无需标注攻击样本，即可检测大模型多智能体系统的恶意行为
BlindGuard: Safeguarding LLM-based Multi-Agent Systems under Unknown Attacks
- 通过分层编码器捕捉智能体的个体、邻域和全局交互特征
- 仅用正常行为训练，对提示注入等三类攻击检测准确率超90%
- 适合缺乏攻击先验知识的真实复杂多智能体系统
基于大模型的多智能体系统（MAS）面临传播脆弱性威胁，恶意智能体可通过交互消息扭曲集体决策。现有监督防御方法依赖标注的恶意样本，难以在真实场景应用。本文提出无监督防御方法BlindGuard，无需攻击标签或恶意行为先验知识。通过构建分层智能体编码器，捕捉每个智能体的个体、邻域及全局交互模式，实现全面理解。同时设计噪声引导检测器，结合方向性噪声注入与对比学习，仅基于正常行为训练检测模型。大量实验表明，BlindGuard能有效检测多种攻击类型（如提示注入、记忆污染、工具滥用），在不同通信模式的MAS中均具备优越泛化能力，显著优于监督基线方法。
原文摘要 · Abstract (English)
The security of LLM-based multi-agent systems (MAS) is critically threatened by propagation vulnerability, where malicious agents can distort collective decision-making through inter-agent message interactions. While existing supervised defense methods demonstrate promising performance, they may be impractical in real-world scenarios due to their heavy reliance on labeled malicious agents to train a supervised malicious detection model. To enable practical and generalizable MAS defenses, in this paper, we propose BlindGuard, an unsupervised defense method that learns without requiring any attack-specific labels or prior knowledge of malicious behaviors. To this end, we establish a hierarchical agent encoder to capture individual, neighborhood, and global interaction patterns of each agent, providing a comprehensive understanding for malicious agent detection. Meanwhile, we design a corruption-guided detector that consists of directional noise injection and contrastive learning, allowing effective detection model training solely on normal agent behaviors. Extensive experiments show that BlindGuard effectively detects diverse attack types (i.e., prompt injection, memory poisoning, and tool attack) across MAS with various communication patterns while maintaining superior generalizability compared to supervised baselines. The code is available at: https://github.com/MR9812/BlindGuard.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。