Multi-Agent Safety Shield (MASS)

• Multi-Agent Safety Shield (MASS) is an architectural framework that separates decision generation from pre-execution safety enforcement to ensure safe multi-agent operations.
• It encompasses various implementations—centralized, dynamic, and contract-based shields—using tools like control barrier functions and LTL to maintain safety under uncertainty.
• Empirical studies in domains such as autonomous driving and LLM-based assistants demonstrate MASS’s effectiveness in minimizing collisions and mitigating unsafe actions.

Multi-Agent Safety Shield (MASS) denotes a class of runtime-assurance architectures in which a multi-agent policy, planner, or skill graph proposes actions, while a distinct safety mechanism mediates those actions before execution so that unsafe behavior is corrected, blocked, or replaced by certified-safe alternatives. In the cited literature, MASS appears both as an explicit term for connected autonomous vehicles and as a unifying interpretation of shielded MARL, distributed runtime enforcement, and enforced execution graphs in LLM-based multi-agent assistants. Across these settings, the defining property is not cooperative learning alone but the insertion of a safety layer that preserves hard constraints under interaction, uncertainty, and partial observability (Hegde et al., 10 Feb 2026, Smith et al., 1 Jun 2025, Wang et al., 28 Mar 2026).

1. Definitional core

MASS is characterized by a structural separation between decision generation and decision authorization. A learned MARL policy may choose a candidate action, a skill agent may emit a functional operation, or a distributed controller may compute a nominal control; however, execution is contingent on passage through a shield. In autonomous-driving formulations, the shield typically lies between a policy’s action suggestion and the executed vehicle control. In LTL-based shielded MARL, it monitors proposed joint actions and substitutes safe alternatives when necessary. In execution-graph formulations for LLM-based assistants, every potentially harmful functional action must be preceded by an enforcement node that can allow, block, defer for review, or adapt the action (Smith et al., 1 Jun 2025, ElSayed-Aly et al., 2021, Wang et al., 28 Mar 2026).

This suggests that MASS is best treated as an architectural category rather than a single algorithmic template. The common denominator is pre-execution mediation. That property distinguishes MASS from post-hoc monitoring, reward-only safety shaping, or purely offline verification. A shield may be centralized, factored, distributed, graph-structured, or contract-based, but it remains a MASS instance only insofar as unsafe trajectories are intercepted before they occur.

Domain	Shielded object	Representative mechanism
Connected autonomous vehicles	Policy action or nominal control	CBF-QP filtering
Safe MARL	Joint action profile	DFA/safety-game shield
LLM-based MAS	Functional skill execution	Enforcement nodes on execution graph

2. Formal models and enforcement primitives

In MARL-oriented MASS formulations, the underlying control problem is often written as a Markov game. One connected-autonomy framework models the multi-agent problem as $G=(S,A,P,r,\gamma)$, with decentralized policies $\pi_\theta(a_i \mid s_i)$ and CTDE-style training, while another writes MARL as $$(N, S, \{A^i\}_{i\in N}, P, \{R^i\}_{i\in N}, \gamma)$$ and expresses safety in LTL such as $\Box \neg \mathsf{unsafe}$ (Smith et al., 1 Jun 2025, ElSayed-Aly et al., 2021). The shielded object can therefore be either an individual control input, a joint action, or a region-dependent local action mask.

A large fraction of MASS work in cyber-physical systems uses Control Barrier Functions. The safe set is expressed as

$\mathcal{C}=\{x \in \mathbb{R}^n : h(x)\ge 0\},$

and the shield computes the minimally modified safe control through a quadratic program of the form

$$u^* = \arg\min_{u \in \mathbb{R}^m} \ \|u-u_{\text{nom}}\|^2$$

subject to a barrier constraint such as

$$\frac{\partial h(x)}{\partial x}f(x)+\frac{\partial h(x)}{\partial x}g(x)u+\alpha(h(x)) \ge 0,$$

or, equivalently in Lie-derivative form,

$$\frac{\partial h(x,t)}{\partial t} + L_f h(x,t) + L_g h(x,t)u \ge -\gamma h(x,t).$$

Within this design, the shield does not optimize task performance; it enforces forward invariance of the safe set by projecting nominal behavior onto the admissible set (Smith et al., 1 Jun 2025, Zhang et al., 2022).

Symbolic and formal-method variants replace CBFs with automata and games. Centralized and factored multi-agent shields are synthesized from DFAs obtained from LTL safety formulas and implemented as Mealy machines operating over abstract observations and joint actions. The winning region $W$ of the induced safety game determines which actions are allowed. Dynamic shielding generalizes this construction by recomputing and reconfiguring distributive shields online, while contract-based shielding certifies tuples of local $\mathsf{LTL}_{\mathsf{safe}}$ obligations whose conjunction implies a global safety specification (ElSayed-Aly et al., 2021, Xiao et al., 2023, Adalat et al., 12 Jun 2026).

Execution-graph MASS for LLM agents introduces a different formal primitive. SafeClaw-R models the MAS as a directed graph

$\pi_\theta(a_i \mid s_i)$0

with functional nodes and enforcement nodes, and imposes the invariant

$\pi_\theta(a_i \mid s_i)$1

so that a functional node may execute only if the enforcement node authorizes it. Here the MASS concept is expressed not as control synthesis but as a structural constraint over the execution graph (Wang et al., 28 Mar 2026).

3. Architectural families

The literature contains several recurring MASS organizations.

Family	Core idea	Representative work
Centralized and factored shields	One global shield or multiple factor shields monitor MARL actions	(ElSayed-Aly et al., 2021)
Dynamic distributive shielding	Shields split, merge, and recompute online	(Xiao et al., 2023)
Onboard runtime synthesis	One shield per agent; online path synthesis plus dynamic priorities	(Raju et al., 2019)
Distributed Simplex	Local AC/BC/DM per agent; local safety implies global safety	(Mehmood et al., 2020)
Contract-based compositional shielding	Certified tuples of local obligations projected into local masks	(Adalat et al., 12 Jun 2026)
Collaborative graph-based CBF shielding	Interaction topology determines multi-vehicle dependencies	(Hegde et al., 10 Feb 2026)

The centralized/factored line treats MASS as a synthesized runtime filter over joint actions. Its principal benefit is exact reasoning over a specified safety objective; its principal difficulty is the exponential growth of the joint state-action space. Dynamic shielding, online synthesis, and distributed Simplex were all proposed as responses to that scaling problem, each moving enforcement closer to the agents and limiting the information each shield must process.

Contract-based compositional shielding occupies a distinct position. Instead of permitting each local shield to reason conservatively against all possible teammate actions, it certifies local obligations simultaneously and allows each agent to rely on the others’ obligations as assumptions. This preserves safe coordinated behaviors that would be lost under purely unilateral factorization. A plausible implication is that MASS has evolved from “local filtering of local actions” toward “local filtering under jointly certified coordination structure.”

4. Communication, topology, and uncertainty

MASS is often communication-aware because safety in multi-agent settings is conditioned on what each agent can know about others. In a connected-autonomous-vehicle realization, each ego agent receives local observation $\pi_\theta(a_i \mid s_i)$2 together with shared observations $\pi_\theta(a_i \mid s_i)$3, the system explicitly models delayed observations $\pi_\theta(a_i \mid s_i)$4, the shield computes a safe action set from delayed state information, and the fallback when that set is empty is emergency stop. The same framework reports that the CBF intervened in about 14.2% of executed steps in real-world trials, and that the communication-enabled configuration reduced the intervention rate relative to no communication, indicating that shared state information can make unsafe action requests less frequent without displacing the shield’s role as the hard backstop (Smith et al., 1 Jun 2025).

In hazardous connected-driving scenarios, the communication structure itself becomes part of the safety architecture. A constrained MARL framework for CAVs uses a GCN-Transformer as a spatial-temporal encoder over vehicles, neighbors, and infrastructure messages, with a 100 m V2X communication range, and shows that removing communication sharply degrades collision-free rate in testing, for example from 94% to 44% in Intersection and from 78% to 48% in Highway-Hard. In that design, richer shared information improves both coordination and the quality of safety checks, but the CBF shield remains the online authority that filters candidate actions (Zhang et al., 2022).

The explicit MASS formulation for congested on-ramp merging makes topology first-class. It defines an interaction graph $\pi_\theta(a_i \mid s_i)$5 mapping each CAV $\pi_\theta(a_i \mid s_i)$6 to a parent set $\pi_\theta(a_i \mid s_i)$7, selected from vehicles such as the leading vehicle $\pi_\theta(a_i \mid s_i)$8, the adjacent leading vehicle $\pi_\theta(a_i \mid s_i)$9, and the adjacent rear vehicle $$(N, S, \{A^i\}_{i\in N}, P, \{R^i\}_{i\in N}, \gamma)$$0. If $$(N, S, \{A^i\}_{i\in N}, P, \{R^i\}_{i\in N}, \gamma)$$1 follows a lane, it depends on $$(N, S, \{A^i\}_{i\in N}, P, \{R^i\}_{i\in N}, \gamma)$$2; if $$(N, S, \{A^i\}_{i\in N}, P, \{R^i\}_{i\in N}, \gamma)$$3 is changing into the current lane behind $$(N, S, \{A^i\}_{i\in N}, P, \{R^i\}_{i\in N}, \gamma)$$4, $$(N, S, \{A^i\}_{i\in N}, P, \{R^i\}_{i\in N}, \gamma)$$5 depends on $$(N, S, \{A^i\}_{i\in N}, P, \{R^i\}_{i\in N}, \gamma)$$6; and if $$(N, S, \{A^i\}_{i\in N}, P, \{R^i\}_{i\in N}, \gamma)$$7 is changing lane, $$(N, S, \{A^i\}_{i\in N}, P, \{R^i\}_{i\in N}, \gamma)$$8 in the target lane is added to $$(N, S, \{A^i\}_{i\in N}, P, \{R^i\}_{i\in N}, \gamma)$$9. The paper explicitly excludes the adjacent rear vehicle from the interaction topology to avoid deadlocks, while still using its state in lateral safety checking with worst-case assumptions (Hegde et al., 10 Feb 2026).

Topology is also central in adversarial LLM-based MAS. AgentShield models the system as a directed graph $\Box \neg \mathsf{unsafe}$0, identifies critical nodes using degree, betweenness, closeness, and task contribution, audits only the top proportion $\Box \neg \mathsf{unsafe}$1 of nodes, and escalates from light sentry verification to consensus arbitration only on uncertain cases. This places MASS in a broader class of topology-aware runtime defenses in which safety depends not only on local outputs but on how faults propagate across the multi-agent graph (Wang et al., 28 Nov 2025).

5. Empirical performance across domains

In connected autonomy, MASS-style designs are supported by both simulation and hardware experiments. The Real-Sim-Real framework for F1/10th-scale vehicles reports zero collisions in all reported real-world cases for the full shielded system, including $\Box \neg \mathsf{unsafe}$2, $\Box \neg \mathsf{unsafe}$3, and $\Box \neg \mathsf{unsafe}$4 on the 3-lane miniature highway across three obstacle settings, where the pair denotes $\Box \neg \mathsf{unsafe}$5. Over 50 test episodes in simulation, the same method reports 0 collisions and the highest mean discounted efficiency return, 129.52, whereas robust MARL without communication-delay handling still has 28 collisions, and variants without the shield reach 42 and 45 collisions (Smith et al., 1 Jun 2025).

A parallel result appears in hazard-heavy CARLA scenarios. In training, the spatial-temporal-aware constrained MARL method with shield reports 96% collision-free rate and 624.8 mean return in Intersection, versus 21% and 430.8 without the shield, and 95% and 955.6 in Highway, versus 0% and 166.4 without the shield. In testing, it reaches 94% collision-free rate in Intersection, 90% in Highway, and 78% in Highway-Hard, and in normal hazard-free scenarios it achieves 100% collision-free rate (Zhang et al., 2022).

For congested on-ramp merging, the explicit MARL-MASS framework evaluates the best policy over 100 episodes and reports 0.59 (0.01) minimum headway, 24.71 (0.09) average speed, and 83.36 (0.38) merging percentage. The comparable shielded HSS variant yields 0.72 (0.03), 21.95 (0.31), and 52.75 (7.07), while MARL-CS and Unsafe MARL achieve minimum headway = 0.00 s, indicating collisions. The paper therefore positions MASS as less conservative than worst-case shielding while still strictly maintaining the 0.5 s safety threshold (Hegde et al., 10 Feb 2026).

In LLM-based assistant systems, the same architectural idea is instantiated as action mediation over skills and execution graphs. SafeClaw-R reports 95.2% accuracy in Google Workspace scenarios versus 61.6% for a regex baseline, 97.8% detection of malicious third-party skill patterns, and 100% detection accuracy on a 2,020-case adversarial code-execution benchmark. Its preliminary audit of OpenClaw further finds that 36.4% of built-in skills pose high or critical risks, motivating pre-execution enforcement rather than static prompt-level guardrails (Wang et al., 28 Mar 2026).

Distributed auditing for adversarial MAS shows a related performance pattern. AgentShield reports a 92.5% recovery rate under mixed attacks, with auditing overhead reduced by over 70% relative to majority voting; specifically, average extra time overhead in the no-attack case is 13.9% for AgentShield versus 48.0% for Majority Voting, and under attack 12.4% versus 62.1%. Although this line of work emphasizes security auditing rather than vehicle control, it still operationalizes MASS as a runtime mediation layer over interacting agents (Wang et al., 28 Nov 2025).

6. Guarantees, conservatism, and boundaries

The central guarantee sought by MASS is hard online safety, not merely improved average behavior. In CBF-based vehicle formulations, this means that if the learned action would violate safety, the QP projects it to the nearest safe action, and safety is guaranteed for each individual agent by verifying and correcting its own control through the barrier constraint. In LTL/game-based shielding, the guarantee is that all generated runs remain within the winning region or accepting states of the safety automaton. In distributed runtime synthesis, correctness, minimal deviation, boundedness, and completeness are made explicit: the paper proves that the set of onboard enforcers are correct, deviate minimally, bounded, and complete, and that runtime synthesis is $\Box \neg \mathsf{unsafe}$6 rather than exponentially hard at design time; for 50 agents in a 50x50 grid, runtime synthesis requires a few seconds per agent when a potential collision is detected, whereas centralized design-time synthesis is reported as intractable beyond 4 agents in a 5x5 grid (Smith et al., 1 Jun 2025, ElSayed-Aly et al., 2021, Raju et al., 2019).

A recurring issue is conservatism. Purely factorized or worst-case local shields may exclude safe team behaviors that require coordinated commitments. Contract-based compositional shielding addresses this with certified tuples of local obligations. The motivating example is explicit: the safe joint set

$\Box \neg \mathsf{unsafe}$7

collapses under unilateral factorization to

$\Box \neg \mathsf{unsafe}$8

thereby losing the coordinated safe action $\Box \neg \mathsf{unsafe}$9. The contract-based framework is designed precisely to recover such team-optimal safe behavior without centralized runtime control (Adalat et al., 12 Jun 2026).

Another boundary concerns model knowledge. Dynamic shielding with known dynamics offers formal runtime guarantees through the winning region of a $\mathcal{C}=\{x \in \mathbb{R}^n : h(x)\ge 0\},$0-step safety game; when the dynamics are unknown, the same framework learns an approximate world model during early exploration and claims formal safety guarantees with high probability. This places MASS on a spectrum ranging from exact model-based enforcement to probabilistic enforcement conditioned on learned abstractions (Xiao et al., 2023).

MASS is also not synonymous with every safety-aware multi-agent method. Some approaches embed safety inside the control problem rather than placing an external shield between nominal decisions and execution. The barrier-state framework for stochastic optimal control augments subsystem dynamics with BaSs and solves the resulting HJB problem so that the resulting controller is already safe-optimal; the paper explicitly contrasts this with shielding architectures such as CBF-QPs that override a nominal controller. This suggests an important conceptual boundary: MASS is most naturally reserved for methods in which safety is enforced by a distinct mediation layer, even when that layer is distributed, compositional, or graph-structured (Song et al., 2022).

Finally, the literature consistently distinguishes shielding from reward shaping. Reward penalties, constrained RL objectives, graph encoders, worst-Q training, and custom efficiency rewards can reduce the frequency of unsafe proposals or improve coordination, but the shield remains the component that prevents unsafe execution. The practical significance of MASS therefore lies in exactly this division of labor: learning handles coordination and performance; shielding enforces admissibility online.