ai-research-survey

scan.json (26000B)

---

 {
   "paper": {
     "title": "MAD-SPEAR: A Conformity-Driven Prompt Injection Attack on Multi-Agent Debate Systems",
     "authors": ["Yu Cui", "Hongyang Du"],
     "year": 2025,
     "venue": "arXiv",
     "arxiv_id": "2507.13038"
   },
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": false,
         "justification": "No repository URL, GitHub link, or code archive is provided anywhere in the paper. The paper references the SoM framework and external APIs but does not release its own attack code or experimental scripts."
       },
       "data_released": {
         "applies": true,
         "answer": true,
         "justification": "The paper uses publicly available datasets: GSM-Ranges (Shrestha, Kim, and Ross 2025) and Logical Fallacies from MMLU (Hendrycks et al. 2021). These are standard public benchmarks that were not modified."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "No requirements.txt, Dockerfile, conda environment, or detailed library versions are provided. The paper mentions using specific model APIs (DeepSeek, moonshot, Qwen) and the DeepSeek tokenizer for token counting, but does not specify a reproducible environment."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "No step-by-step reproduction instructions, README, or scripts are provided. Algorithm 1 describes the attack process at a high level but the paper does not provide enough implementation detail (e.g., exact prompt injection templates, SoM modification code) for independent reproduction."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "Results are reported as point estimates (e.g., '56.66% ASR', '100% to 26.67% accuracy') with no confidence intervals, error bars, or uncertainty quantification on any figures or tables."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "The paper makes comparative claims (e.g., MAD-SPEAR achieves '8x improvement in attack success rate' over baseline) but provides no statistical significance tests such as p-values or hypothesis tests."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "The paper reports effect sizes in context: 'accuracy on Level 4 drops sharply from 100% to 26.67%', 'accuracy drops from 86.67% to 46.67%', 'over an 8x improvement in attack success rate', 'more than a 3x degradation in scalability'. Baselines and attacked conditions are provided for context."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not justify the sample sizes used. It is unclear how many problems from each GSM-Ranges level or the Logical Fallacies dataset were used. The paper states results in percentages (e.g., 86.67%, 46.67%) suggesting small sample sizes (likely 15 problems given the granularity), but this is never justified or discussed."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "No standard deviations, variance, or spread measures are reported across experimental runs. Results appear to be single-run numbers with no indication of multiple runs or result stability."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "The paper includes baselines: (1) MAD under no attack conditions, and (2) the infinite loop attack from Zhang et al. (2024a), identified as the stronger of two existing attack methods. Table 1 compares No Attack, Baseline, and MAD-SPEAR."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "The baseline attack (infinite loop from Zhang et al. 2024a) is from 2024, which is recent and relevant. The paper acknowledges it as the state-of-the-art attack method for multi-agent systems."
       },
       "ablation_study": {
         "applies": true,
         "answer": true,
         "justification": "The paper investigates several component variations: (1) reducing the proportion of compromised agents from 1/4 to 1/6 (Figure 4), (2) comparing heterogeneous vs. homogeneous MAD (Table 2), (3) varying debate rounds (3 vs 4), and (4) the composite attack combining prompt injection with communication attack."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "Three evaluation metrics are used: accuracy (attack success rate), scalability (token consumption), and consensus speed (number of rounds to reach consensus). These are defined in the Evaluation Approach section."
       },
       "human_evaluation": {
         "applies": false,
         "answer": false,
         "justification": "This is a benchmark evaluation of automated attack methods on multi-agent debate systems. Human evaluation of system outputs is not relevant to the claims being made about attack effectiveness."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not discuss any separation between development and test data. It is unclear whether hyperparameters of the attack (e.g., number of Sybil agents L, prompt template design) were tuned on the same data used for final evaluation."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Results are broken down by dataset difficulty level (Level 3-6 in GSM-Ranges) in Figure 5 and Figure 3, plus a separate evaluation on the Logical Fallacies dataset. Per-agent token consumption is shown in Figure 6."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": true,
         "justification": "The appendix (Figure 7) provides detailed analysis of how the attack affects reasoning processes of non-compromised agents, showing the contradiction and self-doubt stages. The paper also notes that reasoning LLMs show 'relatively stronger resistance' to the attack compared to traditional LLMs."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "The paper reports that reasoning LLMs demonstrate 'a higher level of confidence' and 'relatively stronger resistance against our prompt injection attack' compared to traditional LLMs. It also reports that the attack on homogeneous MAD (Qwen1.5-32B) only caused a drop from 94% to 78%, a smaller effect than on heterogeneous MAD."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "The abstract claims that MAD-SPEAR 'consistently outperforms the baseline attack in degrading system performance' (supported by Table 1 and Figure 5), that it works with 'five benchmark datasets with varying difficulty levels' (supported by Level 3-6 GSM-Ranges + Logical Fallacies), and that 'agent diversity substantially improves MAD performance' (supported by Table 2)."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": true,
         "justification": "The paper's main causal claims are that the prompt injection attack causes degradation in MAD performance. The experimental design (controlled comparison of MAD with and without attack, using the same datasets and settings) is adequate for this type of causal claim. The ablation of attack components (varying compromised agent ratio, composite attack) provides controlled single-variable manipulation."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": false,
         "justification": "The title and abstract speak broadly of 'Multi-Agent Debate Systems', but experiments are conducted only on the SoM framework with a maximum of 6 agents, using only mathematical reasoning (GSM-Ranges) and one multiple-choice task (MMLU Logical Fallacies). The generalizability section argues adaptation to Sparse MAD is easy but provides no experiments. The claim of 'broad applicability' is not well-bounded."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not substantively discuss alternative explanations for its results. For example, the dramatic accuracy drops could be partly due to the specific models used, the small sample sizes, or the particular task types. The limitations section mentions budget constraints and scale limits but does not discuss confounding factors for the observed results."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": true,
         "justification": "The paper specifies 'DeepSeek-R1-0528' (with a footnote linking to the API docs for this specific version), 'moonshot-v1-32k' (with API link), and 'Qwen1.5-32B-Chat' (with HuggingFace link). The version identifiers include specific version numbers or snapshot dates."
       },
       "prompts_provided": {
         "applies": true,
         "answer": true,
         "justification": "The full injected prompt template is provided in the appendix under 'Injected Data' and 'Injected Data (continued)', spanning approximately two pages with the complete text of the attack prompt including the example, instructions, and output template."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not report temperature, top-p, max tokens, or other sampling parameters for any of the LLM API calls. The number of Sybil agents L=2 is stated, debate rounds delta_R=3 or 4, and N=4 or 6 agents, but LLM inference hyperparameters are missing."
       },
       "scaffolding_described": {
         "applies": true,
         "answer": true,
         "justification": "The MAD scaffolding is described: the paper uses the SoM framework (Du et al. 2024), modified to support heterogeneous MAD. The debate process (multi-round agent interaction, consensus mechanism), attack injection process (Algorithm 1), and message passing between agents are detailed."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": false,
         "justification": "The paper states it 'specifically select subsets of the dataset featuring level 3 to 6 perturbations' from GSM-Ranges and selects the 'Logical Fallacies dataset from MMLU', but does not specify how many problems were selected, what the selection criteria were, or how subsets were drawn from these benchmarks."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": true,
         "justification": "The appendix contains a 'Limitations and Ethical Considerations' section that discusses budget constraints, the maximum of six agents, and acknowledges that 'investigating the behavior of larger-scale MAD systems under attack remains an important direction for future research.'"
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": true,
         "justification": "The limitations section mentions a specific threat: 'Due to budget constraints, the MAD system implemented in our experiments includes up to six agents.' This is a concrete limitation specific to this study, though the discussion could be more extensive."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not explicitly state what the results do NOT show. It does not bound its claims to specific model families, task types, or MAD frameworks tested. The limitation about scale (up to 6 agents) is mentioned but no explicit statements about what settings or populations are excluded from the claims."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": false,
         "justification": "No raw experimental data (individual problem results, model outputs, conversation logs) is made available. Only aggregated results in figures and tables are shown."
       },
       "data_collection_described": {
         "applies": true,
         "answer": false,
         "justification": "The paper describes which datasets were used (GSM-Ranges Level 3-6, MMLU Logical Fallacies) and which models (DeepSeek-R1-0528, moonshot-v1-32k, Qwen1.5-32B-Chat) but does not specify how many problems were sampled from each dataset, the exact selection process, or the time period of experiments."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study. Data sources are standard public benchmarks."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": false,
         "justification": "The pipeline from dataset selection to final results is not documented in detail. How problems were selected from each dataset, how the SoM framework was configured, and the complete flow from data input to reported metrics lacks step-by-step documentation."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": false,
         "justification": "No funding source is disclosed anywhere in the paper. There is no acknowledgments section listing grants or sponsors."
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Author affiliations are clearly listed: both authors are from the Department of Electrical and Electronic Engineering, The University of Hong Kong. Yu Cui's work was done during an internship at HKU."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": false,
         "justification": "No funding is disclosed, so independence cannot be assessed. The paper uses DeepSeek and moonshot APIs but does not disclose whether API access was granted/sponsored by these companies."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests statement or financial interest declaration is present in the paper."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": true,
         "answer": false,
         "justification": "The paper evaluates DeepSeek-R1-0528, moonshot-v1-32k, and Qwen1.5-32B-Chat on GSM-Ranges and MMLU benchmarks but does not state the training data cutoff dates for any of these models."
       },
       "train_test_overlap_discussed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of potential train/test overlap. MMLU (Hendrycks et al. 2021) has been publicly available since 2021 and could easily be in the training data of models released in 2024-2025. GSM-Ranges is derived from GSM8K which is also widely known. Neither overlap is discussed."
       },
       "benchmark_contamination_addressed": {
         "applies": true,
         "answer": false,
         "justification": "MMLU was published in 2021 and GSM-based benchmarks have been publicly available for years. All three models used were trained well after these benchmarks were published. No contamination analysis or discussion is provided."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": true,
         "justification": "Token consumption is explicitly measured and reported as a key metric. Figure 3 shows output token consumption across datasets, and Table 1 reports average token consumption (e.g., 26947 for no attack vs. 85101.5 under MAD-SPEAR). This serves as a proxy for API cost."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "No total computational budget is stated. The paper does not report total API spend, number of API calls, wall-clock time for experiments, or hardware used."
       }
     }
   },
   "claims": [
     {
       "claim": "MAD-SPEAR achieves an average attack success rate of 56.66%, over 8x higher than the baseline infinite loop attack (6.67%).",
       "evidence": "Table 1 compares MAD-SPEAR with the baseline attack on Dataset Level 3-4, showing 56.66% vs 6.67% ASR.",
       "supported": "moderate"
     },
     {
       "claim": "MAD-SPEAR causes more than 3x degradation in scalability (token consumption) compared to baseline conditions.",
       "evidence": "Table 1 shows average token consumption of 85101.50 under MAD-SPEAR vs 26947.00 under no attack and 26959.00 under baseline. Figure 3 shows per-level token consumption comparisons.",
       "supported": "moderate"
     },
     {
       "claim": "The attack's effectiveness does not diminish when the proportion of compromised agents decreases from 1/4 to 1/6.",
       "evidence": "Figure 4 shows results with N=6 (1/6 compromised), where the attack maintains substantial disruptive impact on accuracy.",
       "supported": "weak"
     },
     {
       "claim": "Agent diversity (heterogeneous MAD) significantly improves mathematical reasoning performance, with a ~56% accuracy improvement over homogeneous MAD.",
       "evidence": "Table 2 shows heterogeneous MAD achieves 93.33% average accuracy vs 60.00% for homogeneous MAD under normal conditions.",
       "supported": "moderate"
     },
     {
       "claim": "The attack becomes increasingly effective as the number of debate rounds increases, pushing the system from finite MAD toward infinite MAD.",
       "evidence": "Figure 4 compares results with delta_R=3 vs delta_R=4, showing lower probability of correct convergence with more rounds under attack.",
       "supported": "moderate"
     }
   ],
   "methodology_tags": ["benchmark-eval"],
   "key_findings": "MAD-SPEAR is a prompt injection attack on multi-agent debate systems that exploits LLM conformity by creating Sybil agents through a single compromised agent. The attack achieves 56.66% average attack success rate, over 8x higher than the baseline infinite loop attack, while causing 3x higher token consumption. Even compromising only 1/6 of agents maintains attack effectiveness. The paper also finds that agent diversity (heterogeneous models) substantially improves MAD mathematical reasoning performance (~56% accuracy gain over homogeneous MAD), contradicting prior work.",
   "red_flags": [
     {
       "flag": "Very small sample sizes",
       "detail": "Results reported in percentages like 86.67%, 46.67%, 26.67% suggest samples of approximately 15 problems per dataset level. Such small samples make individual results highly variable, yet no uncertainty quantification is provided."
     },
     {
       "flag": "No statistical uncertainty quantification",
       "detail": "All results are point estimates with no confidence intervals, error bars, standard deviations, or multiple-run analysis. Given the small apparent sample sizes, the results could easily shift with different random samples."
     },
     {
       "flag": "Single framework evaluation",
       "detail": "All experiments use only the SoM framework. The generalizability claim to other MAD frameworks (e.g., Sparse MAD) is argued theoretically but never tested experimentally."
     },
     {
       "flag": "Fixed attack target",
       "detail": "The paper states 'we consistently designate the first of the four agents as the target of the attack.' This means no randomization of which agent is attacked, potentially confounding results with agent-position effects."
     },
     {
       "flag": "Contamination risk unaddressed",
       "detail": "The evaluation uses MMLU (published 2021) and GSM-derived benchmarks with models from 2024-2025 that almost certainly saw these benchmarks during training. The baseline 'no attack' accuracy could be inflated by memorization, making the attack's impact appear larger."
     }
   ],
   "cited_papers": [
     {
       "title": "Breaking agents: Compromising autonomous llm agents through malfunction amplification",
       "authors": ["B. Zhang", "Y. Tan", "Y. Shen", "A. Salem", "M. Backes", "S. Zannettou", "Y. Zhang"],
       "year": 2024,
       "relevance": "Proposes prompt injection attacks (infinite loop, incorrect function execution) against LLM agents, used as the baseline comparison in this paper."
     },
     {
       "title": "Red-teaming llm multi-agent systems via communication attacks",
       "authors": ["P. He", "Y. Lin", "S. Dong", "H. Xu", "Y. Xing", "H. Liu"],
       "year": 2025,
       "relevance": "Proposes communication attacks on multi-agent systems that are combined with MAD-SPEAR for the composite attack strategy."
     },
     {
       "title": "Amplified Vulnerabilities: Structured Jailbreak Attacks on LLM-based Multi-Agent Debate",
       "authors": ["S. Qi", "Y. Zou", "P. Li", "Z. Lin", "X. Cheng", "D. Yu"],
       "year": 2025,
       "relevance": "Studies jailbreak attacks on multi-agent debate systems, directly relevant to MAD system security."
     },
     {
       "title": "Agents Under Siege: Breaking Pragmatic Multi-Agent LLM Systems with Optimized Prompt Attacks",
       "authors": ["R. M. S. Khan", "Z. Tan", "S. Yun", "C. Flemming", "T. Chen"],
       "year": 2025,
       "relevance": "Studies optimized prompt attacks against multi-agent LLM systems."
     },
     {
       "title": "IP Leakage Attacks Targeting LLM-Based Multi-Agent Systems",
       "authors": ["L. Wang", "W. Wang", "S. Wang", "Z. Li", "Z. Ji", "Z. Lyu", "D. Wu", "S.-C. Cheung"],
       "year": 2025,
       "relevance": "Studies IP leakage vulnerabilities in LLM multi-agent systems, relevant to multi-agent security."
     },
     {
       "title": "Formalizing and Benchmarking Prompt Injection Attacks and Defenses",
       "authors": ["Y. Liu", "Y. Jia", "R. Geng", "J. Jia", "N. Z. Gong"],
       "year": 2024,
       "relevance": "Provides formal framework and benchmarks for prompt injection attacks and defenses, foundational to the attack taxonomy used."
     },
     {
       "title": "Automatic and universal prompt injection attacks against large language models",
       "authors": ["X. Liu", "Z. Yu", "Y. Zhang", "N. Zhang", "C. Xiao"],
       "year": 2024,
       "relevance": "Proposes automated prompt injection attacks against LLMs, relevant to attack methodology against AI systems."
     },
     {
       "title": "Improving factuality and reasoning in language models through multiagent debate",
       "authors": ["Y. Du", "S. Li", "A. Torralba", "J. B. Tenenbaum", "I. Mordatch"],
       "year": 2024,
       "relevance": "Introduces the SoM multi-agent debate framework used as the experimental platform in this paper."
     },
     {
       "title": "If Multi-Agent Debate is the Answer, What is the Question?",
       "authors": ["H. Zhang", "Z. Cui", "X. Wang", "Q. Zhang", "Z. Wang", "D. Wu", "S. Hu"],
       "year": 2025,
       "relevance": "Comprehensive evaluation of existing MAD frameworks on multiple benchmarks, relevant to understanding MAD system capabilities."
     },
     {
       "title": "Which agent causes task failures and when? on automated failure attribution of llm multi-agent systems",
       "authors": ["S. Zhang", "M. Yin", "J. Zhang", "J. Liu", "Z. Han", "J. Zhang", "B. Li", "C. Wang", "H. Wang", "Y. Chen"],
       "year": 2025,
       "relevance": "Studies automated failure attribution in LLM multi-agent systems, proposed as a potential defense mechanism."
     },
     {
       "title": "G-safeguard: A topology-guided security lens and treatment on llm-based multi-agent systems",
       "authors": ["S. Wang", "G. Zhang", "M. Yu", "G. Wan", "F. Meng", "C. Guo", "K. Wang", "Y. Wang"],
       "year": 2025,
       "relevance": "Proposes security mechanisms for LLM multi-agent systems based on topology analysis, suggested as a potential defense."
     },
     {
       "title": "Prompt infection: Llm-to-llm prompt injection within multi-agent systems",
       "authors": ["D. Lee", "M. Tiwari"],
       "year": 2024,
       "relevance": "Studies LLM-to-LLM prompt injection propagation in multi-agent systems."
     },
     {
       "title": "Revisiting Multi-Agent Debate as Test-Time Scaling: A Systematic Study of Conditional Effectiveness",
       "authors": ["Y. Yang", "E. Yi", "J. Ko", "K. Lee", "Z. Jin", "S.-Y. Yun"],
       "year": 2025,
       "relevance": "Systematic study of MAD effectiveness that claims agent diversity has minimal impact on performance, directly contradicted by this paper's findings."
     }
   ]
 }