cy0307/awesome-graph-engineering huggingface dataset:
Secure Low-Latency Interactive Messaging (SLIM) (Docs, IETF Datatracker; individual Internet-Draft, 2026)
Authors: Luca Muscariello; Michele Papalini; Mauro Sardara; Sam Betts
Proposes a transport layer for A2A and MCP using gRPC over HTTP/2 and HTTP/3 with stream multiplexing, flow control, group communication, native RPC semantics, and MLS end-to-end encryption. It is an individual informational Internet-Draft with no formal IETF standing.
Why it matters: Adds a concrete secure transport substrate for high-volume graph edges that must cross process and organizational boundaries.
Accelerating the Adoption of Software and Artificial Intelligence Agent Identity and Authorization (Docs, NIST NCCoE Initial Public Draft, 2026)
Authors: Harold Booth; William Fisher; Ryan Galluzzo; Joshua Roberts
Outlines considerations and open questions for standards-based identity, authorization, auditing, and non-repudiation when software and AI agents access enterprise systems and take actions. The concept paper remains an initial public draft under review.
Why it matters: Grounds graph roles and permissions in identity practice so delegation does not silently transfer more authority than an edge contract allows.
Google ADK: Artifacts (Docs, Google ADK Documentation, 2026)
Authors: Google
Defines named, automatically versioned binary work products that agents and tools can save, load, list, and exchange within session-scoped or persistent user-scoped namespaces.
Why it matters: Provides explicit, inspectable edge artifacts instead of forcing large or structured outputs through conversational context.
LEGOMem: Modular Procedural Memory for Multi-agent LLM Systems for Workflow Automation (Paper, AAMAS Extended Abstracts, 2026)
Authors: Dongge Han; Camille Couturier; Daniel Madrigal Diaz; Xuchao Zhang; Victor Rühle; Saravan Rajmohan
Decomposes execution trajectories into reusable procedural memories and allocates them to an orchestrator and specialist agents for workflow automation.
Why it matters: Shows how durable experience can improve decomposition and delegation without collapsing every node's memory into one undifferentiated store; the selected artifact is a three-page extended abstract.
When Agents Go Rogue: Activation-Based Detection of Malicious Behaviors in Multi-Agent Systems (Paper, ICML, 2026)
Authors: Haowen Xu et al.
Evaluates activation-space detection and restorative steering of compromised agents across five attack scenarios, multiple models, and synchronous and asynchronous multi-agent interactions.
Why it matters: Tests a topology-agnostic gate for locating and repairing a malicious node when its messages appear superficially benign.
DoVer: Intervention-Driven Auto Debugging for LLM Multi-Agent Systems (Paper, ICLR, 2026)
Authors: Ming Ma et al.
Tests failure hypotheses by editing messages or plans and measuring whether each intervention repairs the outcome or advances execution in branching multi-agent traces.
Why it matters: Turns graph debugging into causal repair experiments instead of relying on plausible but unverified post-hoc explanations.
Microsoft Agent Framework: Durable Extension (Docs, Microsoft Learn, 2026)
Authors: Microsoft
Adds persisted sessions, checkpointed progress, failure recovery, external-event waits, and distributed hosting to agents, multi-agent orchestrations, and graph workflows. The documented packages remain prerelease.
Why it matters: Shows how an agent graph can resume without losing context or repeating completed work after interruption.
Breaking and Fixing Defenses Against Control Flow Hijacking in Multi-Agent Systems (Paper, ICLR, 2026)
Authors: Rishi Dev Jha; Harold Triedman; Justin Wagle; Vitaly Shmatikov
Demonstrates attacks against alignment-check defenses and introduces ControlValve, which generates permitted control-flow graphs and enforces least privilege for each agent invocation.
Why it matters: Makes invocation authority and contextual permissions explicit on every edge instead of trusting a separate checker that can also be hijacked.
BAMAS: Structuring Budget-Aware Multi-Agent Systems (Paper, AAAI, 2026)
Authors: Liming Yang; Junyu Luo; Xuanzhe Liu; Yiling Lou; Zhenpeng Chen
Selects an LLM team with integer programming and then learns its collaboration topology under an explicit budget, reporting comparable performance with cost reductions of up to 86% on three tasks.
Why it matters: Jointly engineers node selection, edge structure, and spend instead of optimizing quality while treating inference cost as an afterthought.
AgentXRay: White-Boxing Agentic Systems via Workflow Reconstruction (Paper, ICML, 2026)
Authors: Ruijie Shi; Houbin Zhang; Yuecheng Han; Yuheng Wang; Jingru Fan; Runde Yang; Yufan Dang; Huatao Li; Dewen Liu; Yuan Cheng; Chen Qian
Reconstructs an editable explicit stand-in workflow for a black-box agentic system from input-output behavior using iterative search and evaluation.
Why it matters: Offers a path to inspect, compare, and modify systems whose load-bearing workflow is hidden behind an API.
SILO-BENCH: A Scalable Environment for Evaluating Distributed Coordination in Multi-Agent LLM Systems (Benchmark, ACL, 2026)
Authors: Yuzhe Zhang et al.
Benchmarks free-form coordination under information silos across 30 exact-answer tasks, three communication protocols, six agent scales, and three models while recording success, tokens, and communication density.
Why it matters: Tests whether more nodes and denser edges overcome distributed information constraints under explicit coordination and cost measures.
Gaia2: Benchmarking LLM Agents on Dynamic and Asynchronous Environments (Benchmark, ICLR, 2026)
Authors: Romain Froger et al.
Evaluates agents in asynchronous simulated environments across execution, search, ambiguity, adaptation, temporal reasoning, noise, and agent-to-agent collaboration, with action-level verifiers and structured traces.
Why it matters: Makes delays, environmental change, peer communication, and externally checked writes first-class work-graph conditions.
TAMAS: Benchmarking Adversarial Risks in Multi-Agent LLM Systems (Benchmark, ACL, 2026)
Authors: Ishan Kavathekar; Hemang Jain; Ameya Rathod; Ponnurangam Kumaraguru; Tanuja Ganu
Provides five scenarios with 300 adversarial instances, six attack types, 211 tools, 100 harmless tasks, and multiple AutoGen and CrewAI interaction configurations, plus an Effective Robustness Score.
Why it matters: Evaluates whether safety controls preserve useful work while attacks exploit the distinctive trust and communication surfaces of a multi-agent graph.
Seeing the Whole Elephant: A Benchmark for Failure Attribution in LLM-based Multi-Agent Systems (Benchmark, ACL, 2026)
Authors: Mengzhuo Chen et al.
Introduces TraceElephant with full execution traces and reproducible environments for attributing failures to responsible agents and decisive steps.
Why it matters: Measures causal diagnosis over nodes, messages, plans, and dependencies instead of evaluating only the final team output.
Creating AI agent solutions for warehouse data access and security (Blog, Engineering at Meta, 2025)
Authors: Can Lin; Uday Ramesh Savagaonkar; Iuliu Rus; Komal Mangtani
Describes collaborating data-user and data-owner agents, specialized subagents, triage, permission negotiation, human oversight, access budgets, analytical risk rules, output guardrails, traces, and daily regression evaluation.
Why it matters: Shows plural bounded agency governed by independent rule-based gates rather than relying on model judgment for security decisions.
How Meta Used AI to Map Tribal Knowledge in Large-Scale Data Pipelines (Blog, Engineering at Meta, 2026)
Authors: Krishna Ganeriwal; Plawan Rath; Ashwini Verma
Reports a staged swarm of more than 50 explorer, analyst, writer, critic, fixer, upgrader, tester, and gap-filling tasks, with repeated review rounds and recurring automated refresh runs.
Why it matters: Provides a concrete fan-out, critique, repair, integration, and recurrence graph with explicit artifacts and quality gates; efficiency figures are company-reported and preliminary.
Solving the Identity Crisis for AI Agents (Blog, Uber Engineering, 2026)
Authors: Matt Mathew; Prasad Borole; Meng Huang; Sergey Burykin; Gaurav Goel; Bayard Walsh
Describes an internal agent mesh with registered identities, SPIRE-backed workload attestation, short-lived audience-scoped tokens for every hop, actor-chain provenance, MCP gateway enforcement, and a standardized A2A client.
Why it matters: Treats identity, delegated authority, and provenance as mandatory edge state across a multi-agent graph; adoption and latency metrics are company-reported.
Dynamic Generation of Multi LLM Agents Communication Topologies with Graph Diffusion Models (Paper, ACL, 2026)
Authors: Eric Hanchen Jiang et al.
Introduces Guided Topology Diffusion, which iteratively synthesizes sparse, task-adaptive communication graphs using a proxy model for objectives such as accuracy, utility, and cost.
Why it matters: Treats topology as a multi-objective, per-task design artifact rather than a static collaboration template.
Topology Matters: Measuring Memory Leakage in Multi-Agent LLMs (Paper, Findings of ACL, 2026)
Authors: Jinbo Liu et al.
Measures private-information leakage across six communication topologies, agent counts, and attacker-target placements, finding higher leakage with denser connectivity, shorter graph distance, and greater target centrality.
Why it matters: Makes privacy a measurable consequence of edge structure and node placement, motivating topology-aware access controls.
Diversity Collapse in Multi-Agent LLM Systems: Structural Coupling and Collective Failure in Open-Ended Idea Generation (Paper, Findings of ACL, 2026)
Authors: Nuo Chen et al.
Studies multi-agent ideation across model, cognition, and system levels, finding diminishing group-size returns, authority effects, and faster premature convergence under dense communication.
Why it matters: Shows that interaction can contract a search space, so graph designs for exploration must preserve independence and meaningful disagreement.
AgentDropout: Dynamic Agent Elimination for Token-Efficient and High-Performance LLM-Based Multi-Agent Collaboration (Paper, ACL, 2025)
Authors: Zhexuan Wang; Yutong Wang; Xuebo Liu; Liang Ding; Miao Zhang; Jie Liu; Min Zhang
Optimizes communication-graph adjacency matrices across collaboration rounds to remove redundant agents and messages, reducing both prompt and completion token consumption in its evaluations.
Why it matters: Makes node participation and edge density explicit cost-quality decisions instead of assuming every role should run on every task.
Collab-Overcooked: Benchmarking and Evaluating Large Language Models as Collaborative Agents (Benchmark, EMNLP, 2025)
Authors: Haochen Sun; Shuwen Zhang; Lujie Niu; Lei Ren; Hao Xu; Hao Fu; Fangkun Zhao; Caixia Yuan; Xiaojie Wang
Provides 30 open-ended cooperative tasks and process-oriented measures for goal interpretation, active collaboration, communication, and continuous adaptation across 13 language models.
Why it matters: Distinguishes reaching an answer from coordinating well, exposing collaboration failures that final-outcome metrics can hide.
Red-Teaming LLM Multi-Agent Systems via Communication Attacks (Paper, Findings of ACL, 2025)
Authors: Pengfei He; Yuping Lin; Shen Dong; Han Xu; Yue Xing; Hui Liu
Introduces an Agent-in-the-Middle attack that intercepts and manipulates inter-agent messages, evaluated across multiple frameworks, communication structures, and applications.
Why it matters: Shows that graph edges can compromise the whole system without altering its nodes, making message integrity and provenance part of the handoff contract.
Multi-agent Architecture Search via Agentic Supernet (Paper, ICML, 2025)
Authors: Guibin Zhang; Luyang Niu; Junfeng Fang; Kun Wang; Lei Bai; Xiang Wang
Represents possible agentic architectures as a probabilistic supernet and samples query-dependent systems with tailored language-model calls, tool calls, and token costs across six benchmarks.
Why it matters: Replaces a one-size-fits-all graph with per-query architecture and resource allocation while keeping the design space explicit.
Unlocking the Power of Multi-Agent LLM for Reasoning: From Lazy Agents to Deliberation (Paper, ICLR, 2026)
Authors: Zhiwei Zhang et al.
Identifies lazy-agent behavior in which one role dominates a nominally collaborative system, then measures causal influence and uses verifiable rewards to encourage deliberation and selective reasoning restarts.
Why it matters: Requires builders to verify that each node contributes causal value rather than allowing a multi-agent graph to collapse into one effective agent.
Cooperation, Competition, and Maliciousness: LLM-Stakeholders Interactive Negotiation (Benchmark, NeurIPS, 2024)
Authors: Sahar Abdelnabi; Amr Gomaa; Sarath Sivaprasad; Lea Schönherr; Mario Fritz
Provides scorable, multi-agent, multi-issue negotiation games with metrics for task performance and role alignment, including cooperative, competitive, greedy, and adversarial participants.
Why it matters: Tests communication and collective decisions when graph nodes hold conflicting objectives or attempt manipulation rather than cooperating by default.
OWASP Top 10 for Agentic Applications for 2026 (Standard, OWASP GenAI Security Project, 2025)
Authors: OWASP GenAI Security Project; Agentic Security Initiative
Provides a globally peer-reviewed operational framework for critical risks in autonomous and agentic applications, developed with contributions from more than 100 security experts, researchers, and practitioners.
Why it matters: Supplies a practical threat checklist for node authority, tool permissions, memory provenance, inter-agent trust, and cascading failures across an agent graph.
AMAS: Adaptively Determining Communication Topology for LLM-based Multi-agent System (Paper, EMNLP Industry Track, 2025)
Authors: Hui Yi Leong; Yuheng Li; Yuqing Wu; Wenwen Ouyang; Wei Zhu; Jiechao Gao; Wei Han
Introduces a dynamic graph selector that uses lightweight LLM adaptation to choose task-specific communication structures and route each query through a matching agent pathway.
Why it matters: Operationalizes topology as an input-conditioned decision rather than a fixed template; evidence is currently concentrated in question answering, mathematics, and code generation.
MasRouter: Learning to Route LLMs for Multi-Agent Systems (Paper, ACL, 2025)
Authors: Yanwei Yue; Guibin Zhang; Boyang Liu; Guancheng Wan; Kun Wang; Dawei Cheng; Yiyan Qi
Defines multi-agent system routing as a joint decision over collaboration mode, role allocation, and language-model selection, implemented with a cascaded controller that progressively constructs a task-specific system.
Why it matters: Makes node roles, model assignment, and whether collaboration is needed explicit routing decisions with measurable cost-quality trade-offs.
MOC: Multi-Order Communication in LLM-based Multi-Agent Systems (Paper, ICML, 2026)
Authors: Yao Guan; Lin Wang; Zhihui Lu; Ziyi Wang; Wenzhu Yan; Qiang Duan
Constructs structured multi-order evidence streams so agents can receive relevant information from multiple upstream hops, then applies semantic-topological merging under token constraints.
Why it matters: Shows that graph engineering includes what evidence survives across paths, not only which nodes and edges exist; it improves communication over a supplied topology rather than selecting that topology.
HieraMAS: Optimizing Intra-Node LLM Mixtures and Inter-Node Topology for Multi-Agent Systems (Paper, ICML, 2026)
Authors: Tianjun Yao; Zhaoyi Li; Zhiqiang Shen
Models each functional role as a supernode containing heterogeneous language models in a propose-synthesis structure, then uses multi-level reward attribution and graph classification to select the inter-supernode topology.
Why it matters: Jointly engineers node composition, role capability, credit assignment, and communication edges instead of optimizing each dimension independently.
Learning to Share: Selective Memory for Efficient Parallel Agentic Systems (Paper, ICML, 2026)
Authors: Joseph Fioresi; Parth Parag Kulkarni; Ashmal Vayani; Song Wang; Mubarak Shah
Adds a global memory bank to parallel agent teams and trains an admission controller with stepwise reinforcement learning and usage-aware credit assignment to retain reusable intermediate work.
Why it matters: Treats cross-team memory writes as governed graph operations that can reduce duplicate work while limiting indiscriminate context growth.
Accelerating Language Model Workflows with Prompt Choreography (Paper, TACL, 2026)
Authors: TJ Bai; Jason Eisner
Executes multi-agent workflows with a dynamic global key-value cache in which each call can attend to a reordered subset of previously encoded messages, including parallel branches.
Why it matters: Makes workflow dependencies and reusable message state explicit execution concerns; its primary result concerns speed, and cache reuse can alter model behavior.
Can LLMs Help You at Work? A Sandbox for Evaluating LLM Agents in Enterprise Environments (Benchmark, EMNLP, 2025)
Authors: Harsh Vishwakarma; Ankush Agarwal; Ojas Patil; Chaitanya Devaguptapu; Mahesh Chandran
Introduces EnterpriseBench with 500 tasks across software engineering, HR, finance, and administration, including fragmented data, access-control hierarchies, and cross-functional workflows.
Why it matters: Tests work graphs that retrieve, modify, and transfer artifacts across services while respecting authority boundaries; the organization and services are simulated.
ToolSandbox: A Stateful, Conversational, Interactive Evaluation Benchmark for LLM Tool Use Capabilities (Benchmark, Findings of NAACL, 2025)
Authors: Jiarui Lu; Thomas Holleis; Yizhe Zhang; Bernhard Aumayer; Feng Nan; Haoping Bai; Shuang Ma; Shen Ma; Mengyu Li; Guoli Yin; Zirui Wang; Ruoming Pang
Evaluates stateful tool execution, implicit dependencies between tools, on-policy user interaction, and intermediate and final milestones over arbitrary trajectories.
Why it matters: Transfers milestone and state-transition testing to graph prerequisites, although the evaluated system is an agent-user-tool loop rather than an agent-agent topology.
AgentBoard: An Analytical Evaluation Board of Multi-turn LLM Agents (Benchmark, NeurIPS Datasets & Benchmarks, 2024)
Authors: Chang Ma; Junlei Zhang; Zhihao Zhu; Cheng Yang; Yujiu Yang; Yaohui Jin; Zhenzhong Lan; Lingpeng Kong; Junxian He
Unifies partially observable, multi-round agent environments and adds a fine-grained progress-rate metric plus interactive trajectory analysis beyond final success.
Why it matters: Supplies milestone-level evaluation that can localize incomplete work, while its primarily single-agent tasks do not identify the responsible graph component by themselves.
Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agents (Benchmark, ICLR, 2025)
Authors: Hanrong Zhang; Jingyuan Huang; Kai Mei; Yifei Yao; Zhenting Wang; Chenlu Zhan; Hongwei Wang; Yongfeng Zhang
Benchmarks prompt injection, memory poisoning, backdoors, mixed attacks, and defenses across 10 scenarios, more than 400 tools, 13 model backbones, and seven metrics.
Why it matters: Maps security failures to prompts, plans, tools, and memory surfaces that graph designs must isolate separately; inter-agent trust propagation is outside its main evaluation target.
AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents (Benchmark, NeurIPS Datasets & Benchmarks, 2024)
Authors: Edoardo Debenedetti; Jie Zhang; Mislav Balunovic; Luca Beurer-Kellner; Marc Fischer; Florian Tramèr
Provides an extensible adversarial environment with 97 realistic tasks and 629 security test cases for agents executing tools over untrusted data.
Why it matters: Tests the instruction-data boundary that every external-input and artifact edge must preserve; compromised peer-agent messages require separate evaluation.
AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agents (Benchmark, ICLR, 2025)
Authors: Maksym Andriushchenko; Alexandra Souly; Mateusz Dziemian; Derek Duenas; Maxwell Lin; Justin Wang; Dan Hendrycks; Andy Zou; J. Zico Kolter; Matt Fredrikson; Yarin Gal; Xander Davies
Evaluates refusal and retained task capability on 110 explicitly malicious multi-stage agent tasks with 440 augmented variants across 11 harm categories.
Why it matters: Tests whether safety gates reject prohibited work and stop a compromised node from completing a harmful path; the score is not a general measure of agent-system safety.
IPIGuard: A Novel Tool Dependency Graph-Based Defense Against Indirect Prompt Injection in LLM Agents (Paper, EMNLP, 2025)
Authors: Hengyu An; Jinghuai Zhang; Tianyu Du; Chunyi Zhou; Qingming Li; Tao Lin; Shouling Ji
Models task execution as traversal over a planned Tool Dependency Graph and separates action planning from interaction with untrusted external data.
Why it matters: Shows how structural constraints on allowed tool edges can block unauthorized actions instead of relying only on prompts or classifiers.
Identity Management for Agentic AI: The new frontier of authorization, authentication, and security for an AI agent world (Docs, OpenID Foundation, 2025)
Authors: OpenID Foundation Artificial Intelligence Identity Management Community Group
Maps identity, authentication, delegated authority, consent, governance, and accountability gaps for autonomous agents against OAuth and OpenID Connect foundations.
Why it matters: Provides a standards-grounded vocabulary for identity-bearing nodes and auditable delegation across agent and tool edges; it is a non-normative landscape whitepaper, not a protocol.
Open Agentic Schema Framework (OASF) v1.1.0 (Standard, AGNTCY Project, Linux Foundation, 2026)
Authors: AGNTCY Project
Defines versioned schemas and taxonomies for agent identity metadata, capabilities, skills, modules, interactions, and discovery records, including MCP and A2A alignment modules.
Why it matters: Gives graph builders a portable node descriptor for capability-based discovery and routing validation; it describes capabilities but does not execute a graph or authorize an edge.
PROV-DM: The PROV Data Model (Standard, W3C Recommendation, 2013)
Authors: Luc Moreau; Paolo Missier
Defines entities, activities, agents, derivation, attribution, responsibility, bundles, and collections for interoperable provenance records.
Why it matters: Maps artifacts, execution steps, and responsible nodes into a portable lineage model; storage, access control, and cryptographic integrity remain implementation concerns.
in-toto: Providing farm-to-table guarantees for bits and bytes (Paper, USENIX Security, 2019)
Authors: Santiago Torres-Arias; Hammad Afzali; Trishank Karthik Kuppusamy; Reza Curtmola; Justin Cappos
Introduces signed material and product links for supply-chain steps and verifies them against an expected layout, supported by analysis of 30 historical compromises and deployed integrations.
Why it matters: Supplies a transferable receipt pattern that binds each artifact transformation to an authorized step and identity; it verifies process integrity, not semantic correctness.
Serverless Workflow Specification v1.0.0 (Standard, Open Workflow Specification, Cloud Native Computing Foundation, 2025)
Authors: Open Workflow Specification Project
Defines a vendor-neutral workflow language with sequential and concurrent tasks, event correlation, service calls, error handling, retries, and timeouts.
Why it matters: Provides an inspectable execution contract for production work graphs; conformance does not itself supply a durable runtime, an agent protocol, or model-level correctness.
Are More LLM Calls All You Need? Towards the Scaling Properties of Compound AI Systems (Paper, NeurIPS, 2024)
Authors: Lingjiao Chen; Jared Davis; Boris Hanin; Peter Bailis; Ion Stoica; Matei Zaharia; James Zou
Analyzes Vote and Filter-Vote compound systems and finds that performance can rise and then fall as the number of language-model calls increases because query difficulty is heterogeneous.
Why it matters: Bounds claims that adding calls, voters, or nodes automatically improves a system; the experiments cover simple aggregation systems rather than rich agent organizations.