ai-research-survey

scan.json (26341B)

---

 {
   "paper": {
     "title": "The Trust Paradox in LLM-Based Multi-Agent Systems: When Collaboration Becomes a Security Vulnerability",
     "authors": ["Zijie Xu", "Minfeng Qi", "Shiqing Wu", "Lefeng Zhang", "Qiwen Wei", "Han He", "Ningran Li"],
     "year": 2025,
     "venue": "arXiv",
     "arxiv_id": "2510.18563"
   },
   "scan_version": 2,
   "active_modules": ["experimental_rigor", "data_leakage"],
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": false,
         "justification": "The conclusion mentions 'release the scenario dataset and evaluation pipeline as a reproducible baseline' but no repository URL, archive link, or download location is provided anywhere in the paper."
       },
       "data_released": {
         "applies": true,
         "answer": false,
         "justification": "Same as above — the dataset is described as reusable and releasable but no actual download URL or repository link is provided in the paper."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "The paper names frameworks (AgentScope, AutoGen, LangGraph) and models but provides no requirements.txt, Dockerfile, library versions, or environment setup details."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "No step-by-step reproduction instructions are provided. The experimental setup is described at a high level but lacks runnable commands or scripts."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "Table III reports only point estimates for OER and AD. Box plots in Fig. 6 show distributions but no confidence intervals are reported for any main results."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "The paper claims OER 'rises monotonically with τ' and ranks models by trust sensitivity without any statistical significance tests. Comparisons are made by inspecting numbers directly."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "The paper reports effect sizes with baseline context: '∆OER = 0.36', '79.5% reduction relative to the no-defense baseline', 'OER drops by 22% (0.50 → 0.39)'. These provide magnitude and context."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "1,488 interaction chains are generated across the grid but no justification is provided for why this number is sufficient. The limitations section acknowledges the sample is 'adequate for aggregate trends but insufficient for tail-risk.'"
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "Fixed random seeds are used with apparently single runs per cell. No variance across seeds or repeated runs is reported. AD captures variance across trust levels, not across replications."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "The paper compares across 4 model backends, 3 frameworks, 3 trust levels, and evaluates two defenses against a no-defense baseline condition."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "DeepSeek, Qwen, GPT, and Llama-3-8B are contemporary models. AgentScope, AutoGen, and LangGraph are current orchestration frameworks."
       },
       "ablation_study": {
         "applies": true,
         "answer": true,
         "justification": "Two defenses (Sensitive-Information Repartitioning and GA-Agent) are tested independently against no-defense baseline (Section V.E, Fig. 9), functioning as ablation of defense components."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "Three metrics are used: Over-Exposure Rate (OER), Authorization Drift (AD), and task success rate. OER and AD are formally defined in Section IV.D."
       },
       "human_evaluation": {
         "applies": true,
         "answer": false,
         "justification": "OER is computed via 'a rules library and a classifier' (Section IV.D). No human evaluation of whether outputs actually constitute privacy violations or are contextually appropriate."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": false,
         "justification": "All 19 scenarios are used for evaluation. There is no separation of development scenarios (for tuning prompts/defenses) from test scenarios."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Table III provides per-sub-scene OER and AD breakdowns across all 19 scenarios, 4 models, and 3 frameworks — extensive per-category reporting."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": true,
         "justification": "Section V.F discusses scenarios where defenses fail: out-of-scope/emergency requests yield OER of 0.41. Section V.E notes defenses raise low-τ baseline (DeepSeek: 0.12→0.21)."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "Defenses raising low-τ baseline OER is reported as a trade-off. AutoGen's high baseline OER despite low AD is discussed. GA-Agent's weaker slope reduction vs Repartitioning is acknowledged."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "Abstract claims that higher trust improves task success but heightens exposure risks are supported by Table III, Figs. 3-6. Defense claims supported by Fig. 9. All stated trends are present in the data."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": true,
         "justification": "The study uses controlled experiments: 'Within each (S, m, f) tuple, only τ systematically varied' (Section VI.A). Fixed seeds, unified prompts, disabled tools/networking. This is adequate for the causal claim that τ modulates OER."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": false,
         "justification": "The title claims broadly about 'LLM-Based Multi-Agent Systems' but experiments use only synthetic two-agent CK/SK scenarios with disabled networking, tools, and memory. The limitations section notes 'limiting ecological validity' but the title and abstract don't bound these claims."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": true,
         "justification": "Section VI.A discusses and rules out a 'length-risk artifact' via length-controlled resampling (r < 0.12, p > 0.1). The mechanistic account distinguishes model-level alignment priors from system-level coordination effects."
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": true,
         "justification": "The paper clearly defines OER as measuring information beyond MNI baseline and AD as sensitivity to τ. These directly measure what is claimed (over-exposure and trust sensitivity). No proxy gap."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": false,
         "justification": "Models are listed as 'DeepSeek', 'Qwen', 'GPT', 'Llama-3-8B' without specific version identifiers (no API version, snapshot date, or model ID like 'gpt-4-0613'). Section IV.B describes them generically."
       },
       "prompts_provided": {
         "applies": true,
         "answer": true,
         "justification": "Appendix A provides full scenario prompts for all 19 sub-scenes with CK-Agent and SK-Agent role descriptions. Appendix B provides the full GA-Agent prompt. These are the actual texts used."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": false,
         "justification": "The paper repeatedly mentions 'fixed decoding hyperparameters (temperature, top-p, max tokens)' but never states the actual values used for any of these parameters."
       },
       "scaffolding_described": {
         "applies": true,
         "answer": true,
         "justification": "Table II describes each framework's key characteristics and experiment setup. Fig. 1 shows the workflow. Agent JSON configs are shown in figures. The round-robin scheduling and MNI-Gate hooks are described."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": true,
         "justification": "Section IV.A describes scenario construction: 3 macro scenes, 19 sub-scenes, synthetic de-identified data, trust operationalized via κ(τ) and r(τ). The (S, τ, m, f) grid producing 1,488 chains is fully specified."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": true,
         "justification": "Section VI.B 'Limitations and Future Work' provides substantive discussion of four specific limitations."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": true,
         "justification": "Section VI.B identifies specific threats: 1,488 chains insufficient for tail-risk analysis, generation stochasticity despite fixed parameters, discrete τ only (0.1/0.5/0.9), and disabled networking/tools limiting ecological validity."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": true,
         "justification": "Section VI.B explicitly states: 'networking, tools, and memory were disabled to control confounders, limiting ecological validity.' Also notes discrete τ limitation and plans for continuous/dynamic τ."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": false,
         "justification": "No interaction logs, raw outputs, or data archives are made available despite the paper claiming to release the dataset. No URL is provided."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "Section IV.A-E describe data generation: closed-loop A2A interactions, isolated chains, fixed seeds, cleared caches, standardized prompts. The full (S, τ, m, f) grid is specified."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. All data is synthetically generated from agent-agent interactions on purpose-built scenarios."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": true,
         "justification": "Section IV.E describes the two-step protocol: (i) fix framework, sweep models; (ii) fix model, sweep frameworks. Each cell produces an independent log; OER and AD are computed from outputs."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": false,
         "justification": "No funding source, grants, or sponsorship is mentioned anywhere in the paper."
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Author affiliations are listed: Minzu University of China, City University of Macau, University of Adelaide. None of the authors are affiliated with the model providers being evaluated."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": false,
         "justification": "No funding is disclosed, so independence cannot be assessed. The absence of a funding statement leaves this unanswerable."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests or financial interests statement is included in the paper."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": false,
         "answer": false,
         "justification": "The paper tests model behavior (information disclosure under trust manipulation), not model knowledge on benchmarks. Scenarios are novel synthetic constructions. Contamination of test scenarios in training data is not a meaningful concern here."
       },
       "train_test_overlap_discussed": {
         "applies": false,
         "answer": false,
         "justification": "Same as above — the evaluation tests behavioral tendencies under controlled trust conditions, not memorized knowledge. Standard contamination concerns do not apply."
       },
       "benchmark_contamination_addressed": {
         "applies": false,
         "answer": false,
         "justification": "The scenarios are purpose-built synthetic interactions, not pre-existing benchmarks that could appear in training data."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. All experiments involve agent-agent interactions."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": false,
         "justification": "1,488 interaction chains across 4 model backends (including GPT API calls) with no mention of API costs, tokens consumed, or wall-clock time."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "No compute budget, GPU hours, or total API spend is mentioned despite running Llama-3-8B locally and calling commercial APIs."
       }
     },
     "experimental_rigor": {
       "seed_sensitivity_reported": {
         "applies": true,
         "answer": false,
         "justification": "Seeds are fixed but only single-seed results are reported. No analysis of how results vary across seeds despite the paper acknowledging 'generation stochasticity persists' in limitations."
       },
       "number_of_runs_stated": {
         "applies": true,
         "answer": false,
         "justification": "The total of 1,488 chains across the full grid is stated, but per-cell run counts are not explicitly given. It appears to be a single run per (S, τ, m, f) cell."
       },
       "hyperparameter_search_budget": {
         "applies": false,
         "answer": false,
         "justification": "No hyperparameter tuning is performed. Decoding parameters are fixed across all experiments."
       },
       "best_config_selection_justified": {
         "applies": false,
         "answer": false,
         "justification": "No configuration selection is performed. All conditions in the grid are reported."
       },
       "multiple_comparison_correction": {
         "applies": false,
         "answer": false,
         "justification": "No statistical significance tests are performed, so multiple comparison correction is not applicable."
       },
       "self_comparison_bias_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The authors propose and evaluate their own defenses (Repartitioning and GA-Agent) without acknowledging the bias of evaluating their own mitigations. No independent evaluation."
       },
       "compute_budget_vs_performance": {
         "applies": true,
         "answer": false,
         "justification": "Defenses add 'extra turns and latency' but no quantification of compute cost vs. safety improvement is provided. Llama-3-8B (local) vs API models have very different compute profiles, not discussed."
       },
       "benchmark_construct_validity": {
         "applies": true,
         "answer": false,
         "justification": "The 19 synthetic scenarios are never validated as representative of real multi-agent trust dynamics. No discussion of whether synthetic CK/SK-Agent scenarios capture real-world information leakage risks."
       },
       "scaffold_confound_addressed": {
         "applies": true,
         "answer": true,
         "justification": "The paper explicitly tests three different frameworks (AgentScope, AutoGen, LangGraph) with the same models and analyzes how the framework shapes the trust-risk curve (Section V.D, RQ4). Framework is treated as a variable."
       }
     },
     "data_leakage": {
       "temporal_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether models may have been exposed to similar trust-manipulation scenarios in training data, or whether the scenario structures resemble training examples."
       },
       "feature_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "Trust is injected directly into prompts (e.g., 'You trust Jay very much'). No discussion of whether this prompt-level manipulation constitutes a form of feature leakage or whether models respond to surface cues vs. genuine trust modeling."
       },
       "non_independence_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The 19 scenarios share structural similarities (CK-Agent/SK-Agent pattern, similar secret types). No discussion of non-independence across scenarios or whether results are driven by shared structure."
       },
       "leakage_detection_method": {
         "applies": true,
         "answer": false,
         "justification": "No leakage detection or prevention method is applied. The length-controlled resampling check (Section VI.A) addresses a confound, not data leakage."
       }
     }
   },
   "claims": [
     {
       "claim": "Higher inter-agent trust (τ) monotonically increases Over-Exposure Rate (OER) across all model backends and frameworks.",
       "evidence": "Table III shows OER rising with τ across all (m, f) combinations. Example: DeepSeek under AgentScope grows from 0.120 to 0.500 (Section V.A). Fig. 3 confirms monotonic trend.",
       "supported": "strong"
     },
     {
       "claim": "Authorization Drift (AD) is positive across all models, with Llama-3-8B showing the greatest trust sensitivity (AD=0.0783) and GPT the least (AD=0.0243).",
       "evidence": "Fig. 4a reports AD values: Llama-3-8B 0.0783, Qwen 0.0310, DeepSeek 0.0268, GPT 0.0243. Consistent ordering across scenarios (Section V.C).",
       "supported": "strong"
     },
     {
       "claim": "Task success and OER both rise with τ, establishing an efficiency-security trade-off.",
       "evidence": "Fig. 5 shows task success rates rising with τ (e.g., Llama-3-8B: 0.05 → 0.71). Concurrent OER rise documented in Table III. Section V.A(3) discusses the trade-off.",
       "supported": "moderate"
     },
     {
       "claim": "Sensitive-Information Repartitioning reduces AD by 79.5% (DeepSeek) and 88.4% (Llama-3-8B).",
       "evidence": "Section V.E: DeepSeek AD drops from 0.0268 to 0.0055; Llama-3-8B from 0.0783 to 0.0091. OER at τ=0.9 drops 22% and 46.5% respectively.",
       "supported": "moderate"
     },
     {
       "claim": "Orchestration frameworks alter both the slope and intercept of the τ→risk mapping.",
       "evidence": "Section V.D: AutoGen has high-level/low-slope (AD=0.0068), LangGraph mid-level/high-slope (AD=0.0296), AgentScope low-level/mid-slope (AD=0.0268). Fig. 8 provides 3D visualization.",
       "supported": "moderate"
     }
   ],
   "methodology_tags": ["benchmark-eval"],
   "key_findings": "The paper empirically validates the Trust-Vulnerability Paradox: across 1,488 agent-agent interaction chains spanning 4 LLM backends and 3 orchestration frameworks, increasing inter-agent trust (τ) monotonically raises information over-exposure while simultaneously improving task success. Trust sensitivity varies significantly by model (Llama-3-8B most sensitive, GPT least) and framework (AutoGen flattens the trust-risk slope, LangGraph amplifies it). Two defenses — information repartitioning and a Guardian-Agent — reduce over-exposure by 20-50% and trust sensitivity by 38-88% without materially degrading task success.",
   "red_flags": [
     {
       "flag": "No model versions specified",
       "detail": "Models are identified only as 'DeepSeek', 'Qwen', 'GPT', and 'Llama-3-8B' without version identifiers. Given that model behavior changes across versions, results may not be reproducible."
     },
     {
       "flag": "Hyperparameter values omitted",
       "detail": "The paper repeatedly states hyperparameters are 'fixed' but never reveals the actual values for temperature, top-p, or max tokens. These materially affect LLM output behavior."
     },
     {
       "flag": "No statistical significance tests",
       "detail": "All claims of trends and differences are based on comparing point estimates. With single-seed runs and no uncertainty quantification, observed trends could reflect stochastic variation."
     },
     {
       "flag": "Construct validity of synthetic scenarios unexamined",
       "detail": "The 19 scenarios are creative but there is no validation that synthetic CK/SK-Agent trust scenarios with explicit τ prompt labels reflect real multi-agent trust dynamics. Telling a model 'You trust Jay very much' tests prompt compliance, not emergent trust behavior."
     },
     {
       "flag": "Artifacts promised but not released",
       "detail": "The conclusion promises to 'release the scenario dataset and evaluation pipeline as a reproducible baseline' but no URL, repository, or archive is provided."
     },
     {
       "flag": "Single-seed single-run design",
       "detail": "The limitations section acknowledges 'generation stochasticity persists' but all results appear to be single-seed runs. The paper's own proposed future work includes 'multi-seed Monte Carlo,' implicitly admitting this weakness."
     }
   ],
   "cited_papers": [
     {
       "title": "AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents",
       "authors": ["E. Debenedetti", "J. Zhang", "M. Balunovic"],
       "year": 2024,
       "relevance": "Benchmark for evaluating agent safety under prompt injection, testing utility-safety trade-offs in multi-agent settings."
     },
     {
       "title": "AgentPoison: Red-Teaming LLM Agents via Poisoning Memory or Knowledge Bases",
       "authors": ["Z. Chen", "Z. Xiang", "C. Xiao"],
       "year": 2024,
       "relevance": "Demonstrates backdoor attacks on LLM agents through memory/RAG poisoning, relevant to agent security evaluation."
     },
     {
       "title": "Multi-Agent Security Tax: Trading Off Security and Collaboration Capabilities in Multi-Agent Systems",
       "authors": ["P. Peigné", "M. Kniejski", "F. Sondej"],
       "year": 2025,
       "relevance": "Directly studies the safety-efficiency trade-off in multi-agent systems, showing defensive strategies reduce coordination capability."
     },
     {
       "title": "A Survey on Trustworthy LLM Agents: Threats and Countermeasures",
       "authors": ["M. Yu", "F. Meng", "X. Zhou"],
       "year": 2025,
       "relevance": "Comprehensive survey of agent safety threats including prompt injection, jailbreaks, RAG contamination, and privacy leakage."
     },
     {
       "title": "Agents in Software Engineering: Survey, Landscape, and Vision",
       "authors": ["Y. Wang", "W. Zhong", "Y. Huang"],
       "year": 2025,
       "relevance": "Survey of agent-based approaches in software engineering, relevant to understanding agentic system architectures."
     },
     {
       "title": "LLM-Based Multi-Agent Systems for Software Engineering: Literature Review, Vision, and the Road Ahead",
       "authors": ["Y. Jiang", "T. Zhang", "J. Shi"],
       "year": 2025,
       "relevance": "Literature review on multi-agent systems in software engineering, covering architectures and orchestration patterns."
     },
     {
       "title": "Can Large Language Model Agents Simulate Human Trust Behavior?",
       "authors": ["C. Xie", "C. Chen", "F. Jia"],
       "year": 2024,
       "relevance": "Studies whether LLM agents exhibit human-like trust behavior, directly relevant to trust modeling in agent systems."
     },
     {
       "title": "Why Do Multiagent Systems Fail?",
       "authors": ["M. Z. Pan", "M. Cemri", "L. A. Agrawal"],
       "year": 2025,
       "relevance": "Analyzes failure modes in multi-agent systems, relevant to understanding group-level misalignment and error propagation."
     },
     {
       "title": "Security and Privacy Challenges of Large Language Models: A Survey",
       "authors": ["B. C. Das", "M. H. Amini", "Y. Wu"],
       "year": 2025,
       "relevance": "Survey of LLM security and privacy challenges including jailbreaks and prompt injection."
     },
     {
       "title": "Prioritizing Safeguarding Over Autonomy: Risks of LLM Agents for Science",
       "authors": ["X. Tang", "Q. Jin", "K. Zhu"],
       "year": 2024,
       "relevance": "Advocates safety-first design for LLM agents, relevant to the paper's argument about trust as a security variable."
     },
     {
       "title": "AgentScope: A Flexible yet Robust Multi-Agent Platform",
       "authors": ["D. Gao", "Z. Li", "X. Pan"],
       "year": 2024,
       "arxiv_id": "2402.14034",
       "relevance": "Primary orchestration framework used in experiments; relevant to understanding how frameworks shape agent behavior."
     }
   ]
 }