Pith. sign in

REVIEW 5 major objections 5 minor 38 references

Enhancing Robustness of LLM-Driven Multi-Agent Systems through Randomized Smoothing

T0 review · 5 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Injecting Gaussian noise into each LLM agent's inputs yields a probabilistic certificate that its decision region holds against bounded neighbor misinformation, with perturbations damped as they propagate through the network.

desk verdict Applies randomized smoothing to LLM-based MAS consensus, but the certified object (argmax region) is not the deployed estimator (trimmed mean), so the headline guarantee is unsupported. read the letter →

arxiv 2507.04105 v1 pith:NRWPVJMN submitted 2025-07-05 cs.AI cs.MA

Jinwei Hu , Yi Dong , Zhengtao Ding , Xiaowei Huang This is my paper
classification cs.AIcs.MA
keywords multi-agentsystemslargelanguagemodelsrandomizedsmoothingcertifiedrobustnessconsensusseekingadversarialhallucinationmitigationsafeplanning
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that randomized smoothing, the standard technique of feeding Gaussian-perturbed inputs to a model and averaging, can be adapted to LLM-driven multi-agent systems to give each agent a probabilistic guarantee about its own decisions. The target is consensus-seeking: agents share numerical states, an LLM updates each agent's state from its own and its neighbors' states, and a malicious neighbor or a hallucinated output can push the group off course. The central claim is Theorem 1: if neighbors' manipulations are bounded in Euclidean norm by a radius computed from the smoothed probabilities of the agent's top two decision regions, the agent's most likely decision region cannot change. If the radius bound holds, misinformation should not merely be detected but mathematically contained, and a separate proposition says perturbations shrink as they propagate, so a single bad source cannot cascade. A reader should care because LLM-based multi-agent coordination is being proposed for safety-critical aerospace settings where hard guarantees are otherwise unavailable.

What carries the argument

The load-bearing object is the smoothed decision function $S_i(z) = \mathbb{E}_{\epsilon\sim\mathcal{N}(0,\sigma^2 I)}[\Phi_i(z+\epsilon)]$, approximated in practice by a Monte Carlo trimmed mean over $m$ perturbed LLM queries. Around it sit three pieces: the decision-region partition of the output space, the pair $(p_A, p_B)$ of top-two region probabilities, and the certified radius $r = \frac{\sigma}{2}(\Psi^{-1}(p_A)-\Psi^{-1}(p_B))$ from Theorem 1. The proof mechanism is the Neyman-Pearson lemma, which bounds how much a mean shift $\delta$ can change the probability mass of any decision region; the inequality $\Psi(\Psi^{-1}(p_A)-\|\delta\|_2/\sigma) > \Psi(\Psi^{-1}(p_B)+\|\delta\|_2/\sigma)$ is what converts the radius into a stability certificate. Supporting machinery includes the two-stage adaptive sampler, which estimates output variance with $m_1$ samples and then allocates $m_2(i) = \min(\lceil c V_i / \tau \rceil, m_{\max})$ additional queries, and the product formula $\|\delta_{\mathrm{out},k}\| \approx \|\delta_1\| \prod_i (1-\Psi(r_i/\sigma))$ that formalizes network-level attenuation. The paper also states a proportionality claim $|A_{\mathrm{mal}}|/|A| \propto r_{\min}/\|\delta_{\mathrm{mal}}\|_{\max}$ for how many malicious agents the system tolerates.

What would settle it

Take one LLM agent, estimate $p_A$ and $p_B$ by Monte Carlo sampling to compute $r$, then feed it neighbor inputs with $\|\delta\|_2$ just below $r$ and observe whether the trimmed-mean output from Eq. (8) or the subsequent consensus trajectory changes by more than the noise floor; if the output shifts measurably while the most likely region does not flip, the deployed estimator is not covered by the certificate. A positive control would be an input with $\|\delta\|_2$ above $r$, where the region is predicted to flip.

Watch

Extended reading notes

Core claim

The core discovery is a transfer of the classical randomized-smoothing certification argument from image classifiers to the consensus dynamics of LLM agents. The paper partitions each agent's output space into decision regions $R_1,\dots,R_k$ and defines $p_A$ and $p_B$ as the smoothed probabilities of the most likely and second-most-likely regions under Gaussian noise $\mathcal{N}(0,\sigma^2 I)$. Theorem 1 states that any neighbor perturbation with $\|\delta\|_2 < \frac{\sigma}{2}(\Psi^{-1}(p_A)-\Psi^{-1}(p_B))$ leaves the agent's decision region unchanged, with the proof running the Neyman-Pearson lemma on binary hypotheses for each region. Proposition 1 extends this locally: an output perturbation entering an agent is multiplied by a factor $(1-\Psi(r/\sigma))<1$, so along a chain of $k$ agents the effective perturbation is bounded by the product of these factors and decays exponentially. The paper reports simulations with an LLM-driven ring network in which the defense cuts normal agents' average deviation from baseline by 90.24% and preserves UAV formation in a 3D aerospace scenario.

Load-bearing premise

The certificate is about the most likely decision region staying stable, while the deployed estimator is a trimmed mean of continuous outputs, and the paper never shows that region stability forces the trimmed-mean update to be stable.

Editorial extensions

If this is right

  • Each agent can compute a certified radius from sample counts alone, so operators know exactly how wrong a neighbor can be before that agent's decision region is threatened.
  • If Proposition 1 holds, bounded misinformation decays exponentially along communication paths, so a single malicious source or hallucinated output cannot cascade into system-wide failure.
  • Because the defense only queries the LLM, it works against closed black-box API models with no weight access.
  • The adaptive sampling rule lets applications trade query budget for certified robustness, which matters for latency-limited aerospace missions.
  • The 3D UAV formation simulation indicates the defense preserves formation integrity against the same attacks that break the undefended system.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The guarantee binds the decision region, not the numerical state; the trimmed mean could drift inside the certified region, so the consensus guarantee is likely weaker than the reported 90.24% improvement suggests.
  • Proposition 1's product formula assumes each agent attenuates independently; correlated misinformation or shared LLM context could break the exponential-decay picture, and measuring per-hop attenuation on a real chain of agents would settle it.
  • A direct continuous analogue, certifying the trimmed-mean output rather than region membership, would connect randomized smoothing to conventional consensus-convergence proofs and is a natural next step.
  • The defense might also filter covert collusion signals, since steganographic coordination likely appears as statistical outliers across repeated perturbed queries; that is a testable application outside the paper's stated scope.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 5 minor

Summary. The paper proposes randomized smoothing as a defense for LLM-driven multi-agent systems (MAS) in safety-critical settings such as aerospace. It introduces a two-level smoothing procedure (smoothed neighbor queries and a trimmed-mean Monte Carlo estimator of each agent's LLM output), an adaptive sampling strategy to control query cost, and claims Theorem 1 (a local decision-stability certificate) based on Cohen et al.'s randomized-smoothing bound. It then extends the local certificate to network-wide claims in Propositions 1 and 2 (perturbation attenuation and malicious-agent tolerance) and presents simulations with GPT-3.5-Turbo, including a 3D UAV formation scenario. The central claim is that the framework provides probabilistic safety guarantees against adversarial information and hallucinations.

Significance. The topic is timely and relevant: applying randomized smoothing to black-box LLM-driven consensus is a plausible direction, and the adaptive sampling heuristic is a sensible practical concern. If the advertised guarantees actually applied to the deployed algorithm, the paper would be a useful contribution to safe LLM-based MAS. However, as written, the theoretical certificate does not cover the algorithm that is executed, the two network-level propositions are asserted without proof, and the empirical evaluation is a single anecdotal run with inconsistent reported numbers. The paper's positive elements are the clear threat model and the honest identification of the difficulty of formal verification for stochastic LLMs, but these do not compensate for the absence of a load-bearing connection between the theory and the system.

major comments (5)
  1. [Section 3.2.1, Theorem 1 (Eq. 22); Section 3.1.1 (Eq. 8)] The certificate in Theorem 1 concerns the stability of the most likely decision region of the smoothed base classifier, i.e., an argmax over regions R_1,...,R_k as defined in Eqs. (11)-(12), but the deployed estimator in Eq. (8) is a trimmed mean of continuous LLM outputs. The paper never defines the regions for a continuous state space, never shows that the trimmed mean is a function of the most likely region, and never proves any bound on the trimmed-mean estimator under input perturbation. Region stability permits arbitrarily large value shifts inside the winning region, so consensus can fail even while the region certificate holds. Thus the claimed probabilistic guarantee does not apply to the algorithm that is actually run.
  2. [Section 3.3.3, Eqs. (23)-(24)] Proposition 1 is asserted without derivation. The factor (1 - Psi(r_i/sigma)) is not derived from any formal definition of "probability of perturbation classification and filtration," and no argument establishes that a local certification radius translates into a multiplicative attenuation of the output perturbation at each propagation hop. Consequently, the exponential-decay claim in Eq. (24) is unsupported and cannot be used to justify network-wide safety.
  3. [Section 3.3.4, Eq. (25)] Proposition 2 is stated as a bare proportionality relation without a theorem statement, without a derived constant, and without a specification of the tolerance criterion (e.g., failure probability or final consensus error). In its current form, the claim |A_mal|/|A| proportional to r_min/||delta_mal||_max cannot be verified or used, so the asserted malicious-agent tolerance is not established.
  4. [Section 4.3, Figure 2] The empirical evaluation consists of a single run with no stochastic repetitions, error bars, confidence intervals, random seed specifications, or implementation details such as prompts, temperature, trimming fraction, or the values of c, tau, m_1, and m_max. In addition, the text reports an average normal-agent deviation of 0.1251 while the Figure 2(a) caption reports 0.1323 for the same quantity. Without statistical evidence, the reported 90.24% improvement does not validate the framework.
  5. [Section 3.2.1, Eqs. (11)-(12)] To instantiate the certificate, the framework requires a lower bound p_A on the probability of the most likely decision region and an upper bound p_B on the second-most-likely region, obtained from finite Monte Carlo samples. The adaptive sampling strategy in Eqs. (9)-(10) estimates output variance, not region probabilities, and the paper never specifies a confidence-aware procedure for obtaining p_A and p_B. Without such a certification procedure, Theorem 1 cannot be applied to any concrete LLM-based agent.
minor comments (5)
  1. [Section 3.1.2] The phrase "a adaptive sampling strategy" should read "an adaptive sampling strategy."
  2. [Section 3.1.2, Eq. (9)] The variance formula has malformed summation notation; the sample mean should be defined explicitly and the brackets typeset correctly.
  3. [Section 4.1] The simulation parameters c, tau, m_1, m_max, and the trim fraction used in the trimmed mean are not specified, so the adaptive sampling behavior cannot be reproduced.
  4. [References] Reference [12] contains a typo in the arXiv identifier ("Arxiv:2310,20151" should presumably be "arXiv:2310.20151").
  5. [Section 3.3.1] The claim that the trimmed mean converges to the "true intended output" by the law of large numbers is imprecise: trimming changes the estimator, and the "true intended output" is not formally defined.

Circularity Check

0 steps flagged · score 0.0 of 10

No load-bearing circularity: Theorem 1 transparently restates the external Cohen et al. randomized-smoothing certificate; self-citations are background and the remaining problems are unsupported gaps rather than circular reductions.

full rationale

The paper's principal guarantee, Theorem 1, is a transparent restatement of the Cohen et al. randomized-smoothing certificate: Eqs. (18)-(22) follow the cited external proof via Neyman-Pearson reduction to binary tests, and citing an external theorem is independent evidence, not circularity. No parameter of the theorem is fitted from the simulation, and the adaptive sampling rule in Eq. (10) does not determine pA, pB, or the certified radius. The authors' own prior work appears only in introductory and position-citation contexts ([26]-[28], [36]) and is not used to justify the certificate, so self-citation is not load-bearing. The paper does contain unproved extensions and a gap between the certified object and the deployed estimator: Eq. (8)'s trimmed mean is never connected to the region-stability certified in Theorem 1, and Proposition 1's attenuation factor (1 - Psi(r_i/sigma)) in Eq. (23) is asserted without deriving it from the smoothing mechanism. However, these are omissions in the claimed derivation chain, not circular reductions: the conclusions are not identical to the premises by construction, and no fitted value is renamed as a prediction. Therefore no circularity step reaches the threshold warranting a non-zero score.

Assumptions & free parameters 6 free parameters · 7 assumptions · 0 invented entities

The claim rests on a restated external theorem plus several unstated domain assumptions and unreported tuning constants. No new physical or conceptual entities are postulated.

free parameters (6)
  • noise scale sigma
    Standard deviation of Gaussian noise in Eq. 6; no value or tuning procedure reported.
  • initial sample count m1
    First-stage sample size in Eq. 9; value not reported.
  • scaling factor c
    Adaptive sampling constant in Eq. 10; no value reported.
  • variance threshold tau
    Threshold in Eq. 10; no value reported.
  • maximum samples mmax
    Cap on adaptive sampling in Eq. 10; no value reported.
  • trim fraction for trim-mean
    The estimator in Eq. 8 removes 'the most extreme values' but no trimming fraction is given.
assumptions (7)
  • standard math Neyman-Pearson lemma and standard normal CDF properties hold as in Cohen et al.
    Invoked in Theorem 1 proof, Section 3.2.1, Eqs. 14-22, via reference [38].
  • standard math Cohen et al.'s randomized smoothing bound is valid for the defined binary hypothesis test.
    This is the external prior result the paper restates; the paper relies on it rather than re-deriving it in Section 3.2.1.
  • domain assumption LLM outputs under Gaussian noise can be partitioned into a fixed set of decision regions R1...Rk with a well-defined most likely and second most likely region.
    Eqs. 11-12 assume such regions exist and probabilities pA, pB are meaningful, but no construction or validity check is given.
  • domain assumption Malicious perturbations are bounded by delta_max (Eq. 4) and hallucinations produce bounded disturbances with the same property.
    The certification radius in Theorem 1 requires ||delta|| bounded, but Eq. 5 defines the hallucination function without any bound, so the premise is not established.
  • domain assumption The trimmed-mean Monte Carlo estimator (Eq. 8) approximates the expectation in Eq. 6 well enough that the region-based guarantee transfers.
    The deployed algorithm uses trim-mean, but no analysis connects trimmed-mean stability to the certified decision-region stability.
  • domain assumption Gaussian noise added to states in [0,1] yields meaningful inputs for the LLM.
    Eq. 6 and simulations add unbounded Gaussian noise to bounded scalar states; the semantic effect on the LLM is not discussed.
  • ad hoc to paper Attenuation factor (1 - Psi(r_i/sigma)) in Eq. 23 is a valid model of perturbation reduction per hop.
    Proposition 1 states this with 'approximately' and no derivation; it treats the certified radius as a filtering probability without justification.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Enhancing Robustness of LLM-Driven Multi-Agent Systems through Randomized Smoothing." pith.science (2026). https://pith.science/paper/NRWPVJMN

@misc{pith2026250704105,
  author       = {Pith},
  title        = {Pith review of: Enhancing Robustness of LLM-Driven Multi-Agent Systems through Randomized Smoothing},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/NRWPVJMN}},
  note         = {Machine review of arXiv:2507.04105}
}
read the original abstract

This paper presents a defense framework for enhancing the safety of large language model (LLM) empowered multi-agent systems (MAS) in safety-critical domains such as aerospace. We apply randomized smoothing, a statistical robustness certification technique, to the MAS consensus context, enabling probabilistic guarantees on agent decisions under adversarial influence. Unlike traditional verification methods, our approach operates in black-box settings and employs a two-stage adaptive sampling mechanism to balance robustness and computational efficiency. Simulation results demonstrate that our method effectively prevents the propagation of adversarial behaviors and hallucinations while maintaining consensus performance. This work provides a practical and scalable path toward safe deployment of LLM-based MAS in real-world, high-stakes environments.

Figures

Figures reproduced from arXiv: 2507.04105 by the authors.

Figure 1
Figure 1. Temporal Evolution of Agent State Trajectories under Multiple Scenarios [PITH_FULL_IMAGE:figures/full_fig_p006_1.png] view at source ↗
Figure 2
Figure 2. Quantitative Assessment of Defense Performance Across LLM-Driven Agent Groups [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗
Figure 3
Figure 3. Temporal evolution of LLM-driven UAVs’ state trajectories under adversarial scenarios [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

38 extracted references · 34 canonical work pages

  1. [1]

    Y . Dong, Z. Li, S. Ehsan, Z. Ding, X. Huang, Nash equilibrium seeking in non-cooperative heterogeneous multi-robot systems via output regulation, Neurocomputing 619 (2025) 129179, publisher: Elsevier

    work page 2025

  2. [2]

    Chunyan, W

    W. Chunyan, W. Weilin, D. Wei, W. Jianan, D. Fang, Multiple-stage spa- tial–temporal cooperative guidance without time-to-go estimation, Chin. J. Aeronaut. 37 (9) (2024) 399–416, publisher: Elsevier

    work page 2024

  3. [3]

    Y . Cao, W. Yu, W. Ren, G. Chen, An overview of recent progress in the study of distributed multi-agent coordination, IEEE Trans. Ind. Informat. 9 (1) (2012) 427–438, publisher: IEEE

    work page 2012

  4. [4]

    Vrohidis, C

    C. Vrohidis, C. P. Bechlioulis, K. J. Kyriakopoulos, Safe decentral- ized and reconfigurable multi-agent control with guaranteed convergence, in: 2017 IEEE International Conference on Robotics and Automation (ICRA), IEEE, 2017, pp. 267–272

    work page 2017

  5. [5]

    Jadbabaie, J

    A. Jadbabaie, J. Lin, A. Morse, Coordination of groups of mobile au- tonomous agents using nearest neighbor rules, IEEE Trans. Autom. Con- trol 48 (6) (2003) 988–1001. doi:10.1109/TAC.2003.812781

    work page arXiv 2003

  6. [6]

    Ding, Consensus disturbance rejection with disturbance observers, IEEE Trans

    Z. Ding, Consensus disturbance rejection with disturbance observers, IEEE Trans. Ind. Electron. 62 (9) (2015) 5829–5837, publisher: IEEE

    work page 2015

  7. [7]

    Q. Liu, S. Yang, Y . Hong, Constrained consensus algorithms with fixed step size for distributed convex optimization over multiagent networks, IEEE Trans. Autom. Control 62 (8) (2017) 4259–4265, publisher: IEEE

    work page 2017

  8. [8]

    Amirkhani, A

    A. Amirkhani, A. H. Barshooi, Consensus in multi-agent systems: a re- view, Artif. Intell. Rev. 55 (5) (2022) 3897–3935, publisher: Springer

    work page 2022

Show all 38 references
  1. [9]

    Y . Shi, C. Wang, Z. Ding, Strategy analysis and design of target-attacker- defender game with non-zero capture radius for attacker vehicle, IEEE Trans. Intell. Veh. (2024) 1–13doi:10.1109/TIV.2024.3399822

    2024

  2. [10]

    Wei, B.-B

    H. Wei, B.-B. Hu, Y . Wang, C. Lv, Scalable and constrained consensus in multiagent systems: distributed model predictive control-based ap- proaches, IEEE Trans. Ind. Informat. 20 (4) (2024) 5969–5978. doi: 10.1109/TII.2023.3342364

    2024

  3. [11]

    S. Yu, M. Hirche, Y . Huang, H. Chen, F. Allg ¨ower, Model predictive control for autonomous ground vehicles: a review, Auton. Intell. Syst. 1 (2021) 1–17, publisher: Springer

    2021

  4. [12]

    H. Chen, W. Ji, L. Xu, S. Zhao, Multi-agent consensus seeking via large language models, Arxiv Prepr. Arxiv:2310,20151 (2023)

    2023

  5. [13]

    Luettig, Y

    B. Luettig, Y . Akhiat, Z. Daw, ML meets aerospace: challenges of cer- tifying airborne AI, Front. Aerosp. Eng. 3 (2024) 1475139, publisher: Frontiers Media SA

    2024

  6. [14]

    Perez-Cerrolaza, J

    J. Perez-Cerrolaza, J. Abella, M. Borg, C. Donzella, J. Cerquides, F. J. Cazorla, C. Englund, M. Tauber, G. Nikolakopoulos, J. L. Flores, Artifi- cial intelligence for safety-critical systems in industrial and transportation domains: a survey, ACM Comput. Surv. 56 (7) (2024) 1...

    2024

  7. [15]

    Jabbour, V

    J. Jabbour, V . J. Reddi, Generative AI agents in autonomous machines: a safety perspective, Arxiv Prepr. Arxiv:2410,15489 (2024)

    2024

  8. [16]

    H. Kim, J. Ben-Othman, L. Mokdad, J. Son, C. Li, Research challenges and security threats to AI-driven 5G virtual emotion applications us- ing autonomous vehicles, drones, and smart devices, IEEE Netw. 34 (6) (2020) 288–294, publisher: IEEE

    2020

  9. [17]

    Y . Ma, W. Ye, C. Cui, H. Zhang, S. Xing, F. Ke, J. Wang, C. Miao, J. Chen, H. Rezatofighi, Others, Position: prospective of autonomous driving-multimodal llms world models embodied intelligence AI align- ment and mamba, in: Proceedings of the Winter Conference on Applica- tio...

    2025

  10. [18]

    Natarajan, E

    G. Natarajan, E. Elango, B. Sundaravadivazhagan, S. Rethinam, Artifi- cial intelligence algorithms and models for embodied agents: enhanc- ing autonomy in drones and robots, in: Building Embodied AI Systems: the Agents, the Architecture Principles, Challenges, and Application ...

    2025

  11. [19]

    D. B. Acharya, K. Kuppan, B. Divya, Agentic AI: autonomous intelli- gence for complex goals–a comprehensive survey, IEEE Access : Pract. Innov. Open Solut.Publisher: IEEE (2025)

    2025

  12. [20]

    E. E. Alves, D. Bhatt, B. Hall, K. Driscoll, A. Murugesan, J. Rushby, Considerations in assuring safety of increasingly autonomous systems, Tech. rep. (2018)

    2018

  13. [21]

    J. Tian, B. Wang, R. Guo, Z. Wang, K. Cao, X. Wang, Adversarial attacks and defenses for deep-learning-based unmanned aerial vehicles, IEEE In- ternet Things J. 9 (22) (2021) 22399–22409, publisher: IEEE

    2021

  14. [22]

    Hickling, N

    T. Hickling, N. Aouf, P. Spencer, Robust adversarial attacks detection based on explainable deep reinforcement learning for UA V guidance and planning, IEEE Trans. Intell. Veh. 8 (10) (2023) 4381–4394, publisher: IEEE

    2023

  15. [23]

    N. A. of Sciences, Medicine, D. on Engineering, P. Sciences, Aeronau- tics, S. E. Board, A. S. A. Committee, In-time aviation safety manage- ment: challenges and research for an evolving aviation system, National Academies Press, 2018

    2018

  16. [24]

    J. Ji, B. Hou, Z. Zhang, G. Zhang, W. Fan, Q. Li, Y . Zhang, G. Liu, S. Liu, S. Chang, Advancing the robustness of large language models through self-denoised smoothing, in: K. Duh, H. Gomez, S. Bethard (Eds.), Proceedings of the 2024 Conference of the North American Chap- ter...

    2024

  17. [25]

    Z. Ji, N. Lee, R. Frieske, T. Yu, D. Su, Y . Xu, E. Ishii, Y . J. Bang, A. Madotto, P. Fung, Survey of hallucination in natural language gen- eration, ACM Comput. Surv. 55 (12) (2023) 1–38, publisher: ACM New York, NY

    2023

  18. [26]

    Y . Dong, R. Mu, Y . Zhang, S. Sun, T. Zhang, C. Wu, G. Jin, Y . Qi, J. Hu, J. Meng, S. Bensalem, X. Huang, Safeguarding large language models: A survey (2024). arXiv:2406.02622. URL https://arxiv.org/abs/2406.02622

    2024 arXiv

  19. [27]

    Y . Dong, R. Mu, G. Jin, Y . Qi, J. Hu, X. Zhao, J. Meng, W. Ruan, X. Huang, Position: Building guardrails for large language models re- quires systematic design, in: R. Salakhutdinov, Z. Kolter, K. Heller, A. Weller, N. Oliver, J. Scarlett, F. Berkenkamp (Eds.), Proceedings o...

    2024

  20. [28]

    J. Hu, Y . Dong, X. Huang, Trust-oriented adaptive guardrails for large language models (2025). arXiv:2408.08959. URL https://arxiv.org/abs/2408.08959

    2025 arXiv

  21. [29]

    X. Yin, Y . Qi, J. Hu, Z. Chen, Y . Dong, X. Zhao, X. Huang, W. Ruan, TAIJI: textual anchoring for immunizing jailbreak images in vision lan- guage models, arXiv: 2503.10872 [cs.CV] (2025). URL https://arxiv.org/abs/2503.10872

    2025 arXiv

  22. [30]

    Motwani, M

    S. Motwani, M. Baranchuk, M. Strohmeier, V . Bolina, P. Torr, L. Ham- mond, C. Schroeder de Witt, Secret collusion among AI agents: multi- agent deception via steganography, Adv. Neural Inf. Process. Syst. 37 (2024) 73439–73486

    2024

  23. [31]

    R. Y . Lin, S. Ojha, K. Cai, M. Chen, Strategic collusion of LLM agents: market division in multi-commodity competitions, in: Language Gamifi- cation - Neurips 2024 Workshop, 2024. URL https://openreview.net/forum?id=X9vAImw5Yj

    2024

  24. [32]

    Kouvaros, A

    P. Kouvaros, A. Lomuscio, E. Pirovano, H. Punchihewa, Formal verifi- cation of open multi-agent systems, in: Proceedings of the 18th Interna- tional Conference on Autonomous Agents and Multiagent Systems, 2019, pp. 179–187

    2019

  25. [33]

    Hibbard, U

    M. Hibbard, U. Topcu, K. Hobbs, Guaranteeing safety via active-set in- variance filters for multi-agent space systems with coupled dynamics, in: 2022 American Control Conference (ACC), IEEE, 2022, pp. 430–436

    2022

  26. [34]

    Huang, M

    X. Huang, M. Kwiatkowska, M. Olejnik, Reasoning about cognitive trust in stochastic multiagent systems, ACM Trans. Comput. Log. (TOCL) 20 (4) (2019) 1–64, publisher: ACM New York, NY , USA

    2019

  27. [35]

    Q. Wang, Z. Wang, Y . Su, H. Tong, Y . Song, Rethinking the bounds of LLM reasoning: are multi-agent discussions the key?, in: L.-W. Ku, A. Martins, V . Srikumar (Eds.), Proceedings of the 62nd Annual Meet- ing of the Association for Computational Linguistics (volume 1: Long P...

    2024 doi

  28. [36]

    J. Hu, Y . Dong, S. Ao, Z. Li, B. Wang, L. Singh, G. Cheng, S. D. Ram- churn, X. Huang, Position: Towards a responsible llm-empowered multi- agent systems (2025). arXiv:2502.01714. URL https://arxiv.org/abs/2502.01714

    2025 arXiv

  29. [37]

    Cohen, E

    J. Cohen, E. Rosenfeld, Z. Kolter, Certified adversarial robustness via ran- domized smoothing, in: International Conference on Machine Learning, PMLR, 2019, pp. 1310–1320

    2019

  30. [38]

    Neyman, E

    J. Neyman, E. S. Pearson, IX. On the problem of the most efficient tests of statistical hypotheses, Philos. Trans. R. Soc. Lond., Contain. Pap. Math. Phys. Character 231 (694-706) (1933) 289–337, publisher: The Royal Society London. 9

    1933

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.