---
title: Multi-Agent Defense Framework
url: https://www.emergentmind.com/topics/multi-agent-defense-framework
type: topic
---

# Multi-Agent Defense Framework

Multi-agent defense framework denotes a class of defensive architectures in which multiple specialized agents, controllers, or policy modules coordinate to detect, contain, misdirect, monitor, or recover from attacks against complex AI or cyber-physical systems. In the recent literature, the term covers closed self-healing defenses for LLM resource exhaustion, psychologically grounded safeguards for LLM-based multi-agent systems, SOC-style cyber pipelines, consensus-based protection for collaborative perception, hierarchical LLM–RL controllers for cloud defense, and runtime monitoring stacks for enterprise agent deployments [2601.19174] [2401.11880] [2512.14846] [2603.09134].

## 1. Scope and representative formulations

The topic spans several technical domains rather than a single canonical architecture. Reported systems defend against jailbreaks, prompt injection, sponge attacks, malicious collaborators in embodied perception, cyber intrusions, DoS in UAV swarms, and exponentially unbounded false-data-injection attacks in signed-digraph cyber-physical systems [2601.04034] [2509.14285] [2506.22890] [2506.07392] [2501.00990].

| Framework | Target setting | Main defensive structure |
|---|---|---|
| SHIELD [2601.19174] | LLM resource exhaustion attacks | Defense Agent, Knowledge Updating Agent, Prompt Optimization Agent |
| PsySafe [2401.11880] | Psychological safety of LLM-based MAS | Psychological Profiling, Behavior Evaluation, Defense Module |
| MALCDF [2512.14846] | Real-time cyber defense | Threat Detection, Threat Intelligence, Response Coordination, Analyst |
| CP-Guard [2506.22890] | Collaborative perception | PASAC, CCLoss verification, dual-window adaptive threshold |
| HoneyTrap [2601.04034] | Multi-turn jailbreak defense | Threat Interceptor, Misdirection Controller, Forensic Tracker, System Harmonizer |
| CyberOps-Bots [2601.07122] | Cloud network resilience | Upper-level LLM agent, lower-level RL agents |
| AgenticCyOps [2603.09134] | Enterprise cyber operations | Trust-boundary control over tools and memory |
| TrinityGuard [2603.15408] | MAS evaluation and runtime monitoring | MAS abstraction, evaluation layer, monitor agents |

From a historical perspective, the literature includes a 2019 multi-agent POMDP model for adaptive moving target defense and, by 2026, a broad family of agentic defense systems with explicit orchestration, memory, tool, and communication controls [1911.11972] [2603.15408]. This suggests that the notion of a multi-agent defense framework has expanded from adversarial control problems into full-stack security architectures for LLM-based systems and enterprise workflows.

## 2. Recurring architectural patterns

A recurring architectural pattern is role specialization. AutoDefense decomposes response filtering into an Input Agent, Coordinator Agent, Intention Analyzer, Prompt Inference Agent, Judge Agent, Output Agent, and an optional External Defense Tool Agent [2403.04783]. MALCDF follows a classic SOC style with a Threat Detection Agent, Threat Intelligence Agent, Response Coordination Agent, and Analyst Agent, while HoneyTrap assigns front-line interception, misdirection, forensics, and orchestration to four separate defenders [2512.14846] [2601.04034]. In these systems, defense is not a monolithic classifier but a structured workflow in which different modules hold different epistemic or operational responsibilities.

Another recurrent pattern is staged or cascaded filtering. SHIELD routes all queries through a three-stage Defense Agent consisting of semantic similarity filtering, substring matching, and LLM-based reasoning; only queries that pass all three stages reach the target model [2601.19174]. The prompt-injection pipeline similarly separates pre-input classification by a Coordinator from post-generation validation by a Guard, while AegisLLM uses an Orchestrator to classify the query, a Responder to answer safe inputs, an Evaluator to re-check outputs, and a Deflector to refuse unsafe cases [2509.14285] [2504.20965]. These designs implement defense-in-depth by placing multiple decision points around the vulnerable generation step.

A third pattern is the closed loop. SHIELD is explicitly described as a closed self-healing loop: when a missed attack is observed, the Knowledge Updating Agent updates the attack-type cache and sponge-prompt knowledge base, and the Prompt Optimization Agent refines the Stage-3 prompt if a genuinely novel attack type has appeared [2601.19174]. PsySafe also forms a closed loop across psychological profiling, behavior evaluation, and intervention, while CyberOps-Bots combines perception, memory, ReAct planning, and lower-level RL execution in an ongoing control cycle over a dynamic cloud environment [2401.11880] [2601.07122].

Secure or constrained coordination is another strong theme. MALCDF routes inter-agent traffic through a Secure Communication Layer with AES-256/TLS tunnels, signed and timestamped messages, and ontology-aligned JSON Schema fields [2512.14846]. AgenticCyOps treats tool orchestration and memory management as primary trust boundaries, then enforces authorized interfaces, capability scoping, verified execution, memory integrity and synchronization, and access-controlled data isolation inside a phase-scoped SOC workflow based on the Model Context Protocol [2603.09134]. TrinityGuard, by contrast, abstracts the MAS underneath a BaseMAS interface and then layers attack injection, event streaming, evaluation, and monitoring logic above that abstraction [2603.15408].

## 3. Defensive mechanisms and control logic

Detection mechanisms vary substantially by domain, but several families recur. SHIELD’s first stage computes cosine similarity between the query embedding and stored malicious embeddings, rejecting if $\max_i \mathrm{sim}_i \ge \tau$ with a reported example threshold $\tau=0.6$; the second stage applies a Knuth–Morris–Pratt search for exact malicious fragments; the third stage invokes an LLM classifier over optimized defense instructions, retrieved contexts, and the query [2601.19174]. The prompt-injection coordinator uses a weighted pattern-matching score,
$$
s(P)=\sum_{i=1}^n w_i \cdot \mathbf{1}_{\text{pattern}_i \in P},
$$
and flags a prompt as malicious if $s(P)\ge T_C$, while the Guard applies token blocklists, format constraints, redaction, truncation, and hard blocking [2509.14285].

Some frameworks emphasize behavioral or psychological intervention rather than only content filtering. PsySafe administers a modified Dark Triad Dirty Dozen test to each agent and defines
$$
\mathrm{PsyScore}_i=\sum_{k=1}^{12} s_{ik},
$$
then uses Doctor Defense to rewrite contaminated system prompts until the score falls below a threshold, and Police Defense to inject self-reflection prompts when dangerous behavior persists [2401.11880]. In this family of work, the defended object is the internal disposition of the agent rather than only the literal string content of a single response.

Other frameworks replace direct refusal with deception or sanitization. HoneyTrap delays and misdirects suspicious attackers through the Threat Interceptor and Misdirection Controller, while the Forensic Tracker classifies each turn by strategy category and the System Harmonizer adjusts thresholds, delay, and deception depth [2601.04034]. SAIGuard takes a different route: it simulates message propagation over the MAS interaction graph with a surrogate GNN, reconstructs benign communication-state patterns, and blocks, sanitizes, or regenerates suspicious messages before they reach the live system [2606.12474]. “Learn to Disguise” formalizes another variant in which a Disguiser must reply with safe, on-topic content that contains no explicit refusal so as to hide defensive intent [2404.02532].

Consensus verification and trust-boundary management appear in domains where messages have operational effects. CP-Guard uses Probability-Agnostic Sample Consensus to isolate malicious collaborators, Collaborative Consistency Loss to compare fused predictions with ego-only perception, and a dual sliding-window threshold to preserve target false-positive and false-negative rates in dynamic environments [2506.22890]. AgenticCyOps pushes the same general idea upward into enterprise architecture: tool invocations and memory accesses are treated as explicitly guarded surfaces, and high-stakes actions pass through consensus validation loops [2603.09134]. In cyber-physical and UAV settings, the equivalent control logic appears as moving target defense, federated aggregation, or attack-resilient compensators rather than language-based judgment [2506.07392] [2501.00990].

## 4. Formalization and metrics

No single metric dominates the area. Instead, each framework couples security measures to the operational layer it is meant to protect. PsySafe defines Process Danger Rate and Joint Danger Rate over rounds of multi-agent interaction, as well as a Behavioral Safety Score derived from $1-\mathrm{PDR}$ or $1-\mathrm{JDR}$ [2401.11880]. HoneyTrap introduces Mislead Success Rate and Attack Resource Consumption to capture deceptive success and attacker token expenditure, explicitly extending evaluation beyond simple block-or-allow outcomes [2601.04034].

LLM-facing defenses frequently report Attack Success Rate, false-positive behavior, or F1-style classification metrics. AutoDefense formalizes ASR as the fraction of harmful responses that pass the filter, alongside false positive rate and overall accuracy [2403.04783]. The prompt-injection pipeline uses ASR and Mitigation Rate, and MALCDF evaluates Accuracy, Precision, Recall, F1-Score, False Positive Rate, and Average Latency per Event on a common 50-record stream [2509.14285] [2512.14846]. SHIELD centers its evaluation on F1-score across multiple sponge-attack datasets and also reports stage-level mean latency [2601.19174].

Perception and cyber-defense frameworks use task-specific performance and control metrics. CP-Guard reports mIoU for BEV segmentation, AP@0.5 and AP@0.7 for object detection, PASAC verification counts, and threshold convergence behavior [2506.22890]. PoolFlip defines ownership-based utility functions, WinRate at target $\theta$, and normalized performance gaps in a partially observable stochastic game [2508.19488]. CyberOps-Bots measures mean cumulative reward, reward CV, mean healthy-node ratio, max episode length, jumpstart performance, average network vulnerability at episode end, tokens per step, latency, hallucination rates, and HITL adaptation behavior [2601.07122].

Frameworks dedicated to evaluation and governance add yet another layer of metrics. TrinityGuard defines tier-specific pass rates
$$
S_k(\mathcal{M},r_j)=\frac{1}{N_k}\sum_{i=1}^{N_k}\mathbf{1}\{\text{test}_i\text{ passes}\},
$$
and an overall weighted safety score
$$
S_{\mathrm{total}}(\mathcal{M})=\sum_{k=1}^{3}\sum_{r_j\in \mathcal{R}_k} w_{k,j}\,S_k(\mathcal{M},r_j),
$$
together with FPR and FNR for the LLM Judge and per-agent trust metrics [2603.15408]. AgenticCyOps evaluates coverage, attack-path interception, and trust-boundary reduction, explicitly treating architectural exposure as a measurable property [2603.09134].

## 5. Empirical findings across domains

Reported results are strong but heterogeneous. On a LLaMA 2 target, SHIELD reports F1-scores of 100.00 on AUTO-DOS, 99.85 on GCG-DOS, 95.32 on EOGen, and 99.60 on RL-GOAL, compared against perplexity-filter and harm-filter baselines; reported mean latency per query is 97 ms for Stage 1, 63 ms for Stage 2, and 1 600 ms for Stage 3 [2601.19174]. The same paper states that over repeated attacks, detections migrate progressively from Stage 3 into Stages 1 and 2 as the knowledge base grows.

PsySafe reports that in the HI–Traits Camel setting, Doctor Defense reduces PDR from 100% to 21.6% on safe tasks and from 98.4% to 26.2% on dangerous tasks, with JDR rounds falling to 0–3%; PsyScore falls from 85 to 44 on safe tasks and from 83 to 41 on dangerous tasks [2401.11880]. The paper also reports a point-biserial correlation of $r\approx 0.41$ with $p<0.001$ between PsyScore and dangerous behavior. This suggests that psychometric signals can serve as actionable defense features in some multi-agent settings.

For prompt- and jailbreak-oriented systems, the literature reports both strict blocking and resource-wasting strategies. The prompt-injection defense pipeline reduces ASR to 0% across 400 total attack instances on ChatGLM and Llama2, with none of the benign test queries misclassified or altered [2509.14285]. HoneyTrap reports an average reduction of 68.77% in attack success rates compared to state-of-the-art baselines, and improves MSR and ARC by 118.11% and 149.16%, respectively; under adaptive-single-turn attacks it reports ASR $\le 0.12$ across several strategies with MSR $\ge 0.30$ [2601.04034]. AutoDefense reports reducing the attack success rate on GPT-3.5 from 55.74% to 7.95% using LLaMA-2-13b with a 3-agent system [2403.04783].

Proactive communication defense also shows strong reported gains. SAIGuard reports average ACC/ASR of 89.8%/5.4%, compared with 63.8%/34.6% for No Defense, and states that it consistently limits ASR below 6% while keeping ACC above 89% across Chain, Tree, Star, and Random topologies [2606.12474]. TrinityGuard’s case studies on a Travel Planner Agent and a Deep Research Agent report substantial pre-hardening vulnerabilities, then partial recovery after message authentication, metadata signatures, memory validation, and citation whitelisting, with runtime overheads of about 5% added latency in agent messaging and under 5% added wall-clock latency in one case and about 12% CPU for monitor agents in another [2603.15408].

Cyber-defense and cyber-physical frameworks emphasize resilience, latency, and continuity rather than only semantic safety. MALCDF reports 90.0% detection accuracy, 85.7% F1-score, 9.1% false-positive rate, and 6.8 s average per-event latency on a held-out 50-record stream [2512.14846]. CyberOps-Bots reports network availability 68.5% higher than state-of-the-art algorithms and a 34.7% jumpstart performance gain when shifting scenarios without retraining, with convergence in under 10k steps after each scenario switch [2601.07122]. The federated multi-agent moving target defense for UAV swarms reports up to a 34.6% improvement in attack mitigation rate, a reduction in average recovery time of up to 94.6%, and decreases in energy consumption and defense cost by as much as 29.3% and 98.3%, respectively [2506.07392]. AgenticCyOps reports that its SOC design intercepts three of four representative attack chains within the first two steps and reduces exploitable trust boundaries by a minimum of 72% compared to a flat MAS [2603.09134].

## 6. Limitations, misconceptions, and open directions

A persistent limitation is overhead. HoneyTrap introduces a deliberate 1.2–1.5 s per turn latency and reports a 20% throughput drop [2601.04034]. The prompt-injection pipeline adds 30–50 ms for Coordinator classification and 40–80 ms for Guard validation, while CyberOps-Bots reports 335–366 ms per step compared with baselines at 72–142 ms [2509.14285] [2601.07122]. AegisLLM notes runtime overhead of 3–4 LLM calls per query, TrinityGuard reports nontrivial monitoring overhead, and SHIELD’s Stage 3 remains the most expensive stage at 1 600 ms mean latency [2504.20965] [2603.15408] [2601.19174].

Another limitation is architectural rigidity. HoneyTrap explicitly identifies its static role set as a limitation, AutoDefense notes fixed linear turn-taking and hand-crafted role definitions, and the prompt-injection pipeline warns that adaptive adversaries may craft out-of-distribution payloads and that multi-turn, cross-session attacks require extended context handling [2601.04034] [2403.04783] [2509.14285]. In reinforcement-learning defenses, scalability and attacker realism remain open: the UAV swarm framework assumes fixed, random, or greedy attackers, while EdgeAgentX highlights asynchronous FL and larger-scale deployments as future considerations [2506.07392] [2505.18457].

A common misconception is that multi-agent defense is synonymous with direct rejection. Several frameworks instead rely on misdirection, self-reflection, message regeneration, consensus validation, or moving target adaptation. HoneyTrap aims to waste attacker resources rather than simply reject; PsySafe’s Police Defense prompts self-critique; SAIGuard requests safe regeneration of internally hijacked messages; and adaptive moving target defense frameworks continuously alter leaders, routes, frequencies, or server states to change the attack surface [2601.04034] [2401.11880] [2606.12474] [1911.11972].

The stated future directions are correspondingly diverse. Reported extensions include automated agent creation for novel jailbreak patterns, integration with fine-tuning such as RLHF, multimodal defense, dynamic dialog graphs, automated role discovery, hierarchical collaborator splitting, self-supervised threshold learning, and DRL-based adversaries [2601.04034] [2403.04783] [2506.22890] [2506.07392]. Taken together, these proposals suggest that the field is moving toward adaptive, architecture-aware, and domain-specific defense stacks rather than a single universal guardrail.

Source: https://www.emergentmind.com/topics/multi-agent-defense-framework