arXiv:2604.17139cs.CLcs.AI2026-04被引 7

多智能体推理中,投票机制易被少数恶意攻击者破坏,新方法通过逐字协作提升抗干扰能力。

The Consensus Trap: Rescuing Multi-Agent LLMs from Adversarial Majorities via Token-Level Collaboration

论文配图:The Consensus Trap: Rescuing Multi-Agent LLMs from Adversarial Majorities via Token-Level Collaboration
图 1 · 摘自论文原文
  • 让多个智能体在共享上下文中逐字轮流生成,形成逻辑交织的协作链
  • 当恶意代理占比超半数时,传统投票法准确率骤降至10%,新方法仍保持78%以上
  • 适合高风险场景下的可信推理系统设计,尤其对抗性环境

多智能体大语言模型架构普遍依赖响应层聚合(如多数投票,MAJ)以提升推理能力。然而在开放环境中,智能体极易受到隐蔽的上下文污染,例如针对性提示注入。我们揭示了当前多智能体系统的结构性缺陷:当被污染的智能体形成局部多数时,响应层聚合会失效。由于投票仅汇总最终结论,无法察觉错误的中间逻辑。为此,我们提出逐字轮询(Token-Level Round-Robin, RR)协作机制,让智能体在共享自回归上下文中依次交替生成。我们将该过程形式化为离散时间动力系统,证明令牌级交错使聚合从脆弱的最终票数相加(线性求和)转变为动态、交织的逻辑链(非线性算子积)。理论上,诚实模型的修复作用可压倒恶意污染,即使污染代理占多数。我们在多个推理基准上进行充分实验,结果显示:当污染代理达到多数时,MAJ准确率降至10%以下;而RR在临界点后仍能保持78%以上的鲁棒准确率。

原文摘要 · Abstract (English)

Multi-agent large language model (LLM) architectures increasingly rely on response-level aggregation, such as Majority Voting (MAJ), to raise reasoning ceilings. However, in open environments, agents are highly susceptible to stealthy contextual corruption, such as targeted prompt injections. We reveal a critical structural vulnerability in current multi-agent systems: response-level aggregation collapses when corrupted agents form a local majority. Because voting aggregates fully-formed conclusions, it is blind to flawed intermediate logic. To overcome this systematic limitation, we propose the Token-Level Round-Robin (RR) Collaboration, where agents sequentially interleave generation within a shared auto-regressive context. We formalize this process as a discrete-time dynamical system, proving that token-level interleaving transitions aggregation from a brittle counting of final votes (a linear sum) to a dynamic, interwoven chain of logic (a non-linear operator product). Through this theoretical lens, we prove that the honest model's restorative pull can overpower adversarial corruptions, even when corrupted agents form a majority. We conduct an exhaustive empirical evaluation across diverse reasoning benchmarks and demonstrate that while MAJ collapses when corrupted agents reach a majority, RR maintains robust accuracy well beyond this critical threshold.

多智能体对抗攻击逻辑协作

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。