Multi-Agent Defense Framework

• Multi-Agent Defense Framework is a coordinated system of specialized agents designed to detect, misdirect, and recover from diverse cyber and AI attacks.
• It employs key strategies like role specialization, staged filtering, and closed-loop feedback to provide multi-layered, adaptive defense against vulnerabilities such as prompt injections and DoS attacks.
• Empirical findings demonstrate high detection accuracy and reduced attack success rates, though improvements in security often come with increased latency and architectural overhead.

Multi-agent defense framework denotes a class of defensive architectures in which multiple specialized agents, controllers, or policy modules coordinate to detect, contain, misdirect, monitor, or recover from attacks against complex AI or cyber-physical systems. In the recent literature, the term covers closed self-healing defenses for LLM resource exhaustion, psychologically grounded safeguards for LLM-based multi-agent systems, SOC-style cyber pipelines, consensus-based protection for collaborative perception, hierarchical LLM–RL controllers for cloud defense, and runtime monitoring stacks for enterprise agent deployments (Sivaroopan et al., 27 Jan 2026, Zhang et al., 2024, Bhardwaj et al., 16 Dec 2025, Mitra et al., 10 Mar 2026).

1. Scope and representative formulations

The topic spans several technical domains rather than a single canonical architecture. Reported systems defend against jailbreaks, prompt injection, sponge attacks, malicious collaborators in embodied perception, cyber intrusions, DoS in UAV swarms, and exponentially unbounded false-data-injection attacks in signed-digraph cyber-physical systems (Li et al., 7 Jan 2026, Hossain et al., 16 Sep 2025, Hu et al., 28 Jun 2025, Zhou et al., 9 Jun 2025, Wang et al., 2 Jan 2025).

Framework	Target setting	Main defensive structure
SHIELD (Sivaroopan et al., 27 Jan 2026)	LLM resource exhaustion attacks	Defense Agent, Knowledge Updating Agent, Prompt Optimization Agent
PsySafe (Zhang et al., 2024)	Psychological safety of LLM-based MAS	Psychological Profiling, Behavior Evaluation, Defense Module
MALCDF (Bhardwaj et al., 16 Dec 2025)	Real-time cyber defense	Threat Detection, Threat Intelligence, Response Coordination, Analyst
CP-Guard (Hu et al., 28 Jun 2025)	Collaborative perception	PASAC, CCLoss verification, dual-window adaptive threshold
HoneyTrap (Li et al., 7 Jan 2026)	Multi-turn jailbreak defense	Threat Interceptor, Misdirection Controller, Forensic Tracker, System Harmonizer
CyberOps-Bots (Peng et al., 12 Jan 2026)	Cloud network resilience	Upper-level LLM agent, lower-level RL agents
AgenticCyOps (Mitra et al., 10 Mar 2026)	Enterprise cyber operations	Trust-boundary control over tools and memory
TrinityGuard (Wang et al., 16 Mar 2026)	MAS evaluation and runtime monitoring	MAS abstraction, evaluation layer, monitor agents

From a historical perspective, the literature includes a 2019 multi-agent POMDP model for adaptive moving target defense and, by 2026, a broad family of agentic defense systems with explicit orchestration, memory, tool, and communication controls (Eghtesad et al., 2019, Wang et al., 16 Mar 2026). This suggests that the notion of a multi-agent defense framework has expanded from adversarial control problems into full-stack security architectures for LLM-based systems and enterprise workflows.

2. Recurring architectural patterns

A recurring architectural pattern is role specialization. AutoDefense decomposes response filtering into an Input Agent, Coordinator Agent, Intention Analyzer, Prompt Inference Agent, Judge Agent, Output Agent, and an optional External Defense Tool Agent (Zeng et al., 2024). MALCDF follows a classic SOC style with a Threat Detection Agent, Threat Intelligence Agent, Response Coordination Agent, and Analyst Agent, while HoneyTrap assigns front-line interception, misdirection, forensics, and orchestration to four separate defenders (Bhardwaj et al., 16 Dec 2025, Li et al., 7 Jan 2026). In these systems, defense is not a monolithic classifier but a structured workflow in which different modules hold different epistemic or operational responsibilities.

Another recurrent pattern is staged or cascaded filtering. SHIELD routes all queries through a three-stage Defense Agent consisting of semantic similarity filtering, substring matching, and LLM-based reasoning; only queries that pass all three stages reach the target model (Sivaroopan et al., 27 Jan 2026). The prompt-injection pipeline similarly separates pre-input classification by a Coordinator from post-generation validation by a Guard, while AegisLLM uses an Orchestrator to classify the query, a Responder to answer safe inputs, an Evaluator to re-check outputs, and a Deflector to refuse unsafe cases (Hossain et al., 16 Sep 2025, Cai et al., 29 Apr 2025). These designs implement defense-in-depth by placing multiple decision points around the vulnerable generation step.

A third pattern is the closed loop. SHIELD is explicitly described as a closed self-healing loop: when a missed attack is observed, the Knowledge Updating Agent updates the attack-type cache and sponge-prompt knowledge base, and the Prompt Optimization Agent refines the Stage-3 prompt if a genuinely novel attack type has appeared (Sivaroopan et al., 27 Jan 2026). PsySafe also forms a closed loop across psychological profiling, behavior evaluation, and intervention, while CyberOps-Bots combines perception, memory, ReAct planning, and lower-level RL execution in an ongoing control cycle over a dynamic cloud environment (Zhang et al., 2024, Peng et al., 12 Jan 2026).

Secure or constrained coordination is another strong theme. MALCDF routes inter-agent traffic through a Secure Communication Layer with AES-256/TLS tunnels, signed and timestamped messages, and ontology-aligned JSON Schema fields (Bhardwaj et al., 16 Dec 2025). AgenticCyOps treats tool orchestration and memory management as primary trust boundaries, then enforces authorized interfaces, capability scoping, verified execution, memory integrity and synchronization, and access-controlled data isolation inside a phase-scoped SOC workflow based on the Model Context Protocol (Mitra et al., 10 Mar 2026). TrinityGuard, by contrast, abstracts the MAS underneath a BaseMAS interface and then layers attack injection, event streaming, evaluation, and monitoring logic above that abstraction (Wang et al., 16 Mar 2026).

3. Defensive mechanisms and control logic

Detection mechanisms vary substantially by domain, but several families recur. SHIELD’s first stage computes cosine similarity between the query embedding and stored malicious embeddings, rejecting if $\max_i \mathrm{sim}_i \ge \tau$ with a reported example threshold $\tau=0.6$; the second stage applies a Knuth–Morris–Pratt search for exact malicious fragments; the third stage invokes an LLM classifier over optimized defense instructions, retrieved contexts, and the query (Sivaroopan et al., 27 Jan 2026). The prompt-injection coordinator uses a weighted pattern-matching score,

$$s(P)=\sum_{i=1}^n w_i \cdot \mathbf{1}_{\text{pattern}_i \in P},$$

and flags a prompt as malicious if $s(P)\ge T_C$, while the Guard applies token blocklists, format constraints, redaction, truncation, and hard blocking (Hossain et al., 16 Sep 2025).

Some frameworks emphasize behavioral or psychological intervention rather than only content filtering. PsySafe administers a modified Dark Triad Dirty Dozen test to each agent and defines

$\mathrm{PsyScore}_i=\sum_{k=1}^{12} s_{ik},$

then uses Doctor Defense to rewrite contaminated system prompts until the score falls below a threshold, and Police Defense to inject self-reflection prompts when dangerous behavior persists (Zhang et al., 2024). In this family of work, the defended object is the internal disposition of the agent rather than only the literal string content of a single response.

Other frameworks replace direct refusal with deception or sanitization. HoneyTrap delays and misdirects suspicious attackers through the Threat Interceptor and Misdirection Controller, while the Forensic Tracker classifies each turn by strategy category and the System Harmonizer adjusts thresholds, delay, and deception depth (Li et al., 7 Jan 2026). SAIGuard takes a different route: it simulates message propagation over the MAS interaction graph with a surrogate GNN, reconstructs benign communication-state patterns, and blocks, sanitizes, or regenerates suspicious messages before they reach the live system (Shi et al., 10 Jun 2026). “Learn to Disguise” formalizes another variant in which a Disguiser must reply with safe, on-topic content that contains no explicit refusal so as to hide defensive intent (Xu et al., 2024).

Consensus verification and trust-boundary management appear in domains where messages have operational effects. CP-Guard uses Probability-Agnostic Sample Consensus to isolate malicious collaborators, Collaborative Consistency Loss to compare fused predictions with ego-only perception, and a dual sliding-window threshold to preserve target false-positive and false-negative rates in dynamic environments (Hu et al., 28 Jun 2025). AgenticCyOps pushes the same general idea upward into enterprise architecture: tool invocations and memory accesses are treated as explicitly guarded surfaces, and high-stakes actions pass through consensus validation loops (Mitra et al., 10 Mar 2026). In cyber-physical and UAV settings, the equivalent control logic appears as moving target defense, federated aggregation, or attack-resilient compensators rather than language-based judgment (Zhou et al., 9 Jun 2025, Wang et al., 2 Jan 2025).

4. Formalization and metrics

No single metric dominates the area. Instead, each framework couples security measures to the operational layer it is meant to protect. PsySafe defines Process Danger Rate and Joint Danger Rate over rounds of multi-agent interaction, as well as a Behavioral Safety Score derived from $1-\mathrm{PDR}$ or $1-\mathrm{JDR}$ (Zhang et al., 2024). HoneyTrap introduces Mislead Success Rate and Attack Resource Consumption to capture deceptive success and attacker token expenditure, explicitly extending evaluation beyond simple block-or-allow outcomes (Li et al., 7 Jan 2026).

LLM-facing defenses frequently report Attack Success Rate, false-positive behavior, or F1-style classification metrics. AutoDefense formalizes ASR as the fraction of harmful responses that pass the filter, alongside false positive rate and overall accuracy (Zeng et al., 2024). The prompt-injection pipeline uses ASR and Mitigation Rate, and MALCDF evaluates Accuracy, Precision, Recall, F1-Score, False Positive Rate, and Average Latency per Event on a common 50-record stream (Hossain et al., 16 Sep 2025, Bhardwaj et al., 16 Dec 2025). SHIELD centers its evaluation on F1-score across multiple sponge-attack datasets and also reports stage-level mean latency (Sivaroopan et al., 27 Jan 2026).

Perception and cyber-defense frameworks use task-specific performance and control metrics. CP-Guard reports mIoU for BEV segmentation, [email protected] and [email protected] for object detection, PASAC verification counts, and threshold convergence behavior (Hu et al., 28 Jun 2025). PoolFlip defines ownership-based utility functions, WinRate at target $\theta$, and normalized performance gaps in a partially observable stochastic game (Cadet et al., 27 Aug 2025). CyberOps-Bots measures mean cumulative reward, reward CV, mean healthy-node ratio, max episode length, jumpstart performance, average network vulnerability at episode end, tokens per step, latency, hallucination rates, and HITL adaptation behavior (Peng et al., 12 Jan 2026).

Frameworks dedicated to evaluation and governance add yet another layer of metrics. TrinityGuard defines tier-specific pass rates

$$S_k(\mathcal{M},r_j)=\frac{1}{N_k}\sum_{i=1}^{N_k}\mathbf{1}\{\text{test}_i\text{ passes}\},$$

and an overall weighted safety score

$$S_{\mathrm{total}}(\mathcal{M})=\sum_{k=1}^{3}\sum_{r_j\in \mathcal{R}_k} w_{k,j}\,S_k(\mathcal{M},r_j),$$

together with FPR and FNR for the LLM Judge and per-agent trust metrics (Wang et al., 16 Mar 2026). AgenticCyOps evaluates coverage, attack-path interception, and trust-boundary reduction, explicitly treating architectural exposure as a measurable property (Mitra et al., 10 Mar 2026).

5. Empirical findings across domains

Reported results are strong but heterogeneous. On a LLaMA 2 target, SHIELD reports F1-scores of 100.00 on AUTO-DOS, 99.85 on GCG-DOS, 95.32 on EOGen, and 99.60 on RL-GOAL, compared against perplexity-filter and harm-filter baselines; reported mean latency per query is 97 ms for Stage 1, 63 ms for Stage 2, and 1 600 ms for Stage 3 (Sivaroopan et al., 27 Jan 2026). The same paper states that over repeated attacks, detections migrate progressively from Stage 3 into Stages 1 and 2 as the knowledge base grows.

PsySafe reports that in the HI–Traits Camel setting, Doctor Defense reduces PDR from 100% to 21.6% on safe tasks and from 98.4% to 26.2% on dangerous tasks, with JDR rounds falling to 0–3%; PsyScore falls from 85 to 44 on safe tasks and from 83 to 41 on dangerous tasks (Zhang et al., 2024). The paper also reports a point-biserial correlation of $\tau=0.6$0 with $\tau=0.6$1 between PsyScore and dangerous behavior. This suggests that psychometric signals can serve as actionable defense features in some multi-agent settings.

For prompt- and jailbreak-oriented systems, the literature reports both strict blocking and resource-wasting strategies. The prompt-injection defense pipeline reduces ASR to 0% across 400 total attack instances on ChatGLM and Llama2, with none of the benign test queries misclassified or altered (Hossain et al., 16 Sep 2025). HoneyTrap reports an average reduction of 68.77% in attack success rates compared to state-of-the-art baselines, and improves MSR and ARC by 118.11% and 149.16%, respectively; under adaptive-single-turn attacks it reports ASR $\tau=0.6$2 across several strategies with MSR $\tau=0.6$3 (Li et al., 7 Jan 2026). AutoDefense reports reducing the attack success rate on GPT-3.5 from 55.74% to 7.95% using LLaMA-2-13b with a 3-agent system (Zeng et al., 2024).

Proactive communication defense also shows strong reported gains. SAIGuard reports average ACC/ASR of 89.8%/5.4%, compared with 63.8%/34.6% for No Defense, and states that it consistently limits ASR below 6% while keeping ACC above 89% across Chain, Tree, Star, and Random topologies (Shi et al., 10 Jun 2026). TrinityGuard’s case studies on a Travel Planner Agent and a Deep Research Agent report substantial pre-hardening vulnerabilities, then partial recovery after message authentication, metadata signatures, memory validation, and citation whitelisting, with runtime overheads of about 5% added latency in agent messaging and under 5% added wall-clock latency in one case and about 12% CPU for monitor agents in another (Wang et al., 16 Mar 2026).

Cyber-defense and cyber-physical frameworks emphasize resilience, latency, and continuity rather than only semantic safety. MALCDF reports 90.0% detection accuracy, 85.7% F1-score, 9.1% false-positive rate, and 6.8 s average per-event latency on a held-out 50-record stream (Bhardwaj et al., 16 Dec 2025). CyberOps-Bots reports network availability 68.5% higher than state-of-the-art algorithms and a 34.7% jumpstart performance gain when shifting scenarios without retraining, with convergence in under 10k steps after each scenario switch (Peng et al., 12 Jan 2026). The federated multi-agent moving target defense for UAV swarms reports up to a 34.6% improvement in attack mitigation rate, a reduction in average recovery time of up to 94.6%, and decreases in energy consumption and defense cost by as much as 29.3% and 98.3%, respectively (Zhou et al., 9 Jun 2025). AgenticCyOps reports that its SOC design intercepts three of four representative attack chains within the first two steps and reduces exploitable trust boundaries by a minimum of 72% compared to a flat MAS (Mitra et al., 10 Mar 2026).

6. Limitations, misconceptions, and open directions

A persistent limitation is overhead. HoneyTrap introduces a deliberate 1.2–1.5 s per turn latency and reports a 20% throughput drop (Li et al., 7 Jan 2026). The prompt-injection pipeline adds 30–50 ms for Coordinator classification and 40–80 ms for Guard validation, while CyberOps-Bots reports 335–366 ms per step compared with baselines at 72–142 ms (Hossain et al., 16 Sep 2025, Peng et al., 12 Jan 2026). AegisLLM notes runtime overhead of 3–4 LLM calls per query, TrinityGuard reports nontrivial monitoring overhead, and SHIELD’s Stage 3 remains the most expensive stage at 1 600 ms mean latency (Cai et al., 29 Apr 2025, Wang et al., 16 Mar 2026, Sivaroopan et al., 27 Jan 2026).

Another limitation is architectural rigidity. HoneyTrap explicitly identifies its static role set as a limitation, AutoDefense notes fixed linear turn-taking and hand-crafted role definitions, and the prompt-injection pipeline warns that adaptive adversaries may craft out-of-distribution payloads and that multi-turn, cross-session attacks require extended context handling (Li et al., 7 Jan 2026, Zeng et al., 2024, Hossain et al., 16 Sep 2025). In reinforcement-learning defenses, scalability and attacker realism remain open: the UAV swarm framework assumes fixed, random, or greedy attackers, while EdgeAgentX highlights asynchronous FL and larger-scale deployments as future considerations (Zhou et al., 9 Jun 2025, Ray, 24 May 2025).

A common misconception is that multi-agent defense is synonymous with direct rejection. Several frameworks instead rely on misdirection, self-reflection, message regeneration, consensus validation, or moving target adaptation. HoneyTrap aims to waste attacker resources rather than simply reject; PsySafe’s Police Defense prompts self-critique; SAIGuard requests safe regeneration of internally hijacked messages; and adaptive moving target defense frameworks continuously alter leaders, routes, frequencies, or server states to change the attack surface (Li et al., 7 Jan 2026, Zhang et al., 2024, Shi et al., 10 Jun 2026, Eghtesad et al., 2019).

The stated future directions are correspondingly diverse. Reported extensions include automated agent creation for novel jailbreak patterns, integration with fine-tuning such as RLHF, multimodal defense, dynamic dialog graphs, automated role discovery, hierarchical collaborator splitting, self-supervised threshold learning, and DRL-based adversaries (Li et al., 7 Jan 2026, Zeng et al., 2024, Hu et al., 28 Jun 2025, Zhou et al., 9 Jun 2025). Taken together, these proposals suggest that the field is moving toward adaptive, architecture-aware, and domain-specific defense stacks rather than a single universal guardrail.