Technical Summary: CASPIAN – Online Detection and Attribution of Cascade Attacks in LLM Multi-Agent Systems

1. Problem Statement

Large Language Model Multi-Agent Systems (LLM-MAS) are increasingly susceptible to cascade attacks, a failure mode distinct from isolated prompt injections or hallucinations. In these attacks, adversarial or erroneous influence injected at a single agent propagates, amplifies, and self-reinforces across multiple agents and interaction turns. These cascades exploit the system's interaction structure, potentially corrupting shared memory, redirecting tool outputs, and synchronizing agents toward a collectively flawed trajectory.

The core challenge in detecting these attacks lies in the distributed and coupled nature of the evidence:

• Cross-Channel Propagation: Influence spreads concurrently through communication, shared memory, tool APIs, and execution metadata. Monitoring a single channel provides an incomplete view.
• Temporal Accumulation: Influence accumulates gradually through context reuse. An agent may appear locally benign while the system collectively transitions toward coordinated failure.
• Limitations of Existing Defenses: Current approaches (semantic guardrails, LLM judges, graph-based detectors) largely operate on isolated messages, static graphs, or post-hoc traces. They fail to capture the online, cross-channel, temporally coordinated dynamics of cascade propagation, often missing early-stage failures or requiring offline analysis that precludes real-time intervention.

2. Methodology: The CASPIAN Framework

CASPIAN (Cascade Attack Spectral Propagation and Influence Attribution Network) is a unified framework designed for online detection and attribution of cascade attacks. It shifts the paradigm from localized semantic inspection to monitoring the evolving structure of causal influence across the system.

2.1 Unified Cross-Channel Causal Modeling

CASPIAN models the LLM-MAS as an evolving cross-channel causal influence tensor $A_t \in \mathbb{R}^{N \times N \times |C|}$, where $N$ is the number of agents and $C = \{comm, mem, tool, exec\}$ represents the interaction channels.

• Influence Estimation: Instead of computationally expensive full-state analysis, CASPIAN employs a Late-Interaction Conditional Transfer Entropy (LI-CTE) formulation. This estimates directed influence $a_{ij}^{(c)}(t)$ from agent $i$ to $j$ on channel $c$ by measuring how much the source's activity explains the target's current behavior, conditioned on the target's own historical state.
• Efficiency: Inspired by ColBERT-style decomposition, LI-CTE constructs compact source and target projections, introducing only millisecond-scale overhead while capturing history-aware, directed dependencies.
• Tensor Aggregation: Channel-specific influence matrices are normalized and aggregated into a unified influence matrix $\tilde{A}_t$ for spectral analysis, while preserving the tensor structure for channel-level attribution.

2.2 Online Spectral Cascade Detection

CASPIAN detects cascades by monitoring spectral transitions in the evolving influence topology. It distinguishes transient collaborative activity from self-reinforcing cascades through four key dynamics:

1. Amplification: Growth in dominant spectral energy ($E_t = \lambda_1(t) + \lambda_2(t)$).
2. Synchronization: Tightening of the spectral gap ($g_t = 1 - \lambda_2(t)/\lambda_1(t)$), indicating coupled propagation modes.
3. Cross-Channel Spread: Distribution of influence energy across multiple channels, measured via normalized Shannon entropy ($H_t^{norm}$).
4. Persistence: Sustained reinforcement of these dynamics over time.

Detection Logic:

• WATCH Condition: Activates when amplification growth coincides with tightening spectral coupling ($\Delta g_t > 0$) driven by the dominant mode.
• Classification:
  • Single-Turn Cascades: Detected immediately if WATCH coincides with a Phase Shift (abrupt structural change) or Cross-Channel Spread, provided a feasible propagation path (Weak-Link check) exists.
  • Multi-Turn Cascades: Detected if WATCH persists over an adaptive window $W_{tw}$ (governed by the inverse spectral gap) and contains at least one structural transition event.

2.3 Online Causal Attribution

Upon detection, CASPIAN performs online attribution using cached influence dynamics, requiring no replay or recomputation. It identifies:

• Origin: The agent with the strongest outgoing influence at onset.
• Amplifier: The agent that most strongly reinforces propagation (high outflow-to-inflow ratio).
• Bridge: The agent that receives and redistributes influence across the network.
• Propagation Spines: The top-$K$ dominant paths, ranked by their weakest-link strength, along with the dominant interaction channel for each spine.

3. Key Contributions

1. Unified Cross-Channel Causal Modeling: The first framework to jointly model directed inter-agent influence across communication, memory, tool, and execution channels in LLM-MAS using an efficient LI-CTE formulation.
2. Online Spectral Detection: A detection mechanism that identifies both abrupt single-turn and gradual multi-turn cascades from evolving influence dynamics without requiring attack templates, benign calibration traces, or offline training.
3. Real-Time Attribution: An attribution scheme that recovers cascade origins, amplifiers, bridges, and propagation paths directly from cached influence dynamics at detection time, enabling immediate intervention.

4. Experimental Results

CASPIAN was evaluated on two benchmarks (TAMAS and ACIArena) across four LLM-MAS frameworks (AutoGen, CrewAI, MetaGPT, LLM Debate) involving 727 scenarios and 2,908 execution traces.

• Detection Performance: CASPIAN consistently outperformed semantic guardrails (e.g., PromptGuard), LLM-based judges, and graph-based detectors (e.g., G-Safeguard).
  • AUROC: Exceeded 0.90 in most configurations (e.g., 0.942 on AutoGen).
  • Early Detection (EDR@5): Achieved detection within 5 turns of injection in ~79% of cases on AutoGen, significantly outperforming baselines (e.g., 0.792 vs. 0.482 for the best graph-based baseline).
  • Robustness: Performance remained strong across different attack types (Intent Manipulation, Execution Attacks, Coordination Attacks) and framework topologies.
• Attribution Accuracy:
  • Origin Localization: High accuracy (Acc@1 $\approx$ 0.86 on TAMAS AutoGen).
  • Bridge/Amplifier: Stable recovery, though bridge identification is more challenging in distributed topologies.
  • Path Recovery: Spine Jaccard@3 scores remained above 0.62 across settings.
• Efficiency: CASPIAN operates with sub-1% relative overhead latency (e.g., ~0.66% on benign traces), making it suitable for online deployment.

5. Significance and Claims

The paper claims that unified cross-channel causal modeling is essential for reliably detecting and understanding cascade failures in LLM multi-agent systems. Unlike prior methods that reason locally about prompts or static graphs, CASPIAN addresses the fundamental nature of cascade attacks as global propagation processes.

Key takeaways emphasized by the authors:

• Structural Reorganization: Cascade onset is characterized by a structural reorganization of inter-agent influence (amplification, synchronization, cross-channel spread) rather than just isolated anomalies.
• Online Viability: The framework demonstrates that complex causal monitoring can be integrated into online execution with negligible latency, enabling real-time intervention.
• Beyond Message Inspection: Monitoring execution, memory, and tool channels is critical; message-only monitoring fails to capture propagation signals in systems with persistent memory or tool access.
• Interpretability: The attribution capabilities provide a trace-conditioned decomposition of failure, supporting security auditing and the analysis of agent coordination dynamics.

The work concludes that structural causal monitoring offers a scalable foundation for security and auditing in complex LLM-agent ecosystems, moving beyond the limitations of localized semantic inspection.