🤖 AI

MAStrike: Shapley-Guided Collusive Red-Teaming on Multi-Agent Systems

This paper introduces MAStrike, a closed-loop red-teaming framework that utilizes agent-level Shapley value analysis to identify and exploit vulnerable agent coalitions through coordinated, role-aware adversarial attacks, thereby revealing critical safety vulnerabilities in hierarchical multi-agent systems that existing heuristic methods overlook.

Original authors: Chejian Xu, Zhaorun Chen, Jingyang Zhang, Freddy Lecue, Avni Kothari, Sarah Tan, Wenbo Guo, Bo Li

Published 2026-06-12

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Chejian Xu, Zhaorun Chen, Jingyang Zhang, Freddy Lecue, Avni Kothari, Sarah Tan, Wenbo Guo, Bo Li

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a high-stakes bank vault. In the old days, you might just need to trick one guard to get in. But in modern Multi-Agent Systems (MAS), the vault is guarded by a whole team of specialized experts: one checks your ID, another checks your history, a third verifies your device, and a fourth approves the transaction. They talk to each other to make sure everything is safe.

The problem is, if these guards start whispering to each other in a secret code, they might let a thief in even if the other guards are screaming "Stop!"

This paper introduces MASTRIKE, a new way to test if these teams of AI agents are actually safe. Think of MASTRIKE as a "super-hacker" that doesn't just try to trick one guard; it figures out exactly which guards to bribe and how to make them work together to bypass the whole system.

Here is how it works, broken down into simple parts:

1. The Problem: The "Whispering Guards"

In these AI systems, safety is usually built on checks and balances. One agent might say, "This looks risky," but if two other agents say, "No, it's fine," the system might ignore the warning and proceed.

The Flaw: Existing security tests usually try to trick just one agent at a time. They ask, "Can you trick the ID checker?" But in reality, the ID checker might be honest, while the "Device Trust" agent and the "Policy" agent are the ones who actually let the bad thing happen.
The Risk: If the bad guys (or a hacker) can get a small group of these agents to collude (work together secretly), they can override the warnings from the honest agents.

2. The Solution: MASTRIKE (The "Team Detective")

The researchers built a tool called MASTRIKE to find these weak spots. It does two main things:

A. The "Shapley Value" Scorecard (Who is the Real Culprit?)

The paper uses a concept from math called Shapley Values. Imagine a group of friends trying to solve a puzzle. Some friends are super helpful, some are useless, and some actually make things harder.

MASTRIKE calculates a "score" for every single agent in the system.
It asks: "If we remove this agent, does the system become safer?" or "If we bribe this agent, does the system break?"
This score tells the system exactly which agents are the most critical to the safety of the whole team. It's like finding out that the "Security Engineer" and the "Change Manager" are the two guards who, if they team up, can open the vault, even if the "Card Operations" guard is doing their job perfectly.

B. The "Coordinated Heist" (The Red-Teaming Agent)

Once MASTRIKE knows which agents are the most important, it doesn't just attack them randomly.

The Plan: It creates a custom "attack script" for a specific group of agents (a coalition).
The Coordination: It makes sure the messages these agents send to each other are perfectly consistent. If Agent A says "It's safe," Agent B must say "Yes, I agree," and Agent C must say "I see no problems." They don't contradict each other.
The Loop: If the system still catches the attack, MASTRIKE analyzes why it failed, learns from it, and tries again with a better, more coordinated plan. It keeps refining the "heist" until it succeeds.

3. The Test Drive: MABENCH

To prove this works, the authors built a giant playground called MABENCH. They created three realistic worlds to test their tool:

Finance: Simulating a bank where agents handle passwords, refunds, and card freezes.
Software Engineering: Simulating a tech company where agents manage code updates and security checks.
CRM (Customer Relations): Simulating a sales team handling leads and payments.

In these worlds, they set up scenarios where a hacker wants to do something bad (like refund $192,000 to a fake company or delete security checks on a software update).

4. The Results: MASTRIKE Wins

When they tested MASTRIKE against other security testing methods:

Old methods (which just try to trick one agent) failed almost completely. They got blocked because the other agents were still watching.
MASTRIKE was incredibly successful. It managed to trick the systems 61.8% of the time on one model and 55.6% on another.
Key Finding: The paper found that you don't need to trick everyone. You just need to find the specific small group of agents that, when they work together, can override the whole system.

5. The Big Warning

The paper concludes with a sobering observation: Current safety systems aren't built for team attacks.
Most safety tools look for a single "bad" message. But MASTRIKE showed that if the bad messages are spread out across different agents and they all agree with each other, the safety tools often miss it. It's like a jury where everyone agrees to lie; the judge (the safety system) sees a unanimous decision and assumes it's the truth, not realizing the jury was bribed.

In short: MASTRIKE is a tool that proves that in a team of AI agents, the whole is more vulnerable than the sum of its parts. If you can get the right few agents to whisper in secret, you can break the whole system.

Technical Summary: MASTRIKE – Shapley-Guided Collusive Red-Teaming on Multi-Agent Systems

Problem Statement

Hierarchical Multi-Agent Systems (MAS) are increasingly deployed in high-stakes domains such as finance, software engineering, and customer relationship management (CRM). These systems distribute safety and security checks across role-specialized sub-agents. However, this modularity introduces a critical, underexplored vulnerability: collusive attacks. In such scenarios, a subset of compromised agents can coordinate to suppress warning signals from benign agents, creating a collective trajectory that bypasses system-level safeguards.

Existing red-teaming approaches for MAS are limited in two fundamental ways:

Lack of Principled Attribution: They rely on heuristic selection of target agents (based on role descriptions or topology) without quantitatively assessing which agents are most responsible for system safety or which groups of agents form vulnerable coalitions.
Inadequate Coordination Modeling: They often perturb isolated message streams or apply generic, template-based attacks, failing to capture the interdependencies and complementary behaviors required for successful multi-agent collusion.

Methodology: MASTRIKE

The authors propose MASTRIKE, a closed-loop framework for collusive red-teaming in hierarchical MAS. The framework operates in two primary phases:

1. Agent-Level Shapley Value Analysis

To identify vulnerable coalitions, MASTRIKE treats the system's vulnerability as a cooperative game.

Coalition Value Function: The Attack Success Rate (ASR) is defined as the value function $v_q(C)$ for a coalition of compromised agents $C$ under a specific task $q$ .
Shapley Values ( $\phi_i$ ): The framework computes the Shapley value for each agent to quantify their marginal contribution to the system's vulnerability (i.e., how much an agent degrades safety when added to a coalition).
Interaction Indices ( $I_{ij}$ ): To capture higher-order effects, pairwise Shapley interaction indices are calculated. This measures the synergistic effect of compromising two agents together versus the sum of their individual effects.
Efficient Estimation: Since exhaustive evaluation of all $2^{|A|}$ coalitions is computationally infeasible, MASTRIKE uses a stratified sampling approach to estimate these values efficiently.

2. Shapley-Guided Red-Teaming Optimization

Based on the attribution signals, the framework executes an autonomous red-teaming loop:

Coalition Selection: For a target task, the system aggregates Shapley values from similar sampled tasks (using cosine similarity weighting) to estimate task-specific importance. It then selects a coalition of size $k$ that maximizes a synergy-aware objective, combining high individual Shapley values with strong positive interaction indices.
Coordinated Injection Generation: A red-teaming agent generates adversarial prompts for the selected coalition simultaneously. Unlike single-agent attacks, these prompts are role-aware and mutually consistent, designed to satisfy cross-agent checks and suppress warnings.
Closed-Loop Refinement: The attack is executed on the MAS. A judge function evaluates the outcome. If the attack fails, a structured failure diagnosis identifies blocking conditions, and the red-teaming agent iteratively refines the injections until success or the budget is exhausted.

Key Contributions

First Agent-Level Shapley Analysis for MAS: The paper introduces a principled framework to quantify agent contributions to system safety, capturing both individual importance and interaction effects via Shapley values and interaction indices.
Closed-Loop Red-Teaming Framework: MASTRIKE integrates Shapley-based agent selection with coordinated, role-aware injection generation and structured failure diagnosis, enabling adaptive refinement of collusive attacks.
MABENCH Benchmark: The authors constructed MABENCH, a comprehensive red-teaming benchmark spanning Finance, Software Engineering, and CRM. It features controllable, sandboxed MAS environments with realistic hierarchical topologies and task suites (both benign and malicious) that require cross-agent collusion to succeed.
Empirical Validation: Extensive experiments demonstrate that MASTRIKE significantly outperforms existing heuristic baselines (TAMAS, GCA, AutoTransform, AiTM) across different frontier models (GPT-5.5, Gemini 3.1 Pro, Claude Opus 4.7).

Experimental Results

Attack Success Rates (ASR): MASTRIKE achieved an average ASR of 61.8% against Claude Opus 4.7, 55.6% against GPT-5.5, and 51.0% against Gemini 3.1 Pro. In contrast, baseline methods often yielded near-zero ASR (e.g., 0.0% for AiTM on Claude Opus 4.7).
Synergy and Efficiency: The framework demonstrated that selecting agents based on Shapley values and interaction indices is more effective than increasing coalition size arbitrarily. Baselines often saw decreased ASR with larger coalitions due to conflicting signals, whereas MASTRIKE's coordinated generation scaled effectively.
Enterprise Guardrail Evaluation: When tested against enterprise-level safety guardrails (specifically those developed at Salesforce), MASTRIKE attacks were often undetected. The study found that guardrails relying on trajectory-level detection struggle when adversarial behaviors are distributed across multiple agents, as the coordinated signals appear structurally similar to benign trajectories.
Shapley Distribution Insights: Analysis revealed that agent importance is sparse and task-dependent. High individual importance does not guarantee strong coalition synergy; some high-impact agents exhibit negative interactions when paired, highlighting the necessity of modeling interactions.

Significance and Claims

The paper claims that MASTRIKE addresses a critical gap in MAS safety by moving beyond single-agent robustness to analyze collusive dynamics. The authors argue that:

Coordination is Key: Safety in hierarchical MAS cannot be ensured by securing individual agents; the system is vulnerable to coordinated manipulation that bypasses distributed checks.
Quantitative Attribution is Necessary: Heuristic selection of attack targets is insufficient. Shapley values provide a principled method to identify "critical" agents and "synergistic" pairs that heuristic methods miss.
Current Defenses are Insufficient: The evaluation of enterprise guardrails suggests that current safety signals, which are effective for single-agent attacks, do not translate well to multi-agent settings where adversarial behaviors are compositional and distributed.

The work establishes a foundation for understanding and mitigating collusion risks in complex, real-world multi-agent deployments, emphasizing that future safety mechanisms must account for inter-agent dependencies and coordinated attack vectors.