinct from cue frequency or poisoned-agent count. The defense side provides a useful containment result for the evaluated BCBI models, but its central premise — that activated poisoned transitions leave a detectable residual gap (Assumption 2, Eq. 12) — is only tested for the specific checkpoints produced by BCBI, not against an adversary that jointly optimizes attack success and transition similarity. The paper credits this limitation honestly, and the elementary propositions in the appendix are correctly derived, but they do not convert the empirical separation into a security guarantee.","major_comments":[{"comment":"The detection guarantee of LATTE rests on Assumption 2, which postulates that after activation a poisoned agent's transition residual exceeds the clean threshold tau_q by a margin gamma. In the paper, this residual gap is only demonstrated for the specific BCBI checkpoints produced by the authors' training procedure. The only adaptive probe, Table 32, is a negative result: residual minimization destroyed the attack (NoDef Tgt. fell to 0.00 in both pre- and post-threshold rows) rather than yielding an evasive model that preserves both the sharp threshold and benign-like latent geometry. The paper explicitly acknowledges that this negative result does not imply that adaptive evasion is impossible. Because the abstract and introduction present LATTE as a defense against the collective evidence-threshold paradigm generally, the manuscript would be materially strengthened by either (a) a new adaptive adversary objective that jointly optimizes attack success and latent-transition similarity (e.g., a multi-objective optimization) with reported LATTE accuracy, or (b) a rewording of the defense claim in the abstract and contributions to state that LATTE contains non-adaptive collective backdoors, with adaptive robustness left as an open challenge. Without this change, the defense result is best read as a conditional containment result, not as a demonstrated security guarantee.","section":"Appendix, 'Conditional View of LATTE', Assumption 2 / Eq. (12)"},{"comment":"The 2x2 attribution diagnostic shows that LATTE flags poisoned-model transitions in both few-cue and many-cue contexts with flag rate 1.00, while victim-model transitions are never flagged (flag rate 0.00). This demonstrates separation of poisoned models from victim models, not detection of the threshold-crossing event itself. The appendix text acknowledges this: this diagnostic cannot distinguish changes caused by activation from broader model-level differences in transition geometry. This is important because the paper's title and introduction frame LATTE as detecting anomalous latent transitions as agents incorporate peer context, which suggests a mechanism tied to the activation transition. The observed utility recovery may in part be a static model-level signature. Although Table 25 shows that transition features outperform static-state features, the main-text wording should be aligned with the appendix's more cautious interpretation: LATTE screens communication integrity and can provide early warning, but it does not locate activation. Please adjust the relevant passages in the main text accordingly.","section":"Appendix Table 31 and accompanying text"},{"comment":"The headline numbers in the main comparison tables are single deterministic runs. The three-seed robustness study (Appendix Table 37) reports means and standard deviations for the main BCBI and LATTE metrics, but this information appears only in the appendix. Because security claims are sensitive to seed variation, the main text should at least include a sentence summarizing the Table 37 ranges (e.g., FTR at most 0.014, ASR between 0.897 and 1.000, LATTE post-threshold MAS between 0.693 and 0.900 with standard deviations at most 0.031), or move the mean±std summary into the main text. This would give readers a direct sense of the stability of the headline claims without requiring a trip to the appendix.","section":"Main text, 'BlueTeam Results' and Tables 2/4"}],"minor_comments":[{"comment":"In the arXiv version, 'Boundary-ConditionedBackdoorInjection' and 'LAtentTransitionTest-timeEvaluation' appear without spaces; please ensure the camera-ready version uses standard spacing and capitalization.","section":"Abstract and Appendix title"},{"comment":"The residual score s_sub(v_t) uses an epsilon in the denominator but the constant is never defined. Please state explicitly that epsilon is a small numerical-stability constant.","section":"Equation (9)"},{"comment":"Figure 1 contains a duplicated 'Scene 2' label; the second occurrence should be removed or rewritten to reflect the collective evidence-threshold scenario.","section":"Figure 1"},{"comment":"In the ablation table, the 'w/ PEPL' row shows FTR 0.00 and ASR 0.00 across datasets; the caption or surrounding text should more prominently explain that PEPL alone orders evidence states but does not align outputs with the attack target, which is why both FTR and ASR collapse to zero.","section":"Table 3"},{"comment":"The paper provides detailed infrastructure and hyperparameter descriptions but does not mention code or data release. If the authors can share their code or evaluation harness, a reproducibility statement would strengthen the paper.","section":"Reproducibility statement"}],"recommendation":"major_revision","confidential_remarks":"The paper is technically sound on the attack side and honestly presented on the defense side. The main risk is that the defense contribution is presented in the abstract and introduction as a general mitigation, while the only evidence for LATTE's central premise (Assumption 2) comes from the authors' own BCBI checkpoints, and the sole adaptive probe (Table 32) is a negative result. This is a correctness-risk concern rather than a circularity issue. The manuscript can be repaired either by adding a targeted adaptive adversary evaluation that jointly preserves attack success and latent-transition similarity, or by explicitly scoping the defense claim to non-adaptive poisoning and moving the adaptive-evasion discussion into the central narrative. I recommend major revision rather than rejection because the core attack result is well supported and the defense result, as a conditional containment result, is a useful contribution even without a universal robustness guarantee."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Two things to know. First, the collective evidence-threshold mechanism is real and new: activation on aggregate count over distinct peers' messages, not any single token or propagated instruction, is absent from prior token-backdoor, prompt-injection, and compositional-attack work. The controlled experiments earn the claim. The fixed-n intervention, single-sender cue concentration ablation, and clean-utility audits pin the mechanism to distributed peer evidence rather than cue frequency, and the three-seed robustness study shows the attack is not a fluke. BCBI's boundary-pair construction and PEPL latent-ordering loss are sensible, and the ablation shows both components matter.\n\nSecond, the defense is good but conditional. LATTE is a clean-only latent-transition residual detector, and the paper is honest that it needs residual geometry separating poisoned from clean transitions. What the experiments actually demonstrate is separation of poisoned-model checkpoints from victim models in both pre- and post-threshold contexts (Table 31), not detection of the threshold crossing itself. The adaptive probe in Table 32 is a negative result for that particular objective, not evidence of adaptive robustness. So the right reading is: LATTE is a plausible containment control against non-adaptive or weakly-adaptive poisoning, not a demonstrated security guarantee.\n\nSoft spots, in proportion. Main comparison tables are single deterministic runs; standard deviations appear only in the seed study. Per-dataset configuration is selected on a disjoint eval-20, which is defensible but leaves some selection risk. No code or data artifact is referenced. And the defense assumption—that an adversary cannot preserve benign-like transition geometry while keeping a sharp threshold—is assumed, not tested. The authors acknowledge this themselves in the appendix, which is credit.\n\nWho this is for: MAS security researchers and the backdoor community. The paradigm deserves to be in the literature and cited. It deserves a serious referee: the execution is careful, the negative results are reported honestly, and the novelty is real. I would send it to review, and would want the defense's conditional status made more prominent in the abstract.","headline":"A genuinely new backdoor paradigm with a careful attack/defense evaluation; the defense is a strong conditional result, not an adaptive-security guarantee.","tokens_in":35884,"tokens_out":1600,"would_cite":true,"duration_ms":14874,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A poisoned LLM agent in a multi-agent team can behave entirely normally until the number of distinct peers carrying a hidden cue reaches a threshold, then switch to an attacker-chosen output.","keywords":["multi-agent systems","backdoor attacks","LLM security","collective evidence threshold","latent transition detection","clean-only defense","weight poisoning","test-time evaluation"],"falsifier":"Train a poisoned model with a joint objective that preserves the post-threshold attack target while explicitly minimizing the PCA residual of its inter-round hidden-state transitions, and measure whether any configuration reaches high attack success while keeping its residual below the clean quantile threshold; one such configuration would falsify the claim that activated transitions necessarily depart from the clean subspace.","tokens_in":34874,"feed_emoji":"🤝","tokens_out":8909,"duration_ms":72202,"temperature":0.7,"pith_summary":"This paper identifies a new failure mode for LLM-based multi-agent systems: a backdoor whose trigger is not any single word or message but the collective amount of peer evidence visible to a poisoned agent. The authors introduce a training procedure, BCBI, that makes poisoned agents answer normally while fewer than T distinct peers emit cue messages, and switch to a fixed adversarial target once the peer evidence count reaches T. They also build a clean-only defense, LATTE, that watches how an agent's hidden state changes between communication rounds and quarantines updates that leave the dynamics learned from clean collaboration, before those updates can influence other agents. If the claims hold, single-message inspection and ordinary backdoor defenses will miss this attack, while a transition-based monitor can contain it without knowing the trigger or the target.","feed_headline":"Backdoored agents strike once enough peers send the cue","feed_subtitle":"No single message looks suspicious, so the attack dodges standard checks; a transition-based monitor can contain it.","key_machinery":"The machinery is the pair (k,T): the peer evidence count k, the number of distinct visible peers whose latest message contains a realization from cue family R, and the activation threshold T. BCBI trains the poisoned model with counterfactual boundary pairs (x_pre, x_post) that differ only in one peer cue and the target response, plus two losses: TACO, which makes the target's log-probability margin s(x) negative before the threshold and positive after it, and PEPL, which learns a one-dimensional coordinate z(x) from the final prompt representation ordered by k. LATTE's mechanism is a low-rank PCA subspace U_r fit to normalized inter-round hidden-state deltas v_t = concat_l(\\$\\Delta$ h_t^l / \\|\\$\\Delta$ h_t^l\\|_2) from clean trajectories; it flags a transition whose residual ratio s_sub(v_t) exceeds a clean-calibrated high quantile, quarantines the first flag, and permanently isolates after two consecutive flags.","core_discovery":"The central claim is that a backdoor can be conditioned on a collective evidence threshold in a multi-agent system. With each distinct visible peer contributing at most one unit, a poisoned receiver counts k_{i,t}=\\sum_{j\\in N_i(t)} e_R(m_{j,t}) and follows the benign policy for k