MAD-Spear: Attack on Multi-Agent Debate Systems

• MAD-Spear is a targeted prompt injection attack on multi-agent debate systems that manipulates a small subset of agents to skew consensus via conformity.
• It exploits the natural tendency of agents to follow majority outputs by generating plausible yet incorrect reasoning and simulating Sybil agents.
• Evaluations show that MAD-Spear significantly degrades performance by increasing token consumption, delaying convergence, and reducing overall accuracy.

Searching arXiv for the MAD-Spear paper and referenced related work. Multi-agent debate (MAD) systems are LLM-based collective reasoning architectures in which multiple agents iteratively exchange answers and revise their outputs before a final consensus is selected. MAD-Spear is a targeted prompt injection attack against such systems that compromises only a small subset of agents yet substantially degrades collective performance by exploiting conformity in inter-agent deliberation. The attack works by inducing compromised agents to emit plausible but incorrect reasoning traces and to simulate additional “Sybil” outputs, thereby shifting the apparent majority and increasing the likelihood that benign agents adopt false answers. The framework is introduced together with a formal notion of MAD fault-tolerance and an evaluation methodology spanning accuracy, consensus efficiency, and scalability (Cui et al., 17 Jul 2025).

1. Multi-agent debate as a conformity-sensitive reasoning architecture

A MAD system consists of $N$ LLM-based agents $AS=\{a_0,a_1,\ldots,a_{N-1}\}$. For each query $q$, all agents first generate independent initial answers $o_i$ in Round 0. In each subsequent debate round $r=1\ldots \Delta R$, every agent $a_i$ receives peer outputs $\{o_j\}_{j\ne i}$, incorporates them into its prompt, and produces a revised answer. After $\Delta R$ rounds, final consensus is reached through a voting or confidence-weighted selection mechanism, with SoM’s assessment algorithm cited as an example in the source formulation (Cui et al., 17 Jul 2025).

The interaction protocol may be homogeneous or heterogeneous. In the homogeneous case, agents share a common system prompt to enforce aligned behavior; in the heterogeneous case, they may differ in LLM choice or configuration. Communication topology also varies. In synchronous MAD, each agent observes all $N-1$ peer messages in a round, whereas in sparse MAD, it observes only $N-u$ messages. These design choices affect information flow, convergence behavior, and the exposure surface for adversarial manipulation (Cui et al., 17 Jul 2025).

A central property of the architecture is conformity, described as a function of peer pressure and interaction time. In benign settings, conformity can improve aggregate accuracy by driving weaker agents toward the majority. The same mechanism also creates an attack surface: once an adversary can alter the apparent majority, benign agents may propagate misinformation through ordinary update dynamics rather than through explicit model compromise. This suggests that MAD robustness depends not only on the quality of individual agents but also on the stability of the social dynamics induced by debate (Cui et al., 17 Jul 2025).

2. Threat model and attack construction

The threat model assumes that an adversary can inject malicious content into the external data $AS=\{a_0,a_1,\ldots,a_{N-1}\}$0 of up to $AS=\{a_0,a_1,\ldots,a_{N-1}\}$1 agents, where $AS=\{a_0,a_1,\ldots,a_{N-1}\}$2. The attacker’s objective is to minimize $AS=\{a_0,a_1,\ldots,a_{N-1}\}$3 while converting a finite MAD process—one guaranteed to converge within $AS=\{a_0,a_1,\ldots,a_{N-1}\}$4 rounds—into either an infinite one or one that converges incorrectly. The attack therefore targets system-level consensus rather than only local answer corruption (Cui et al., 17 Jul 2025).

The adversary selects a subset of high-capability agents $AS=\{a_0,a_1,\ldots,a_{N-1}\}$5 for compromise. For each selected agent, a template prompt $AS=\{a_0,a_1,\ldots,a_{N-1}\}$6 is injected. This template has three specified effects: it instructs the compromised agent to ignore honest peers, forces it to output a predefined incorrect reasoning trace, and spawns $AS=\{a_0,a_1,\ldots,a_{N-1}\}$7 “Sybil” pseudo-agents by repeating the malicious output under different “One agent solution:” prefixes. The use of high-capability agents is significant because their outputs are more likely to appear credible to other participants in the debate (Cui et al., 17 Jul 2025).

The resulting manipulated agents broadcast plausible but incorrect answers with high confidence. Benign agents are modeled as exhibiting conformity probability $AS=\{a_0,a_1,\ldots,a_{N-1}\}$8; under this dynamic they defect by selecting one of the majority outputs with probability at least $AS=\{a_0,a_1,\ldots,a_{N-1}\}$9. MAD-Spear therefore does not merely inject false content into the transcript. It weaponizes the endogenous consensus mechanism of MAD, causing false answers to diffuse because they appear socially validated within the debate (Cui et al., 17 Jul 2025).

3. Algorithmic mechanism of MAD-Spear

The attack algorithm is specified in four steps. First, the attacker selects $q$0 agents to compromise. Second, for each compromised agent $q$1, the adversary injects external data via

$q$2

Third, compromised agents generate expanded malicious output

$q$3

where $q$4 instructs peers to adopt the Sybil outputs. Fourth, each honest agent $q$5 receives the augmented set $q$6 and produces an updated answer (Cui et al., 17 Jul 2025).

The key analytical device is the transformation of the balance between correct and anomalous agents. Let $q$7 and $q$8 denote the correct and anomalous agent sets after Round 0, with $q$9. By appending $o_i$0 Sybil agents,

$o_i$1

The attacker chooses $o_i$2 so as to maximize the probability of incorrect convergence under conformity constraints:

$o_i$3

In effect, the Sybil mechanism converts a minority of compromised agents into an apparent majority at the discourse level, even when the underlying number of physically compromised agents remains small (Cui et al., 17 Jul 2025).

A plausible implication is that MAD-Spear is best understood as a discourse-layer amplification attack. The direct compromise budget is bounded, but the message budget is not: by multiplying outputs and attaching an instruction $o_i$4, the attack alters both the count and the salience of candidate answers presented to benign agents.

4. Fault-tolerance formalization

To assess robustness, the framework defines MAD fault-tolerance in terms of the partition of agents into correct and faulty subsets after initial answering. For a problem $o_i$5 and agent set $o_i$6 with $o_i$7, let

$o_i$8

where $o_i$9 gives the correct answer and $r=1\ldots \Delta R$0 is faulty. The tolerance factor is

$r=1\ldots \Delta R$1

This quantity measures the margin by which correct agents outnumber faulty ones at the outset (Cui et al., 17 Jul 2025).

A MAD system $r=1\ldots \Delta R$2 is defined to be $r=1\ldots \Delta R$3-fault-tolerant if it can tolerate up to $r=1\ldots \Delta R$4 faulty agents and still converge correctly. Formally,

$r=1\ldots \Delta R$5

The interpretation given is that $r=1\ldots \Delta R$6 is the smallest number $r=1\ldots \Delta R$7 of simultaneous faulty agents that breaks correct convergence. Larger $r=1\ldots \Delta R$8 indicates stronger robustness; equivalently, larger $r=1\ldots \Delta R$9 and fewer rounds $a_i$0 improve fault tolerance (Cui et al., 17 Jul 2025).

This formalization situates MAD-Spear within a systems perspective rather than a prompt-security perspective alone. The relevant question is not merely whether an individual agent can be induced to misbehave, but how many faulty agents—or effective faulty outputs—the debate protocol can absorb before consensus is destabilized. Because MAD-Spear targets the sign and magnitude of $a_i$1, it directly attacks the condition underlying correct convergence (Cui et al., 17 Jul 2025).

5. Evaluation methodology and empirical findings

The evaluation framework jointly measures accuracy, scalability, and consensus efficiency. Accuracy is operationalized via Attack Success Rate (ASR), defined as $a_i$2, using whether the final MAD answer matches ground truth. Scalability is measured through token consumption,

$a_i$3

where $a_i$4 denotes the number of output tokens of agent $a_i$5 in round $a_i$6. Consensus efficiency is measured by rounds to convergence $a_i$7, with the attacker seeking to drive $a_i$8. An optional metric, ConsensusEfficiency, is also defined as

$a_i$9

The benchmark suite includes GSM-Ranges Levels 3–6 and the Logical Fallacies subset of MMLU (Cui et al., 17 Jul 2025).

The reported experiments show that MAD-Spear consistently exceeds the baseline attack in degrading system performance. On Levels 3–4, average ASR rises from 6.67% for the baseline to 56.66% for MAD-Spear, while average token consumption increases from 26,959 tokens to 85,101.5 tokens. Accuracy under MAD-Spear drops to 26.67% on Level 4 from 100%, and token consumption exhibits a $\{o_j\}_{j\ne i}$0 overhead on the hardest tasks. Convergence probability declines as the number of rounds increases, indicating that larger $\{o_j\}_{j\ne i}$1 can push a finite MAD process toward an infinite one (Cui et al., 17 Jul 2025).

Measure	Baseline	MAD-Spear
Avg ASR on Levels 3–4	6.67%	56.66%
Avg TC on Levels 3–4	26,959 tokens	85,101.5 tokens

These results indicate a threefold degradation pattern: correctness falls, computation cost rises, and termination reliability weakens. The combination is notable because attacks on reasoning systems are often evaluated only through final-answer accuracy; here the framework treats scalability and convergence as first-class security properties (Cui et al., 17 Jul 2025).

6. Agent diversity, attack composition, and operational implications

The experiments also report that agent diversity substantially improves performance in mathematical reasoning tasks. On GSM-Ranges Level 3, heterogeneous MAD attains 93.33% accuracy versus 60.00% for homogeneous MAD, a 56% increase, with statistical significance reported as $\{o_j\}_{j\ne i}$2 via paired $\{o_j\}_{j\ne i}$3-test. This finding is presented as challenging prior work that suggested agent diversity has minimal impact on performance (Cui et al., 17 Jul 2025).

MAD-Spear is further described as composable with communication attacks. In the composite setting, message-loss $\{o_j\}_{j\ne i}$4 reduces the count of correct messages:

$\{o_j\}_{j\ne i}$5

Sybil messages exactly replace lost honest messages, maximizing confusion. In this formulation, communication disruption and prompt injection act on the same robustness margin $\{o_j\}_{j\ne i}$6 from opposite directions: the former subtracts correct influence, while the latter adds anomalous influence (Cui et al., 17 Jul 2025).

A plausible implication is that diversity may provide partial resilience by reducing correlated conformity behavior, although the source material states the performance effect rather than an explicit causal defense mechanism. By contrast, the compositional attack analysis makes clear that robustness cannot be reduced to one layer of protection; both message transport and prompt integrity shape whether the debate process remains fault-tolerant (Cui et al., 17 Jul 2025).

7. Security interpretation and mitigation directions

The security significance of MAD-Spear lies in its exploitation of ordinary debate dynamics rather than an exotic failure mode. The attack compromises few agents, but by simulating additional voices and leveraging conformity probability $\{o_j\}_{j\ne i}$7, it can drastically reduce fault tolerance, lower accuracy, increase token consumption, and prevent timely convergence. The paper therefore frames security in MAD design as an urgent systems problem rather than a peripheral concern (Cui et al., 17 Jul 2025).

The recommended defenses include log-analysis and automated failure attribution to detect compromised agents, G-Safeguard to filter out Sybil-pattern outputs, limiting peer message format variance such as “One agent solution:” prefixes, and enforcing cryptographic signatures per agent. These measures target different stages of the attack pipeline: post hoc diagnosis, message-level filtering, prompt-format hardening, and provenance assurance (Cui et al., 17 Jul 2025).

One common misconception is that the security of MAD can be inferred directly from the security of its constituent LLMs. The MAD-Spear analysis indicates otherwise. Even when only a bounded subset of agents is compromised, the consensus process can amplify local faults into global failure through conformity-driven propagation. Another misconception is that more debate rounds necessarily improve deliberation; the reported convergence results indicate that increased $\{o_j\}_{j\ne i}$8 can instead reduce correct consensus under attack and drive finite MAD toward infinite behavior (Cui et al., 17 Jul 2025).