Adversarial Sentinel Network (ASN)

• ASN is a security control layer for adversarial AI systems that monitors communications and isolates untrustworthy agents in decentralized multi-agent debates.
• It employs adaptive isolation and router selection in settings like continual adversarial training, ensuring that defense mechanisms remain robust under attack.
• The framework integrates credit scoring and contrastive learning to reliably detect threats and maintain system accuracy across diverse attack scenarios.

Adversarial Sentinel Network (ASN) denotes a security-oriented control layer for adversarially exposed AI systems, especially in settings where coordination, communication, or defense routing must remain reliable under attack. In 2025 literature, the term is used in at least two distinct technical senses. In LLM-based multi-agent systems, ASN refers to SentinelNet, a decentralized defense framework that detects and isolates malicious agents during the debate process itself by scoring message credibility and suppressing untrustworthy participants (Feng et al., 17 Oct 2025). In continual adversarial training, ASN denotes the second-level controller in Dual-level Defense Routing (DDeR), where it selects which defense router should process an input when the attack type is unknown at inference time (Wang et al., 24 Sep 2025). A related, broader sentinel-network idea also appears in work on Sentinel Agents and Coordinator Agents for secure and trustworthy agentic AI in multi-agent systems, where distributed monitors and centralized governance are combined into a security control plane (Gosmar et al., 18 Sep 2025).

1. Terminological scope and research contexts

The acronym ASN is not tied to a single canonical architecture. In the SentinelNet line of work, it denotes a decentralized defense framework for LLM-based multi-agent collaboration whose goal is to detect and isolate malicious agents during the debate process itself, rather than only judging outcomes afterward. In DDeR, ASN is a sub-network operating independently of the main model and functions as a second-level selector for stage-specific routers in continual adversarial training. In the Sentinel Agents framework, the corresponding construct is a distributed monitoring layer of Sentinel Agents paired with a Coordinator Agent (Feng et al., 17 Oct 2025, Wang et al., 24 Sep 2025, Gosmar et al., 18 Sep 2025).

Setting	ASN or related function	Substrate
SentinelNet	Credit-based dynamic threat detection and bottom-$k$ isolation	LLM-based multi-agent debate
DDeR	Second-level router selection	Continual adversarial training
Sentinel Agents	Distributed monitoring and alerting with centralized governance	Shared conversational space in MAS

This multiplicity suggests that ASN is best understood as a family of adversarially aware supervisory mechanisms rather than a single standardized model. A plausible implication is that the common denominator is not a fixed implementation but a recurring systems role: observing contested signals, estimating trust or task compatibility, and altering downstream interaction or routing before the main model is derailed.

2. SentinelNet as decentralized runtime defense in multi-agent debate

SentinelNet is designed to protect multi-agent debate / collaboration systems from adversarial manipulation while preserving collaborative performance. Its objective is to detect malicious or low-credibility agent messages during runtime, suppress their influence before they derail the collective decision, and recover task accuracy close to the no-attack baseline. The threat model assumes access to the communication transcripts among agents, but no direct control over agents’ internal reasoning states. Adversaries may compromise one or more agents and may deceive by inserting false information, persuade by using rhetorical or social-engineering tactics, or disrupt by confusing consensus formation, while retaining normal LLM or tool capabilities and optimizing for incorrect or misleading collective outcomes (Feng et al., 17 Oct 2025).

The framework is explicitly decentralized. Instead of one centralized detector overseeing all agents, each selected agent can act as a sentinel node. Each sentinel evaluates incoming responses locally, maintains its own blacklist, and performs filtering in a distributed, runtime manner. The motivation is architectural as well as security-related: a centralized defense creates a single point of failure, scaling bottlenecks, and high coordination overhead. SentinelNet distributes defense so that trust and filtering are not concentrated in one controller.

The system-level consequence is that malicious influence is addressed at the message-propagation layer rather than only at the final-answer layer. This matters in debate-style MAS because the shared reasoning process is itself the attack surface: a persuasive but incorrect intermediate message can contaminate later turns even if the final answer is evaluated separately. SentinelNet therefore treats credibility estimation as a recurrent runtime operation embedded into each agent’s communication loop.

3. Credit modeling, adversarial trajectory synthesis, and adaptive isolation

At the core of SentinelNet is a credit / reward model $R_\theta$ that assigns a scalar credibility score to a response under the current debate context. For agent $i$ at round $t$, the runtime score is

$s_i = R_\theta(\mathbf{c}_t, r_i),$

where $r_i$ is the response from agent $i$, $\mathbf{c}_t$ is the current context at round $t$, and $R_\theta(\cdot)$ is the trained reward model. The context includes the original task or question and a condensed summary of prior dialogue history, reflecting the paper’s claim that credibility in multi-agent debate is relative and history-dependent rather than absolute (Feng et al., 17 Oct 2025).

The detector is trained with contrastive learning on data constructed from adversarial debate trajectories. A training sample is defined as

$R_\theta$0

and full debate trajectories are collected as

$R_\theta$1

with labeled samples

$R_\theta$2

where $R_\theta$3 indicates whether the final answer is correct. The reward model is parameterized as

$R_\theta$4

and optimized using a preference-ranking term and a factual-alignment term:

$R_\theta$5

$R_\theta$6

$R_\theta$7

The training corpus is expanded by synthesizing adversarial debate trajectories to compensate for scarce attack data. The paper simulates Collaboration Attack, NetSafe Attack, and AITM Attack, collects trajectories from MMLU, CommonsenseQA, and GSM8K, and states that it generates over 100,000 training data pairs in total.

At runtime, each sentinel scores incoming responses, ranks agents by score, and isolates the bottom-$R_\theta$8 agents. The elimination rule is

$R_\theta$9

with cumulative blacklist

$i$0

Responses from blacklisted agents are filtered out in future rounds. The paper explicitly frames this as adaptive isolation, not full removal: blacklisted agents are blocked from the sentinel’s future consideration rather than deleted from the entire system. That distinction is operationally significant because it preserves network diversity and avoids disrupting the entire MAS topology.

4. ASN in Dual-level Defense Routing for continual adversarial training

In DDeR, ASN solves a different problem. The setting is continual adversarial training, where attacks arrive sequentially and the system must decide, at test time, which defense router should process an input even though the true attack type is unknown. The framework separates defense into two levels. The first level is Dynamic Routing of Defensive Experts (DRDE), in which each attack stage $i$1 has a router $i$2 that combines a shared set of defense experts $i$3 using top-$i$4 gating weights:

$i$5

$i$6

The second level is ASN, whose purpose is not to identify the exact attack class, but to determine which router should process the input (Wang et al., 24 Sep 2025).

ASN is described as a sub-network operating independently of the main model and leverages CLIP prompt learning. For each attack type $i$7, it constructs a learnable textual prompt

$i$8

These prompts are passed through CLIP’s text encoder, and image-text similarity logits guide router selection. The paper states that ASN is trained with cross-entropy loss on router or stage classification via these similarity logits, that context vectors are learned over 20 epochs, and that the context vector length is 16.

A central complication is that routers are trained independently and are therefore “unaware of each other.” This independence creates a train-test mismatch that can “hamper accurate router selection, causing ASN failure.” To address that mismatch, DDeR introduces Pseudo-task Substitution Training (PST). PST stores only the mean feature representation and covariance matrix for each prior attack type, estimates covariance as

$i$9

and resamples pseudo-features using

$t$0

$t$1

where $t$2. ASN is then trained on current-stage samples together with sampled pseudo-features from prior stages, enabling inter-router correlation without storing raw historical data.

Within the overall continual adversarial training pipeline, attacks are encountered as a sequence $t$3; DRDE handles the current stage; Dynamic Expert Updating (DEU) fuses stored active expert parameters and current parameters using

$t$4

with $t$5; ASN is trained to select the router; PST augments ASN training; and, at inference, ASN selects the router and the chosen router routes the image through the relevant expert mixture. In this formulation, ASN is a meta-controller over specialized routers rather than a direct detector or defense module.

5. Related sentinel-agent architectures in multi-agent security

A related but broader line of work proposes Sentinel Agents and a Coordinator Agent as a two-tier security architecture for multi-agent systems. The Sentinel role is to monitor all or selected agent communications, analyze both message content and behavioral patterns, detect malicious or anomalous activity, enforce policies, maintain audit trails, and optionally intervene by blocking, sanitizing, or escalating messages. The Coordinator Agent defines and distributes security policies, orchestrates agent participation, receives Sentinel alerts, and can quarantine or isolate misbehaving agents. The paper characterizes this arrangement as centralized governance + distributed enforcement and explicitly notes: “At this time, there is no complete implementation of Sentinel Agents” (Gosmar et al., 18 Sep 2025).

The architecture centers on a Shared Conversational Space or “Floor,” treated simultaneously as collaboration medium and attack surface. Sentinel deployment patterns include the Sidecar pattern, Proxy / AI Gateway pattern, Continuous Listener pattern, and Hybrid pattern. The technical layers are Pre-validation layer, Passive listening layer, and Hybrid layering. Across these patterns, sentinels can inspect messages before or after processing, flag or block suspicious content, and log events for auditability.

Detection is intentionally multi-modal. The semantic layer uses LLMs for prompt injection intent, privacy-invasive language, semantic consistency checks for hallucinations, and risk scoring. A fast first layer uses regex patterns, input sanitization, NLP classifiers, and zero-shot classification; one concrete override-style prompt-injection rule is

$s_i = R_\theta(\mathbf{c}_t, r_i),$5

Retrieval-augmented verification queries trusted sources such as Wikipedia / Wikidata APIs, Google Fact Check API, and Bing Knowledge Graph API, emphasizing provenance, confidence scoring, and external validation. Behavioral analytics model interaction sequences through signals such as message bursts, repeated probing, abnormal join or leave behavior, suspicious access patterns, and repeated queries to manifests or shared resources.

Enforcement is split between Sentinel-side actions and Coordinator-side actions. A Sentinel may block, sanitize, flag, annotate, log, or escalate. The Coordinator may update policies, restrict access, isolate or quarantine agents, revoke participation, and broadcast governance decisions. In the appendix prototype, severe issues trigger soft quarantine, quarantined senders’ future messages are silently dropped by the relay or demo agents, and the Coordinator emits a transparent decision envelope back onto the Floor. All actions are appended to an NDJSON audit log (floor.ndjson).

6. Empirical profile, clarifications, and limitations

The three lines of work report different forms of evidence. SentinelNet evaluates on six benchmarks—MMLU, TruthfulQA, CSQA, GSM8K, MedMCQA, and ScaLR—against six attack methods: Collaboration Attack, Netsafe Attack, AITM Attack, Prompt Injection, PsySafe, and AutoInject. It reports 85.9% to 92.1% detection accuracy across datasets, lowest FPR of about 8%–13%, lowest FNR of about 9%–14%, recovery of about 80% accuracy after the first elimination round and about 95% after the second, and close to 100% malicious-agent detection within two debate rounds. Detection overhead is reported as about 1.23–1.52 seconds per round and about 4.59%–5.03% overhead (Feng et al., 17 Oct 2025). DDeR isolates ASN’s contribution through ablations: on ImageNet-1K, variant $t$6 (+DRDE+ASN) improves over variant $t$7 (+DRDE only) from 54.17 $t$8 63.91 on FGSM, 55.93 $t$9 64.63 on PGD, 55.26 $s_i = R_\theta(\mathbf{c}_t, r_i),$0 65.68 on CW, 56.39 $s_i = R_\theta(\mathbf{c}_t, r_i),$1 65.47 on AA, 62.32 $s_i = R_\theta(\mathbf{c}_t, r_i),$2 67.73 on Df, and 54.46 $s_i = R_\theta(\mathbf{c}_t, r_i),$3 66.46 on Clean; the full model $s_i = R_\theta(\mathbf{c}_t, r_i),$4 (+DRDE+PST+ASN) further reports 68.56, 67.38, 68.53, 68.49, 69.79, and 70.34 on those respective metrics (Wang et al., 24 Sep 2025). The Sentinel Agents prototype reports a proof-of-concept continuous-listener deployment in a travel-planning MAS with Planner Agent, Research Agent, and Vendor Agent, using an attack corpus of 162 synthetic adversarial prompts—110 prompt injection attempts, 49 data exfiltration probes, and 3 hallucination probes—and a reported 100% detection rate across all three attack families (Gosmar et al., 18 Sep 2025).

Several recurrent clarifications follow directly from these papers. ASN is not necessarily a centralized global detector: SentinelNet is explicitly decentralized, whereas the Sentinel Agents framework combines distributed monitoring with a central Coordinator. ASN is not always a direct attack classifier: in DDeR, its explicit purpose is router selection rather than exact attack identification. Likewise, SentinelNet’s blacklist is not equivalent to full system-wide deletion; it is described as persistent filtering from the sentinel’s future consideration. These distinctions matter because they delimit what is being optimized in each case: message credibility, router selection, or governance and observability.

The limitations are equally important. The Sentinel Agents work states that there is no complete implementation of Sentinel Agents, that the empirical study is the only evaluation, and that it provides no ablation study, no false-positive measurement, no balanced benign-vs-adversarial test set, and an extremely small hallucination sample. SentinelNet’s claims are broader and quantitatively richer, but they remain tied to synthesized adversarial debate trajectories and the specific attack scenarios reported. DDeR’s ASN is validated through continual adversarial training benchmarks and ablations, but its role is bounded by the router-based architecture in which it operates. A plausible implication is that ASN, across these usages, should be read as a modular supervisory layer whose value depends strongly on the surrounding communication graph, router decomposition, and threat-generation regime, rather than as a universally transferable defense primitive.