Researchers propose OpenEvoShield, a co-evolutionary continual defense framework for LLM-based multi-agent systems

LLM-based multi-agent systems (LLM-MAS) are vulnerable to adversarial attacks where malicious instructions are injected through inter-agent communication, enabling the propagation of harmful behaviors. Unlike static threats, these attacks are doubly dynamic: adversaries continuously refine their injection strategies in response to deployed defenses, while normal-agent behavior drifts as the system expands or evolves.

Existing defenses typically treat deployment as a closed-world problem, assuming that training coverage will remain sufficient. However, these approaches degrade rapidly when distribution shifts—either in attack patterns or normal behavior—exceed the coverage of the training data.

To address this, researchers propose OpenEvoShield, a co-evolutionary continual defense framework for LLM-MAS. The framework consists of four components: an asymmetric rate controller (M1) that decouples fast attack-side learning rates from slow normal-side learning rates using dual drift signals; a normal-boundary updater (M2) that maintains a dynamic behavioral boundary at the slow rate; an EWC-regularized policy ensemble (M3) that fast-adapts to new attacks without catastrophic forgetting; and an energy-based multi-granularity detector (M4) that fuses node-, subgraph-, and graph-level evidence to classify novel attacks as out-of-distribution.

The framework was evaluated over 100 deployment rounds across five benchmarks and four multi-agent system topologies. Results show that OpenEvoShield outperforms both static and continual baselines, detecting most previously unseen attacks while maintaining low false positive rates. The authors emphasize that this approach is designed to handle the non-stationary, open-world conditions where LLM-MAS operate, addressing a key limitation of prior defenses.