BlindGuard: Safeguarding LLM-based Multi-Agent Systems under Unknown Attacks

1. Problem Statement

Large Language Model (LLM)-based Multi-Agent Systems (MAS) are increasingly vulnerable to propagation vulnerabilities, where a few malicious agents can distort collective decision-making through inter-agent interactions. Common attack vectors include:

• Prompt Injection (PI): Manipulating system prompts or user inputs.
• Memory Poisoning (MA): Corrupting historical interaction data or knowledge bases.
• Tool Exploitation (TA): Leveraging vulnerabilities in external plugins.

Limitations of Existing Solutions:
Current defense mechanisms, such as G-Safeguard, rely on supervised Graph Anomaly Detection (GAD). These methods require labeled data of malicious agents to train detection models. This creates two critical bottlenecks:

1. Data Scarcity: Real-world adversarial attacks are sparse and camouflaged, making it difficult to obtain well-annotated malicious samples.
2. Lack of Generalizability: Supervised models trained on specific attack types often fail to detect novel, unseen, or evolving attack patterns.

The core research question is: Can we design a defense framework for MAS that operates without labeled attack data or prior knowledge of attack patterns?

2. Methodology: BlindGuard

BlindGuard is an unsupervised defense framework designed to detect and mitigate malicious agents using only normal interaction data. It consists of three core components:

A. Hierarchical Agent Encoder

To address the gap in "multi-level contextual awareness," BlindGuard constructs comprehensive agent representations by fusing information from three distinct levels:

1. Agent Level (Ego): Captures individual semantic features derived from the agent's textual response (encoded via SentenceBERT).
2. Neighbor Level: Aggregates contextual information from directly connected agents to model local interactions.
3. System Level: Integrates global information across the entire MAS graph to capture long-range dependencies and collective behavior patterns.

The encoder uses a "summarization-transformation" architecture to combine these features ($h^s_i, h^n_i, h^g_i$) into a unified representation $z_i$, allowing the model to detect both isolated attackers (via neighborhood divergence) and coordinated attack groups (via global behavioral divergence).

B. Corruption-Guided Attack Detector

Since no labeled malicious data exists for training, BlindGuard employs a corruption-based strategy to simulate attacks:

1. Semantic Corruption: Instead of manipulating raw text (which is complex), the model injects directional noise into the embedding space of normal agent features. This simulates the semantic deviation caused by adversarial attacks.
   • Formula: $\tilde{x}_i = x_i + \alpha \|x_i\|_2 \cdot \frac{\epsilon_i}{\|\epsilon_i\|_2}$, where $\epsilon_i$ is random noise and $\alpha$ controls intensity.
2. Supervised Contrastive Learning: The model is trained using these synthetic "corrupted" agents as negative samples and normal agents as positive samples. The objective is to maximize similarity among normal agents while minimizing similarity between normal and corrupted agents. This creates a robust decision boundary in the embedding space without needing real attack labels.

C. Pruning-Based Remediation

During inference, the system calculates an anomaly score for each agent based on its contextual similarity to the global representation.

• Detection: Agents with high anomaly scores (low similarity to the normal cluster) are flagged.
• Remediation: The system performs bidirectional edge pruning, severing all communication links to and from detected malicious agents. This isolates the threat and prevents adversarial propagation while preserving legitimate interactions among normal agents.

3. Key Contributions

1. Scenario Innovation: Proposes a practical defense paradigm for MAS that functions without labeled attack data or prior knowledge of specific attack patterns, addressing a critical gap in real-world deployment.
2. Methodological Advancement: Introduces BlindGuard, the first unsupervised GAD method specifically tailored for LLM-based MAS. It uniquely combines hierarchical encoding (local + global context) with corruption-guided contrastive learning to handle semantic anomalies that traditional structural GAD methods miss.
3. Comprehensive Evaluation: Extensively validates the method across 4 different MAS topologies (Chain, Tree, Star, Random), 3 attack types (PI, MA, TA), and multiple LLM backbones (GPT-4o-mini, DeepSeek-V3, Qwen3).

4. Experimental Results

BlindGuard was evaluated against state-of-the-art baselines, including supervised methods (G-Safeguard) and unsupervised GAD methods (DOMINANT, PREM, TAM).

• Performance vs. Unsupervised Baselines: BlindGuard significantly outperforms other unsupervised methods, achieving AUC scores > 80% across most scenarios. It consistently reduces the Attack Success Rate (ASR) by a large margin compared to "No Defense" and other unsupervised approaches.
• Performance vs. Supervised Upper Bound: Despite lacking labeled training data, BlindGuard achieves performance comparable to the supervised G-Safeguard (which has access to ground-truth attack labels).
• Generalization:
  • Unseen Attacks: BlindGuard demonstrates superior generalization against unseen attack types (e.g., trained on Prompt Injection, tested on Memory Poisoning), whereas supervised models suffer significant performance drops.
  • Topology & LLM Agnostic: The method maintains robust performance across different communication topologies and various LLM backbones, indicating it learns universal adversarial patterns rather than overfitting to specific structures or models.
• Scalability: The method scales effectively to larger MAS (up to 50 agents) without performance degradation.

5. Significance and Impact

• Practicality: By removing the dependency on labeled malicious data, BlindGuard makes robust security feasible for real-world MAS deployments where attack data is unavailable or classified.
• Attack Agnosticism: The ability to detect "unknown" attacks makes it a critical tool for defending against emerging threats in dynamic environments.
• Theoretical Contribution: The paper highlights the necessity of global system context in MAS security. It demonstrates that relying solely on local neighborhood features is insufficient for detecting coordinated or subtle semantic attacks, establishing a new standard for graph-based anomaly detection in language-centric systems.

In conclusion, BlindGuard represents a significant step forward in securing LLM-based multi-agent systems, offering a scalable, generalizable, and practical solution to the growing threat of adversarial propagation.