Skip to content

GUARDIAN: Safeguarding LLM Multi-Agent Collaborations with Temporal Graph Modeling

🕒 Published (v1): 2025-01-01 · Source: NeurIPS · Venue: NeurIPS 2025 · link

Ask a follow-up

Open an assistant pre-loaded with this paper's context.

💬 Ask ChatGPT✦ Ask Claude

TL;DR

GUARDIAN models LLM multi-agent collaboration as a discrete-time temporal attributed graph and applies an unsupervised encoder-decoder with dual decoders to detect and remove anomalous agents or communications. It addresses both hallucination amplification (emergent) and malicious error injection/propagation (adversarial) in a single unified, model-agnostic framework. State-of-the-art accuracy is achieved while reducing API calls compared to all baselines.

Problem

Existing defenses for multi-agent LLM systems either detect single-model hallucinations without modeling inter-agent propagation dynamics, or use majority voting under the flawed assumption of agent independence. Neither category handles all three failure modes simultaneously—hallucination cascades, agent-targeted prompt attacks, and communication-channel corruption—nor is applicable to closed-source models that cannot be modified.

Method

Multi-agent collaboration across T rounds is encoded as a discrete-time temporal attributed graph where each node v_{t,i} represents agent m_i at timestep t, node features x_{t,i} are BERT embeddings of agent responses, and directed edges encode inter-round communication. An Attributed Graph Encoder (2-layer GCN) produces per-timestep node embeddings Z_t; a Transformer-based Time Information Encoder aggregates the embedding sequence {Z_1,...,Z_T} via self-attention into a final representation Z_T. Dual decoders then reconstruct (i) node attributes (MSE loss) and (ii) adjacency structure (binary cross-entropy), with reconstruction errors serving as per-node anomaly scores. A Graph Information Bottleneck (GIB) mechanism (minimizing I(X_t;Z_t) − βI(Z_t;Y_t)) compresses the temporal graph while preserving task-relevant patterns and bounding inter-agent information flow. An incremental training paradigm fine-tunes the model across consecutive timesteps, removing identified anomalous nodes before each new round. The overall loss is L_total = αL_att + (1−α)L_stru + λL_GIB. One highest-scoring node is pruned per round to prevent cascading false removals.

Key Contributions

  • Temporal attributed graph representation of multi-agent collaboration that explicitly captures hallucination and error propagation dynamics.
  • Unsupervised dual-decoder encoder-decoder architecture detecting anomalies in both attribute and structure spaces without labeling or LLM modification.
  • First application of Information Bottleneck Theory to LLM multi-agent safety, with formal bounds on inter-agent information flow and temporal state transitions (Theorem 4.2).
  • Incremental training paradigm that removes confirmed anomalies from the training graph before each new round, building cumulative representations of normal behavior.
  • Model-agnostic framework compatible with closed-source LLMs (GPT-3.5-turbo, GPT-4o, Claude-3.5-sonnet).

Results

  • Hallucination amplification: +4.2% average accuracy over state-of-the-art across MMLU, MATH, FEVER, Biographies; +7.1% on MATH averaged over backbone models; up to +15.4% on MATH with GPT-3.5-turbo vs. best baseline (DyLAN).
  • Agent-targeted error injection: +4.3% over best baseline on MATH; +8.6% over GPT-3.5-turbo.
  • Communication-targeted error injection: +3.6% on MMLU and MATH; +7.5% / +7.7% over GPT-3.5-turbo.
  • Anomaly detection rate: above 80% average, peak 94.74%.
  • False Discovery Rate: mostly below 20%; as low as 8.32% (MATH, agent-targeted attacks).
  • API calls: lowest among all methods (e.g., ~4–5 calls vs. 12–16 for most baselines in hallucination scenarios).
  • Runtime: lowest on MMLU and FEVER; marginal overhead (<5 s) vs. LLM Debate on MATH, far below other defenses (Table 5).
  • Robust to sparse topologies (25%–75% connectivity) and scales from 3 to 7 agents.

Limitations

  • False discovery rates remain non-trivial (up to ~31% for communication-targeted attacks on MMLU), meaning correct agents are sometimes pruned.
  • Evaluation uses only 100 randomly sampled questions per dataset per scenario, limiting statistical coverage.
  • Incremental training assumes in-distribution anomalies; generalization to out-of-distribution attack strategies is untested.
  • BERT-based node features may not capture full semantic richness of long, multi-turn agent responses.
  • Conservative single-node-per-round deletion heuristic may slow convergence when multiple agents are simultaneously compromised.
  • Scalability beyond 7 agents and performance under highly adaptive adversaries are not evaluated.

Relevance to Agentic AI / LLM Agents

GUARDIAN directly targets safety vulnerabilities that grow more acute as agent systems scale: hallucination cascades and adversarial prompt injection in A2A-style multi-agent pipelines. By framing the collaboration as a temporal graph and applying anomaly detection without touching the underlying LLMs, it offers a plug-in safety layer applicable to any production multi-agent stack including LangGraph, CrewAI, and Google ADK. The Information Bottleneck formalization of inter-agent information flow provides a theoretical handle on why debate-based agent systems can amplify errors, which connects to broader questions in agentic AI about emergent failure modes in networked reasoning systems. The work complements trust and verification research for autonomous agents by proposing a structural, communication-level audit rather than relying solely on output-space consistency checks.