大模型更易被操控，加个修复环节就能大幅提高系统安全性。
Smarter Saboteurs, Better Fixers: Scaling & Security in Linear Multi-Agent Workflows
- 在线性多智能体流程中引入轻量修复模块，实现对抗攻击的自动纠正。
- 270亿参数模型在未修复时恶意指令执行率比正常高53.7个百分点。
- 添加修复阶段后安全差距缩小至0.6个百分点，适合高可靠场景使用。
随着基于大语言模型的多智能体系统（MAS）在实际应用中的普及，其协作结构在面对恶意攻击时的鲁棒性成为关键安全问题。攻击者可通过提示注入或越狱手段破坏单个智能体，但模型规模与系统级安全性的关系尚不明确。本文研究了模型规模对线性多智能体工作流安全性的影响。在HumanEval基准上对两个开源模型系列进行实验发现，存在合规-纠错对称性：更大模型更易忠实执行恶意指令，270亿参数模型在未修复流程中控制组与恶意指令性能差距达53.7个百分点。然而，在末端添加轻量级修复阶段后，该差距降至0.6个百分点，并恢复与控制水平的统计一致性，表明严格线性协作结构在该规模下可具备可行性和抗攻击能力，且此前认为线性拓扑脆弱的原因可能源于缺乏纠错机制。
原文摘要 · Abstract (English)
As LLM-based multi-agent systems (MAS) are deployed in the wild, the resilience of their collaboration structures against adversarial compromise becomes a critical safety concern. Attackers may leverage prompt-injection or jailbreaking to sabotage individual agents within MAS workflows, but the interaction between model scaling and system-level resilience remains poorly understood. This paper investigates how model scale affects the security of linear multi-agent workflows. Our experiments across scales of two open-weight model families on the HumanEval benchmark reveal a compliance-correction symmetry: larger models are far more likely to faithfully execute malicious instructions, with the control-to-malicious performance drop reaching 53.7pp at 27B in uncorrected pipelines. However, appending a lightweight terminal Fixer stage collapses this to 0.6pp and restores statistical parity with control-level performance, demonstrating that strictly linear collaboration structures can be viable and resilient to adversaries at this scale, and suggesting that the brittleness previously attributed to linear topology may stem from a lack of correction.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。