MASTER : Multi-Agent Security Through Exploration of Roles and Topological Structures - A Comprehensive Framework (2025)

Abstract: Large Language Models (LLMs)-based Multi-Agent Systems (MAS) exhibit remarkable problem-solving and task planning capabilities across diverse domains due to their specialized agentic roles and collaborative interactions. However, this also amplifies the severity of security risks under MAS attacks. To address this, we introduce \textbf{MASTER} , a novel security research framework for MAS, focusing on diverse \textbf{R} ole configurations and \textbf{T} opological structures across various scenarios. MASTER offers an automated construction process for different MAS setups and an information-flow-based interaction paradigm. To tackle MAS security challenges in varied scenarios, we design a scenario-adaptive, extensible attack strategy utilizing role and topological information, which dynamically allocates targeted, domain-specific attack tasks for collaborative agent execution. Our experiments demonstrate that such an attack, leveraging role and topological information, exhibits significant destructive potential across most models. Additionally, we propose corresponding defense strategies, substantially enhancing MAS resilience across diverse scenarios. We anticipate that our framework and findings will provide valuable insights for future research into MAS security challenges.

## introduction recent advancements in large language model (llm) technology have positioned llm-based agents @xcite as a focal point in ai research. these agents @xcite @xcite demonstrate human-like reasoning abilities and can autonomously tackle complex, diverse tasks. by combining multiple specialized agents into multi-agent systems (mas), researchers have achieved enhanced problem-solving and task planning capabilities for sophisticated studies have demonstrated the feasibility of in-ducing "jailbreak" behaviors in llms through prompt-based attacks @xcite @xcite . due to their open-ended natural language capabilities and complex reasoning mechanisms, llm-based agents present unique security challenges. compared to single-agent systems, multi-agent architectures face heightened security risks due to role heterogeneity and frequent interagent collaboration. the diversity in agent roles and permissions increases the attack surface @xcite , while vulnerabilities in a single agent can propagate rapidly across the network @xcite , leading to systemic compromise. moreover, in adversarial settings, agents may collaborate, based on their roles and topology, to execute harmful tasks more effectively and express malicious content more comprehensively. these risks highlight the urgent need for security frameworks tailored to multi-agent systems, accounting for role configuration, topology structures, and cooperative behaviors under adversarial influence. existing research on the security of multi-agent systems is primarily grounded in areas such as the psychological safety @xcite of agents, the security of communication @xcite and memory storage @xcite within the system, and the robustness of the mas's topological structure @xcite , among others. in this work, we focus on two fundamental distinctions between single-agent and multi-agent systems: building on prior insights, we introduce mas-ter, the first comprehensive framework for security research in multi-agent systems focusing on diverse role configurations and topological structures. master features a stream-based information interaction mechanism adaptable to varied mas scenarios with heterogeneous roles and complex topologies. we also develop an automated pipeline for constructing structurally diverse mas instances efficiently. unlike existing mas security research, which often applies single-agent attack methods without considering system-wide topology or scenario context @xcite , or targets communication and memory modules while overlooking role heterogeneity @xcite , master proposes a scenario-adaptive, extensible attack strategy utilizing role and topological information. this strategy includes three key stages: (1) collecting system information to build a detailed scenario profile reflecting role and topology; (2) injecting targeted adversarial traits using predefined attack strategies; and (3) activating and enhancing agents based on designated roles and collaborative network relationships. additionally, master incorporates tailored defense mechanisms, including prompt leakage detection for identifying potential prompt leakage, hierarchical monitoring based on agent criticality levels, and scenario-aware preemptive defenses to anticipate vulnerabilities, enabling comprehensive security research for complex, roledifferentiated, and topologically diverse mas. our experiments demonstrate that most models are highly vulnerable to role-and topologybased attack strategies in mas. role and topological information significantly enhances adversarial role consistency, team cooperation, and attack success rate (asr), amplifying attack severity. our proposed defense strategies effectively mitigate these attacks, reducing asr below 20% with high efficiency. as attack propagation increases, asr rises, but inter-agent cooperation slightly declines. model sensitivity to topologies varies, with the chain topology yielding the lowest asr. among domains, data management mas exhibits the highest attack risks, while education mas shows greater resilience. these insights will guide the development of safer, more robust mas. our contribution can be summarized as follows: ## experiment to thoroughly investigate security issues in mas concerning roles and topological structures, we de-1 same in the following tables. ## conclusion in this work, we introduce master, the first comprehensive framework for mas security research addressing diverse scenarios composed of varying roles and topological structures. our experiments reveal specific vulnerabilities in mas under diverse scenarios composed of varying roles and topological structures, with the use of role and topological information amplifying the severity of attack outcomes and exposing significant safety risks. generalized security research for diverse mas is urgently needed, and the master framework paves the way for future studies to enhance the generalized safety of mas across varied scenarios.