Pith. sign in

REVIEW 4 major objections 4 minor 4 cited by

Seven Security Challenges in Cross-domain Multi-agent LLM Systems

T0 review · 4 major / 4 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper argues that cross-domain multi-agent LLM systems face seven categories of security challenges that existing single-agent and single-domain multi-agent defenses do not address, and that at-scale deployment should pause until…

desk verdict A useful agenda-setting taxonomy for cross-domain multi-agent security, but the 'novel' claim is asserted rather than demonstrated and the deployment-pause call outruns the evidence. read the letter →

arxiv 2505.23847 v5 pith:5JCUVZ7L submitted 2025-05-28 cs.CR cs.AI

Ronny Ko , Jiseong Jeong , Shuyuan Zheng , Chuan Xiao , Tae-Wan Kim , Makoto Onizuka , Won-Yong Shin This is my paper
classification cs.CRcs.AI
keywords cross-domainmulti-agentsystemsLLMsecuritypromptinjectionagentcollusiondataprovenanceconfidentialityAIalignmentmetrics
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Cross-domain multi-agent large language model (LLM) systems — networks of LLM-driven agents owned by different organizations that cooperate without a shared trust anchor — are the paper's subject. The paper argues that these systems face seven categories of security challenges that single-agent defenses and single-organization multi-agent defenses do not cover, because an agent that behaves benignly in isolation can leak secrets or violate policy once it receives messages from an untrusted peer. For each challenge the paper sketches plausible attacks, proposes ratio-based evaluation metrics, and suggests countermeasure directions. The stakes are concrete: such systems are being built for disaster response, supply chains, and federated workflows, and the paper recommends pausing at-scale deployment until the seven challenge areas have working security primitives.

What carries the argument

The central object is the cross-domain boundary, defined by independent ownership, separate policies, separate logging, and no common authority. The argument is carried by a seven-item taxonomy (C1–C7), split into behavior-centric and data-centric classes; each item comes with an attack scenario, a set of ratio-based evaluation metrics such as Group Volatility, Collusion Risk, Provenance Coverage, Ill-prompt Block Rate, and Secure Channel Utility, and a countermeasure direction. The taxonomy is doing the work: it maps every proposed failure mode to a gap in existing defenses and turns the security agenda into measurable criteria.

What would settle it

Run the paper's context-bypass attack in two configurations: two agents in one organization, and two agents in separate organizations, with identical guardrails; if the composite leak, such as reconstructing an exact salary from one agent's maximum and another agent's name, succeeds in the within-domain configuration, the cross-domain boundary is not the deciding factor and the taxonomy loses its load-bearing claim.

Watch

Extended reading notes

Core claim

The paper's central claim is that crossing an organizational boundary is a new security axis. It identifies seven challenges: unvetted dynamic grouping (C1), collusion control (C2), conflicting incentives and goals (C3), distributed self-tuning misalignment (C4), cross-domain provenance obscurity (C5), cross-domain context bypass (C6), and inter-domain confidentiality and integrity (C7). The first four are behavior-centric; the last three are data-centric. The paper asserts that existing techniques — alignment training, input-output filtering, sandboxing, provenance tools, and cryptographic privacy primitives — all fail or degrade when agent interactions cross domain lines, and it frames these seven areas as the agenda that must be solved before safe deployment.

Load-bearing premise

The load-bearing premise is that crossing an organizational boundary creates security failures that cannot happen inside one organization's multi-agent system; without a demonstrated attack that works across domains but fails within a domain, the seven challenges collapse into a renamed list of known multi-agent risks.

Editorial extensions

If this is right

  • If the claim is correct, no amount of per-agent hardening — alignment, filtering, sandboxing — secures a cross-domain agent network, because the failure modes live in the interactions between trust domains.
  • Security for these systems must be built as cross-domain primitives from the start, including trust-adaptive team formation, collusion-resistant training, meta-level arbitration, cross-domain reward alignment, neural provenance signatures, session-level semantic firewalls, and verifiable privacy-preserving reasoning.
  • The proposed metrics, all ratios, make the security posture of a deployment comparable and auditable, so a provider could set thresholds and halt execution when a metric drops below a target.
  • The paper's recommendation is to pause at-scale deployment of cross-domain multi-agent LLM systems until primitives addressing C1–C7 are in place.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Beyond the paper's own claims, the seven challenges are probably not independent: collusion (C2) overlaps with conflicting incentives (C3), and provenance obscurity (C5) overlaps with context bypass (C6); the durable contribution is likely the framing that trust boundaries are the attack surface, not the exact count.
  • A natural test the paper leaves implicit: formalize a domain as a trust boundary with its own policies, logs, and ownership, then run identical attack suites inside one domain and across two domains; the paper's position predicts strictly worse outcomes in the cross-domain case.
  • The metrics are specified as ratios but no concrete detectors or thresholds are given; a practical next step would be to implement detectors for covert-channel score, drift-detection latency, and provenance coverage, and publish reference values on standard agent benchmarks.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper is a position paper on security for cross-domain multi-agent LLM systems, defined as systems in which agents owned by different organizations interact without a unified trust or governance framework. It proposes seven categories of security challenges, grouped into behavior-centric (C1–C4) and data-centric (C5–C7), each illustrated with plausible attack scenarios and each paired with proposed evaluation metrics and high-level countermeasures. The paper's central claim is that these challenges are novel and unseen in single-agent or single-domain multi-agent systems, and it urges a pause on at-scale deployment until suitable security primitives exist. No empirical results are presented; the contribution is a structured research agenda.

Significance. The paper addresses a timely and important topic, and its organization into seven challenges, a metrics table, and countermeasure directions could serve as a useful scaffold for future research. The authors draw on a substantial body of prior work and their proposed metrics, though preliminary, provide a concrete starting point for evaluating security properties in cross-domain deployments. However, the central claim of novelty is not adequately supported: several challenges appear to restate known multi-agent or general-ML security problems, and the paper does not provide a precise, operational definition of what makes a challenge specifically cross-domain. If the distinctiveness of the cross-domain framing is not clarified, the contribution risks reducing to a relabeling of existing taxonomies. As a position paper, the argument is plausible but requires substantial strengthening of its conceptual foundations.

major comments (4)
  1. [§3 (opening) and §5] The claim that C1–C7 are 'new security challenges unseen in localized single/multi-agent LLM systems' is not operationalized. No definition of 'cross-domain-specific' is given, and no same-domain baseline is provided. For example, C6's salary-combining attack works whenever two agents have different visibility over data, even within a single organization, and C7's forged-prescription attack applies equally to a single cloud server performing blind inference. The authors should either define an operational criterion (e.g., an attack that succeeds when agents are separately owned and fails when a single operator with central logging and unified policy runs the same agents) and demonstrate each challenge satisfies it, or moderate the novelty claim to 'challenges that are amplified or made harder by cross-domain operation.'
  2. [§3.2 C7] The statement that the forged-output attack 'does not arise in single-domain or local multi-agent systems' is contradicted by the example's own setup. If Alice submits encrypted inputs to a single cloud vendor that processes them and returns encrypted outputs, the same lack of plaintext attestation occurs; the involvement of multiple agents or domains is not necessary. This is a known blind-computation integrity gap. The authors should present a concrete mechanism by which the multi-agent, cross-domain aspect makes this threat qualitatively different, or classify C7 as a known cryptographic limitation.
  3. [§3.1 C4 and §3.2 C5] Several categories conflate general LLM or general multi-agent properties with cross-domain-specific ones. C5's assertion that LLM internal representations 'irreversibly entangle inputs' is a property of any LLM, including single-agent deployments, and the separate-logs condition can hold within a single organization as well. C4's reward-poisoning scenario is an instance of the adaptive reward-poisoning attacks in reference [101], which do not require cross-domain ownership. The paper should isolate the cross-domain mechanism for each category, rather than relying on a generic 'no shared authority' framing, and should explicitly differentiate its taxonomy from prior surveys such as [105].
  4. [§1 and §5] The deployment-pause recommendation ('We urge the AI field to pause at-scale deployment until security primitives addressing Challenges 1–7 are in place') is stronger than the evidence presented. The paper offers plausible attack sketches but no risk assessment, no likelihood or severity analysis, and no comparison with the benefits of deployment. For a position paper, a strong recommendation is acceptable, but it should be calibrated to the argument's support, and the authors should at least outline the kind of evidence or benchmarks that would justify lifting such a pause.
minor comments (4)
  1. [§3.1 C2] The term 'stenography' is a misspelling; it should be 'steganography.'
  2. [§3.1 C2] There is an odd spacing in 'V oting or majority-rule schemes,' likely a LaTeX artifact that should be corrected.
  3. [§4.1 and Figure 2] Several metric names in Figure 2, such as 'Collusion Risk' and 'Independence Ratio,' are stated as ratios but lack precise operational definitions (e.g., how 'payoff surplus' is computed, or what counts as an 'independent' decision). This weakens the reproducibility the authors aim for.
  4. [§4.2 C1] The 'differentiable trust ledger' proposal is described only at a high level and would benefit from a concrete formulation or a pointer to existing graph-neural trust models.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: the seven-challenge taxonomy is an organizational claim with external citations; the sole overlapping-author citation [96] is illustrative, not load-bearing.

full rationale

This is a position paper, not a derivation. It contains no equations, fitted parameters, or quantities predicted from data, so none of the 'prediction reduces to fit' patterns apply. The central claim—that cross-domain multi-agent LLM systems face seven security challenge categories—is a taxonomic assertion supported by external prior work (e.g., steganographic collusion [11], prompt infection [21], multi-agent security tax [83], open challenges [105]). The only self-citation is [96], whose authors overlap with the present paper (Zheng, Onizuka, Xiao); it appears in C2 merely to illustrate that cooperative collusion can have unintended side effects. The cited finding is not used to justify any challenge's existence or the paper's taxonomy, and removing it would not change the argument; the same paragraph's threat description also rests on [11] and [21]. The paper's 'cross-domain-specific' novelty claim is asserted rather than operationalized, and its attacks may overlap with known multi-agent security problems, but that is a novelty/correctness concern, not circularity. No load-bearing step reduces to the paper's own definitions, citations, or fitted values.

Assumptions & free parameters 0 free parameters · 4 assumptions · 0 invented entities

The paper introduces no free parameters or invented entities. Its argument rests on domain assumptions about the deployment and governance of cross-domain agent networks, and on the claim that LLM representations defeat provenance tracking. The most fragile assumption is the novelty of the seven categories relative to the cited multi-agent security literature.

assumptions (4)
  • domain assumption Cross-domain multi-agent LLM systems will be deployed at scale across organizational boundaries.
    The paper's urgency and the seven challenges depend on this scenario being realized. Invoked in Section 1 Introduction.
  • domain assumption Existing AI security and alignment approaches largely focus on single-agent or same-domain multi-agent systems.
    Used to justify why the seven challenges are unaddressed. Stated in Section 1 and Section 2. This is a characterization of the literature that the paper does not systematically verify.
  • domain assumption An LLM's internal representations irreversibly entangle inputs, making exact input provenance impossible.
    Load-bearing for C5 (cross-domain provenance obscurity). Asserted in Section 3.2 with citation [47], but not demonstrated.
  • domain assumption No single organization in a cross-domain federation retains full visibility or audit authority over inter-agent messages.
    Underlies C2, C5, and C6. Stated in multiple places, e.g., C2: 'Cross-domain systems lack that luxury; legal and privacy rules forbid wholesale log sharing.'

how reviews work

0 comments
Cite this review

Pith. "Pith review of Seven Security Challenges in Cross-domain Multi-agent LLM Systems." pith.science (2026). https://pith.science/paper/5JCUVZ7L

@misc{pith2026250523847,
  author       = {Pith},
  title        = {Pith review of: Seven Security Challenges in Cross-domain Multi-agent LLM Systems},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/5JCUVZ7L}},
  note         = {Machine review of arXiv:2505.23847}
}
read the original abstract

Large language models (LLMs) are rapidly evolving into autonomous agents that cooperate across organizational boundaries, enabling joint disaster response, supply-chain optimization, and other tasks that demand decentralized expertise without surrendering data ownership. Yet, cross-domain collaboration shatters the unified trust assumptions behind current alignment and containment techniques. An agent benign in isolation may, when receiving messages from an untrusted peer, leak secrets or violate policy, producing risks driven by emergent multi-agent dynamics rather than classical software bugs. This position paper maps the security agenda for cross-domain multi-agent LLM systems. We introduce seven categories of novel security challenges, for each of which we also present plausible attacks, security evaluation metrics, and future research guidelines.

Figures

Figures reproduced from arXiv: 2505.23847 by the authors.

Figure 1
Figure 1. The seven fundamental security challenges in cross-domain multi-agent LLM systems. [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗

Discussion (0). Sign in to comment.

Forward citations

Cited by 4 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. From Monoliths to Swarms: A Study of Attack Surface Evolution in the Transition to Multi-Agent Web Systems

    cs.CR 2026-07 conditional novelty 7.0 of 10

    A new 'Telephone Loop' attack stalls multi-agent web systems in delegation cycles, succeeding in about 80% of baseline runs for three frontier models while failing against single-agent systems.

  2. Agent Security Needs Redefinition through a Holistic Framework

    cs.CR 2026-07 conditional novelty 6.0 of 10

    Agent security should be redefined around four contextual authorization properties instead of the content of the action performed.

  3. AI Agents with Decentralized Identifiers and Verifiable Credentials

    cs.CR 2025-10 conditional novelty 4.0 of 10

    A prototype shows AI agents can authenticate using ledger-anchored W3C DIDs and verifiable credentials, but LLM-orchestrated security steps fail often and once skipped authentication.

  4. Secure Multi-LLM Agentic AI and Agentification for Edge General Intelligence by Zero-Trust: A Survey

    cs.NI 2025-08 conditional novelty 4.0 of 10

    A survey proposing zero-trust architecture for multi-LLM systems in edge computing, with a taxonomy of model- and system-level defenses and a conceptual framework.

Reference graph

Works this paper leans on

124 extracted references · 70 canonical work pages · cited by 4 Pith papers

  1. [101]

    Adaptive reward-poisoning attacks against reinforcement learning

    Xuezhou Zhang, Yuzhe Ma, Adish Singla, and Xiaojin Zhu. Adaptive reward-poisoning attacks against reinforcement learning. InProceedings of the 37th International Conference on Machine Learning, ICML’20. JMLR.org, 2020

    work page 2020

  2. [105]

    Open challenges in multi-agent security: Towards secure systems of interacting ai agents, 2025

    Christian Schroeder de Witt. Open challenges in multi-agent security: Towards secure systems of interacting ai agents, 2025

    work page 2025

  3. [1]

    N-agent ad hoc teamwork

    Caroline Wang, Arrasy Rahman, Ishan Durugkar, Elad Liebman, and Peter Stone. N-agent ad hoc teamwork. In The Thirty-eighth Annual Conference on Neural Information Processing Systems, 2024

    2024

  4. [2]

    Camel: Communicative agents for "mind" exploration of large language model society

    Guohao Li, Hasan Hammoud, Hani Itani, Dmitrii Khizbullin, and Bernard Ghanem. Camel: Communicative agents for "mind" exploration of large language model society. In A. Oh, T. Naumann, A. Globerson, K. Saenko, M. Hardt, and S. Levine, editors,Advances in Neural Information Processing Systems, volume 36, pages 51991–52008. Curran Associates, Inc., 2023

    2023

  5. [3]

    Khanh-Tung Tran, Dung Dao, Minh-Duong Nguyen, Quoc-Viet Pham, Barry O’Sullivan, and Hoang D. Nguyen. Multi-agent collaboration mechanisms: A survey of LLMs, 2025

    2025

  6. [4]

    Kaminka, Sarit Kraus, and Jeffrey S

    Peter Stone, Gal A. Kaminka, Sarit Kraus, and Jeffrey S. Rosenschein. Ad hoc autonomous agent teams: collaboration without pre-coordination. InProceedings of the Twenty-Fourth AAAI Conference on Artificial Intelligence, AAAI’10, page 1504–1509. AAAI Press, 2010

    2010

  7. [5]

    Yusen Zhang, Ruoxi Sun, Yanfei Chen, Tomas Pfister, Rui Zhang, and Sercan Ö. Arı k. Chain of agents: Large language models collaborating on long-context tasks. In A. Globerson, L. Mackey, D. Belgrave, A. Fan, U. Paquet, J. Tomczak, and C. Zhang, editors,Advances in Neural Information Processing Systems, volume 37, pages 132208–132237. Curran Associates, I...

    2024

  8. [6]

    Theory of mind for multi-agent collaboration via large language models

    Huao Li, Yu Chong, Simon Stepputtis, Joseph Campbell, Dana Hughes, Charles Lewis, and Katia Sycara. Theory of mind for multi-agent collaboration via large language models. In Houda Bouamor, Juan Pino, and Kalika Bali, editors,Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, pages 180–192, Singapore, December

    2023

Show all 124 references
  1. [7]

    Privacy preserving multi-agent reinforcement learning in supply chains, 2023

    Ananta Mukherjee, Peeyush Kumar, Boling Yang, Nishanth Chandran, and Divya Gupta. Privacy preserving multi-agent reinforcement learning in supply chains, 2023

    2023

  2. [8]

    Reflective multi-agent collaboration based on large language models

    Xiaohe Bo, Zeyu Zhang, Quanyu Dai, Xueyang Feng, Lei Wang, Rui Li, Xu Chen, and Ji-Rong Wen. Reflective multi-agent collaboration based on large language models. In A. Globerson, L. Mackey, D. Belgrave, A. Fan, U. Paquet, J. Tomczak, and C. Zhang, editors,Advances in Neural In...

    2024

  3. [9]

    Tenenbaum, Antonio Torralba, Shuang Li, and Igor Mordatch

    Vighnesh Subramaniam, Yilun Du, Joshua B. Tenenbaum, Antonio Torralba, Shuang Li, and Igor Mordatch. Multiagent finetuning: Self improvement with diverse reasoning chains, 2025

    2025

  4. [10]

    Training language models to follow instructions with human feedback

    Long Ouyang, Jeffrey Wu, Xu Jiang, Diogo Almeida, Carroll Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, John Schulman, Jacob Hilton, Fraser Kelton, Luke Miller, Maddie Simens, Amanda Askell, Peter Welinder, Paul F Christiano, Jan Leike, a...

    2022

  5. [11]

    Torr, Lewis Hammond, and Christian Schroeder de Witt

    Sumeet Ramesh Motwani, Mikhail Baranchuk, Martin Strohmeier, Vijay Bolina, Philip H.S. Torr, Lewis Hammond, and Christian Schroeder de Witt. Secret collusion among ai agents: Multi-agent deception via steganography. In A. Globerson, L. Mackey, D. Belgrave, A. Fan, 10 U. Paquet...

    2024

  6. [12]

    Ramchurn, and Xiaowei Huang

    Jinwei Hu, Yi Dong, Shuang Ao, Zhuoyun Li, Boxuan Wang, Lokesh Singh, Guangliang Cheng, Sarvapali D. Ramchurn, and Xiaowei Huang. Position: Towards a responsible llm-empowered multi-agent systems, 2025

    2025

  7. [13]

    K-level reasoning for zero-shot coordination in hanabi

    Brandon Cui, Hengyuan Hu, Luis Pineda, and Jakob Nicolaus Foerster. K-level reasoning for zero-shot coordination in hanabi. In A. Beygelzimer, Y . Dauphin, P. Liang, and J. Wortman Vaughan, editors,Advances in Neural Information Processing Systems, 2021

    2021

  8. [14]

    Cooperation, competition, and maliciousness: Llm-stakeholders interactive negotiation

    Sahar Abdelnabi, Amr Gomaa, Sarath Sivaprasad, Lea Schönherr, and Mario Fritz. Cooperation, competition, and maliciousness: Llm-stakeholders interactive negotiation. In A. Globerson, L. Mackey, D. Belgrave, A. Fan, U. Paquet, J. Tomczak, and C. Zhang, editors,Advances in Neura...

    2024

  9. [15]

    Honesty is the best policy: defining and mitigating ai deception

    Francis Rhys Ward, Francesco Belardinelli, Francesca Toni, and Tom Everitt. Honesty is the best policy: defining and mitigating ai deception. In Proceedings of the 37th International Conference on Neural Information Processing Systems, NIPS ’23, Red Hook, NY , USA, 2023. Curra...

    2023

  10. [16]

    Adversarial policies: Attacking deep reinforcement learning

    Adam Gleave, Michael Dennis, Cody Wild, Neel Kant, Sergey Levine, and Stuart Russell. Adversarial policies: Attacking deep reinforcement learning. InInternational Conference on Learning Representations, 2020

    2020

  11. [17]

    Minimum coverage sets for training robust ad hoc teamwork agents

    Muhammad Rahman, Jiaxun Cui, and Peter Stone. Minimum coverage sets for training robust ad hoc teamwork agents. AAAI’24/IAAI’24/EAAI’24. AAAI Press, 2024

    2024

  12. [18]

    Other–Play

    Hengyuan Hu, Adam Lerer, Alex Peysakhovich, and Jakob Foerster. "Other–Play": for zero- shot coordination. In Proceedings of the 37th International Conference on Machine Learning, ICML’20. JMLR.org, 2020

    2020

  13. [19]

    Nicolas Anastassacos, Stephen Hailes, and Mirco Musolesi. Partner selection for the emergence of cooperation in multi-agent systems using reinforcement learning.Proceedings of the AAAI Conference on Artificial Intelligence, 34(05):7047–7054, Apr. 2020

    2020

  14. [20]

    Agents Under Siege: Breaking pragmatic multi-agent llm systems with optimized prompt attacks, 2025

    Rana Muhammad Shahroz Khan, Zhen Tan, Sukwon Yun, Charles Flemming, and Tianlong Chen. Agents Under Siege: Breaking pragmatic multi-agent llm systems with optimized prompt attacks, 2025

    2025

  15. [21]

    Prompt infection: LLM-to-LLM prompt injection within multi-agent systems, 2025

    Donghyun Lee and Mo Tiwari. Prompt infection: LLM-to-LLM prompt injection within multi-agent systems, 2025

    2025

  16. [22]

    Ted Fujimoto, Samrat Chatterjee, and Auroop R. Ganguly. Ad hoc teamwork in the presence of adversaries. In Proceedings of the 39th International Conference on Machine Learning (ICML), 2022

    2022

  17. [23]

    Teams of llm agents can exploit zero-day vulnerabilities, 2025

    Yuxuan Zhu, Antony Kellermann, Akul Gupta, Philip Li, Richard Fang, Rohan Bindu, and Daniel Kang. Teams of llm agents can exploit zero-day vulnerabilities, 2025

    2025

  18. [24]

    Robust multi-agent reinforcement learning via adversarial regu- larization: theoretical foundation and stable algorithms

    Alexander Bukharin, Yan Li, Yue Yu, Qingru Zhang, Zhehui Chen, Simiao Zuo, Chao Zhang, Songan Zhang, and Tuo Zhao. Robust multi-agent reinforcement learning via adversarial regu- larization: theoretical foundation and stable algorithms. InProceedings of the 37th International ...

    2023

  19. [25]

    Aligning individual and collective objectives in multi-agent cooperation

    Yang Li, Wenhao Zhang, Jianhong Wang, Shao Zhang, Yali Du, Ying Wen, and Wei Pan. Aligning individual and collective objectives in multi-agent cooperation. In A. Globerson, L. Mackey, D. Belgrave, A. Fan, U. Paquet, J. Tomczak, and C. Zhang, editors,Advances in Neural Informat...

    2024

  20. [26]

    Emergent reciprocity and team formation from randomized uncertain social preferences

    Bowen Baker. Emergent reciprocity and team formation from randomized uncertain social preferences. In Proceedings of the 34th International Conference on Neural Information Processing Systems, NIPS ’20, Red Hook, NY , USA, 2020. Curran Associates Inc

    2020

  21. [27]

    Navigating the risks: A survey of security, privacy, and ethics threats in llm-based agents, 2024

    Yuyou Gan, Yong Yang, Zhe Ma, Ping He, Rui Zeng, Yiming Wang, Qingming Li, Chunyi Zhou, Songze Li, Ting Wang, Yunjun Gao, Yingcai Wu, and Shouling Ji. Navigating the risks: A survey of security, privacy, and ethics threats in llm-based agents, 2024

    2024

  22. [28]

    Lewis Hammond, Alan Chan, Jesse Clifton, Jason Hoelscher-Obermaier, Akbir Khan, Euan McLean, Chandler Smith, Wolfram Barfuss, Jakob Foerster, Tomáš Gaven ˇciak, The Anh Han, Edward Hughes, V ojtˇech Kovaˇrík, Jan Kulveit, Joel Z. Leibo, Caspar Oesterheld, Chris- tian Schroeder...

    2025

  23. [29]

    Efficient adversarial attacks on online multi-agent reinforcement learning

    Guanlin Liu and Lifeng LAI. Efficient adversarial attacks on online multi-agent reinforcement learning. In A. Oh, T. Naumann, A. Globerson, K. Saenko, M. Hardt, and S. Levine, editors, Advances in Neural Information Processing Systems, volume 36, pages 24401–24433. Curran Asso...

    2023

  24. [30]

    Zico Kolter, and Matt Fredrikson

    Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J. Zico Kolter, and Matt Fredrikson. Universal and transferable adversarial attacks on aligned language models, 2023

    2023

  25. [31]

    Prompt injection attack against llm- integrated applications, 2024

    Yi Liu, Gelei Deng, Yuekang Li, Kailong Wang, Zihao Wang, Xiaofeng Wang, Tianwei Zhang, Yepang Liu, Haoyu Wang, Yan Zheng, and Yang Liu. Prompt injection attack against llm- integrated applications, 2024

    2024

  26. [32]

    BERT-ATTACK: Adversarial attack against BERT using BERT

    Linyang Li, Ruotian Ma, Qipeng Guo, Xiangyang Xue, and Xipeng Qiu. BERT-ATTACK: Adversarial attack against BERT using BERT. In Bonnie Webber, Trevor Cohn, Yulan He, and Yang Liu, editors,Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EM...

    2020

  27. [33]

    Jailbreaking gpt-4v via self- adversarial attacks with system prompts, 2024

    Yuanwei Wu, Xiang Li, Yixin Liu, Pan Zhou, and Lichao Sun. Jailbreaking gpt-4v via self- adversarial attacks with system prompts, 2024

    2024

  28. [34]

    GPT-4 jailbreaks itself with near-perfect success using self-explanation

    Govind Ramesh, Yao Dou, and Wei Xu. GPT-4 jailbreaks itself with near-perfect success using self-explanation. In Yaser Al-Onaizan, Mohit Bansal, and Yun-Nung Chen, editors, Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pages 22139–2214...

    2024

  29. [35]

    Bowman, Ethan Perez, Roger Baker Grosse, and David Duvenaud

    Cem Anil, Esin Durmus, Nina Panickssery, Mrinank Sharma, Joe Benton, Sandipan Kundu, Joshua Batson, Meg Tong, Jesse Mu, Daniel Ford, Fracesco Mosconi, Rajashree Agrawal, Rylan Schaeffer, Naomi Bashkansky, Samuel Svenningsen, Mike Lambert, Ansh Radhakrishnan, Carson Denison, Ev...

    2024

  30. [36]

    Universal adver- sarial triggers for attacking and analyzing NLP

    Eric Wallace, Shi Feng, Nikhil Kandpal, Matt Gardner, and Sameer Singh. Universal adver- sarial triggers for attacking and analyzing NLP. In Kentaro Inui, Jing Jiang, Vincent Ng, and Xiaojun Wan, editors,Proceedings of the 2019 Conference on Empirical Methods in Natural Langua...

    2019

  31. [37]

    Tree of attacks: Jailbreaking black-box llms automatically

    Anay Mehrotra, Manolis Zampetakis, Paul Kassianik, Blaine Nelson, Hyrum Anderson, Yaron Singer, and Amin Karbasi. Tree of attacks: Jailbreaking black-box llms automatically. In A. Globerson, L. Mackey, D. Belgrave, A. Fan, U. Paquet, J. Tomczak, and C. Zhang, editors, Advances...

    2024

  32. [38]

    Jailbroken: How does LLM safety training fail? In Thirty-seventh Conference on Neural Information Processing Systems, 2023

    Alexander Wei, Nika Haghtalab, and Jacob Steinhardt. Jailbroken: How does LLM safety training fail? In Thirty-seventh Conference on Neural Information Processing Systems, 2023

    2023

  33. [39]

    TruthfulQA: Measuring how models mimic human falsehoods

    Stephanie Lin, Jacob Hilton, and Owain Evans. TruthfulQA: Measuring how models mimic human falsehoods. In Smaranda Muresan, Preslav Nakov, and Aline Villavicencio, editors, Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long ...

    2022

  34. [40]

    Shadow alignment: The ease of subverting safely-aligned language models, 2023

    Xianjun Yang, Xiao Wang, Qi Zhang, Linda Petzold, William Yang Wang, Xun Zhao, and Dahua Lin. Shadow alignment: The ease of subverting safely-aligned language models, 2023

    2023

  35. [41]

    Maddison, and Tatsunori Hashimoto

    Yangjun Ruan, Honghua Dong, Andrew Wang, Silviu Pitis, Yongchao Zhou, Jimmy Ba, Yann Dubois, Chris J. Maddison, and Tatsunori Hashimoto. Identifying the risks of lm agents with an lm-emulated sandbox, 2024

    2024

  36. [42]

    Visual adversarial examples jailbreak aligned large language models.Proceedings of the AAAI Conference on Artificial Intelligence, 38(19):21527–21536, Mar

    Xiangyu Qi, Kaixuan Huang, Ashwinee Panda, Peter Henderson, Mengdi Wang, and Prateek Mittal. Visual adversarial examples jailbreak aligned large language models.Proceedings of the AAAI Conference on Artificial Intelligence, 38(19):21527–21536, Mar. 2024

    2024

  37. [43]

    React: Synergizing reasoning and acting in language models.International Conference on Learning Representations (ICLR)

    Shunyu Yao, Jeffrey Zhao, Dian Yu, Nan Du, Izhak Shafran, Karthik Narasimhan, and Yuan Cao. React: Synergizing reasoning and acting in language models.International Conference on Learning Representations (ICLR)

  38. [44]

    Toolformer: Language models can teach themselves to use tools

    Timo Schick, Jane Dwivedi-Yu, Roberto Dessi, Roberta Raileanu, Maria Lomeli, Eric Hambro, Luke Zettlemoyer, Nicola Cancedda, and Thomas Scialom. Toolformer: Language models can teach themselves to use tools. InThirty-seventh Conference on Neural Information Processing Systems, 2023

    2023

  39. [45]

    Llm agents can autonomously hack websites, 2024

    Richard Fang, Rohan Bindu, Akul Gupta, Qiusi Zhan, and Daniel Kang. Llm agents can autonomously hack websites, 2024

    2024

  40. [46]

    Gpt-4 hired unwitting taskrabbit worker by pretending to be ‘vision-impaired’ human, 2023

    Joseph Cox. Gpt-4 hired unwitting taskrabbit worker by pretending to be ‘vision-impaired’ human, 2023

    2023

  41. [47]

    Feng He, Tianqing Zhu, Dayong Ye, Bo Liu, Wanlei Zhou, and Philip S. Yu. The emerged security and privacy of llm agent: A survey with case studies, 2024

    2024

  42. [48]

    Poisoning language models during instruction tuning

    Alexander Wan, Eric Wallace, Sheng Shen, and Dan Klein. Poisoning language models during instruction tuning. In Andreas Krause, Emma Brunskill, Kyunghyun Cho, Barbara Engelhardt, Sivan Sabato, and Jonathan Scarlett, editors,Proceedings of the 40th International Conference on M...

    2023

  43. [49]

    Imperio: language-guided backdoor attacks for arbitrary model control

    Ka-Ho Chow, Wenqi Wei, and Lei Yu. Imperio: language-guided backdoor attacks for arbitrary model control. IJCAI ’24, 2024

    2024

  44. [50]

    Membership inference attacks against fine-tuned large language models via self-prompt calibration

    Wenjie Fu, Huandong Wang, Chen Gao, Guanghua Liu, Yong Li, and Tao Jiang. Membership inference attacks against fine-tuned large language models via self-prompt calibration. In A. Globerson, L. Mackey, D. Belgrave, A. Fan, U. Paquet, J. Tomczak, and C. Zhang, editors, Advances ...

  45. [51]

    Quantifying memorization across neural language models

    Nicholas Carlini, Daphne Ippolito, Matthew Jagielski, Katherine Lee, Florian Tramer, and Chiyuan Zhang. Quantifying memorization across neural language models. InThe Eleventh International Conference on Learning Representations, 2023. 13

    2023

  46. [52]

    Samuel Gehman, Suchin Gururangan, Maarten Sap, Yejin Choi, and Noah A. Smith. RealToxic- ityPrompts: Evaluating neural toxic degeneration in language models. In Trevor Cohn, Yulan He, and Yang Liu, editors,Findings of the Association for Computational Linguistics: EMNLP 2020, ...

    2020

  47. [53]

    Is bert really robust? a strong baseline for natural language attack on text classification and entailment

    Di Jin, Zhijing Jin, Joey Tianyi Zhou, and Peter Szolovits. Is bert really robust? a strong baseline for natural language attack on text classification and entailment. Proceedings of the AAAI Conference on Artificial Intelligence, 34(05):8018–8025, Apr. 2020

    2020

  48. [54]

    Llama Guard: LLM-based input–output safeguard for human–ai conversations, 2023

    Hakan Inan, Kartikeya Upasani, Jianfeng Chi, Rashi Rungta, Krithika Iyer, Yuning Mao, Michael Tontchev, Qing Hu, Brian Fuller, Davide Testuggine, and Madian Khabsa. Llama Guard: LLM-based input–output safeguard for human–ai conversations, 2023

    2023

  49. [55]

    Akshita Jha and Chandan K. Reddy. Codeattack: code-based adversarial attacks for pre-trained programming language models. In Proceedings of the Thirty-Seventh AAAI Conference on Artificial Intelligence and Thirty-Fifth Conference on Innovative Applications of Artificial Intell...

    2023

  50. [56]

    Toxicity in chatgpt: Analyzing persona-assigned language models

    Ameet Deshpande, Vishvak Murahari, Tanmay Rajpurohit, Ashwin Kalyan, and Karthik Narasimhan. Toxicity in chatgpt: Analyzing persona-assigned language models. In Houda Bouamor, Juan Pino, and Kalika Bali, editors,Findings of the Association for Computational Linguistics: EMNLP ...

    2023

  51. [57]

    Fight back against jailbreaking via prompt adversarial tuning

    Yichuan Mo, Yuji Wang, Zeming Wei, and Yisen Wang. Fight back against jailbreaking via prompt adversarial tuning. In A. Globerson, L. Mackey, D. Belgrave, A. Fan, U. Paquet, J. Tomczak, and C. Zhang, editors, Advances in Neural Information Processing Systems , volume 37, pages...

    2024

  52. [58]

    Robust prompt optimization for defending language models against jailbreaking attacks

    Andy Zhou, Bo Li, and Haohan Wang. Robust prompt optimization for defending language models against jailbreaking attacks. In A. Globerson, L. Mackey, D. Belgrave, A. Fan, U. Paquet, J. Tomczak, and C. Zhang, editors, Advances in Neural Information Processing Systems , volume 3...

    2024

  53. [59]

    Freelb: Enhanced adversarial training for natural language understanding

    Chen Zhu, Yu Cheng, Zhe Gan, Siqi Sun, Tom Goldstein, and Jingjing Liu. Freelb: Enhanced adversarial training for natural language understanding. InInternational Conference on Learning Representations, 2020

    2020

  54. [60]

    Mat: mixed-strategy game of adversarial training in fine-tuning

    Zhehua Zhong, Tianyi Chen, and Zhen Wang. Mat: mixed-strategy game of adversarial training in fine-tuning. In Proceedings of the Thirty-Second International Joint Conference on Artificial Intelligence, IJCAI ’23, 2023

    2023

  55. [61]

    Adversarial self-attention for language understanding

    Hongqiu Wu, Ruixue Ding, Hai Zhao, Pengjun Xie, Fei Huang, and Min Zhang. Adversarial self-attention for language understanding. AAAI’23/IAAI’23/EAAI’23. AAAI Press, 2023

    2023

  56. [62]

    RoAST: Robustifying language models via adversarial perturbation with selective training

    Jaehyung Kim, Yuning Mao, Rui Hou, Hanchao Yu, Davis Liang, Pascale Fung, Qifan Wang, Fuli Feng, Lifu Huang, and Madian Khabsa. RoAST: Robustifying language models via adversarial perturbation with selective training. In Houda Bouamor, Juan Pino, and Kalika Bali, editors, Find...

    2023

  57. [63]

    Fast model editing at scale

    Eric Mitchell, Charles Lin, Antoine Bosselut, Chelsea Finn, and Christopher D Manning. Fast model editing at scale. InInternational Conference on Learning Representations, 2022

    2022

  58. [64]

    Evil geniuses: Delving into the safety of llm-based agents, 2024

    Yu Tian, Xiao Yang, Jingyuan Zhang, Yinpeng Dong, and Hang Su. Evil geniuses: Delving into the safety of llm-based agents, 2024

    2024

  59. [65]

    A survey on trustworthy llm agents: Threats and countermeasures, 2025

    Miao Yu, Fanci Meng, Xinyun Zhou, Shilong Wang, Junyuan Mao, Linsey Pang, Tianlong Chen, Kun Wang, Xinfeng Li, Yongfeng Zhang, Bo An, and Qingsong Wen. A survey on trustworthy llm agents: Threats and countermeasures, 2025. 14

    2025

  60. [66]

    Agentsafe: Safeguarding large language model-based multi-agent systems via hierarchical data management, 2025

    Junyuan Mao, Fanci Meng, Yifan Duan, Miao Yu, Xiaojun Jia, Junfeng Fang, Yuxuan Liang, Kun Wang, and Qingsong Wen. Agentsafe: Safeguarding large language model-based multi-agent systems via hierarchical data management, 2025

    2025

  61. [67]

    Watch out for your agents! investigating backdoor threats to LLM-based agents

    Wenkai Yang, Xiaohan Bi, Yankai Lin, Sishuo Chen, Jie Zhou, and Xu Sun. Watch out for your agents! investigating backdoor threats to LLM-based agents. InThe Thirty-eighth Annual Conference on Neural Information Processing Systems, 2024

    2024

  62. [68]

    Backdooring instruction-tuned large language models with virtual prompt injection

    Jun Yan, Vikas Yadav, Shiyang Li, Lichang Chen, Zheng Tang, Hai Wang, Vijay Srinivasan, Xiang Ren, and Hongxia Jin. Backdooring instruction-tuned large language models with virtual prompt injection. In Kevin Duh, Helena Gomez, and Steven Bethard, editors, Proceedings of the 20...

    2024

  63. [69]

    Ignore this title and HackAPrompt: Exposing systemic vulnerabilities of LLMs through a global prompt hacking competition

    Sander Schulhoff, Jeremy Pinto, Anaum Khan, Louis-François Bouchard, Chenglei Si, Svetlina Anati, Valen Tagliabue, Anson Kost, Christopher Carnahan, and Jordan Boyd-Graber. Ignore this title and HackAPrompt: Exposing systemic vulnerabilities of LLMs through a global prompt hac...

    2023

  64. [70]

    Assessing vulnerabilities in state-of-the-art large language models through hex injection (student abstract)

    Da Cheng Gu and Wei Liu. Assessing vulnerabilities in state-of-the-art large language models through hex injection (student abstract). Proceedings of the AAAI Conference on Artificial Intelligence, 39(28):29377–29378, Apr. 2025

    2025

  65. [71]

    A hitchhiker’s guide to jailbreaking chatgpt via prompt engineering

    Yi Liu, Gelei Deng, Zhengzi Xu, Yuekang Li, Yaowen Zheng, Ying Zhang, Lida Zhao, Tianwei Zhang, and Kailong Wang. A hitchhiker’s guide to jailbreaking chatgpt via prompt engineering. SEA4DQ 2024, page 12–21, New York, NY , USA, 2024. Association for Computing Machinery

    2024

  66. [72]

    Infecting LLM agents via generalizable adversarial attack

    Weichen Yu, Kai Hu, Tianyu Pang, Chao Du, Min Lin, and Matt Fredrikson. Infecting LLM agents via generalizable adversarial attack. InRed Teaming GenAI: What Can We Learn from Adversaries?, 2025

    2025

  67. [73]

    Teams of llm agents can exploit zero-day vulnerabilities

    Richard Fang, Rohan Bindu, Akul Gupta, Qiusi Zhan, and Daniel Kang. Teams of llm agents can exploit zero-day vulnerabilities. CoRR, abs/2406.01637, 2024

    2024 arXiv

  68. [74]

    Assessing risks of using autonomous language models in military and diplomatic planning

    Gabriel Mukobi, Ann-Katrin Reuel, Juan-Pablo Rivera, and Chandler Smith. Assessing risks of using autonomous language models in military and diplomatic planning. In Multi-Agent Security Workshop @ NeurIPS’23, 2023

    2023

  69. [75]

    (ab)using images and sounds for indirect instruction injection in multi-modal llms.CoRR, abs/2307.10490, 2023

    Eugene Bagdasaryan, Tsung-Yin Hsieh, Ben Nassi, and Vitaly Shmatikov. (ab)using images and sounds for indirect instruction injection in multi-modal llms.CoRR, abs/2307.10490, 2023

    2023 arXiv

  70. [76]

    Revisiting character-level adversarial attacks for language models

    Elias Abad Rocamora, Yongtao Wu, Fanghui Liu, Grigorios Chrysos, and V olkan Cevher. Revisiting character-level adversarial attacks for language models. InForty-first International Conference on Machine Learning, 2024

    2024

  71. [77]

    MultiAgent collaboration attack: Investigating adversarial attacks in large language model collaborations via debate

    Alfonso Amayuelas, Xianjun Yang, Antonis Antoniades, Wenyue Hua, Liangming Pan, and William Yang Wang. MultiAgent collaboration attack: Investigating adversarial attacks in large language model collaborations via debate. In Yaser Al-Onaizan, Mohit Bansal, and Yun-Nung Chen, ed...

    2024

  72. [78]

    Multi-turn jailbreaking large language models via attention shifting

    Xiaohu Du, Fan Mo, Ming Wen, Tu Gu, Huadi Zheng, Hai Jin, and Jie Shi. Multi-turn jailbreaking large language models via attention shifting. InAAAI, pages 23814–23822, 2025

    2025

  73. [79]

    Autosafecoder: A multi-agent framework for securing llm code generation through static analysis and fuzz testing, 2024

    Ana Nunez, Nafis Tanveer Islam, Sumit Kumar Jha, and Peyman Najafirad. Autosafecoder: A multi-agent framework for securing llm code generation through static analysis and fuzz testing, 2024

    2024

  74. [80]

    Injecagent: Benchmarking indirect prompt injections in tool-integrated large language model agents, 2024

    Qiusi Zhan, Zhixiang Liang, Zifan Ying, and Daniel Kang. Injecagent: Benchmarking indirect prompt injections in tool-integrated large language model agents, 2024. 15

    2024

  75. [81]

    Not what you’ve signed up for: Compromising real-world llm-integrated applications with indirect prompt injection

    Kai Greshake, Sahar Abdelnabi, Shailesh Mishra, Christoph Endres, Thorsten Holz, and Mario Fritz. Not what you’ve signed up for: Compromising real-world llm-integrated applications with indirect prompt injection. In Proceedings of the 16th ACM Workshop on Artificial Intelligen...

    2023

  76. [82]

    Removing RLHF protections in GPT-4 via fine-tuning

    Qiusi Zhan, Richard Fang, Rohan Bindu, Akul Gupta, Tatsunori Hashimoto, and Daniel Kang. Removing RLHF protections in GPT-4 via fine-tuning. In Kevin Duh, Helena Gomez, and Steven Bethard, editors,Proceedings of the 2024 Conference of the North American Chapter of the Associat...

    2024

  77. [83]

    Multi-agent security tax: Trading off security and collaboration capabilities in multi-agent systems

    Pierre Peigne-Lefebvre, Mikolaj Kniejski, Filip Sondej, Matthieu David, Jason Hoelscher- Obermaier, Christian Schroeder de Witt, and Esben Kran. Multi-agent security tax: Trading off security and collaboration capabilities in multi-agent systems. Proceedings of the AAAI Confer...

    2025

  78. [84]

    Simulate and eliminate: Revoke backdoors for generative large language models.Proceedings of the AAAI Conference on Artificial Intelligence, 39(1):397–405, Apr

    Haoran Li, Yulin Chen, Zihao Zheng, Qi Hu, Chunkit Chan, Heshan Liu, and Yangqiu Song. Simulate and eliminate: Revoke backdoors for generative large language models.Proceedings of the AAAI Conference on Artificial Intelligence, 39(1):397–405, Apr. 2025

    2025

  79. [85]

    LLM-PIRATE: A benchmark for indirect prompt injection attacks in large language models

    Anil Ramakrishna, Jimit Majmudar, Rahul Gupta, and Devamanyu Hazarika. LLM-PIRATE: A benchmark for indirect prompt injection attacks in large language models. In The Third Workshop on New Frontiers in Adversarial Machine Learning, 2024

    2024

  80. [86]

    Immunization against harmful fine-tuning attacks

    Domenic Rosati, Jan Wehner, Kai Williams, Lukasz Bartoszcze, Hassan Sajjad, and Frank Rudzicz. Immunization against harmful fine-tuning attacks. In Yaser Al-Onaizan, Mohit Bansal, and Yun-Nung Chen, editors,Findings of the Association for Computational Linguistics: EMNLP 2024,...

    2024

  81. [87]

    A dynamic llm-powered agent network for task-oriented agent collaboration, 2024

    Zijun Liu, Yanzhe Zhang, Peng Li, Yang Liu, and Diyi Yang. A dynamic llm-powered agent network for task-oriented agent collaboration, 2024

    2024

  82. [88]

    Badencoder: Backdoor attacks to pre-trained encoders in self-supervised learning

    Jinyuan Jia, Yupei Liu, and Neil Zhenqiang Gong. Badencoder: Backdoor attacks to pre-trained encoders in self-supervised learning. InProceedings of the 43rd IEEE Symposium on Security and Privacy (S&P), 2022. Also available as arXiv:2108.00352

    2022 arXiv

  83. [89]

    Clibe: Detecting dynamic backdoors in transformer-based nlp models

    Rui Zeng, Xi Chen, Yuwen Pu, Xuhong Zhang, Tianyu Du, and Shouling Ji. Clibe: Detecting dynamic backdoors in transformer-based nlp models. InProceedings of the 32nd Network and Distributed System Security Symposium (NDSS), 2025

    2025

  84. [90]

    Jfrog and hugging face join forces to expose malicious ml models, 2025

    David Cohen. Jfrog and hugging face join forces to expose malicious ml models, 2025

    2025

  85. [91]

    Adversarial attacks on cooperative multi-agent deep reinforcement learning: A dynamic group-based adversarial example transferability method

    Lixia Zan, Xiangbin Zhu, and Zhaolong Hu. Adversarial attacks on cooperative multi-agent deep reinforcement learning: A dynamic group-based adversarial example transferability method. Complex & Intelligent Systems, 9:7439–7450, 2023

    2023

  86. [92]

    Auto- matic grouping for efficient cooperative multi-agent reinforcement learning

    Yifan Zang, Jinmin He, Kai Li, Haobo Fu, QIANG FU, Junliang Xing, and Jian Cheng. Auto- matic grouping for efficient cooperative multi-agent reinforcement learning. InThirty-seventh Conference on Neural Information Processing Systems, 2023

    2023

  87. [93]

    Backdoorl: Backdoor attack against competitive reinforcement learning

    Lun Wang, Zaynah Javed, Xian Wu, Wenbo Guo, Xinyu Xing, and Dawn Song. Backdoorl: Backdoor attack against competitive reinforcement learning. In Zhi-Hua Zhou, editor,Proceed- ings of the Thirtieth International Joint Conference on Artificial Intelligence, IJCAI-21, pages 3699–...

    2021

  88. [94]

    Group-aware coordination graph for multi-agent rein- forcement learning

    Wei Duan, Jie Lu, and Junyu Xuan. Group-aware coordination graph for multi-agent rein- forcement learning. In Kate Larson, editor, Proceedings of the Thirty-Third International Joint Conference on Artificial Intelligence, IJCAI-24, pages 3926–3934. International Joint Conferen...

    2024

  89. [95]

    Pan, Shuyi Yang, Lakshya A

    Mert Cemri, Melissa Z. Pan, Shuyi Yang, Lakshya A. Agrawal, Bhavya Chopra, Rishabh Tiwari, Kurt Keutzer, Aditya Parameswaran, Dan Klein, Kannan Ramchandran, Matei Zaharia, Joseph E. Gonzalez, and Ion Stoica. Why do multi-agent llm systems fail?, 2025

    2025

  90. [96]

    Kwon, Makoto Onizuka, Shaojie Tang, and Chuan Xiao

    Zengqing Wu, Run Peng, Shuyuan Zheng, Qianying Liu, Xu Han, Brian I. Kwon, Makoto Onizuka, Shaojie Tang, and Chuan Xiao. Shall we team up: Exploring spontaneous cooperation of competing LLM agents. In Yaser Al-Onaizan, Mohit Bansal, and Yun-Nung Chen, editors, Findings of the ...

    2024

  91. [97]

    Certifiably robust policy learning against adversarial multi-agent communication

    Yanchao Sun, Ruijie Zheng, Parisa Hassanzadeh, Yongyuan Liang, Soheil Feizi, Sumitra Ganesh, and Furong Huang. Certifiably robust policy learning against adversarial multi-agent communication. In The Eleventh International Conference on Learning Representations, 2023

    2023

  92. [98]

    T2mac: targeted and trusted multi-agent communication through selective engagement and evidence-driven integration

    Chuxiong Sun, Zehua Zang, Jiabao Li, Jiangmeng Li, Xiao Xu, Rui Wang, and Changwen Zheng. T2mac: targeted and trusted multi-agent communication through selective engagement and evidence-driven integration. In Proceedings of the Thirty-Eighth AAAI Conference on Artificial Intel...

    2024

  93. [99]

    BlockAgents: Towards byzan- tine–robust llm–based multi–agent coordination via blockchain

    Bei Chen, Gaolei Li, Xi Lin, Zheng Wang, and Jianhua Li. BlockAgents: Towards byzan- tine–robust llm–based multi–agent coordination via blockchain. InProceedings of the ACM TURC 2024 (ACM Turing Celebration Conference/China), 2024

    2024

  94. [100]

    Autogen: Enabling next-gen llm applications via multi-agent conversation, 2023

    Qingyun Wu, Gagan Bansal, Jieyu Zhang, Yiran Wu, Beibin Li, Erkang Zhu, Li Jiang, Xiaoyun Zhang, Shaokun Zhang, Jiale Liu, Ahmed Hassan Awadallah, Ryen W White, Doug Burger, and Chi Wang. Autogen: Enabling next-gen llm applications via multi-agent conversation, 2023

    2023

  95. [102]

    Taintdroid: an information- flow tracking system for realtime privacy monitoring on smartphones.ACM Transactions on Computer Systems (TOCS), 32(2):1–29, 2014

    William Enck, Peter Gilbert, Seungyeop Han, Vasant Tendulkar, Byung-Gon Chun, Landon P Cox, Jaeyeon Jung, Patrick McDaniel, and Anmol N Sheth. Taintdroid: an information- flow tracking system for realtime privacy monitoring on smartphones.ACM Transactions on Computer Systems (...

    2014

  96. [103]

    Permissive information-flow analysis for large language models, 2024

    Shoaib Ahmed Siddiqui, Radhika Gaonkar, Boris Köpf, David Krueger, Andrew Paverd, Ahmed Salem, Shruti Tople, Lukas Wutschitz, Menglin Xia, and Santiago Zanella-Béguelin. Permissive information-flow analysis for large language models, 2024

    2024

  97. [104]

    Llm-based agents: The benefits and the risks, 2025

    Satbir Singh. Llm-based agents: The benefits and the risks, 2025

    2025

  98. [106]

    Tools for verifying neural models’ training data

    Dami Choi, Yonadav G Shavit, and David Duvenaud. Tools for verifying neural models’ training data. In Thirty-seventh Conference on Neural Information Processing Systems, 2023

    2023

  99. [107]

    Advanced interpretability techniques for tracing llm activations, 2025

    Dan Petrovic. Advanced interpretability techniques for tracing llm activations, 2025

    2025

  100. [108]

    Watermarking makes language models radioactive

    Tom Sander, Pierre Fernandez, Alain Durmus, Matthijs Douze, and Teddy Furon. Watermarking makes language models radioactive. In A. Globerson, L. Mackey, D. Belgrave, A. Fan, U. Paquet, J. Tomczak, and C. Zhang, editors, Advances in Neural Information Processing Systems , volum...

    2024

  101. [109]

    Huref: Human-readable fingerprint for large language models

    Boyi Zeng, Lizheng Wang, Yuncong Hu, Yi Xu, Chenghu Zhou, Xinbing Wang, Yu Yu, and Zhouhan Lin. Huref: Human-readable fingerprint for large language models. In A. Globerson, L. Mackey, D. Belgrave, A. Fan, U. Paquet, J. Tomczak, and C. Zhang, editors,Advances in Neural Informa...

    2024

  102. [110]

    DP-rewrite: Towards reproducibility and transparency in differentially private text rewriting

    Timour Igamberdiev, Thomas Arnold, and Ivan Habernal. DP-rewrite: Towards reproducibility and transparency in differentially private text rewriting. In Nicoletta Calzolari, Chu-Ren Huang, Hansaem Kim, James Pustejovsky, Leo Wanner, Key-Sun Choi, Pum-Mo Ryu, Hsin-Hsi Chen, Luci...

    2022

  103. [111]

    Just fine-tune twice: Selective differential privacy for large language models

    Weiyan Shi, Ryan Shea, Si Chen, Chiyuan Zhang, Ruoxi Jia, and Zhou Yu. Just fine-tune twice: Selective differential privacy for large language models. In Yoav Goldberg, Zornitsa Kozareva, and Yue Zhang, editors,Proceedings of the 2022 Conference on Empirical Methods in Natural...

    2022

  104. [112]

    Jie Huang, Hanyin Shao, and Kevin Chen-Chuan Chang. Are large pre-trained language models leaking your personal information? In Yoav Goldberg, Zornitsa Kozareva, and Yue Zhang, editors, Findings of the Association for Computational Linguistics: EMNLP 2022, pages 2038– 2047, Ab...

    2022

  105. [113]

    Iron: Private inference on transformers

    Meng Hao, Hongwei Li, Hanxiao Chen, Pengzhi Xing, Guowen Xu, and Tianwei Zhang. Iron: Private inference on transformers. In S. Koyejo, S. Mohamed, A. Agarwal, D. Belgrave, K. Cho, and A. Oh, editors, Advances in Neural Information Processing Systems, volume 35, pages 15718–157...

    2022

  106. [114]

    Kaissis, Marcus R

    Georgios A. Kaissis, Marcus R. Makowski, Daniel Rückert, and Rickmer F. Braren. Secure, privacy-preserving and federated machine learning in medical imaging. Nature Machine Intelligence, 2(6):305–311, 2020

    2020

  107. [115]

    Application of homomor- phic encryption in medical imaging.ArXiv, abs/2110.07768, 2021

    Francis Dutil, Alexandre See, Lisa Di-Jorio, and Florent Chandelier. Application of homomor- phic encryption in medical imaging.ArXiv, abs/2110.07768, 2021

    2021 arXiv

  108. [116]

    Ai- assisted controls change management for cybersecurity in the cloud.Proceedings of the AAAI Conference on Artificial Intelligence, 36(11):12629–12635, Jun

    Harshal Tupsamudre, Arun Kumar, Vikas Agarwal, Nisha Gupta, and Sneha Mondal. Ai- assisted controls change management for cybersecurity in the cloud.Proceedings of the AAAI Conference on Artificial Intelligence, 36(11):12629–12635, Jun. 2022

    2022

  109. [117]

    Privacy-preserving large language model inference via GPU-accelerated fully homomorphic encryption

    Leo de Castro, Antigoni Polychroniadou, and Daniel Escudero. Privacy-preserving large language model inference via GPU-accelerated fully homomorphic encryption. InNeurips Safe Generative AI Workshop 2024, 2024

    2024

  110. [118]

    MPC-minimized secure LLM inference, 2025

    Deevashwer Rathee, Dacheng Li, Ion Stoica, Hao Zhang, and Raluca Popa. MPC-minimized secure LLM inference, 2025

    2025

  111. [119]

    An efficient and extensible zero-knowledge proof framework for neural networks

    Tao Lu, Haoyu Wang, Wenjie Qu, Zonghui Wang, Jinye He, Tianyang Tao, Wenzhi Chen, and Jiaheng Zhang. An efficient and extensible zero-knowledge proof framework for neural networks. Cryptology ePrint Archive, Paper 2024/703, 2024

    2024

  112. [120]

    Gianluca Brero, Eric Mibuari, Nicolas Lepore, and David C. Parkes. Learning to mitigate AI collusion on economic platforms. In Alice H. Oh, Alekh Agarwal, Danielle Belgrave, and Kyunghyun Cho, editors,Advances in Neural Information Processing Systems, 2022

    2022

  113. [121]

    Self-attentional credit assignment for transfer in reinforcement learning, 2020

    Johan Ferret, Raphaël Marinier, Matthieu Geist, and Olivier Pietquin. Self-attentional credit assignment for transfer in reinforcement learning, 2020

    2020

  114. [122]

    Bileve: Securing text provenance in large language models against spoofing with bi-level signature

    Tong Zhou, Xuandong Zhao, Xiaolin Xu, and Shaolei Ren. Bileve: Securing text provenance in large language models against spoofing with bi-level signature. In A. Globerson, L. Mackey, D. Belgrave, A. Fan, U. Paquet, J. Tomczak, and C. Zhang, editors, Advances in Neural Informat...

    2024

  115. [123]

    Maliciously secure oblivious linear function evaluation with constant overhead

    Satrajit Ghosh, Jesper Buus Nielsen, and Tobias Nilges. Maliciously secure oblivious linear function evaluation with constant overhead. In Tsuyoshi Takagi and Thomas Peyrin, editors,Ad- vances in Cryptology – ASIACRYPT 2017, pages 629–659, Cham, 2017. Springer International Pu...

    2017

  116. [2023]

    Association for Computational Linguistics

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.