基于图学习的 MAS 拓扑设计多为「一对一」范式，每个任务域单独训练模型，对未见领域泛化差且无法复用跨任务的结构知识。OFA-MAS 用单一通用模型为任意自然语言描述的任务生成协作图：任务感知图状态编码器以稀疏门控过滤任务相关节点信息，混合专家（MoE）架构动态选择专门子网络驱动节点与边预测，并以规范拓扑预训练、LLM 生成数据条件预训练、经验图微调三阶段训练。六个基准上显著优于专用模型。
研究动机基于图学习的 MAS 拓扑设计多为「一对一」范式，每个任务域单独训练模型，对未见领域泛化差，也无法利用不同任务间共享的结构知识。
Multi-Agent Systems (MAS) offer a powerful paradigm for solving complex problems, yet their performance is critically dependent on the design of their underlying collaboration topology. As MAS become increasingly deployed in web services (e.g., search engines), designing adaptive topologies for diverse cross-domain user queries becomes essential. Current graph learning-based design methodologies often adhere to a ''one-for-one'' paradigm, where a specialized model is trained for each specific task domain. This approach suffers from poor generalization to unseen domains and fails to leverage shared structural knowledge across different tasks. To address this, we propose OFA-MAS, a one-for-all framework that generates adaptive collaboration graphs for any task described in natural language through a single universal model. Our approach integrates a Task-Aware Graph State Encoder (TAGSE) that filters task-relevant node information via sparse gating, and a Mixture-of-Experts (MoE) architecture that dynamically selects specialized sub-networks to drive node and edge prediction. We employ a three-stage training strategy: unconditional pre-training on canonical topologies for structural priors, large-scale conditional pre-training on LLM-generated datasets for task-topology mappings, and supervised fine-tuning on empirically validated graphs. Experiments across six diverse benchmarks show that OFA-MAS significantly outperforms specialized one-for-one models, generating highly adaptive MAS topologies. Code: https://github.com/Shiy-Li/OFA-MAS.
方法
GoAgent：以智能体群为单元的通信拓扑生成
GoAgent: Group-of-Agents Communication Topology Generation for LLM-based Multi-Agent Systems
可借鉴点「以群为原子单元自回归构图 + 信息瓶颈压缩跨群消息」为降低 MAS 通信开销提供了可复用机制，准确率与 token 消耗成对报告的方式也值得沿用。
Large language model (LLM)-based multi-agent systems (MAS) have demonstrated exceptional capabilities in solving complex tasks, yet their effectiveness depends heavily on the underlying communication topology that coordinates agent interactions. Within these systems, successful problem-solving often necessitates task-specific group structures to divide and conquer subtasks. However, most existing approaches generate communication topologies in a node-centric manner, leaving group structures to emerge implicitly from local connectivity decisions rather than modeling them explicitly, often leading to suboptimal coordination and unnecessary communication overhead. To address this limitation, we propose GoAgent (Group-of-Agents), a communication topology generation method that explicitly treats collaborative groups as the atomic units of MAS construction. Specifically, GoAgent first enumerates task-relevant candidate groups through an LLM and then autoregressively selects and connects these groups as atomic units to construct the final communication graph, jointly capturing intra-group cohesion and inter-group coordination. To mitigate communication redundancy and noise propagation inherent in expanding topologies, we further introduce a conditional information bottleneck (CIB) objective that compresses inter-group communication, preserving task-relevant signals while filtering out redundant historical noise. Extensive experiments on six benchmarks demonstrate the state-of-the-art performance of GoAgent with 93.84% average accuracy while reducing token consumption by about 17%.
方法
Hetero-Designer：异构LLM的MAS自动设计
Hetero-Designer: Automated Design of Multi-Agent Systems with Heterogeneous LLMs
ACL 2026·2026·CCF-A 会议·hetero-designer
异构LLMBinary-Star Transformer自回归图生成成本控制
自动 MAS 设计依赖同构大语言模型（LLM），限制整体智能与成本控制。作者首次提出基于异构 LLM 的 MAS 自动化设计（ADHM），并给出 Hetero-Designer：用 Binary-Star Transformer 编码查询、LLM 与角色间的依赖，在自回归图生成中构建异构 LLM 与角色组成的 Hetero-MAS。实验显示其性能领先、开销更低，且可扩展到未见的 LLM 与角色。
研究动机现有自动 MAS 设计依赖同构 LLM，既限制了系统整体智能，也难以在效果与成本之间取得平衡；异构 LLM 与角色的组合空间又缺少自动化设计手段。
可借鉴点把「选哪个 LLM」与「选哪个角色」一起放进自回归图生成，是异构 MAS 拓扑设计的可迁移范式；对未见 LLM 与角色的可扩展性也是该方向值得对标的评价维度。
LLM-based Multi-agent systems (MAS) have shown strong capabilities across a wide range of domains. Their success largely hinges on the collaboration topology design, which has emerged as a central research focus in the automated MAS design.However, existing approaches are fundamentally constrained by their reliance on homogeneous LLMs, which significantly limits overall system intelligence.In response to this limitation, we for the first time propose the concept of **Automated Design of Heterogeneous-LLMs-based MAS (ADHM)**.ADHM sheds light on a promising avenue for advancing collective intelligence, which focuses on the automated design of cost-effective MAS composed of diverse LLMsand roles to suit various queries.Toward this challenging goal, we propose **Hetero-Designer**, a novel pipeline that efficiently encodes intricate dependencies among queries, LLMs and roles through a novel Binary-Star Transformer and constructs Hetero-MAS in an autoregressive graph generation process. Extensive experiments demonstrate that **Hetero-Designer** is: (1) high-performing on various benchmarks, (2) economical in reducing overhead, (3) extensible to unseen LLMs and roles.
方法
ARG-Designer：自回归图生成的通信拓扑设计
Assemble Your Crew: Automatic Multi-agent Communication Topology Design via Autoregressive Graph Generation
现有 MAS 自动设计受限于「模板图修改」范式：智能体集合预定义、交互结构硬编码，对任务需求的适应性不足。本文把 MAS 设计重新表述为条件自回归图生成任务，联合设计系统组成与结构，并提出 ARG-Designer：以自然语言任务查询为条件从零构建协作图，依次确定所需智能体数量、从可扩展角色池中选择角色、并建立最优通信链路。六个基准上取得最优性能，token 效率与可扩展性显著更好。
研究动机现有 MAS 自动设计依赖「模板图修改」范式，智能体集合与交互结构都被预先固定，难以适配不同任务的独特需求。
可借鉴点「组成（智能体数量 + 角色）与结构（连边）联合、从零自回归生成」是当前 MAS 拓扑自动设计的代表性范式，可作为新方法的标准强基线。
Multi-agent systems (MAS) based on large language models (LLMs) have emerged as a powerful solution for dealing with complex problems across diverse domains. The effectiveness of MAS is critically dependent on its collaboration topology, which has become a focal point for automated design research. However, existing approaches are fundamentally constrained by their reliance on a template graph modification paradigm with a predefined set of agents and hard-coded interaction structures, significantly limiting their adaptability to task-specific requirements. To address these limitations, we reframe MAS design as a conditional autoregressive graph generation task, where both the system composition and structure are designed jointly. We propose ARG-Designer, a novel autoregressive model that operationalizes this paradigm by constructing the collaboration graph from scratch. Conditioned on a natural language task query, ARG-Designer sequentially and dynamically determines the required number of agents, selects their appropriate roles from an extensible pool, and establishes the optimal communication links between them. This generative approach creates a customized topology in a flexible and extensible manner, precisely tailored to the unique demands of different tasks. Extensive experiments across six diverse benchmarks demonstrate that ARG-Designer not only achieves state-of-the-art performance but also enjoys significantly greater token efficiency and enhanced extensibility. The source code of ARG-Designer is available at [this https URL](https://github.com/Shiy-Li/ARG-Designer).
结构搜索与动态选择3
方法
HELENA：互补拓扑并集上的层次化稀疏协同
HELENA: Hierarchical Sparse Coordination over a Union of Complementary Topologies for MAS
arXiv·2026·预印本·helena
拓扑并集蒙特卡洛树搜索行列式点过程稀疏协同
单一拓扑会限制推理轨迹，而把多个拓扑拼成复合图又会传播冗余噪声。HELENA 用蒙特卡洛树搜索与行列式点过程从互补候选拓扑中选出子集构建并集 MAS 图，再用层次化稀疏协同模块每步只激活稀疏子图、智能体间交换压缩的潜在摘要，并以局部自精修仅在有对比证据时改写决策单元。八个基准上全部最优，平均比最强基线提升 3.47 个百分点，MMLU-Pro 最高提升 10.34 个百分点。
主要方法先用蒙特卡洛树搜索（MCTS）结合行列式点过程（DPP）从互补候选拓扑中挑出子集，构成并集 MAS 图；再用层次化稀疏协同模块在每一步只激活一个稀疏子图，智能体之间交换压缩的潜在摘要以抑制噪声扩散；最后用局部自精修阶段定位存在差异证据的决策单元，只有当对比证据同时确认解侧失败与挑战者侧改进时才改写该单元。
可借鉴点「拓扑并集 + 每步稀疏子图激活 + 对比证据触发改写」可直接迁移到 MAS 拓扑搜索与抗噪声传播的设计中，DPP 也提供了一个可复用的去冗余拓扑子集选择指标。
LLM-based multi-agent systems (MAS) typically optimize a single topology, restricting reasoning to a narrow trajectory and limiting comprehensive analytical capacity. Naively merging multiple topologies into a composite graph introduces redundant noise propagation across irrelevant connections, degrading solution quality. To address this dilemma, we propose \textbf{Hierarchical Sparse Coordination over a Union of Complementary Topologies for MAS (HELENA)}, a multi-agent framework that balances diverse reasoning paths with sparse task-dependent execution. \helena{} constructs a union MAS graph from complementary candidate topologies selected via Monte Carlo Tree Search and Determinantal Point Process, broadening the reasoning trajectory for comprehensive analysis of complex problems. A Hierarchical Sparse Coordination module then activates only a sparse subgraph at each step while agents exchange compressed latent briefs to suppress redundant noise propagation. Finally, a Local Self-Refinement stage identifies decision units with discrepancy evidence and rewrites them only when contrastive evidence simultaneously confirms a reliable solution-side failure and a challenger-side improvement. Experiments across eight benchmarks show that \helena{} achieves state-of-the-art results on all benchmarks, with an average gain of \pctup{3.47} over the strongest baseline and up to \pctup{10.34} on MMLU-Pro, achieving larger improvements on harder benchmarks at a reasonable additional cost.
方法
AMAS：自适应确定多智能体通信拓扑
AMAS: Adaptively Determining Communication Topology for LLM-based Multi-agent System
EMNLP 2025·2025·CCF-B 会议·amas
动态图选择轻量级适配通信拓扑上下文敏感
传统 MAS 受限于人工设计、缺乏上下文响应能力的固定图拓扑，在不同负载上效果下降。AMAS 用动态图选择器重新定义基于大语言模型（LLM）的 MAS：借助轻量级 LLM 适配自动识别任务特定的最优图结构配置，摆脱单一通用模板，并利用输入固有属性为查询规划任务优化的智能体路径。在问答、数学推理与代码生成基准上跨多种 LLM 架构系统性优于单智能体与多智能体方法。
研究动机传统 MAS 架构受限于不灵活、手工设计的图拓扑，缺乏上下文响应能力，难以适配学术与商业场景中差异极大的工作负载。
可借鉴点把拓扑选择器实现为轻量级适配模块，是在推理开销可控的前提下做动态拓扑切换的可复用做法；「上下文敏感的结构适应性是高性能 MAS 的基本要求」也可作为引用性结论。
Although large language models (LLMs) have revolutionized natural language processing capabilities, their practical implementation as autonomous multi-agent systems (MAS) for industrial problem-solving encounters persistent barriers. Conventional MAS architectures are fundamentally restricted by inflexible, hand-crafted graph topologies that lack contextual responsiveness, resulting in diminished efficacy across varied academic and commercial workloads. To surmount these constraints, we introduce AMAS, a paradigm-shifting framework that redefines LLM-based MAS through a novel dynamic graph selector. This component autonomously identifies task-specific optimal graph configurations via lightweight LLM adaptation, eliminating the reliance on monolithic, universally applied structural templates. Instead, AMAS exploits the intrinsic properties of individual inputs to intelligently direct query trajectories through task-optimized agent pathways. Rigorous validation across question answering, mathematical deduction, and code generation benchmarks confirms that AMAS systematically exceeds state-of-the-art single-agent and multi-agent approaches across diverse LLM architectures. Our investigation establishes that context-sensitive structural adaptability constitutes a foundational requirement for high-performance LLM MAS deployments.
方法
HieraMAS：节点内LLM混合与节点间拓扑协同
HieraMAS: Optimizing Intra-Node LLM Mixtures and Inter-Node Topology for Multi-Agent Systems
Multi-agent systems (MAS) built on large language models (LLMs) have shown strong performance across many tasks. Most existing approaches improve only one aspect at a time, such as the communication topology, role assignment, or LLM routing, while treating each agent as a single, indivisible unit. This misses the opportunity to use mixtures of LLMs within an agent to strengthen role-specific abilities. We propose HieraMAS, a hierarchical collaboration framework that combines intra-node LLM mixtures with an inter-node communication topology. HieraMAS introduces supernodes, where each functional role is implemented by multiple heterogeneous LLMs using a propose-synthesis structure. Optimizing HieraMAS creates unique credit-assignment challenges: final task performance depends heavily on the underlying LLMs' capabilities, which can lead reinforcement methods to incorrectly reward suboptimal configurations. To address this, we use a two-stage algorithm: (1) multi-level reward attribution, which provides fine-grained feedback at both the node level and the overall system level; (2) graph classification for topology selection, which treats choosing the communication structure as a holistic decision rather than optimizing edges one by one. Experiments on reasoning and coding benchmarks show that HieraMAS substantially outperforms existing methods while also delivering better cost-performance trade-offs.
节点优化与编排框架4
方法
Unified-MAS：离线节点合成的自动MAS生成
Unified-MAS: Universally Generating Domain-Specific Nodes for Empowering Automatic Multi-Agent Systems
arXiv·2026·预印本·unified-mas
离线节点合成领域专用节点困惑度奖励架构解耦
自动 MAS 生成在医疗、法律等知识密集型领域遇瓶颈：静态通用节点库缺乏专业能力，在线即时生成节点又让编排器同时承担领域逻辑生成与拓扑优化，造成架构耦合。Unified-MAS 用离线节点合成解耦二者：基于搜索的节点生成先检索外部开放世界知识合成领域专用节点蓝图，再用困惑度引导的奖励迭代优化瓶颈节点逻辑。四个领域的四种基线上性价比更优，增益最高 14.2% 且成本显著下降。
研究动机现有自动 MAS 框架在知识密集型领域受限：静态通用节点库缺乏专业专长，而在线即时生成节点又让编排器同时承担领域逻辑生成与高层拓扑优化，造成严重的架构耦合。
可借鉴点「节点离线合成与拓扑编排解耦」是提升 MAS 领域适配性的可迁移思路，困惑度引导的奖励也可作为节点质量的自动评价信号。
Automatic Multi-Agent Systems (MAS) generation has emerged as a promising paradigm for solving complex reasoning tasks. However, existing frameworks are fundamentally bottlenecked when applied to knowledge-intensive domains (e.g., healthcare and law). They either rely on a static library of general nodes like Chain-of-Thought, which lack specialized expertise, or attempt to generate nodes on the fly. In the latter case, the orchestrator is not only bound by its internal knowledge limits but must also simultaneously generate domain-specific logic and optimize high-level topology, leading to a severe architectural coupling that degrades overall system efficacy. To bridge this gap, we propose Unified-MAS that decouples granular node implementation from topological orchestration via offline node synthesis. Unified-MAS operates in two stages: (1) Search-Based Node Generation retrieves external open-world knowledge to synthesize specialized node blueprints, overcoming the internal knowledge limits of LLMs; and (2) Reward-Based Node Optimization utilizes a perplexity-guided reward to iteratively enhance the internal logic of bottleneck nodes. Extensive experiments across four specialized domains demonstrate that integrating Unified-MAS into four Automatic-MAS baselines yields a better performance-cost trade-off, achieving up to a 14.2% gain while significantly reducing costs. Further analysis reveals its robustness across different designer LLMs and its effectiveness on conventional tasks such as mathematical reasoning.
框架
CFN：记忆驱动的MAS智能中间件
Scaling Multi-agent Systems: A Smart Middleware for Improving Agent Interactions
arXiv·2026·预印本·scaling-multi-agent-systems
中间件记忆驱动拓扑选择强化学习
MAS 走向持续运行的生态后，智能体直连通信暴露上下文碎片化、随机幻觉、安全边界僵硬与拓扑管理低效等问题。本文提出 Cognitive Fabric Nodes（CFN）中间件层，把记忆从存储提升为主动功能基底，驱动拓扑选择、语义接地、安全策略执行与提示变换四项能力，各能力由强化学习与优化算法动态调控。在 HotPotQA 与 MuSiQue 上性能提升超过 10%。
关键实验在多智能体环境下于 HotPotQA 与 MuSiQue 两个数据集上评估，相比智能体直连通信，两个数据集上的性能均提升超过 10%。
可借鉴点把拓扑选择与安全策略统一收拢到中间件层，是架构级可迁移思路；「记忆作为驱动拓扑选择的主动基底」也为记忆增强的 MAS 安全设计提供了新接口。
As Large Language Model (LLM) based Multi-Agent Systems (MAS) evolve from experimental pilots to complex, persistent ecosystems, the limitations of direct agent-to-agent communication have become increasingly apparent. Current architectures suffer from fragmented context, stochastic hallucinations, rigid security boundaries, and inefficient topology management. This paper introduces Cognitive Fabric Nodes (CFN), a novel middleware layer that creates an omnipresent "Cognitive Fabric" between agents. Unlike traditional message queues or service meshes, CFNs are not merely pass-through mechanisms; they are active, intelligent intermediaries. Central to this architecture is the elevation of Memory from simple storage to an active functional substrate that informs four other critical capabilities: Topology Selection, Semantic Grounding, Security Policy Enforcement, and Prompt Transformation. We propose that each of these functions be governed by learning modules utilizing Reinforcement Learning (RL) and optimization algorithms to improve system performance dynamically. By intercepting, analyzing, and rewriting inter-agent communication, the Cognitive Fabric ensures that individual agents remain lightweight while the ecosystem achieves coherence, safety, and semantic alignment. We evaluate the effectiveness of the CFN on the HotPotQA and MuSiQue datasets in a multi-agent environment and demonstrate that the CFN improves performance by more than 10\% on both datasets over direct agent to agent communication.
框架
MASFactory：Vibe Graphing编排框架
MASFactory: A Graph-centric Framework for Orchestrating LLM-Based Multi-Agent Systems with Vibe Graphing
关键实验摘要未给出量化结果（在七个公开基准上验证了代表性 MAS 方法的复现一致性与 Vibe Graphing 的有效性，未报告具体指标数值）。
可借鉴点「自然语言意图 → 可编辑工作流规范 → 可执行图」的两级编译与拓扑预览能力，为 MAS 拓扑的可审计、可复现构建提供了工程范式；复现一致性也可作为拓扑类工作的补充评测维度。
Large language model-based (LLM-based) multi-agent systems (MAS) are increasingly used to extend agentic problem solving via role specialization and collaboration. MAS workflows can be naturally modeled as directed computation graphs, where nodes execute agents or sub-workflows and edges encode dependencies and message passing. However, implementing complex graph workflows in current frameworks still requires substantial manual effort, offers limited reuse, and makes it difficult to integrate heterogeneous external context sources. To overcome these limitations, we present MASFactory, a graph-centric framework for orchestrating LLM-based MAS. It introduces Vibe Graphing, a human-in-the-loop approach that compiles natural-language intent into an editable workflow specification and then into an executable graph. In addition, the framework provides reusable components, skill support, multimodal message handling, and pluggable context integration, as well as a visualizer for topology preview, runtime tracing, and human-in-the-loop interaction. We evaluate MASFactory on seven public benchmarks, validating both reproduction consistency for representative MAS methods and the effectiveness of Vibe Graphing. Our code ([this https URL](https://github.com/BUPT-GAMMA/MASFactory), licensed under Apache-2.0) and video demonstration ([this https URL](https://youtu.be/ANynzVfY32k)) are publicly available.
方法
AgentDropout：动态剔除智能体的高效协同
AgentDropout: Dynamic Agent Elimination for Token-Efficient and High-Performance LLM-Based Multi-Agent Collaboration
可借鉴点用邻接矩阵的可学习优化做动态剔除，是降低 MAS 通信开销的轻量可迁移手段；分项报告 prompt/completion token 消耗并验证领域迁移与结构鲁棒性的做法值得复用。
Multi-agent systems (MAS) based on large language models (LLMs) have demonstrated significant potential in collaborative problem-solving. However, they still face substantial challenges of low communication efficiency and suboptimal task performance, making the careful design of the agents' communication topologies particularly important. Inspired by the management theory that roles in an efficient team are often dynamically adjusted, we propose AgentDropout, which identifies redundant agents and communication across different communication rounds by optimizing the adjacency matrices of the communication graphs and eliminates them to enhance both token efficiency and task performance. Compared to state-of-the-art methods, AgentDropout achieves an average reduction of 21.6% in prompt token consumption and 18.4% in completion token consumption, along with a performance improvement of 1.14 on the tasks. Furthermore, the extended experiments demonstrate that AgentDropout achieves notable domain transferability and structure robustness, revealing its reliability and effectiveness. We release our code at [this https URL](https://github.com/wangzx1219/AgentDropout).
拓扑安全与韧性3
方法
ResMAS：LLM多智能体系统的韧性优化
ResMAS: Resilience Optimization in LLM-based Multi-agent Systems
arXiv·2026·预印本·resmas
韧性优化拓扑生成器奖励模型提示优化
LLM-MAS 常跨设备与环境分布部署，易受智能体故障等扰动影响，而现有工作多在被攻击后被动检测与缓解，缺少主动设计韧性系统的思路。作者发现通信拓扑与提示设计均显著影响韧性，据此提出两阶段 ResMAS：先用奖励模型预测 MAS 韧性，再以强化学习训练拓扑生成器为任务自动设计韧性拓扑；并以拓扑感知的提示优化按智能体间的连接与交互精修提示。多任务实验显示韧性显著提升，并能泛化到新任务与新模型。
主要方法ResMAS 采用两阶段流程：（1）先训练一个奖励模型来预测 MAS 的韧性，再以该奖励用强化学习训练拓扑生成器，为具体任务自动设计韧性拓扑；（2）引入拓扑感知的提示优化，根据每个智能体与其他智能体的连接和交互关系精修其提示。
关键实验摘要未给出量化结果（报告在一系列任务与多种约束下显著提升 MAS 韧性，并对新任务与新模型表现出较强泛化能力）。
可借鉴点「用奖励模型预测韧性 + 强化学习生成拓扑」把鲁棒性从被动防御转为主动设计，是可迁移的 MAS 韧性管线；拓扑感知的提示优化也说明拓扑与提示需要联合优化。
Large Language Model-based Multi-Agent Systems (LLM-based MAS), where multiple LLM agents collaborate to solve complex tasks, have shown impressive performance in many areas. However, MAS are typically distributed across different devices or environments, making them vulnerable to perturbations such as agent failures. While existing works have studied the adversarial attacks and corresponding defense strategies, they mainly focus on reactively detecting and mitigating attacks after they occur rather than proactively designing inherently resilient systems. In this work, we study the resilience of LLM-based MAS under perturbations and find that both the communication topology and prompt design significantly influence system resilience. Motivated by these findings, we propose ResMAS: a two-stage framework for enhancing MAS resilience. First, we train a reward model to predict the MAS's resilience, based on which we train a topology generator to automatically design resilient topology for specific tasks through reinforcement learning. Second, we introduce a topology-aware prompt optimization method that refines each agent's prompt based on its connections and interactions with other agents. Extensive experiments across a range of tasks show that our approach substantially improves MAS resilience under various constraints. Moreover, our framework demonstrates strong generalization ability to new tasks and models, highlighting its potential for building resilient MASs.
方法
小世界网络视角下的多智能体重思
Rethinking Multi-Agent Intelligence Through the Lens of Small-World Networks
Large language models (LLMs) have enabled multi-agent systems (MAS) in which multiple agents argue, critique, and coordinate to solve complex tasks, making communication topology a first-class design choice. Yet most existing LLM-based MAS either adopt fully connected graphs, simple sparse rings, or ad-hoc dynamic selection, with little structural guidance. In this work, we revisit classic theory on small-world (SW) networks and ask: what changes if we treat SW connectivity as a design prior for MAS? We first bridge insights from neuroscience and complex networks to MAS, highlighting how SW structures balance local clustering and long-range integration. Using multi-agent debate (MAD) as a controlled testbed, experiment results show that SW connectivity yields nearly the same accuracy and token cost, while substantially stabilizing consensus trajectories. Building on this, we introduce an uncertainty-guided rewiring scheme for scaling MAS, where long-range shortcuts are added between epistemically divergent agents using LLM-oriented uncertainty signals (e.g., semantic entropy). This yields controllable SW structures that adapt to task difficulty and agent heterogeneity. Finally, we discuss broader implications of SW priors for MAS design, framing them as stabilizers of reasoning, enhancers of robustness, scalable coordinators, and inductive biases for emergent cognitive roles.
框架
MASTER：角色与拓扑探索的MAS安全框架
MASTER: Multi-Agent Security Through Exploration of Roles and Topological Structures — A Comprehensive Framework
arXiv·2025·预印本·master
MAS安全角色配置信息流攻击与防御
基于大语言模型（LLM）的 MAS 凭借专门化角色与协作交互展现强大能力，却也放大了攻击下的安全风险。MASTER 是面向 MAS 安全的研究框架，聚焦不同场景下的角色配置与拓扑结构，提供自动化构建流程与基于信息流的交互范式；并设计场景自适应的可扩展攻击策略，用角色与拓扑信息为智能体动态分配领域特定攻击任务。实验表明该攻击在多数模型上破坏潜力显著，防御策略也显著增强 MAS 韧性。
主要方法MASTER 提供不同 MAS 设置的自动化构建流程与基于信息流的交互范式；在此之上设计场景自适应、可扩展的攻击策略，利用角色与拓扑信息动态地把针对特定领域的攻击任务分配给协作智能体执行，并给出相应的防御策略。
关键实验摘要未给出量化结果（报告该攻击策略在大多数模型上具有显著破坏潜力，相应防御策略显著增强 MAS 在多种场景下的韧性）。
可借鉴点把「角色配置 × 拓扑结构」作为安全评测的二维变量、并以信息流作为交互范式，是 MAS 拓扑安全研究可直接复用的实验底座与攻击面枚举方式。
Large Language Models (LLMs)-based Multi-Agent Systems (MAS) exhibit remarkable problem-solving and task planning capabilities across diverse domains due to their specialized agentic roles and collaborative interactions. However, this also amplifies the severity of security risks under MAS attacks. To address this, we introduce MASTER, a novel security research framework for MAS, focusing on diverse Role configurations and Topological structures across various scenarios. MASTER offers an automated construction process for different MAS setups and an information-flow-based interaction paradigm. To tackle MAS security challenges in varied scenarios, we design a scenario-adaptive, extensible attack strategy utilizing role and topological information, which dynamically allocates targeted, domain-specific attack tasks for collaborative agent execution. Our experiments demonstrate that such an attack, leveraging role and topological information, exhibits significant destructive potential across most models. Additionally, we propose corresponding defense strategies, substantially enhancing MAS resilience across diverse scenarios. We anticipate that our framework and findings will provide valuable insights for future research into MAS security challenges.
拓扑机理实证3
实证
关系先验作为LLM-MAS的收敛压力
Relational Priors as Convergence Pressure in LLM-Based Multi-Agent Systems
arXiv·2026·预印本·relational-priors-as-convergence
关系先验符号网络收敛压力多智能体辩论
MAS 的角色、辩论协议与聚合规则会隐含智能体间的社会预期。本文用最小符号网络形式化关系先验，在任务协议固定时把关系语义的自然语言描述注入系统提示。公共资源治理模拟与多智能体辩论显示，关系先验主要起收敛压力作用：关系越正向越易协调，在效用奖励一致性的任务上有帮助，却不能可靠提升准确率——客观问答辩论中一致率上升而正确性条件化的共识未必改善甚至下降，效果还随模型骨干、关系类型与拓扑而变。
可借鉴点关系先验不应作为 MAS 的默认附加项；评估提示层干预时应引入「正确性条件化一致性」指标并始终与无先验基线对照，这对拓扑与提示的安全加固同样适用。
Large language model-based multi-agent systems (LLM-MAS) are designed through roles, debate protocols, and aggregation rules. These choices create implicit social expectations: agents may be expected to trust, challenge, defer to, or collaborate with peers. We study the effects of making inter-agent relation semantics explicit. We use a minimal signed-network formulation of relational priors and inject natural-language renderings into agent system prompts while holding the task protocol fixed. Across a commons-governance simulation and multi-agent debate, relational priors primarily act as convergence pressure: increasing relational positivity tends to make agents coordinate or agree more readily. This pressure can help when utility rewards behavioral alignment, as in sustainable resource governance and subjective consensus. It does not, however, reliably improve accuracy. In objective QA debates, higher positivity can increase agreement even when correctness-conditioned agreement does not improve and may decline in some settings. Effects vary by model backbone, relation type, and topology; explicit neutrality is not equivalent to omitting relational framing. We argue that relational priors should not be a default add-on for LLM-MAS. Their safer use is diagnostic and task-specific: compare against a no-prior baseline, monitor correctness-conditioned metrics when truth matters, and omit the relational layer when validation does not justify it.
实证
多智能体拓扑结构对协作文本事实一致性的影响
The Influence of the Topological Structure of Multiagent Systems on the Factual Consistency of Collaboratively Generated Text
This paper addresses the issues of factual errors and “error amplification” in the collaborative text generation task of multi-agent systems (MAS). It designs and explores the impact of two major topological structures, Pipeline and Parallel, as well as different agent configurations on the factual consistency of generated texts, and verifies the existence of the error amplification effect, while exploring its associated patterns. This paper integrates GAIR-NLP/FacTool as the factchecking backend and designs 12 experimental configurations (2 single-agent baselines +10 multi-agent configurations) to systematically evaluate the performance of Qwen-Plus and Qwen-Max under pure model, hybrid model, positional influence, and identity influence settings. Experimental data show that the single-agent Qwen-Max baseline performs the best with no error amplification phenomenon; in multi-agent systems, the overall performance of the Parallel topology is significantly better than that of the Pipeline topology; and experimental configurations such as identity and position also affect the factual consistency of the text to varying degrees. This paper reveals the regulatory role of multi-agent topological structures on factual consistency and provides data support and practical guidance for the design of collaborative systems with low error amplification rates. For more details about the code, please refer to: HenryHu1031/Evaluation-of-Fact-Consistency-Emergence-in-Multi-Agent-Text-Generation.
实证
LLM多智能体从众动态：拓扑与自我社会加权
Conformity Dynamics in LLM Multi-Agent Systems: The Roles of Topology and Self-Social Weighting
可借鉴点「置信度归一化池化 + 自我/社会权重」是可直接复用的决策聚合算子；「连接度上升 → 收敛更快但 wrong-but-sure 级联风险更高」是 MAS 拓扑安全设计必须纳入权衡的结论。
Large Language Models (LLMs) are increasingly instantiated as interacting agents in multi-agent systems (MAS), where collective decisions emerge through social interaction rather than independent reasoning. A fundamental yet underexplored mechanism in this process is conformity, the tendency of agents to align their judgments with prevailing group opinions. This paper presents a systematic study of how network topology shapes conformity dynamics in LLM-based MAS through a misinformation detection task. We introduce a confidence-normalized pooling rule that controls the trade-off between self-reliance and social influence, enabling comparisons between two canonical decision paradigms: Centralized Aggregation and Distributed Consensus. Experimental results demonstrate that network topology critically governs both the efficiency and robustness of collective judgments. Centralized structures enable immediate decisions but are sensitive to hub competence and exhibit same-model alignment biases. In contrast, distributed structures promote more robust consensus, while increased network connectivity speeds up convergence but also heightens the risk of wrong-but-sure cascades, in which agents converge on incorrect decisions with high confidence. These findings characterize the conformity dynamics in LLM-based MAS, clarifying how network topology and self-social weighting jointly shape the efficiency, robustness, and failure modes of collective decision-making.
后验拓扑优化3
执行拓扑生成与压缩2
方法
HeGFlow：基于异构图学习的多智能体工作流优化
Optimizing multi-agent workflows via heterogeneous graph learning
Information Processing & Management·2027·一区期刊·optimizing-multi-agent-workflows-via代码 ↗
Large Language Model (LLM)-based multi-agent systems (MAS) have shown promise for complex task solving, yet effective workflow design remains challenging due to poor scalability, limited use of historical context, and insufficient modeling of agent tool interactions in existing methods. To address these limitations, we propose **He**terogeneous **G**raph-based work**Flow** optimization (HeGFlow), which models agents, tools, and the execution topology between agents and tools as interconnected graph components, transforming the design of MAS workflow into a heterogeneous graph adjacency matrix optimization problem. To efficiently explore the vast search space, HeGFlow introduces a two-stage matrix training process guided by a subgraph sampling strategy. Extensive experiments across six complex domains show that HeGFlow improves the average score of smaller LLM (e.g., Qwen3-8B) by 12.4%, enabling it to match or even surpass the performance of much larger models. Furthermore, HeGFlow achieves the best average performance of 79.7 on four widely-used benchmarks, which consistently outperforms existing manually design methods by an average of 3.77.8%, and surpasses the state-of-the-art automated workflow optimization methods by an average of 0.96.7%. Further experiments demonstrate that our graph-based approach achieves strong performance while maintaining low token consumption, establishing a new paradigm for scalable and effective MAS workflow generation. Code is available at [https://anonymous.4open.science/r/Heterogeneous-graph_MAS-B28D/](https://anonymous.4open.science/r/Heterogeneous-graph_MAS-B28D/).
框架
AgentSlimming：面向高效低成本的多智能体系统压缩
AgentSlimming: Towards Efficient and Cost-Aware Multi-Agent Systems
Large Language Model-based Multi-Agent Systems (MAS) have demonstrated remarkable capabilities in complex tasks. However, manually designing optimal communication topologies is labor-intensive, while automated expansion methods often result in bloated structures with redundant agents, leading to excessive token consumption. To address this problem, we introduce AgentSlimming, a plug-and-play compression framework for graph-structured multi-agent workflows. Motivated by the AgentPruner and AgentQuant in neural networks, AgentSlimming compresses workflows by firstly estimate the importance score of each agent with a hybrid mechanism, and then removing redundant agents or replacing them with low-cost ones, where each operation is then validated with a baseline-anchored acceptance rule to prevent performance collapse. Experiments show that AgentSlimming reduces average token cost by up to 78.9% with negligible performance degradation, and even sometimes improves accuracy, achieving a strong Pareto-optimal trade-off between cost and quality.
故障节点拓扑重构1
方法
基于深度学习的多智能体系统网络安全一致性控制
Consensus Control for Network Security in Multi-agent Systems Based on Deep Learning
Chinese Intelligent Systems Conference·2025·会议·consensus-control-for-network-security
With the widespread application of Multi-Agent Systems (MAS) in complex networks, their robustness and consistency under node failures or network attacks have become critical challenges. This paper proposes a solution combining deep learning-based attack detection and a Local Topology Optimization Algorithm (LTOA) to enhance the stability and security of MAS in complex environments. The improved ResNet-50 model was trained on the CSE-CIC-IDS 2018 dataset, incorporating key enhancements such as the Squeeze-and-Excitation Block (SEBlock), Multi-Head Self-Attention Mechanism (MHSA), Depthwise Separable Convolution, and Bidirectional LSTM (Bi-LSTM). These modifications significantly improved the model’s feature extraction capability and time-series modeling performance. Following attack detection, this paper introduces a topology reconstruction strategy based on LTOA. The proposed method removes failed nodes and prioritizes their replacement with the neighboring nodes of the lowest degree, thereby preserving the original topology structure, minimizing communication overhead, and reducing topology perturbations. Additionally, Kruskal’s algorithm is integrated to construct a Minimum Spanning Tree (MST), ensuring global network connectivity and communication efficiency. Experimental results demonstrate that the proposed method not only achieves high-precision network attack detection but also facilitates rapid topology reconstruction after node failures. This significantly enhances the robustness and consistency control of the system, providing effective technical support for the stable operation of MAS in complex network environments.
拓扑自适应进化11
能力与拓扑协同进化2
框架
SkillGraph：多模态图拓扑的自进化协同
SkillGraph: Self-Evolving Multi-Agent Collaboration with Multimodal Graph Topology
Scaling vision-language models into Visual Multiagent Systems (VMAS) is hindered by two coupled issues. First, communication topologies are fixed before inference, leaving them blind to visual content and query context; second, agent reasoning abilities remain static during deployment. These issues reinforce each other: a rigid topology fails to leverage richer agent expertise, while static agents lack incentives to specialize for a given query. We address this with SkillGraph, a joint framework that evolves both agent expertise and communication topology. Within this framework, a Multimodal Graph Transformer (MMGT) encodes visual tokens, instruction semantics and active skill embeddings to predict a query-conditioned collaboration graph, replacing hand-crafted routing with dynamic, content-aware information flow. Complementing this, a Skill Designer distills and refines reasoning heuristics from failure cases, constructing a self-evolving multimodal Skill Bank. Crucially, updated skill embeddings are fed back into the MMGT, enabling the topology to adapt alongside capability growth. Experiments show that SkillGraph achieves consistent improvements across four benchmarks, five common MAS structures and four base models. Code is available at [this https URL](https://github.com/niez233/skillgraph).
框架
TacoMAS：拓扑与能力的测试时共演化
TacoMAS: Test-Time Co-Evolution of Topology and Capability in LLM-based Multi-Agent Systems
研究动机现有自进化 MAS 要么在推理时固定学到的拓扑，要么只调整拓扑或能力中的一轴，缺少关于「两轴必须联合演化」的实证与理论依据。
解决问题如何在测试时联合演化 MAS 的能力与拓扑，并处理两者时间尺度不同所带来的协调稳定性问题。
主要方法TacoMAS 把 MAS 推理建模为在线图自适应（节点是具角色化能力的智能体、边是通信拓扑）：快环用轨迹级反馈持续更新智能体专长以应对新出现的子任务，慢环由元 LLM 驱动的拓扑循环执行智能体出生-死亡操作（边编辑、智能体增设与删除）；论文进一步论证该快慢设计使 MAS 演化趋向任务条件下的稳定均衡。
关键实验在 4 个基准上超过近 20 个多智能体基线，相对最强基线平均提升 13.3%。
可借鉴点「能力快环 + 拓扑慢环」的双时间尺度节奏有理论与实证支撑，可用于抑制拓扑频繁抖动导致的 MAS 协调失稳。
Multi-agent systems (MAS) have emerged as a promising paradigm for solving complex tasks. Recent work has explored self-evolving MAS that automatically optimize agent capabilities or communication topologies. However, existing methods either learn a topology that remains fixed at inference time or adapt only the topology or capability during inference. We empirically and theoretically show that effective test-time evolution requires jointly adapting both axes, but on different time scales: capabilities should update rapidly to handle emerging subtasks, while the topology should evolve more slowly to preserve coordination stability. We then introduce TacoMAS, a test-time co-evolution framework for dynamic MAS. TacoMAS formulates MAS inference as a task of online graph adaptation, where nodes represent agents with role-specific capabilities and edges define their communication topology. During inference, a fast capability loop updates agent expertise using trajectory-level feedback, while a slow meta-LLM-driven topology loop performs agents' birth-death operations on MAS, including edge edit, agent addition, and agent removal. We further show that this fast-slow design drives MAS evolution toward a task-conditioned stable equilibrium. Experiments on four benchmarks demonstrate that TacoMAS outperforms nearly 20 multi-agent baselines, achieving an average improvement of 13.3% over the strongest baseline. The codes are released at [this https URL](https://github.com/chenxu2-gif/TacoMAS-MultiAgent).
经验复用与持续适应3
方法
EMAS：证据引导修订稳定 MAS 进化
EMAS: Stabilizing Multi-Agent System Evolution through Evidence-Guided Revision
arXiv·2026·预印本·emas
拓扑与提示修订经验复用配对验证token 成本
MAS 自动设计多在初始阶段优化提示与拓扑后即冻结部署，新样本经验难以沉淀为可复用更新。EMAS 把轨迹转为结构化诊断，仅在诊断跨样本重复时生成候选修订，并与当前 MAS 做配对验证后才采纳。在 4 个基准、2 个 LLM 上，两个进化轮次内任务加权准确率相对提升 6.30% 与 20.10%；MBPP 上由 55.09% 升至 89.12%，每任务 token 用量下降 62.2%。
研究动机现有 MAS 自动设计在初始阶段一次性优化提示与拓扑，之后部署时不再更新，样本经验无法沉淀为可复用的系统更新；同时准确性导向的设计常伴随高 token 成本。
解决问题如何在不更新 LLM 参数的前提下，把新样本经验转化为可复用的 MAS 拓扑与提示修订，并同时兼顾准确率与成本两个目标。
主要方法EMAS 将执行轨迹转为结构化诊断，每条诊断指定一个修订操作及其作用目标；只有当同一诊断跨多个样本重复出现时才生成候选修订，且修订必须通过与当前 MAS 的配对验证（达到准确率或成本对应的接受准则）才被应用，从而迭代式地演化拓扑与提示。
Many methods for automated multi-agent system design optimize prompts and topologies during an initial design stage and then deploy the resulting system unchanged on subsequent samples. Experience from these samples is rarely consolidated into reusable system updates, while accuracy-oriented designs may incur high token costs. We introduce EMAS (Evolving Multi-Agent System), which uses this experience to revise MAS topology and prompts without updating LLM parameters, either to improve accuracy or to reduce cost. EMAS converts traces into structured diagnoses that specify a revision operation and target. It generates a candidate revision only when the same diagnosis recurs across samples and applies it only if paired validation against the current MAS meets the corresponding acceptance criterion. Across four benchmarks and two LLMs, EMAS attains the highest task-weighted overall accuracy for both backbones and is best or tied in six of eight model--benchmark settings. Within two evolution epochs, EMAS achieves relative gains of 6.30% and 20.10% in task-weighted accuracy on Kimi-K2-6 and Qwen3.6-27B, respectively. On MBPP with Qwen3.6-27B, EMAS raises accuracy from 55.09% to 89.12% while reducing token use per task by 62.2%. These results show that EMAS can turn experience from new samples into reusable updates to MAS topology and prompts.
方法
MasFACT：几何感知后验迁移的持续拓扑学习
MasFACT: Continual Multi-Agent Topology Learning via Geometry-Aware Posterior Transfer
关键实验摘要未给出量化结果（摘要仅说明在类、领域、任务三级持续设置下持续提升平均准确率并减少拓扑遗忘，优于强拓扑生成与基于重放的基线，且可无缝挂接到不同 MAS 拓扑生成器）。
可借鉴点「拓扑遗忘」这一失效模式，加上融合 Gromov-Wasserstein 迁移与 PAC-Bayes 保守后验的组合，可直接复用到跨任务 MAS 拓扑库的稳定性评估与防护设计。
Multi-agent systems (MAS) powered by large language models (LLMs) have emerged as a powerful paradigm for complex problem solving, where performance critically depends on the underlying inter-agent communication topology. However, existing topology generation methods mainly optimize for isolated tasks, while real-world deployments involve streams of evolving tasks, requiring previously effective collaboration patterns to be retained and reused rather than rediscovered or overwritten. We identify a previously underexplored failure mode, \emph{topology forgetting}, in which adapting to new tasks shifts the topology generator away from communication structures required by earlier tasks. This issue stems from cross-task misalignment in both agent-level functional semantics and relational communication structures. To address this challenge, we propose \textbf{\textsc{MasFACT}}, a geometry-aware posterior transfer framework that preserves and reuses historical collaboration knowledge as transferable topology priors. We transfer these priors across task-specific agent spaces through Fused Gromov-Wasserstein optimal transport and perform PAC-Bayes-guided conservative posterior adaptation to balance task-specific plasticity with structural stability. Experiments across class-, domain-, and task-level continual settings demonstrate that \textsc{MasFACT} consistently improves average accuracy while reducing topology forgetting compared to strong topology generation and replay-based baselines, and can be seamlessly integrated with different MAS topology generators.
防御
OpenEvoShield：开放世界攻击的持续防御
OpenEvoShield: Dual Non-Stationary Continual Defense for Open-World Multi-Agent System Attacks
关键实验摘要未给出量化结果（在 5 个基准、4 种 MAS 拓扑上跨 100 轮部署，摘要称其优于静态与持续学习基线，能检出多数此前未见攻击并保持较低误报率）。
可借鉴点「非对称学习率 + EWC 正则化策略集成 + 节点/子图/图多粒度能量检测」为 MAS 通信层注入防御提供了可复用的持续学习骨架，且对未见攻击的检出率与误报率应成对报告。
LLM-based multi-agent systems (LLM-MAS) are increasingly deployed in safety-critical applications, where adversaries inject malicious instructions through inter-agent communication to propagate harmful behaviors. Unlike static threats, these attacks are doubly dynamic: adversaries refine injection strategies against deployed defenses while normal-agent behavior drifts with system expansion. Existing defenses treat deployment as a closed-world problem and degrade rapidly once either distribution shifts beyond training coverage. We propose OpenEvoShield, a co-evolutionary continual defense framework for LLM-MAS. An asymmetric rate controller (M1) decouples fast attack-side and slow normal-side learning rates from dual drift signals. A normal-boundary updater (M2) maintains a dynamic behavioral boundary at the slow rate, while an EWC-regularized policy ensemble (M3) fast-adapts without catastrophic forgetting. An energy-based multi-granularity detector (M4) fuses node-, subgraph-, and graph-level evidence to classify novel attacks as out-of-distribution. Experiments over 100 deployment rounds across five benchmarks and four MAS topologies show that OpenEvoShield outperforms static and continual baselines, detecting most previously unseen attacks while keeping false positive rates low.
动态路由与稀疏激活2
方法
DMoA：可微分混合智能体激发群体智能
Differentiable Mixture-of-Agents Incentivizes Swarm Intelligence of Large Language Models
arXiv·2026·预印本·differentiable-mixture-of-agents
可微分路由稀疏激活预测熵循环结构
现有 MAS 多依赖预定义或预编译的通信拓扑，限制了应对动态任务需求的灵活性与适应性。DMoA 在推理的每个步骤动态路由并激活智能体，隐式模拟多种通信拓扑：其路由机制可微分且上下文感知，利用循环结构融合历史与上下文信息，逐步产生稀疏的智能体激活；并以预测熵作为自监督信号优化路由，无需外部标注即可完成测试时自适应。在 9 个基准上取得最优性能，同时展现出较强的效率、鲁棒性与集成能力。
研究动机现有 MAS 通常依赖预定义或预编译的通信拓扑，灵活性不足，难以适应动态变化的推理需求。
解决问题如何让 MAS 在推理过程中弹性地动态路由与激活智能体，从而隐式覆盖多种通信拓扑并适配演化中的任务需求。
Recent advances in Large Language Models (LLMs) have catalyzed the development of multi-agent systems (MAS) for complex reasoning tasks. However, existing MAS typically rely on pre-defined or pre-compiled communication topologies, which limits their flexibility and adaptability to dynamic task requirements. In this work, we propose Differentiable Mixture-of-Agents (DMoA), a self-evolving multi-agent framework that enables elastic and adaptive agent collaboration during inference. Instead of statically constructing workflows, DMoA dynamically routes and activates agents at each reasoning step, allowing the system to implicitly simulate diverse communication topologies and adapt to evolving demands. To achieve this, we design a differentiable, context-aware routing mechanism that leverages recurrent structures to incorporate historical and contextual information, producing sparse agent activations in a step-wise manner. Furthermore, we introduce predictive entropy as self-supervised signals to optimize the routing process, enabling efficient test-time adaptation without external annotations. Extensive experiments across 9 benchmarks demonstrate that DMoA achieves state-of-the-art performance while exhibiting strong efficiency, robustness, and ensembling capabilities.
方法
BiRouter：自组织 MAS 的双准则下一跳路由
Augmented Runtime Collaboration for Self-Organizing Multi-Agent Systems: A Hybrid Bi-Criteria Routing Approach
可借鉴点「长期重要性 + 上下文连续性」双准则配合动态信誉，是去中心化 MAS 仅凭局部信息做路由决策的可复用打分设计，也提示拓扑安全可以落到路由层的信誉机制上。
LLM-based multi-agent systems have demonstrated significant capabilities across diverse domains. However, the task performance and efficiency are fundamentally constrained by their collaboration strategies. Prevailing approaches rely on static topologies and centralized global planning, a paradigm that limits their scalability and adaptability in open, decentralized networks. Effective collaboration planning in distributed systems using only local information thus remains a formidable challenge. To address this, we propose BiRouter, a novel dual-criteria routing method for Self-Organizing Multi-Agent Systems (SO-MAS). This method enables each agent to autonomously execute “next-hop” task routing at runtime, relying solely on local information. Its core decision-making mechanism is predicated on balancing two metrics: (1) the ImpScore, which evaluates a candidate agent's long-term importance to the overall goal, and (2) the GapScore, which assesses its contextual continuity for the current task state. Furthermore, we introduce a dynamically updated reputation mechanism to bolster system robustness in untrustworthy environments and have developed a large-scale, cross-domain dataset, comprising thousands of annotated task-routing paths, to enhance the model's generalization. Extensive experiments demonstrate that BiRouter achieves superior performance and token efficiency over existing baselines, while maintaining strong robustness and effectiveness in information-limited, decentralized, and untrustworthy settings.
调度式时空协同2
方法
ST-EVO：通信拓扑的生成式时空进化
ST-EVO: Towards Generative Spatio-Temporal Evolution of Multi-Agent Communication Topologies
arXiv·2026·预印本·st-evo
流匹配调度器时空进化不确定性感知对话级调度
由大语言模型（LLM）驱动的 MAS 可用自进化路线构建任务自适应的工作流或通信拓扑，但现有方法只在空间或时间单一维度上进化，未能充分激发 LLM 的协作能力。ST-EVO 从时空联合视角出发，用基于流匹配（flow matching）的紧凑调度器实现逐对话的通信调度，并能感知 MAS 的不确定性、通过自我反馈从累积经验中学习。在 9 个基准上达到当时最优性能，准确率提升约 5%–25%。
研究动机自进化 MAS 能构建任务自适应的工作流或通信拓扑，不再依赖预定义静态结构模板，但现有方法只做空间进化或时间进化，单一维度不足以充分激发 LLM 的协作能力。
解决问题如何从时空联合维度对 MAS 通信做对话级调度，使工作流与通信拓扑随任务需求与对话进程共同进化。
主要方法ST-EVO 用一个紧凑的流匹配（flow matching）调度器实现对话级通信调度，同时显式感知 MAS 的不确定性，并通过自我反馈从累积经验中学习调度策略，从而在空间与时间两个维度上联合进化拓扑。
LLM-powered Multi-Agent Systems (MAS) have emerged as an effective approach towards collaborative intelligence, and have attracted wide research interests. Among them, “self-evolving“ MAS, treated as a more flexible and powerful technical route, can construct task-adaptive workflows or communication topologies, instead of relying on a predefined static structue template. Current self-evolving MAS mainly focus on Spatial Evolving or Temporal Evolving paradigm, which only considers the single dimension of evolution and does not fully incentivize LLMs' collaborative capability. In this work, we start from a novel Spatio-Temporal perspective by proposing ST-EVO, which supports dialogue-wise communication scheduling with a compact yet powerful flow-matching based Scheduler. To make precise Spatio-Temporal scheduling, ST-EVO can also perceive the uncertainty of MAS, and possesses self-feedback ability to learn from accumulated experience. Extensive experiments on nine benchmarks demonstrate the state-of-the-art performance of ST-EVO, achieving about 5%--25% accuracy improvement.
框架
PSMAS：阶段调度的 token 高效协同
Phase-Scheduled Multi-Agent Systems for Token-Efficient Coordination
Multi-agent systems (MAS) powered by large language models suffer from severe token inefficiency arising from two compounding sources: (i) unstructured parallel execution, where all agents activate simultaneously irrespective of input readiness; and (ii) unrestricted context sharing, where every agent receives the full accumulated context regardless of relevance. Existing mitigation strategies - static pruning, hierarchical decomposition, and learned routing - treat coordination as a structural allocation problem and fundamentally ignore its temporal dimension. We propose Phase-Scheduled Multi-Agent Systems (PSMAS), a framework that reconceptualizes agent activation as continuous control over a shared attention space modeled on a circular manifold. Each agent i is assigned a fixed angular phase theta_i in the range $[0, 2*pi]$, derived from the task dependency topology; a global sweep signal phi(t) rotates at velocity omega, activating only agents within an angular window epsilon. Idle agents receive compressed context summaries, reducing per-step token consumption. We implement PSMAS on LangGraph, evaluate on four structured benchmarks (HotPotQA-MAS, HumanEval-MAS, ALFWorld-Multi, WebArena-Coord) and two unstructured conversational settings, and prove stability, convergence, and optimality results for the sweep dynamics. PSMAS achieves a mean token reduction of 27.3 percent (range 21.4-34.8 percent) while maintaining task performance within 2.1 percentage points of a fully activated baseline (p < 0.01, n = 500 per configuration), and outperforms the strongest learned routing baseline by 5.6 percentage points in token reduction with 2.0 percentage points less performance drop. Crucially, we show that scheduling and compression are independent sources of gain: scheduling alone accounts for 18-20 percentage points of reduction, robust to compression degradation up to alpha = 0.40.
约束感知拓扑生成2
方法
AgentConductor：竞赛级代码生成的拓扑进化
AgentConductor: Topology Evolution for Multi-Agent Competition-Level Code Generation
Large language model(LLM)-driven multi-agent systems(MAS) coordinate specialized agents through predefined interaction topologies and have shown promise for complex tasks such as competition-level code generation. Recent studies demonstrate that carefully designed multi-agent workflows and communication graphs can significantly improve code generation performance by leveraging collaborative reasoning. However, existing methods neither adapt topology density to task difficulty nor iteratively refine the topology within an instance using execution feedback, which leads to redundant communication and performance bottlenecks. To address these issues, we propose AgentConductor: a reinforcement learning-optimized MAS with an LLM-based orchestrator agent as its core, which enables end-to-end feedback-driven dynamic generation of interaction topologies. For each query, AgentConductor infers agent roles and task difficulty, then constructs a task-adapted, density-aware layered directed acyclic graph (DAG) topology, underpinned by two key innovations. First, we design a novel topological density function that captures communication-aware mathematical characterizations of multi-agent interactions. Second, we adopt difficulty interval partitioning to avoid excessive pruning for precise topological density upper bound measurement per difficulty level and finer-grained control. Empirically, across three competition-level and two foundational code datasets, AgentConductor achieves state-of-the-art accuracy, outperforming the strongest baseline by up to 14.6% in pass@1 accuracy, 13% in density reduction, and 68% in token cost reduction.
框架
AgentBalance：预算约束下的先骨干后拓扑设计
AgentBalance: Backbone-then-Topology Design for Cost-Effective Multi-Agent Systems under Budget Constraints
可借鉴点把预算当作一等约束、按「先定骨干再定拓扑」的顺序优化，以及用性能-预算曲线 AUC 衡量性价比，都是预算受限 MAS 部署可直接复用的设计与评测思路。
Large Language Model (LLM)-based multi-agent systems (MAS) are becoming indispensable building blocks for web-scale applications such as web search, social network analytics, and online customer support, where cost-effectiveness is increasingly the primary constraint for large-scale deployment. While recent work improves MAS cost-effectiveness by shaping inter-agent communication topologies and selecting agent backbones, it rarely models and optimizes under explicit token-cost and latency budgets that reflect deployment constraints. This often leads to topology-first designs and suboptimal cost-effectiveness when budgets are binding. We present AgentBalance, a framework for constructing cost-effective MAS under explicit token-cost and latency budgets via a backbone-then-topology design. AgentBalance first performs backbone-oriented agent generation, constructing agents with heterogeneous backbones through LLM pool construction, pool selection, and role-backbone matching. It then performs adaptive MAS topology generation, guiding inter-agent communication via agent representation learning, gating, and latency-aware topology synthesis. Experiments on benchmarks with 14 candidate LLM backbones show that AgentBalance achieves up to 10% and 22% performance gains under matched token-cost and latency budgets, respectively, and yields strong AUC on performance-versus-budget curves across benchmarks. AgentBalance also functions as a plug-in for existing MAS, improving performance under the same token-cost and latency constraints, and it generalizes well to unseen LLMs for practical, budget-aware deployment. Code: [this https URL](https://github.com/usail-hkust/AgentBalance)
拓扑重构与防御Reconfiguration & Defense19
在攻击发生时或发生前，通过改变拓扑结构来阻断恶意传播
风险感知拓扑重构2
拓扑线性化重构1
防御
C-SPRM：路径分解的拓扑线性化防御
Topology Linearization for Multi-Agent Systems Security: Mitigating Malicious Propagation via Path Decomposition
The rapid adoption of Large Language Model (LLM)-based Multi-Agent Systems (MAS) is hindered by severe security risks, where high-connectivity topologies facilitate the explosive propagation of prompt injections and hallucinations. To address this, we propose the Chain-Type Secure Path Reconstruction Method (C-SPRM), a topological defense framework that fundamentally constrains threat lateral movement by transforming arbitrary interaction graphs into linearized logical execution chains based on path decomposition theory. We formulate the topology reconstruction as a Spatio-Temporal Attack Surface (STAS) minimization problem and develop a Graph-to-Sequence Path Decomposition via Reinforcement Learning (G2S-PDR) model to generate optimized execution sequences that balance concurrency risks against latency. Additionally, an adaptive topology virtualization mechanism is introduced to resolve topological bottlenecks in high-degree networks like star or fully connected graphs. Experimental results demonstrate that C-SPRM significantly reduces the effective blast radius of malicious agents and exponentially increases the difficulty of attack propagation, achieving superior system robustness with controllable computational overhead compared to traditional interaction architectures.
风险感知拓扑演化1
防御
TopoSHIELD：风险感知的MAS拓扑演化防御
TopoSHIELD: Reshaping the Flow of Malice via Spatio-Temporal Risk-Aware Topological Evolution in Multi-Agent Systems
ACL 2026·2026·CCF-A 会议·toposhield
时空图神经网络节点风险熵边攻击传导率拓扑剪枝
静态防御难以应对恶意注入在互连 MAS 中的快速扩散。本文提出 TopoSHIELD，用时空图神经网络持续监控智能体间的交互动态，计算节点风险熵（NRE）与边攻击传导率（EAC）以精确定位脆弱位置，并据此执行结构干预：剪枝高风险边、隔离受感染的社区，从而阻断攻击扩散。在 GPT-4o 上毒性降低 58%，同时保持高于 90% 的任务成功率，抑制效率与可扩展性均优于现有基线。
研究动机已有防御多为静态或一次性加固，无法跟随 MAS 交互动态地定位风险，容易在高实用性要求下失效。
可借鉴点NRE 与 EAC 这套「节点风险 + 边传导率」组合指标可复用于任意 MAS 拓扑的风险打分与动态剪枝策略。
While LLM-based Multi-Agent Systems (MAS) demonstrate remarkable problem-solving capabilities, their interconnectivity acts as a conduit for the rapid spread of malicious injections. Addressing the limitations of static defenses, we present TopoSHIELD, a framework that reshapes the flow of malice via risk-aware topological evolution. Our approach utilizes a spatio-temporal graph neural network to monitor interaction dynamics, calculating node risk entropy (NRE) and edge attack conductivity (EAC) to pinpoint vulnerabilities. Guided by these metrics, TopoSHIELD executes precise structural interventions, pruning high-risk edges and isolating compromised communities to block attack diffusion. Empirically, TopoSHIELD reduces toxicity by 58% on GPT-4o while preserving high utility (>90% success rate), outperforming existing baselines in both suppression efficiency and scalability.
风险预测 pre-hoc4
边级风险探测排序2
防御
MESA：面向多智能体系统的脆弱通信信道优先排序
MESA: Prioritizing Vulnerable Communication Channels for Securing Multi-Agent Systems
Multi-agent systems (MAS) are increasingly used to automate complex, distributed workflows. However, their inter agent communication channels introduce new attack surfaces that remain poorly understood and are difficult to defend against. In this paper, we address how defenders should prioritize limited security effort to protect vulnerable commu nication channels before attacks are observed. This is motivated by our observation that the channel-level attack impact is highly non-uniform: a single compromised edge can account for up to 75% of total attack success. We introduce MESA, a label-free framework for proactively ranking which MAS edges are most security-critical—that is, most likely to affect the system’s decision if compromised. MESA combines six graph-theoretic metrics and two dynamic probes (ablation and masking) without requiring attack traces. We evaluate MESA against a dynamic misinformation attack pipeline across three diverse MAS scenarios, eight network topologies, and five open source LLMs from Qwen, Llama, and Gemma families. MESA rankings correlate strongly with empirical per-edge attack success rate, achieving mean Spearman ρ = +0.60 (peaking at +0.73). In resource-constrained defense deployment, monitor ing the top 10% of MESA-ranked edges intercepts about 3× the successful attacks as random allocation. We further test MESA under varying attacker and defender models and LangGraph workflows and characterize its limits under adaptive attacks and high-redundancy graphs. Overall, our results show that edge-level risk in MAS is often concentrated and predictable, allowing proactive hardening of multi-agent infrastructures.
框架
E2-Explainer：基于因果推断的可解释通信拓扑发现
Discovering Efficient and Explainable Communication Topologies for LLM-based Multi-Agent Systems via Causal Inference
The performance of large language model (LLM)-based multi-agent systems (MAS) largely depends on effective communication topologies. Existing topology generation methods, however, typically learn communication topologies through black-box optimization driven solely by task-level rewards. While effective, such optimization provides little insight into why particular communication edges are selected, making it difficult to identify the critical communication subgraphs responsible for successful collaboration. To address this limitation, we propose E2-Explainer, a model-agnostic framework for providing interpretable explanations of communication topologies produced by arbitrary topology generators. Specifically, we formulate topology explanation as a causal attribution problem that identifies compact communication subgraphs supported by edge-level evidence of task preservation. We obtain this evidence with a Granger-style objective that measures how masking each communication channel changes the task outcome and the stability of the final response. The resulting budgeted subgraphs are then distilled into an amortized explainer, enabling efficient post-hoc explanation without repeated edge-level evaluations at deployment. Extensive experiments on multiple reasoning and coding benchmarks demonstrate that E2-Explainer identifies critical communication subgraphs that preserve successful collaboration. These subgraphs can also be executed directly to prune redundant communication edges, substantially reducing communication costs while maintaining competitive task performance.
级联风险事前推断2
框架
智能体发言之前：多智能体系统的事前故障风险推断
Before Agents Speak: Pre-hoc Failure Risk Inference in Multi-Agent Systems
LLM-based multi-agent systems (MAS) have exhibited remarkable capabilities in collaborative reasoning and decision-making, yet their interconnected communications introduce new systemic risk: localized hallucinations can propagate along agent communication chain, amplify through interactions, and ultimately trigger cascading failures. Existing countermeasures predominantly follow a post-hoc paradigm, identifying failures only after unsafe behaviors emerge, by which time harmful effects may have already spread throughout the agent network. To tackle this problem, we investigate a complementary pre-hoc approach and propose HalluProp, a Propagation-aware Hallucination inference framework that estimates individual agent failures and emergent system-level hallucination risks before inter-agent interaction. First, we model intrinsic hallucination risks by identifying fine-grained semantic misalignment between agent roles and task queries. We then characterize inter-agent risk propagation by modeling both semantic influence and communication topology. Finally, we integrate these two risks via a differentiable Noisy-OR inference mechanism to derive a systemic diagnosis. Extensive experiments show that HalluProp accurately localizes faulty agents, achieving an average AUROC of 84.6%, while enabling sub-second diagnosis with over 65× speedup over post-hoc methods. By facilitating early intervention through upstream screening, HalluProp effectively complements post-hoc methods, highlighting the potential of pre-hoc risk inference for building more reliable multi-agent systems.
防御
由火星到烈焰：建模与缓解 LLM 多智能体协作中的错误级联
From Spark to Fire: Modeling and Mitigating Error Cascades in LLM-Based Multi-Agent Collaboration
Large Language Model-based Multi-Agent Systems (LLM-MAS) are increasingly applied to complex collaborative scenarios. However, their collaborative mechanisms may cause minor inaccuracies to gradually solidify into system-level false consensus through iteration. Such risks are difficult to trace since errors can propagate and amplify through message dependencies. Existing protections often rely on single-agent validation or require modifications to the collaboration architecture, which can weaken effective information flow and may not align with natural collaboration processes in real tasks. To address this, we propose a propagation dynamics model tailored for LLM-MAS that abstracts collaboration as a directed dependency graph and provides an early-stage risk criterion to characterize amplification risk. Through experiments on six mainstream frameworks, we identify three vulnerability classes: cascade amplification, topological sensitivity, and consensus inertia. We further instantiate an attack where injecting just a single atomic error seed leads to widespread failure. In response, we introduce a genealogy-graph-based governance layer, implemented as a message-layer plugin, that suppresses both endogenous and exogenous error amplification without altering the collaboration architecture. Experiments show that this approach prevents final infection in at least 89% of runs across operating modes and significantly mitigates the cascading spread of minor errors.
错误信息审计与过滤10
感染定位与修复2
防御
INFA-Guard：感染感知的恶意传播抑制
INFA-Guard: Mitigating Malicious Propagation via Infection-Aware Safeguarding in LLM-Based Multi-Agent Systems
The rapid advancement of Large Language Model (LLM)-based Multi-Agent Systems (MAS) has introduced significant security vulnerabilities, where malicious influence can propagate virally through inter-agent communication. Conventional safeguards often rely on a binary paradigm that strictly distinguishes between benign and attack agents, failing to account for infected agents i.e., benign entities converted by attack agents. In this paper, we propose Infection-Aware Guard, INFA-Guard, a novel defense framework that explicitly identifies and addresses infected agents as a distinct threat category. By leveraging infection-aware detection and topological constraints, INFA-Guard accurately localizes attack sources and infected ranges. During remediation, INFA-Guard replaces attackers and rehabilitates infected ones, avoiding malicious propagation while preserving topological integrity. Extensive experiments demonstrate that INFA-Guard achieves state-of-the-art performance, reducing the Attack Success Rate (ASR) by an average of 33%, while exhibiting cross-model robustness, superior topological generalization, and high cost-effectiveness.
实证
更聪明的破坏者与更好的修复者：线性 MAS 的规模与安全
Smarter Saboteurs, Better Fixers: Scaling & Security in Linear Multi-Agent Workflows
As LLM-based multi-agent systems (MAS) are deployed in the wild, the resilience of their collaboration structures against adversarial compromise becomes a critical safety concern. Attackers may leverage prompt-injection or jailbreaking to sabotage individual agents within MAS workflows, but the interaction between model scaling and system-level resilience remains poorly understood. This paper investigates how model scale affects the security of linear multi-agent workflows. Our experiments across scales of two open-weight model families on the HumanEval benchmark reveal a compliance-correction symmetry: larger models are far more likely to faithfully execute malicious instructions, with the control-to-malicious performance drop reaching 53.7pp at 27B in uncorrected pipelines. However, appending a lightweight terminal Fixer stage collapses this to 0.6pp and restores statistical parity with control-level performance, demonstrating that strictly linear collaboration structures can be viable and resilient to adversaries at this scale, and suggesting that the brittleness previously attributed to linear topology may stem from a lack of correction.
消息过滤与净化3
防御
嵌入防御为何失效：重审 LLM-MAS 安全
When Embedding-Based Defenses Fail: Rethinking Safety in LLM-Based Multi-Agent Systems
Large language model (LLM)-powered multi-agent systems (MAS) enable agents to communicate and share information, achieving strong performance on complex tasks. However, this communication also creates an attack surface where malicious agents can propagate misinformation and manipulate group decisions, undermining MAS safety. Existing embedding-based defenses aim to detect and prune suspicious agents, but their effectiveness depends on a clear separation between the text embeddings of malicious and benign messages. Attackers can circumvent such defenses by crafting messages whose embeddings lie close to benign ones. We analyze this failure mode theoretically and validate it empirically with three attacks, Slow Drift, Benign Wrapper, and Chaos Seeding. Our analysis further reveals a fundamental limitation of embedding-based defenses: because they rely solely on the text embeddings, they ignore token-level confidence signals such as logits, which can remain informative when embeddings are not distinguishable under attack. We propose using confidence scores to prune or down-weight messages during MAS communication. Experiments show improved robustness across models, datasets, and communication topologies. Moreover, we find that the effectiveness of confidence signals decays over communication rounds, highlighting the importance of early intervention. This insights can inform and inspire future work on MAS attacks and defenses.
可借鉴点用「本地过滤 + 迭代精炼 + 图结构 (F+1) 鲁棒性条件」替代领导者与自报置信度，是去中心化 MAS 抗拜占庭的通用模板，其中的图条件可直接用于论证拓扑选型。
Large language model (LLM) agents increasingly collaborate over peer-to-peer networks to improve their reliability. However, these same interactions can also become a source of vulnerability, as unreliable or Byzantine agents may sway neighboring agents toward incorrect conclusions and degrade overall system performance. Existing methods rely on leader-based coordination or self-reported confidence, both of which are susceptible to adversarial manipulation. We study decentralized LLM multi-agent systems (LLM-MAS) and propose Self-Anchored Consensus (SAC), a fully decentralized iterative filter-and-refine protocol in which agents iteratively exchange responses, locally evaluate and filter unreliable messages, and refine their own outputs. We present (F+1)-robustness conditions for the communication graph that ensure honest agents preserve and propagate reliable information despite Byzantine influence. Experiments on mathematical and commonsense reasoning benchmarks show that SAC effectively suppresses Byzantine influence and consistently improves performance across diverse communication topologies, whereas prior methods degrade under adversarial conditions.
防御
SAIGuard：通信状态仿真的 LLM-MAS 主动防御
SAIGuard: Communication-State Simulation for Proactive Defense of LLM Multi-Agent Systems
arXiv·2026·预印本·saiguard
通信状态仿真重构偏差主动防御消息净化
现有 MAS 防御多在执行后被动检测并隔离有害智能体，损害不可逆且牺牲协作效用。SAIGuard 改走主动路线：在 MAS 交互图上做通信状态仿真，估计传入消息对局部智能体状态与全局 MAS 状态的影响，并以相对正常通信模式的重构偏差为判据识别风险消息；它不隔离智能体，而是在消息传播进系统前将其净化或重新生成。实验覆盖多种拓扑与攻击场景，攻击成功率下降且 MAS 效用得以保持，优于被动式防御。
LLM-based multi-agent systems (MAS) solve complex tasks through inter-agent collaboration, but their communication-driven nature also allows security risks to spread across agents and trigger system-wide failures. Existing MAS defenses mainly follow a reactive paradigm after execution by detecting and isolating harmful agents, which may cause irreversible damage and degrade collaborative utility. To address this, we propose a proactive defense framework for MAS security, namely a Simulation-aware Interception Guard (SAIGuard). SAIGuard performs communication-state simulation over the MAS interaction graph, estimates the impact of incoming messages on local agent states and the global MAS state, and detects risky messages via reconstruction deviations from benign communication patterns. Instead of isolating agents, SAIGuard sanitizes or regenerates suspicious messages before it propagation into system. Experiments across diverse topologies and attack scenarios show that SAIGuard reduces attack success rates while maintaining MAS utility, outperforming reactive defenses.
图几何与信任自适应2
防御
MAS 级联风险的语义-几何共演化审计
Auditing Cascading Risks in Multi-Agent Systems via Semantic-Geometric Co-evolution
arXiv·2026·预印本·auditing-cascading-risks-in-multi
Ollivier-Ricci 曲率级联风险语义-几何共演化根因归因
基于大语言模型（LLM）的多智能体系统（MAS）存在级联风险：早期交互语义流畅合规，底层交互动力学却已开始扭曲，而逐条消息的语义审计是滞后、被动的。本文把 MAS 交互建模为动态图，用 Ollivier-Ricci 曲率（ORC）刻画通信拓扑的信息冗余与瓶颈，并把语义流信号与图几何耦合，以偏离正常共演化流形作为早期预警。实验表明曲率异常比显式语义违规提前若干轮交互出现，其局部性支持根因归因。
Large Language model (LLM)-based Multi-Agent Systems (MAS) are prone to cascading risks, where early-stage interactions remain semantically fluent and policy-compliant, yet the underlying interaction dynamics begin to distort in ways that amplify latent instability or misalignment. Traditional auditing methods that focus on per-message semantic content are inherently reactive and lagging, failing to capture these early structural precursors. In this paper, we propose a principled framework for cascading-risk detection grounded in semantic--geometric co-evolution. We model MAS interactions as dynamic graphs and introduce Ollivier--Ricci Curvature (ORC) -- a discrete geometric measure -- to characterize information redundancy and bottleneck formation in communication topologies. By coupling semantic flow signals with graph geometry, the framework learns the normal co-evolutionary dynamics of trusted collaboration and treats deviations from this coupled manifold as early-warning signals. Experiments on a suite of cascading-risk scenarios aligned with the risk category demonstrate that curvature anomalies systematically precede explicit semantic violations by several interaction turns, enabling proactive intervention. Furthermore, the local nature of Ricci curvature provides principled interpretability for root-cause attribution, identifying specific agents or links that precipitate the collapse of trustworthy collaboration.
防御
别信任固执的邻居：智能体网络安全框架
Don't Trust Stubborn Neighbors: A Security Framework for Agentic Networks
可借鉴点用意见动力学模型（固执度 + 信任矩阵）参数化 MAS 的拓扑风险，可以把「边上的信任权重」当成连续可调的防御旋钮，比增删节点或改拓扑更轻量。
Large Language Model (LLM)-based Multi-Agent Systems (MASs) are increasingly deployed for agentic tasks, such as web automation, itinerary planning, and collaborative problem solving. Yet, their interactive nature introduces new security risks: malicious or compromised agents can exploit communication channels to propagate misinformation and manipulate collective outcomes. In this paper, we study how such manipulation can arise and spread by borrowing the Friedkin-Johnsen opinion formation model from social sciences to propose a general theoretical framework to study LLM-MAS. Remarkably, this model closely captures LLM-MAS behavior, as we verify in extensive experiments across different network topologies and attack and defense scenarios. Theoretically and empirically, we find that a single highly stubborn and persuasive agent can take over MAS dynamics, underscoring the systems' high susceptibility to attacks by triggering a persuasion cascade that reshapes collective opinion. Our theoretical analysis reveals three mechanisms to increase system security: a) increasing the number of benign agents, b) increasing the innate stubbornness or peer-resistance of agents, or c) reducing trust in potential adversaries. Because scaling is computationally expensive and high stubbornness degrades the network's ability to reach consensus, we propose a new mechanism to mitigate threats by a trust-adaptive defense that dynamically adjusts inter-agent trust to limit adversarial influence while maintaining cooperative performance. Extensive experiments confirm that this mechanism effectively defends against manipulation.
分层审计与共识仲裁2
防御
MAS-Shield：安全高效的 LLM-MAS 防御框架
MAS-Shield: A Defense Framework for Secure and Efficient LLM MAS
可借鉴点「高影响力节点优先审计 + 轻量模型粗筛再升级委员会」是把安全预算集中到关键位置的可复用范式，可直接搬到自建 MAS 防御的资源分配设计中。
Large Language Model (LLM)-based Multi-Agent Systems (MAS) are susceptible to linguistic attacks that can trigger cascading failures across the network. Existing defenses face a fundamental dilemma: lightweight single-auditor methods are prone to single points of failure, while robust committee-based approaches incur prohibitive computational costs in multi-turn interactions. To address this challenge, we propose \textbf{MAS-Shield}, a secure and efficient defense framework designed with a coarse-to-fine filtering pipeline. Rather than applying uniform scrutiny, MAS-Shield dynamically allocates defense resources through a three-stage protocol: (1) \textbf{Critical Agent Selection } strategically targets high-influence nodes to narrow the defense surface; (2) \textbf{Light Auditing} employs lightweight sentry models to rapidly filter the majority of benign cases; and (3) \textbf{Global Consensus Auditing} escalates only suspicious or ambiguous signals to a heavyweight committee for definitive arbitration. This hierarchical design effectively optimizes the security-efficiency trade-off. Experiments demonstrate that MAS-Shield achieves a 92.5\% recovery rate against diverse adversarial scenarios and reduces defense latency by over 70\% compared to existing methods.
防御
拜占庭容错视角下重思多智能体系统可靠性
Rethinking the Reliability of Multi-agent System: A Perspective from Byzantine Fault Tolerance
Ensuring the reliability of agent architectures and effectively identifying problematic agents when failures occur are crucial challenges in multi-agent systems (MAS). Advances in large language models (LLMs) have established LLM-based agents as a major branch of MAS, enabling major breakthroughs in complex problem solving and world modeling. However, the reliability implications of this shift remain largely unexplored. i.e., whether substituting traditional agents with LLM-based agents can effectively enhance the reliability of MAS. In this work, we investigate and quantify the reliability of LLM-based agents from the perspective of Byzantine fault tolerance. We observe that LLM-based agents demonstrate stronger skepticism when processing erroneous message flows, a characteristic that enables them to outperform traditional agents across different topological structures. Motivated by the results of the pilot experiment, we design CP-WBFT, a confidence probe-based weighted Byzantine Fault Tolerant consensus mechanism to enhance the stability of MAS with different topologies. It capitalizes on the intrinsic reflective and discriminative capabilities of LLMs by employing a probe-based, weighted information flow transmission method to improve the reliability of LLM-based agents. Extensive experiments demonstrate that CP-WBFT achieves superior performance across diverse network topologies under extreme Byzantine conditions (85.7\% fault rate). Notably, our approach surpasses traditional methods by attaining remarkable accuracy on various topologies and maintaining strong reliability in both mathematical reasoning and safety assessment tasks.
级联注入基准评测1
基准
ACIArena：智能体级联注入统一评测
ACIArena: Toward Unified Evaluation for Agent Cascading Injection
ACL 2026·2026·CCF-A 会议·aciarena
级联注入鲁棒性评测攻击面基准测试
多智能体系统（MAS）中，被攻陷的智能体可借智能体间信任传播恶意指令，造成智能体级联注入（ACI）与系统级故障。已有研究只用有限攻击策略与简化设置。ACIArena 以统一规范支持 MAS 构建与攻防，攻击面覆盖外部输入、智能体配置与智能体间消息，目标覆盖指令劫持、任务中断与信息窃取，含 6 种主流实现与 1,356 个测试用例。评测显示仅凭拓扑不足以评估鲁棒性，还需刻意的角色设计与受控交互。
主要方法构建统一评测框架 ACIArena：用一套统一规范同时描述 MAS 构建与攻防模块，把用例沿「攻击面 × 攻击目标」组织为外部输入、智能体配置文件、智能体间消息三类攻击面与指令劫持、任务中断、信息窃取三类目标，并接入 6 种主流 MAS 实现、提供 1,356 个测试用例。
关键实验基准包含 1,356 个测试用例、覆盖 6 种主流 MAS 实现；评测结论为仅凭拓扑评估鲁棒性不足，稳健 MAS 需要刻意的角色设计与受控交互模式，且简化环境下开发的防御常无法迁移，范围过窄的防御甚至引入新漏洞。
可借鉴点做 MAS 安全实验可按「攻击面 × 攻击目标」二维矩阵组织用例；两条可直接引用的结论是拓扑不是鲁棒性的充分条件、窄域防御存在负迁移风险。
Collaboration and information sharing empower Multi-Agent Systems (MAS) but also introduce a critical security risk known as Agent Cascading Injection (ACI). In such attacks, a compromised agent exploits inter-agent trust to propagate malicious instructions, causing cascading failures across the system. However, existing studies consider only limited attack strategies and simplified MAS settings, limiting their generalizability and comprehensive evaluation. To bridge this gap, we introduce ACIArena, a unified framework for evaluating the robustness of MAS. ACIArena offers systematic evaluation suites spanning multiple attack surfaces (i.e., external inputs, agent profiles, inter-agent messages) and attack objectives (i.e., instruction hijacking, task disruption, information exfiltration). Specifically, ACIArena establishes a unified specification that jointly supports MAS construction and attack-defense modules. It covers six widely used MAS implementations and provides a benchmark of 1,356 test cases for systematically evaluating MAS robustness. Our benchmarking results show that evaluating MAS robustness solely through topology is insufficient; robust MAS require deliberate role design and controlled interaction patterns. Moreover, defenses developed in simplified environments often fail to transfer to real-world settings; narrowly scoped defenses may even introduce new vulnerabilities. ACIArena aims to provide a solid foundation for advancing deeper exploration of MAS design principles.
恶意行为检测2
激活空间隐蔽检测1
防御
AcMAS：激活空间检测MAS恶意行为
When Agents Go Rogue: Activation-Based Detection of Malicious Behaviors in Multi-Agent Systems
arXiv·2026·预印本·when-agents-go-rogue
激活空间异步 MAS隐蔽攻击功能恢复
现有 MAS 防御多假设攻击语义明显、拓扑可用显式图建模并对齐时间；但真实攻击语义愈发隐蔽，MAS 执行通常异步，缺乏图模型要求的时序对齐。AcMAS 改为分析本地智能体的激活空间内部推理状态，不依赖显式交互图，以对同步不敏感的方式检测隐蔽攻击，并用激活信号引导恢复受损智能体功能，而非直接隔离。同步下 F1 高 0.22（0.94 对 0.72），异步下高 0.55（0.93 对 0.38）。
关键实验对抗隐蔽攻击时，同步设置 F1 为 0.94 对图基线 0.72（+0.22），异步设置 F1 为 0.93 对图基线 0.38（+0.55），并跨多种开源 LLM 骨干、攻击强度与 MAS 规模泛化。
可借鉴点激活空间信号可以免去「先把 MAS 抽象成图」的建模负担，异步 MAS 也应作为独立评测设定而非沿用同步假设。
While enabling effective collaboration on complex tasks, LLM-based Multi-Agent Systems (MAS) face critical security challenges due to vulnerabilities at the agent and interaction levels. Most existing MAS security defenses are built upon two core assumptions: semantically-explicit malicious attacks and explicit graph-based modeling of the MAS topology and agent-level interactions. In practice, real-world attacks are becoming more semantically stealthy, while MAS execution is typically asynchronous without the temporal alignment assumed by graph-based propagation models. To address these limitations, we propose AcMAS, an activation-based framework for malicious-behavior detection in MAS. By analyzing internal reasoning states in the activation space of local agents, AcMAS detects even stealthy attacks in a synchronization-robust fashion, without relying on explicit interaction graphs. Moreover, our activation analysis provides critical signals to guide AcMAS in restoring the functionality of compromised agents, rather than the disruptive agent isolation commonly used by the state-of-the-art methods. Comprehensive evaluation demonstrates that AcMAS significantly outperforms graph-based baselines against stealthy attacks, by +0.22 F1 in synchronous settings (0.94 vs. 0.72) and by +0.55 F1 in asynchronous settings (0.93 vs. 0.38), with generalization across diverse open-source LLM backbones, attack intensity, and MAS scale.
图异常可解释检测1
防御
XG-Guard：MAS双层图异常检测防护
Explainable and Fine-Grained Safeguarding of LLM Multi-Agent Systems via Bi-Level Graph Anomaly Detection
现有图异常检测（GAD）防御虽能识别异常智能体，但依赖句子级粗粒度信息、忽略词级线索，性能受限。本文提出细粒度可解释防护框架 XG-Guard：用双层智能体编码器联合建模每个智能体的句子级与 token 级表示，用基于主题的异常检测器捕捉 MAS 对话中演化的话题焦点，并以双层评分融合量化 token 级贡献以支撑解释。在多种 MAS 拓扑与攻击场景下表现出稳健检测性能与较强可解释性。
可借鉴点把 token 级贡献纳入异常评分既能提升细粒度检测精度又天然给出解释，是 MAS 恶意智能体检测中可复用的建模与评测思路。
Large language model (LLM)-based multi-agent systems (MAS) have shown strong capabilities in solving complex tasks. As MAS become increasingly autonomous in various safety-critical tasks, detecting malicious agents has become a critical security concern. Although existing graph anomaly detection (GAD)-based defenses can identify anomalous agents, they mainly rely on coarse sentence-level information and overlook fine-grained lexical cues, leading to suboptimal performance. Moreover, the lack of interpretability in these methods limits their reliability and real-world applicability. To address these limitations, we propose , an explainable and fine-grained safeguarding framework for detecting malicious agents in MAS. To incorporate both coarse and fine-grained textual information for anomalous agent identification, we utilize a bi-level agent encoder to jointly model the sentence- and token-level representations of each agent. A theme-based anomaly detector further captures the evolving discussion focus in MAS dialogues, while a bi-level score fusion mechanism quantifies token-level contributions for explanation. Extensive experiments across diverse MAS topologies and attack scenarios demonstrate robust detection performance and strong interpretability of XG-Guard.
故障归因与修复1
故障注入与可靠性评估1
框架
MAS-FIRE：LLM 多智能体系统的故障注入与可靠性评估
MAS-FIRE: Fault Injection and Reliability Evaluation for LLM-Based Multi-Agent Systems
As LLM-based Multi-Agent Systems (MAS) are increasingly deployed for complex tasks, ensuring their reliability has become a pressing challenge. Since MAS coordinate through unstructured natural language rather than rigid protocols, they are prone to semantic failures (e.g., hallucinations, misinterpreted instructions, and reasoning drift) that propagate silently without raising runtime exceptions. Prevailing evaluation approaches, which measure only end-to-end task success, offer limited insight into how these failures arise or how effectively agents recover from them. To bridge this gap, we propose MAS-FIRE, a systematic framework for fault injection and reliability evaluation of MAS. We define a taxonomy of 15 fault types covering intra-agent cognitive errors and inter-agent coordination failures, and inject them via three non-invasive mechanisms: prompt modification, response rewriting, and message routing manipulation. Applying MAS-FIRE to three representative MAS architectures, we uncover a rich set of fault-tolerant behaviors that we organize into four tiers: mechanism, rule, prompt, and reasoning. This tiered view enables fine-grained diagnosis of where and why systems succeed or fail. Our findings reveal that stronger foundation models do not uniformly improve robustness. We further show that architectural topology plays an equally decisive role, with iterative, closed-loop designs neutralizing over 40% of faults that cause catastrophic collapse in linear workflows. MAS-FIRE provides the process-level observability and actionable guidance needed to systematically improve multi-agent systems.
攻击与风险实证Attacks & Empirical Risk15
拓扑本身如何被攻击、被泄露，以及拓扑结构对系统行为的实证影响
拓扑攻击2
规划期工作流引导1
攻击
FlowSteer：规划期工作流引导攻击
FlowSteer: Prompt-Only Workflow Steering Exposes Planning-Time Vulnerabilities in Multi-Agent LLM Systems
arXiv·2026·预印本·flowsteer
工作流引导规划期攻击社会影响谄媚表述黑箱拓扑
规划者—执行者架构把 MAS 攻击面挪到工作流生成阶段：提示不改动基础设施即可影响智能体组织方式。社会影响探测显示：工作流位置会放大或抑制恶意信号，谄媚式表述会让下游更愿转发。据此提出的 FlowSteer 只用提示完成引导，把恶意信号对齐到高影响子任务，相比朴素提示恶意成功率最高提升 55%。作者另提输入端防御 FlowGuard，恶意成功率最高降低 34% 且保持提示效用。
研究动机已有 MAS 攻击与防御多聚焦消息内容或通信边，而工作流本身由提示生成，规划阶段的操纵既不触碰基础设施，也难以被「只检查生成后工作流」的防御发现。
解决问题仅靠一个提示能否在规划阶段把恶意信号嵌入 MAS 工作流，并在跨配置、黑箱拓扑条件下保持稳定传播。
Multi-agent systems (MAS) powered by large language models (LLMs) increasingly adopt planner--executor architectures, where planners convert prompts into subtasks, roles, dependencies, and routing paths. This flexibility enables adaptive coordination, but exposes an attack surface in workflow formation: prompts can shape agent organization without modifying MAS infrastructure. We study this risk through social influence probing workflows to identify high-impact subtasks and malicious-signal propagation. The analysis reveals two vulnerabilities: workflow position can amplify or suppress a malicious signal, and sycophantic framing makes downstream agents more likely to relay it. We translate these findings into FlowSteer, a prompt-only workflow steering attack that converts vulnerability priors into one crafted prompt. FlowSteer aligns a malicious signal with influential task components and guides replanning toward dependencies that preserve propagation. Experiments show that FlowSteer increases malicious success by up to 55% over naive prompting, transfers across MAS setups, and remains effective with black-box topology inference. As FlowSteer biases the planning signals that generate the workflow, MAS defenses that inspect only the generated workflow provide limited protection. As such, we introduce FlowGuard, an input-side defense that reduces malicious success by up to 34% while preserving prompt utility. Our results position workflow formation as a new safety frontier for multi-agent LLM systems, opening a planning-time security perspective on how agent coordination itself can be attacked and defended.
拓扑引导污染传播1
攻击
上游不可信：拓扑引导的对抗污染传播
Don't Trust Your Upstream: Exploiting LLM Multi-Agent System via Topology-Guided Adversarial Propagation
arXiv·2026·预印本·don-t-trust-your-upstream
拓扑感知攻击多跳传播载荷封装拓扑信任
现有 LLM-MAS 安全评估多局限于狭窄设定，可能低估真实风险。受「上游输出会被下游重新解释并执行」这一依赖启发，作者提出拓扑感知攻击方案：结合拓扑侦察、污染传播建模与分层有效载荷封装，把对抗性污染从暴露的边缘智能体逐跳传到高权限智能体。实验在三种主流 MAS 框架、五种拓扑上成功率 40%–78%，在两个真实 MAS 应用、20 个场景上达 85%；拓扑信任缓解可阻断 94.8% 的复合攻击。
研究动机已有评估多假设攻击者能直接接触高权限智能体或只考察单跳场景，忽略了 MAS 中上游—下游的重解释执行依赖可以被用来完成多跳提权。
关键实验在三种主流 MAS 框架、五种拓扑上成功率为 40%–78%；在两个真实 MAS 应用、20 个代表性场景上达 85%；提出的拓扑信任缓解阻断 94.8% 的复合攻击。
可借鉴点「上游不可信」应成为 MAS 的默认前提，基于拓扑信任的跨跳来源降权是可快速落地的通用缓解手段。
The digital world is witnessing the rapid rise of LLM-based multi-agent systems (MASs) and their powerful applications. However, their security remains insufficiently understood, as existing evaluations are largely limited to narrow attack settings and may substantially underestimate the real risks of MAS deployments. Inspired by the MAS inter-agent dependencies, where upstream outputs are reinterpreted and executed by downstream agents, we propose a topology-aware attack scheme that propagates adversarial contamination from exposed edge agents to high-privilege agents to induce malicious behaviors. By combining topology reconnaissance, contamination propagation modeling, and hierarchical payload encapsulation, our approach overcomes the key challenges of black-box attacks and makes such multi-hop compromise practical. Experiments show that our approach achieves success rates of 40\%--78\% on three widely-used MAS frameworks under five topologies, and 85\% on two real-world MAS applications across 20 representative scenarios. The results reveal fundamental vulnerabilities in MASs that have been overlooked by prior studies. Based on these findings, we propose a topology-trust mitigation that blocks 94.8\% of such composite attacks.
敏感信息泄露3
系统资产黑箱抽取1
攻击
MASLEAK：黑箱抽取MAS知识产权与拓扑
MASLeak: Investigating and Exposing Intellectual Property Leakage Vulnerabilities in Multi-Agent Systems
USENIX Security 2026·2026·安全性顶会·masleak
知识产权泄露黑箱攻击系统提示抽取对抗性查询
MAS 的架构、交互与内部通信使知识产权（IP）保护面临隐患。本文提出首个黑箱下的 MAS 知识产权抽取框架 MASLEAK：攻击者只能调用公共 API 观察输出，框架借鉴蠕虫的传播方式构造对抗性查询，诱导、传播并保留各智能体的响应，还原智能体数量、通信拓扑与系统提示。在 810 个 MAS 应用与 Coze、CrewAI 等真实系统上，提示与指令抽取成功率 87%，系统架构达 92%。
The rapid advancement of Large Language Models (LLMs) has led to the emergence of Multi-Agent Systems (MAS) to perform complex tasks through collaboration. However, the intricate nature of MAS, including their architecture, agent interactions, and complex internal communication processing, raises significant concerns regarding intellectual property (IP) protection. In this paper, we introduce MASLEAK, the first framework for systematically extracting IP from MAS in a practical black-box setting. We assume a realistic adversary who can only submit queries to the system's public API and observe the final output, without any prior knowledge of the internal architecture and the backend LLM information. Inspired by how computer worms propagate and infect vulnerable network hosts, MASLEAK carefully crafts adversarial query q to elicit, propagate, and retain responses from each MAS agent that reveal a full set of proprietary components, including the number of agents, topology, system prompts, task instructions, and tool usages. We construct the first synthetic dataset of 810 MAS applications and also evaluate MASLEAK against real-world MAS applications, including Coze and CrewAI. MASLEAK achieves high accuracy in extracting MAS IP, with an average attack success rate of 87% for system prompts and task instructions, and 92% for system architecture in most cases. We conclude by discussing the implications of our findings and the potential defenses.
拓扑结构推断攻击2
攻击
WebWeaver：单智能体上下文推断MAS拓扑
WebWeaver: Breaking Topology Confidentiality in LLM Multi-Agent Systems with Stealthy Context-Based Inference
arXiv·2026·预印本·webweaver
拓扑推断上下文推断越狱掩码扩散知识产权
通信拓扑关系到 LLM-MAS 的效用与安全，也是保密性研究不足的高价值知识产权。已有推断依赖控制管理智能体或越狱直查身份等不现实假设，易被关键词防御挡住。WebWeaver 只攻陷任意单个普通智能体，且只依赖智能体上下文而非 ID，还引入隐蔽越狱机制与无越狱扩散设计，并用带正确性保证的掩码策略在扩散中保留已知拓扑。在主动防御下其推断准确率比 SOTA 基线高约 60%，开销可忽略。
Communication topology is a critical factor in the utility and safety of LLM-based multi-agent systems (LLM-MAS), making it a high-value intellectual property (IP) whose confidentiality remains insufficiently studied. Existing topology inference attempts rely on impractical assumptions, including control over the administrative agent and direct identity queries via jailbreaks, which are easily defeated by basic keyword-based defenses. As a result, prior analyses fail to capture the real-world threat of such attacks. To bridge this realism gap, we propose \textit{WebWeaver}, an attack framework that infers the complete LLM-MAS topology by compromising only a single arbitrary agent instead of the administrative agent. Unlike prior approaches, WebWeaver relies solely on agent contexts rather than agent IDs, enabling significantly stealthier inference. WebWeaver further introduces a new covert jailbreak-based mechanism and a novel fully jailbreak-free diffusion design to handle cases where jailbreaks fail. Additionally, we address a key challenge in diffusion-based inference by proposing a masking strategy that preserves known topology during diffusion, with theoretical guarantees of correctness. Extensive experiments show that WebWeaver substantially outperforms state-of-the-art (SOTA) baselines, achieving about 60\% higher inference accuracy under active defenses with negligible overhead.
攻击
CIA：黑箱推断MAS通信拓扑的攻击
CIA: Inferring the Communication Topology from LLM-based Multi-Agent Systems
LLM-based Multi-Agent Systems (MAS) have demonstrated remarkable capabilities in solving complex tasks. Central to MAS is the communication topology which governs how agents exchange information internally. Consequently, the security of communication topologies has attracted increasing attention. In this paper, we investigate a critical privacy risk: MAS communication topologies can be inferred under a restrictive black-box setting, exposing system vulnerabilities and posing significant intellectual property threats. To explore this risk, we propose **Communication Inference Attack (CIA)**, a novel attack that constructs new adversarial queries to induce intermediate agents’ reasoning outputs and models their semantic correlations through the proposed global bias disentanglement and LLM-guided weak supervision. Extensive experiments on MAS with optimized communication topologies demonstrate the effectiveness of CIA, achieving an average AUC of 0.87 and a peak AUC of up to 0.99, thereby revealing the substantial privacy risk in MAS. The source code is available at [https://github.com/aabbbcd/CIA](https://github.com/aabbbcd/CIA).
记忆与跨信道投毒1
记忆投毒链路防护1
防御
MAPLE-Guard：记忆链路投毒防护
MAPLE-Guard: Memory-Aware Link Enforcement Against Memory-Link Poisoning in Multi-Agent Systems
可借鉴点把「记忆生命周期」当作一条独立传播信道来设防，是拓扑视角之外值得纳入 MAS 安全评测与防护设计的一环。
LLM-based multi-agent systems (MAS) increasingly rely on persistent private and shared memories for long-horizon coordination. This memory layer improves continuity, but it also gives attackers a durable channel: a poisoned memory can be written once, continuously retrieved in later tasks, promoted into shared memory, and reused by other agents. A single poisoned write can therefore steer many later decisions and contaminate agents that never saw the original attack, all while no malicious message crosses a visible communication edge at the moment of harm. Further, because existing safeguards mainly inspect prompts, actions, or communication edges, they can miss attacks whose content appears benign at write time but becomes harmful after retrieval. We introduce Memory-Aware Propagation and Link Enforcement Guard, MAPLE-Guard, a memory-link guard for memory-enabled MAS. MAPLE-Guard monitors the memory lifecycle and places gates at write, retrieval, promotion, and cross-agent reuse, so risky memories can be quarantined, unsafe retrievals filtered, and poisoned private memories blocked before they enter shared memory. In the main evaluation, MAPLE-Guard lowers attack success rate (ASR) from 38.2% to 0.9% on LongMemEval and from 34.7% to 0.2% on AppWorld; it also raises multi-agent defense success rate (MDSR) from 54.0% to 74.3% and from 42.5% to 99.8% on the same benchmarks. These results suggest that memory-aware link enforcement covers a gap left by prompt-level and topology-level defenses. Code is available at the link: [this https URL](https://github.com/xiong-wenjun/MAPLE-Guard).
拓扑实证分析9
熵动力学与协作机制2
实证
识别你的编排器：LLM 多智能体系统的熵动力学视角
Recognize Your Orchestrator: An Entropy Dynamics Perspective for LLM Multi-Agent Systems
The transition from single-turn models to Multi-Agent Systems (MAS) promises enhanced problem-solving capabilities, yet the centralized orchestration topology remains a critical point of fragility. To analyze this, we propose a Mean-Field Entropy Dynamics framework, modeling the orchestration process as a system governed by the competing forces of task resolution and cumulative context loading. To facilitate validation, we introduce Inverse Workflow Generation (IWG), a multi-agent pipeline that synthesizes process-verifiable, high-complexity benchmarks with dense intermediate checkpoints. We demonstrate that our entropy dynamics model fits empirical trajectories, providing physically interpretable parameters that quantify system stability and performance collapse. Crucially, our analysis uncovers a ``Reasoning Trap": while reasoning-heavy models excel in isolated tasks, they frequently fail as orchestrators due to context squeezing. Elucidating the physical mechanisms underlying the Orchestrator and quantifying systemic uncertainty offers insights for the MASs' architectural design.
实证
多智能体协作何时有效？熵视角的实证研究
When Does Multi-Agent Collaboration Help? An Entropy Perspective
关键实验对 245 个熵特征的实证分析给出反直觉结论：约 43.3% 的情况下单体智能体优于 MAS，且熵动态主要由第一轮交互决定。三点观察为：确定性偏好（峰值熵直接损害 MAS 正确性、稳定熵直接有益）、基础熵（求解时熵更低的基础模型会因果性地驱动 MAS 性能）、任务感知（熵动态在不同任务中作用不同）。基于此的 Entropy Judger 在所有 MAS 配置与任务上持续提升准确率。
Multi-agent systems (MAS) have emerged as a prominent paradigm for leveraging large language models (LLMs) to tackle complex tasks. However, the mechanisms governing the effectiveness of MAS built upon publicly available LLMs, specifically the underlying rationales for their success or failure, remain largely unexplored. In this paper, we revisit MAS through the perspective of \textit{entropy}, considering both intra- and inter-agent dynamics by investigating entropy transitions during problem-solving across various topologies, six reasoning benchmarks, and two agentic tasks. By analyzing 245 features spanning token-, agent-, and round-level entropy, we counterintuitively find that a single agent outperforms MAS in approximately 43.3\% of cases, and that entropy dynamics are largely determined during the first round of interaction. Furthermore, we provide three key observations: 1) \textit{Certainty Preference}: peak entropy directly harms and stable entropy directly benefits MAS correctness; 2) \textit{Base Entropy}: base models with lower entropy during problem-solving causally drive MAS performance; and 3) \textit{Task Awareness}: entropy dynamics of MAS play varying roles across different tasks. Building on these insights, we introduce a simple yet effective algorithm, the \textit{Entropy Judger}, to select solutions from MAS's pass@k results, leading to consistent accuracy improvements across all MAS configurations and tasks. Our source code is available at \href{[this https URL](https://github.com/AgenticFinLab/multiagent-entropy)}{this https URL}.
可扩展性与成本权衡2
实证
LLM 驱动 MAS 的扩展：设计原则与架构可扩展性
Scaling LLM-Driven Multi-Agent Systems: Design Principles and Architectural Scalability Analysis
LLM-based multi-agent systems have the potential to enable collective intelligence and scale toward solving highly complex tasks through coordinated ensembles of specialized agents. However, despite their theoretical potential, the architectural design space remains largely non-systematized and lacks broadly established design principles. Furthermore, the scalability characteristics of such systems are only partially understood so far. This paper makes two contributions. We first distill four design principles for scalable MAS architectures from a structured analysis of prior work: simplicity, elastic feedback, sequential workflows with optional loops, and summary-based communication. We operationalize these principles in a reference architecture whose topology is formalized as a constrained directed workflow graph, and we evaluate four configurations of increasing complexity on a standardized benchmark of terminal-based system engineering tasks using two LLMs of differing capability. Our findings show that scaling yields measurable accuracy improvements with approximately linear cost growth, but only when the underlying LLM exceeds a minimum capability threshold. Performance peaks at intermediate complexity, then degrades due to timeouts and evaluation limitations. In addition, persistent consistency issues emerge as a central challenge across all scaling levels. These results provide concrete design guidance for practitioners and highlight consistency and evaluation standardization as key targets for future research.
基准
面向攻击性安全任务的最优智能体架构探索
Towards Optimal Agentic Architectures for Offensive Security Tasks
可借鉴点做 MAS 安全评测要同时报告成本、延迟与验证难度：更广的协调未必占优；白盒/黑盒与领域的影响量级大于拓扑选择本身，这一结论可用于论证评测设置的公平性。
Agentic security systems increasingly audit live targets with tool-using LLMs, but prior systems fix a single coordination topology, leaving unclear when additional agents help and when they only add cost. We treat topology choice as an empirical systems question. We introduce a controlled benchmark of 20 interactive targets (10 web/API and 10 binary), each exposing one endpoint-reachable ground-truth vulnerability, evaluated in whitebox and blackbox modes. The core study executes 600 runs over five architecture families, three model families, and both access modes, with a separate 60-run long-context pilot reported only in the appendix. On the completed core benchmark, detection-any reaches 58.0% and validated detection reaches 49.8%. MAS-Indep attains the highest validated detection rate (64.2%), while SAS is the strongest efficiency baseline at $0.058 per validated finding. Whitebox materially outperforms blackbox (67.0% vs. 32.7% validated detection), and web materially outperforms binary (74.3% vs. 25.3%). Bootstrap confidence intervals and paired target-level deltas show that the dominant effects are observability and domain, while some leading whitebox topologies remain statistically close. The main result is a non-monotonic cost-quality frontier: broader coordination can improve coverage, but it does not dominate once latency, token cost, and exploit-validation difficulty are taken into account.
安全脆弱性与偏差放大3
攻击
MAStrike：Shapley 引导的 MAS 协同攻击
MAStrike: Shapley-Guided Collusive Red-Teaming on Multi-Agent Systems
关键实验摘要未给出量化结果：MAStrike 在覆盖金融、软件工程与 CRM 的多种层级拓扑红队基准上，于多个前沿模型构建的 MAS 中显著优于启发式基线；分析还揭示了非平凡的 Shapley 值分布与智能体之间的高阶交互结构，暴露出以往单智能体或模板式方法忽略的脆弱性。
可借鉴点Shapley 值可作为把系统级安全拆解到智能体级的归因指标，配合因果诊断形成红队闭环，对做 MAS 拓扑安全评估与防御加固可直接复用。
Hierarchical multi-agent systems (MAS) are rapidly being deployed in high-stakes workflows across domains such as finance and software engineering. In these systems, safety and security are inherently distributed across role-specialized agents, significantly expanding the attack surface, particularly under coordinated adversarial behaviors such as privilege escalation and cross-agent collusion. Existing red-teaming approaches for MAS remain limited: they rely on heuristic selection of target agents and perturb isolated message streams, leaving critical questions unanswered as which agents are most responsible for system safety, and how compromised agents can coordinate to bypass defenses. We propose MAStrike, a closed-loop framework for collusive red-teaming in hierarchical MAS. We propose the first agent-level Shapley value analysis for MAS, quantifying each agent's marginal contribution to system robustness under task-specific distributions. GGuided by this attribution, MAStrike identifies vulnerable agent coalitions and generates coordinated, role-aware adversarial manipulations. These attacks are iteratively refined through structured causal diagnosis, attributing failure cases to uncompromised agents that block adversarial attempts. We further build a comprehensive MAS red-teaming benchmark and controllable environments spanning diverse hierarchical topologies and domains, including finance, software engineering, and CRM. Extensive experiments across MAS built on multiple frontier models show that MAStrike substantially outperforms heuristic baselines. Our analysis further uncovers non-trivial Shapley value distributions and higher-order interaction structures among agents, revealing critical vulnerabilities and coordination patterns that are overlooked by prior single-agent or template-based methods.
Multi-agent systems (MAS), composed of networks of two or more autonomous AI agents, have become increasingly popular in production deployments, yet introduce security risks that do not arise in single-agent settings. Even if individual agents exhibit robust security, architectural decisions governing their coordination can create attack surfaces that have not been systematically characterized. In this work, we present an empirical study of how MAS design decisions shape the tradeoff between task performance and attack resistance. Across three agentic environments (browser, desktop, and code) and 13 architectural configurations, we use stagewise evaluations that distinguish planning refusal, execution-stage interception, partial harmful execution, and successful attack completion to study three key design choices: (i) agent roles, which determine how authority and responsibility are allocated; (ii) communication topology, which shapes how and when agents interact; and (iii) memory, which determines the context and state visibility accessible to each agent. We find that multi-agent architectures are more vulnerable than standalone agents in the majority of configurations, with attack success rates varying by up to 3.8x at comparable or higher benign accuracy, and that no single design is universally safer. These results motivate the development of further evaluations that move beyond the security properties of a single agent.
实证
对齐的智能体，有偏的群体：MAS 偏见放大测量
Aligned Agents, Biased Swarm: Measuring Bias Amplification in Multi-Agent Systems
多智能体系统（MAS）被广泛用于复杂工作流，但偏见累积仍鲜为人知。本文考察基本 MAS 拓扑与反馈回路如何影响偏见，并假设结构化工作流像回声室一样把微小随机偏见放大为系统性极化。作者引入开放式基准 Discrim-Eval-Open，用跨人口群体的强制比较判断绕过单模型中立性，发现架构越复杂偏见反而越重、孤立中立智能体也出现系统性放大，并提出「触发脆弱性」：注入纯客观上下文反而加速极化。
可借鉴点衡量 MAS 伦理风险时应把拓扑与反馈回路当作自变量、用强制性比较判断构造测量，并优先复现「客观上下文反而加速极化」这类反直觉故障模式。
While Multi-Agent Systems (MAS) are increasingly deployed for complex workflows, their emergent properties-particularly the accumulation of bias-remain poorly understood. Because real-world MAS are too complex to analyze entirely, evaluating their ethical robustness requires first isolating their foundational mechanics. In this work, we conduct a baseline empirical study investigating how basic MAS topologies and feedback loops influence prejudice. Contrary to the assumption that multi-agent collaboration naturally dilutes bias, we hypothesize that structured workflows act as echo chambers, amplifying minor stochastic biases into systemic polarization. To evaluate this, we introduce Discrim-Eval-Open, an open-ended benchmark that bypasses individual model neutrality through forced comparative judgments across demographic groups. Analyzing bias cascades across various structures reveals that architectural sophistication frequently exacerbates bias rather than mitigating it. We observe systemic amplification even when isolated agents operate neutrally, and identify a 'Trigger Vulnerability' where injecting purely objective context drastically accelerates polarization. By stripping away advanced swarm complexity to study foundational dynamics, we establish a crucial baseline: structural complexity does not guarantee ethical robustness. Our code is available at [this https URL](https://github.com/weizhihao1/MAS-Bias).
群体智能与多样性涌现2
实证
识别 LLM 智能体群体中的集体智能因子
Identifying Collective Intelligence Factor in LLM Agent Groups for Generalizable Multi-Agent System Design
Large language model (LLM)-based multi-agent systems (MASs) have shown impressive performance in solving a wide range of complex problems. However, previous studies mainly focus on designing customized MAS for specific tasks, while a critical research problem remains unclear: Do LLM agent groups exhibit a form of “general intelligence” that reflects their general ability across various tasks? Researchers have found a Collective Intelligence (CI) factor in human groups that captures their general capability. Inspired by this, in this study, we aim to investigate whether an analogous CI factor also exists in LLM agent groups, which is crucial for building generalizable MAS. Motivated by human cognitive psychology experiments, we construct 108 LLM agent groups with diverse group sizes, LLM compositions, and communication topologies. We systematically evaluate these groups across a wide range of tasks and analyze their performances. Our results demonstrate that an Artificial Collective Intelligence (ACI) factor can be extracted from LLM agent groups to predict the generalization performance on new tasks. Inspired by this, we train a model to predict the ACI based on the features of MAS, and show that it can be used as a plug-in to enhance the generalization ability of MAS optimization methods.
实证
多智能体 LLM 系统的多样性崩溃与结构耦合
Diversity Collapse in Multi-Agent LLM Systems: Structural Coupling and Collective Failure in Open-Ended Idea Generation
可借鉴点设计创意型 MAS 时，保留独立性与分歧机制比堆更多智能体更关键；「结构耦合 → 多样性崩溃」是评价拓扑优劣时可以复用的故障模式。
Multi-agent systems (MAS) are increasingly used for open-ended idea generation, driven by the expectation that collective interaction will broaden the exploration diversity. However, when and why such collaboration truly expands the solution space remains unclear. We present a systematic empirical study of diversity in MAS-based ideation across three bottom-up levels: model intelligence, agent cognition, and system dynamics. At the model level, we identify a compute efficiency paradox, where stronger, highly aligned models yield diminishing marginal diversity despite higher per-sample quality. At the cognition level, authority-driven dynamics suppress semantic diversity compared to junior-dominated groups. At the system level, group-size scaling yields diminishing returns and dense communication topologies accelerate premature convergence. We characterize these outcomes as collective failures emerging from structural coupling, a process where interaction inadvertently contracts agent exploration and triggers diversity collapse. Our analysis shows that this collapse arises primarily from the interaction structure rather than inherent model insufficiency, highlighting the importance of preserving independence and disagreement when designing MAS for creative tasks. Our code is available at [https://github.com/Xtra-Computing/MAS_Diversity](https://github.com/Xtra-Computing/MAS_Diversity).
评测、应用与综述Benchmark, Application & Survey10
基准测试、落地应用与领域综述
安全基准1
图异常监测评测基准1
基准
GAMMAF：LLM MAS 图异常监测基准框架
GAMMAF: A Common Framework for Graph-Based Anomaly Monitoring Benchmarking in LLM Multi-Agent Systems
可借鉴点把 MAS 交互建成带属性的图、并在推理过程中动态隔离可疑节点，是可复用的防御评测抽象；「修复攻击反而省钱」也为安全机制的经济性论证提供了说法。
The rapid integration of Large Language Models (LLMs) into Multi-Agent Systems (MAS) has significantly enhanced their collaborative problem-solving capabilities, but it has also expanded their attack surfaces, exposing them to vulnerabilities such as prompt infection and compromised inter-agent communication. While emerging graph-based anomaly detection methods show promise in protecting these networks, the field currently lacks a standardized, reproducible environment to train these models and evaluate their efficacy. To address this gap, we introduce Gammaf (Graph-based Anomaly Monitoring for LLM Multi-Agent systems Framework), an open-source benchmarking platform. Gammaf is not a novel defense mechanism itself, but rather a comprehensive evaluation architecture designed to generate synthetic multi-agent interaction datasets and benchmark the performance of existing and future defense models. The proposed framework operates through two interdependent pipelines: a Training Data Generation stage, which simulates debates across varied network topologies to capture interactions as robust attributed graphs, and a Defense System Benchmarking stage, which actively evaluates defense models by dynamically isolating flagged adversarial nodes during live inference rounds. Through rigorous evaluation using established defense baselines (XG-Guard and BlindGuard) across multiple knowledge tasks (such as MMLU-Pro and GSM8K), we demonstrate Gammaf's high utility, topological scalability, and execution efficiency. Furthermore, our experimental results reveal that equipping an LLM-MAS with effective attack remediation not only recovers system integrity but also substantially reduces overall operational costs by facilitating early consensus and cutting off the extensive token generation typical of adversarial agents.
应用1
动态图推理协作1
框架
AdaSTORM：自适应时空多智能体协作的动态图推理
AdaSTORM: Scaling LLM Reasoning on Dynamic Graphs via Adaptive Spatio-Temporal Multi-Agent Collaboration
Large Language Models (LLMs) demonstrate remarkable potential in dynamic graph reasoning, but suffer from a scaling bottleneck: current models can only handle graphs with tens of nodes, constrained by exponential reasoning overhead and finite context windows. While multi-agent systems (MAS) offer collective reasoning and topology-aware orchestration, capabilities naturally suited for graph-structured tasks, their application to dynamic graphs remains unexplored. This paper presents Scaling LLM Reasoning on Dynamic Graphs via Adaptive Spatio-Temporal Multi-Agent Collaboration (AdaSTORM), a framework that reformulates large-scale dynamic graph reasoning into two stages: (i) Adaptive Partitioning, partitioning large-scale dynamic graphs into subregions that match the model's reasoning capacity while minimizing inference cost; and (ii) Collaborative Reasoning, aligning graph partition topologies with a spatio-temporal decoupled multi-agent architecture. AdaSTORM is the first multi-agent framework tailored for dynamic graph reasoning. Extensive experiments show that AdaSTORM successfully breaks through the scaling bottleneck, scaling reasoning to thousand-node graphs with over 90% accuracy across several large-scale dynamic graph settings without external tools, significantly outperforms seven competitive baselines. Furthermore, it achieves state-of-the-art accuracy on existing benchmarks and generalizes robustly to real-world datasets. The source code is available at: [this https URL](https://github.com/irisorchid107/AdaSTORM/).
综述3
智能体安全综述2
综述
自主交互智能体的行为安全：风险、攻击、防御与评估
Behavior Safety of Autonomous Interactive Agents: Risks, Attacks, Defenses and Evaluation
可借鉴点「内生安全 / 外部安全」二分是定位 MAS 安全工作的实用坐标，可用它判断一项拓扑防御补的是哪一侧，并据此选择相应的评估口径。
[[../论文-AI精读/参考论文1_阅读笔记/（综述）Behavior Safety of Autonomous Interactive Agents Risks, Attacks, Defenses and Evaluation]]
综述
SoK：智能体化 AI 系统的攻击与防御全景
SoK: Attack and Defense Landscape of Agentic AI Systems
USENIX Security 2026·2026·安全性顶会·sok
系统性知识梳理设计空间攻击面防御机制
把大语言模型（LLM）与非 AI 工具组件集成起来的 AI 智能体正快速落地，其灵活性带来了不同于传统软件系统的安全挑战。本文给出首个关于 AI 智能体安全的系统性知识梳理（SoK），从设计空间、攻击面与防御机制三条线索组织现有工作，并指出该领域未来的开放挑战。作者称这是理解智能体安全风险与防御策略的首个系统性框架，可作为构建安全智能体系统与推进后续研究的基础。
研究动机智能体把 LLM 组件与非 AI 工具组件组合在一起，产生了传统软件系统不具备的安全挑战，而相关研究此前散落各处、缺少统一的组织框架。
解决问题如何系统化 AI 智能体的安全设计空间、攻击面与防御机制，并给出可支撑后续研究的统一框架。
主要方法以 SoK（systematization of knowledge）方式构建统一分析框架：从智能体系统的设计空间出发，沿 LLM 组件与非 AI 工具组件的交互边界分类攻击面，对应整理防御机制，并归纳该领域的开放挑战。
关键实验摘要未给出量化结果
可借鉴点可借用它的「设计空间—攻击面—防御」三段式定位自己的 MAS 拓扑安全工作处于哪一层，并把其开放挑战清单当作选题检查表。
AI agents that integrate large language models with non-AI tool components are rapidly emerging in real-world applications, offering unprecedented automation and flexibility. However, this flexibility introduces complex security challenges that differ from traditional software systems. In this paper, we present the first comprehensive systematization of knowledge on AI agent security, analyzing the design space, attack landscape, and defense mechanisms for secure AI agent systems. In addition, we identify open challenges for future research in this emerging domain. Our work provides the first systematic framework for understanding AI agent security risks and defense strategies, serving as a foundation for building secure agentic systems and advancing research in this critical area.
多智能体架构综述1
综述
从碎片化到系统化设计：构建基于 LLM 的多智能体系统
From Fragmentation to Systematic Design: Architecting LLM-Based Multi-Agent Systems
主要方法综述沿五个相互作用的维度（智能体构成、多智能体编排、演化、应用、评估）组织文献，并把系统分解为模块化配置、记忆基元与交互拓扑三层，据此提出「确定性数字劳动力 vs 探索性数字实验室」的应用二分，并对应区分任务导向与协调导向两类评估方法。
关键实验摘要未给出量化结果
可借鉴点做 MAS 拓扑研究时可把「交互拓扑」放进它给出的五维框架中定位，并借用「任务导向 / 协调导向」二分来选择评估口径与指标。
The integration of Large Language Models (LLMs) has substantially facilitated the development of autonomous multi agent systems (MAS). However, the contemporary landscape appears characterized by fragmentation arising from incremental prompt engineering and heterogeneous workflow designs. To mitigate this conceptual disparity, the present survey articulates a unified architectural framework intended to advance MAS research from experimental prototyping toward a systematic architectural science. Recent scholarship is organized along five interacting dimensions comprising Agent Constitution, Multi Agent Orchestration, Evolution, Applications, and Evaluation. Through the decomposition of systems into modular profiles, memory substrates, and interaction topologies, the analysis suggests a discernible transition from heuristic scripts toward executable specifications. Complementing this structural view, application paradigms are synthesized into deterministic Digital Workforces and explorative Digital Laboratories, a dichotomy that implies the necessity for distinct task--oriented and coordination--oriented evaluation methodologies. Looking forward, the study identifies adaptive orchestration, risk governance, and process level observability as likely frontiers for the establishment of dependable multi agent infrastructures.
其他论文5
通信内容与共识机制2
方法
面向 LLM 多智能体系统的动态共识通信机制
Dynamic Consensus Communication Mechanism for Large Language Model-Based Multi-Agent Systems
Journal of Signal Processing Systems·2026·四区期刊·dynamic-consensus-communication
Large Language Models (LLMs) often struggle with multi-step reasoning tasks. To address this, LLM-based Multi-Agent Systems (LLM-MAS) have been introduced, where agents interact to reach consensus. However, these systems face two major issues: hallucination propagation, where incorrect responses mislead others, and communication redundancy, where excessive interactions increase token cost without improving performance. This paper proposes a unified solution: Consensus-driven Community Agent Communication (). Each agent’s response is decomposed into an answer and an analysis, allowing for precise tracking of misleading content and redundant patterns. Agents are clustered into communities based on answers, and selected representatives—chosen by analysis quality—conduct cross-community discussion. A confirmation mechanism finalizes the consensus. Experiments on multiple datasets show that significantly reduces hallucinations and communication overhead while maintaining or improving reasoning accuracy. These results demonstrate the effectiveness and scalability of in enhancing LLM-based multi-agent systems.
方法
智能体该说什么：面向高效 MAS 的动作状态通信
What Should Agents Say? Action-state Communication for Efficient Multi-Agent Systems
Multi-agent systems (MAS) built on large language models are typically organized around roles, pipelines, and turn schedules, while the content that agents pass to one another is often left as unconstrained natural language. However, this free-form communication can rapidly inflate token usage, consume the shared context window, and ultimately affect both system performance and inference cost. We analyze five common inter-agent communication strategies across two MAS topologies, finding that no fixed strategy is universally optimal. Instead, effective inter-agent messages consistently preserve action-centered information needed by downstream agents. Building on this, we propose the PACT (Protocolized Action-state Communication and Transmission), which treats inter-agent communication as a public state-update problem and projects each raw agent output into a compact action-state record before it enters shared history. Across different MAS topologies, PACT consistently improves the performance-cost trade-off, achieving comparable or stronger task performance with substantially fewer tokens. The gains extend to production coding harnesses: PACT lifts OpenHands' resolve rate at -10% tokens-per-resolved, and is resolve-neutral on SWE-agent while halving input tokens. Our code is publicly available at [this https URL](https://github.com/iNLP-Lab/PACT).
拓扑与角色自动设计1
框架
ABSTRAL：经迭代精化与拓扑优化的 MAS 自动设计
ABSTRAL: Automatic Design of Multi-Agent Systems Through Iterative Refinement and Topology Optimization
可借鉴点把拓扑设计知识外化成可读文档、再用轨迹对比驱动迭代，是让 MAS 结构优化过程可审计、可跨域迁移的实用做法。
How should multi-agent systems be designed, and can that design knowledge be captured in a form that is inspectable, revisable, and transferable? We introduce ABSTRAL, a framework that treats MAS architecture as an evolving natural-language document, an artifact refined through contrastive trace analysis. Three findings emerge. First, we provide a precise measurement of the multi-agent coordination tax: under fixed turn budgets, ensembles achieve only 26% turn efficiency, with 66% of tasks exhausting the limit, yet still improve over single-agent baselines by discovering parallelizable task decompositions. Second, design knowledge encoded in documents transfers: topology reasoning and role templates learned on one domain provide a head start on new domains, with transferred seeds matching coldstart iteration 3 performance in a single iteration. Third, contrastive trace analysis discovers specialist roles absent from any initial design, a capability no prior system demonstrates. On SOPBench (134 bank tasks, deterministic oracle), ABSTRAL reaches 70% validation / 65.96% test pass rate with a GPT-4o backbone. We release the converged documents as inspectable design rationale.
提示与技能层优化2
方法
从多智能体到单智能体：技能蒸馏何时有益
From Multi-Agent to Single-Agent: When Is Skill Distillation Beneficial?
arXiv·2026·预印本·from-multi-agent-to-single
技能蒸馏能力资源流水线指导行为-结果自由度
结构化数据科学任务的 MAS 通过跨阶段、工具、共享状态、验证与修复的工作流把分析控制外置，蒸馏为单智能体技能可降低编排开销，但哪些组件该跨越控制边界并不清楚。作者区分能力资源（扩展智能体能力）与流水线指导（约束其探索哪些解）：加入任务合格的流水线指导后，方法选择准确率 +19.6 分、数值误差 -10.3 分。为解释该反转，提出预合成诊断量「行为-结果自由度」F 并据此设计 AdaSkill。
研究动机把 MAS 工作流蒸馏为单智能体技能可以降低编排开销，但「哪些工作流组件应当跨越控制边界」缺少判据，盲目搬运会导致性能反转。
可借鉴点「能力资源 / 流水线指导」二分加上可预计算的 F 诊断，为判断拓扑中哪些控制边界该保留、哪些该压掉提供了可复用的判据。
Multi-agent systems (MAS) for structured data-science tasks externalize analytical control through workflows spanning stages, tools, shared state, verification, and repair. Distilling such workflows into a single-agent skill can reduce orchestration overhead, but it remains unclear which workflow components should cross the control boundary. We distinguish capability resources, which expand what an agent can do, from pipeline guidance, which constrains which solutions it explores. On the same causal-estimation instances, adding task-qualified source pipeline guidance to a capability-matched skill changes normalized utility by +19.6 points under method-selection accuracy but -10.3 points under numerical error. To explain this reversal, we introduce Behavior-Outcome Freedom (F), a pre-synthesis diagnostic of signed behavior-outcome rank mismatch, and formalize its candidate-conditional role through Signed Anchor-Rank Transfer. Motivated by this mechanism, we propose AdaSkill, which preserves validated capability resources, removes runtime orchestration, and conditionally inherits pipeline guidance using a calibrated rule over F. Across 16 capability-matched interventions, the native-scale Full-minus-Discard effect decreases across the continuous F scale (r = -0.80, p < 0.001), while a 15-treatment atomic sweep localizes the reversal to pipeline guidance. Across 11 datasets spanning four structured data-science task families, AdaSkill combines strong task performance with substantially lower deployment overhead.
方法
MASPOB：基于多臂老虎机与图神经网络的 MAS 提示优化
MASPOB: Bandit-Based Prompt Optimization for Multi-Agent Systems with Graph Neural Networks
ICML 2026·2026·CCF-A 会议·maspob
多臂老虎机置信上界 UCB图神经网络拓扑耦合
大语言模型（LLM）常作为多智能体系统（MAS）的认知骨干，许多部署场景不允许改动工作流，而性能对提示高度敏感，因此提示优化更自然。但 MAS 提示优化受评估成本高、拓扑耦合、搜索空间组合爆炸三重阻碍。MASPOB 用多臂老虎机（bandit）以置信上界（UCB）平衡探索与利用，用图神经网络（GNN）学习拓扑感知的提示表示以处理耦合，再用坐标上升拆成单变量子问题，把搜索复杂度从指数级降到线性级。
研究动机许多实际部署不允许修改 MAS 工作流，而性能对提示高度敏感，因此提示优化比改结构更现实；但 MAS 提示优化同时受评估成本高、拓扑耦合与搜索空间爆炸三重制约。
Large Language Models (LLMs) have achieved great success in many real-world applications, especially the one serving as the cognitive backbone of Multi-Agent Systems (MAS) to orchestrate complex workflows in practice. Since many deployment scenarios preclude MAS workflow modifications and its performance is highly sensitive to the input prompts, prompt optimization emerges as a more natural approach to improve its performance. However, real-world prompt optimization for MAS is impeded by three key challenges: (1) the need of sample efficiency due to prohibitive evaluation costs, (2) topology-induced coupling among prompts, and (3) the combinatorial explosion of the search space. To address these challenges, we introduce MASPOB (Multi-Agent System Prompt Optimization via Bandits), a novel sample-efficient framework based on bandits. By leveraging Upper Confidence Bound (UCB) to quantify uncertainty, the bandit framework balances exploration and exploitation, maximizing gains within a strictly limited budget. To handle topology-induced coupling, MASPOB integrates Graph Neural Networks (GNNs) to capture structural priors, learning topology-aware representations of prompt semantics. Furthermore, it employs coordinate ascent to decompose the optimization into univariate sub-problems, reducing search complexity from exponential to linear. Extensive experiments across diverse benchmarks demonstrate that MASPOB achieves state-of-the-art performance, consistently outperforming existing baselines.