AuthorsJunyuan Mao, Fanci Meng, Yifan Duan et al.
TL;DR
AgentSafe uses hierarchical ThreatSieve and HierarCache defenses to cut multi-agent attack success, reaching 80.67–96.88% defense rates versus 26.88–50.32% baselines.
Read our summary here, or open the publisher PDF on the next tab.
THE PROBLEM
LLM-based multi-agent systems lack hierarchical control, leading to unauthorized access and data breaches under topology and memory attacks, with defense rates as low as 26.88%.
When multi-round attacks target agent memory and topology, systems without AgentSafe see CSR fall below 0.4, causing privacy leakage, misinformation, and degraded collaboration quality.
HOW IT WORKS
AgentSafe combines ThreatSieve for permission control and message legitimacy with HierarCache for hierarchical storage, junk memory, and periodic detection in LLM-based multi-agent systems.
You can think of AgentSafe like a secure office: ThreatSieve is the badge-checking guard at every door, and HierarCache is a filing system with locked cabinets and a shred bin for junk.
This design lets AgentSafe enforce security levels, authenticate identities, and quarantine suspicious content, enabling controlled information flow far beyond a flat context window.
DIAGRAM
This diagram shows how AgentSafe routes a message between two agents through ThreatSieve checks into HierarCache security levels or junk memory.
DIAGRAM
This diagram shows how AgentSafe is evaluated under topology-based and memory-based attacks on RIOH and WCEI with multiple LLM APIs.
PROCESS
Hierarchical Information Flow
AgentSafe assigns security levels to information and agents, enforcing I ∈ Fi implies ℓ(v) ≥ i so only authorized agents participate in the session.
ThreatSieve Permission Control
ThreatSieve computes A(vi, vj, t) using permission levels ℓ(v) and information level L(Ii,j), blocking communications that violate the hierarchy.
ThreatSieve Message Legitimacy Evaluation
ThreatSieve extracts identities via E(I, fieldm) and θ = l(I, P, C), then applies Iv(vi, vj) using M(IDi, ϑk, P′, C) to prevent impersonation.
HierarCache Storage and Junk Handling
HierarCache applies U(vi, vj, m, ℓ) with D(m) over instruction library C, storing valid messages in Mℓ and routing suspicious ones to Mjunk with periodic reflection R(vj, t).
KEY CONTRIBUTIONS
First Security Level Based MAS
AgentSafe introduces hierarchical information management with security levels ℓ(v) and Fi, enabling system layering and isolation in LLM-based multi-agent systems.
HierarCache Design
AgentSafe's HierarCache organizes memory into security levels Mℓ plus junk memory Mjunk, using D(m) and periodic reflection R(vj, t) to defend against memory poisoning and flooding.
Experimental Validation
AgentSafe is evaluated on RIOH and WCEI under topology-based and memory-based attacks, achieving up to 96.88% defense rate and maintaining CSR between 0.68 and 0.85 as system complexity grows.
RESULTS
Defense Rate IABT RIOH turn 5
80.67%
+46.43 over w o AgentSafe
Defense Rate AM RIOH turn 5
85.93%
+35.61 over w o AgentSafe
Defense Rate II RIOH turn 5
96.88%
+70.00 over w o AgentSafe
Defense Rate IM RIOH turn 5
77.48%
+46.57 over w o AgentSafe
On the RIOH dataset, which encodes privacy information and interpersonal relationships, these defense rates show AgentSafe drastically reduces successful topology-based and memory-based attacks compared to the non-AgentSafe baseline, especially for memory interference where the gap reaches 70.00 percentage points.
BENCHMARK
On the RIOH dataset, which encodes privacy information and interpersonal relationships, these defense rates show AgentSafe drastically reduces successful topology-based and memory-based attacks compared to the non-AgentSafe baseline, especially for memory interference where the gap reaches 70.00 percentage points.
BENCHMARK
Defense Rate at turn 5 on RIOH under different attack methods.
KEY INSIGHT
AgentSafe reduces token consumption by about 60% under topology-based attacks and 75% under memory-based attacks while still increasing defense rates.
This is surprising because stronger defenses are often assumed to add overhead, yet AgentSafe's junk memory and filtering make the system both safer and more efficient.
WHY IT MATTERS
AgentSafe enables multi-agent systems to enforce fine-grained security levels, authenticate identities, and quarantine malicious memory content over long multi-round interactions.
Builders can now deploy LLM-based multi-agent systems in privacy-sensitive domains, like corporate environments modeled by WCEI, without accepting uncontrolled information leakage as a given.
Peilin Feng, Suorong Yang, Soujanya Poria
arXiv 2026 · 2026
Σ-Mem maintains historical competence evidence matrices M_p, a peer relationship matrix G, a memory readout r_{p,t}, and residual steering δ_{p,t} to guide multi-agent trust decisions. On the mixed counterfactual benchmark, Σ-Mem raises Qwen3-0.6B accuracy at CF@90 from 46.22% with the base model to 71.10% with Σ w/ G.
Nikhil Verma
· 2026
Focus Agent adds start_focus, complete_focus, a persistent Knowledge block, and an optimized Persistent Bash plus String-Replace Editor scaffold to actively compress context during long software-engineering tasks. On five hard SWE-bench Lite instances against a Baseline ReAct agent, Focus Agent achieves 22.7% token reduction (14.9M → 11.5M) while matching 3/5 = 60% task success.
Xiaohui Zhang, Zequn Sun et al.
· 2026
ActMem transforms dialogue history into atomic facts via Memory Fact Extraction, groups them with Fact Clustering, links them through a Memory KG Construction module, and uses Counterfactual-based Retrieval and Reasoning for action-aware answers. On ActMemEval, ActMem reaches 76.52% QA accuracy with DeepSeek-V3, beating LightMem’s 63.97% by 12.55 points and NaiveRAG’s 61.54%.
Answers use this explainer on Memory Papers.
Checking…