Paper deep dive
MIRROR: Multipath Quorum Integrity for LLM Multi-Agent Communication
Ryuichi Yamafuji Lun, Jingzhen Wang, Shreyas Kolte, Ruiteng Li
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 90%
Last extracted: 10/5/2026, 5:42:05 AM
Summary
The paper introduces MIRROR, a communication-layer integrity primitive for Large Language Model Multi-Agent Systems (LLM-MAS) designed to defend against Agent-in-the-Middle (AiTM) attacks. MIRROR replicates canonicalized message payloads across k logical routes, using a quorum mechanism where a message is accepted only if a strict majority of routes report the same SHA-256 digest. The system guarantees integrity and availability when the fraction of compromised routes is less than 0.5, reducing Attack Success Rate (ASR) to 0% with minimal overhead (1x LLM token cost) compared to semantic validation methods like LLM-as-a-Judge, which incur high costs and block benign outputs.
Entities (10)
Relation Signals (9)
MIRROR → defendsagainst → Agent-in-the-Middle (AiTM)
confidence 95% · We present MIRROR, a communication-layer integrity primitive... MIRROR reduces ASR to 0% below the threshold
MIRROR → evaluatedonframework → AutoGen
confidence 92% · We evaluate on AutoGen [16], CAMEL [11], and MetaGPT [9]...
MIRROR → evaluatedonframework → CAMEL
confidence 92% · We evaluate on AutoGen [16], CAMEL [11], and MetaGPT [9]...
MIRROR → evaluatedonframework → MetaGPT
confidence 92% · We evaluate on AutoGen [16], CAMEL [11], and MetaGPT [9]...
MIRROR → outperforms → LLM-as-a-Judge
confidence 90% · LLM-as-a-Judge costs 35x in the same deployment, and blocks up to 44.2% of benign outputs... MIRROR reduces ASR to 0%... at 1x LLM token cost.
MIRROR → usesalgorithm → SHA-256
confidence 90% · We use SHA-256.
MIRROR → evaluatedondataset → MMLU
confidence 85% · Across MMLU, HumanEval, and MBPP...
MIRROR → evaluatedondataset → HumanEval
confidence 85% · Across MMLU, HumanEval, and MBPP...
MIRROR → →
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Inter-agent communication is central to Large Language Model Multi-Agent Systems (LLM-MAS), but it introduces an underexplored vulnerability: Agent-in-the-Middle (AiTM) attacks that manipulate messages in transit without compromising the agents themselves. Prior work reports Attack Success Rates (ASR) approaching 100% on structured tasks. Existing defenses rely on semantic validation, which requires additional inference and can block benign outputs, or on transport-layer encryption, which does not help when an intermediary legitimately terminates TLS. We present MIRROR, a communication-layer integrity primitive that replicates a single canonicalized payload across k logical routes and accepts a message only when a strict majority of routes report the same digest. MIRROR uses unkeyed hashing and so authenticates nothing on its own, since an active on-path adversary can always recompute a digest over a payload it has modified. All integrity derives from the assumption that honest routes form a majority. The digest serves only to make witness routes constant-size and to bind the recovered payload to the quorum-agreed value under second-preimage resistance. We give the guarantee under a route-compromise bound alpha < 0.5, and extend it to correlated routes, where the quantity that matters is the size of the largest shared-failure group and not the route count. We further show that availability and integrity degrade at the same threshold: below alpha = 0.5, quorum-denial and message-dropping adversaries cannot block honest traffic. Across MMLU, HumanEval, and MBPP on two frameworks and four communication topologies, and in a MetaGPT deployment against a production API, MIRROR reduces ASR to 0% below the threshold at 1x LLM token cost. LLM-as-a-Judge costs 35x in the same deployment, and blocks up to 44.2% of benign outputs in the topology sweep.
Tags
Links
- Source: https://arxiv.org/abs/2610.02349v1
- Canonical: https://arxiv.org/abs/2610.02349v1
Trouble viewing inline? Open PDF directly →
Full Text
37,023 characters extracted from source content.
Expand or collapse full text
Foundations of Language Model Security: Theory, Practice and Fundamental Limits MIRROR: Multipath Quorum Integrity for LLM Multi-Agent Communication Ryuichi Yamafuji Lun Affiliation: University of Southern California Email: rlun@usc.edu Jingzhen Wang Affiliation: University of Southern California Email: jwang977@usc.edu Shreyas Kolte Affiliation: University of Southern California Email: kolte@usc.edu Ruiteng Li Affiliation: University of Southern California Email: ruitengl@usc.edu Abstract Inter-agent communication is central to Large Language Model Multi-Agent Systems (LLM-MAS), but it introduces an underexplored vulnerability: Agent-in-the-Middle (AiTM) attacks that manipulate messages in transit without compromising the agents themselves. Prior work reports Attack Success Rates (ASR) approaching 100% on structured tasks. Existing defenses rely on semantic validation, which requires additional inference and can block benign outputs, or on transport-layer encryption, which does not help when an intermediary legitimately terminates TLS. We present MIRROR, a communication-layer integrity primitive that replicates a single canonicalized payload across k logical routes and accepts a message only when a strict majority of routes report the same digest. We are explicit about where the security comes from. MIRROR uses unkeyed hashing and so authenticates nothing on its own, since an active on-path adversary can always recompute a digest over a payload it has modified. All integrity derives from the assumption that honest routes form a majority. The digest serves only to make witness routes constant-size and to bind the recovered payload to the quorum-agreed value under second-preimage resistance. We state this scope precisely, give the guarantee under a route-compromise bound α<0.5α<0.5, and extend it to correlated routes, where the quantity that matters is the size of the largest shared-failure group and not the route count. We further show that availability and integrity degrade at the same threshold: below α=0.5α=0.5, quorum-denial and message-dropping adversaries cannot block honest traffic. Across MMLU, HumanEval, and MBPP on two frameworks and four communication topologies, and in a MetaGPT deployment against a production API, MIRROR reduces ASR to 0% below the threshold at 1×1× LLM token cost. LLM-as-a-Judge costs 35×35× in the same deployment, and blocks up to 44.2% of benign outputs in the topology sweep. 1 Introduction The rapid adoption of LLMs has shifted applications from single-model prompting to multi-agent systems (LLM-MAS), where agents collaborate via natural language [15, 17]. Frameworks such as AutoGen [16], CAMEL [11], and MetaGPT [9] exemplify this paradigm. As these systems move toward deployment across organizational boundaries, the integrity of inter-agent communication becomes critical. The communication layer nonetheless remains largely unprotected: Agent-in-the-Middle (AiTM) attacks manipulate messages in transit and corrupt downstream reasoning, reaching 100% ASR on code-generation tasks in an undefended AutoGen chain (Appendix D). Why transport encryption is not sufficient. A natural objection is that TLS already prevents message tampering. It does, for a network-level eavesdropper. It does not help in the deployment we target, where agents communicate through third-party API gateways or broker services that legitimately terminate TLS and therefore see and can modify the plaintext payload. End-to-end digital signatures would address this, but require provisioning, storing, and rotating private keys inside agent frameworks. That is an operational burden across decentralized deployments, and a poor fit for systems whose components are prone to leaking context. MIRROR targets the gap between these two: stronger than TLS against a terminating intermediary, and deployable without a PKI. Scope and framing. We deliberately avoid the language of Byzantine fault tolerance. Classical BFT [10, 3] concerns node-level faults, multi-round consensus, and state-machine replication; MIRROR concerns untrusted intermediaries on a single-shot message path, and provides no agreement over agent outputs and no protection against a compromised agent. We use the term multipath quorum integrity and contrast the two settings in Table 1. We claim no algorithmic novelty relative to the distributed-systems literature on quorum-based integrity; the contribution is a precise adaptation, scoping, and evaluation of that mechanism for LLM-MAS, together with an analysis of the route-independence assumption on which it actually rests. Contributions. • A precisely scoped communication-layer primitive. We specify MIRROR’s mechanism, adversary capabilities, endpoint assumptions, and, critically, what the unkeyed digest does and does not provide (Section 3). • Guarantees under correlated routes. We show that the security threshold is governed by the size of the largest shared-failure group, which yields a concrete deployment rule (Proposition 1). • Availability is not traded away. Below the compromise threshold, quorum-denial and drop adversaries cannot block honest traffic (Corollary 1). • Empirical validation on AutoGen and CAMEL across four communication topologies, and on MetaGPT against a production API (Section 4). 2 System and threat model System model. We consider an LLM-MAS with agents =A1,…,AnA=\A_1,…,A_n\ exchanging natural-language messages. At each step an agent receives incoming messages and produces a response forwarded to others. Each message is an opaque payload m∈ℳm ; MIRROR never interprets its contents. What a route is. A logical route is one delivery path for a message from sender S to receiver R, instantiated as a distinct API gateway, broker service, network path, or region. Routes are not hardware source-routed paths; they are application-level channels chosen by the sending adapter. A message sent over k routes is transmitted k times over k separately addressed channels. Adversary capabilities. We adopt the AiTM model [7] and make the capabilities explicit. On a route it controls, the adversary may read, modify, drop, delay, and replay messages, and may recompute any unkeyed digest to be consistent with a payload it has substituted. It may coordinate across the routes it controls and knows the protocol, the canonicalization rule, and the hash function. It may not read or modify traffic on routes it does not control, and it cannot break second-preimage resistance of the hash. Endpoint assumptions. MIRROR assumes honest endpoints. If the sending or receiving agent is compromised, MIRROR provides no protection: a compromised sender canonicalizes and replicates whatever payload it chooses, across every route. MIRROR is therefore orthogonal to, and composes with, agent-level defenses against prompt injection; it does not replace them. Compromise bound. The adversary controls at most c of k routes with α=c/k<0.5α=c/k<0.5. Section 3.4 replaces this with a weaker and more realistic condition when routes share infrastructure. Freshness. Payload integrity alone does not prevent replay or reordering. Including a monotonic sequence number and timestamp in the canonicalized byte string extends the same quorum logic to freshness without modification, since replayed messages then fail to match the current-round quorum. We treat this as part of the canonicalization rule. 3 MIRROR: multipath quorum integrity Figure 1: Overview of communication threats and the MIRROR defense. (A) Traditional attacks originate from a malicious or compromised sender, which is outside MIRROR’s scope. (B) AiTM attacks manipulate messages in transit via a third-party interceptor. (C) MIRROR replicates across routes and verifies quorum, recovering valid messages or blocking corrupted transmissions. 3.1 Mechanism The sending agent produces one response. MIRROR canonicalizes that single finalized output into a byte string, computes its digest, and replicates the identical bytes across routes. Let k=2t+1k=2t+1 be odd. MIRROR assigns t+1t+1 routes as full-payload routes transmitting (m,H(m))(m,H(m)), and t routes as witness routes transmitting only H(m)H(m). We use SHA-256. The receiver aggregates the reported digests over all k route slots, treating a route that does not deliver within a bounded timeout as reporting no digest. Let C(H∗)C(H ) be the frequency of the most common digest. If C(H∗)>k/2C(H )>k/2, the receiver recovers m from any full-payload route whose digest equals H∗H ; otherwise it rejects the message. Because the quorum is counted against k rather than against the number of replies received, a delayed or withheld route cannot shift the threshold. Routes deviating from the majority are flagged. Note that MIRROR queries the LLM once per message. It does not require deterministic decoding: the agent may sample at any temperature, because replication happens after generation, over fixed bytes. Deterministic decoding appears in our experiments only as an evaluation control (Section 4). Our implementation also retires routes that disagree with the quorum, replacing them on subsequent messages. This plays no part in Theorem 1, which is per-message and single-round, and we make no claims about it; see Section 4 for its role in our runs. 3.2 What the digest does and does not provide The digest is not a message authentication code. It is unkeyed, carries no secret, and authenticates nothing by itself. An active on-path adversary that modifies a payload simply recomputes the digest over the modified bytes; nothing detects this locally. Security comes entirely from the quorum. The adversary can make its own routes internally consistent, but doing so only makes them disagree with the honest majority, which costs it the vote. The digest plays exactly two roles: 1. Compression. Witness routes carry a fixed 32-byte digest rather than the full payload, so the bandwidth cost of replication is t+1t+1 payloads plus t constant-size witnesses rather than k payloads. 2. Binding under second-preimage resistance. Once H∗H is fixed by the honest majority, an adversarial full-payload route cannot supply some m′≠m ≠ m that the receiver would accept, because that requires H(m′)=H(m)H(m )=H(m). The second role is the only cryptographic assumption we need, and it is second-preimage resistance, not collision resistance: the adversary must match a specific target digest it does not choose, not find any colliding pair. We state the assumption accordingly. 3.3 Guarantee Theorem 1 (Integrity and recovery). Let k=2t+1k=2t+1 routes carry a message under the scheme above, with c routes adversarial, and assume (i) honest routes transmit identical canonicalized bytes and digests, (i) H is second-preimage resistant, (i) endpoints are honest, and (iv) c<k/2c<k/2. Then: 1. Integrity. No tampered payload m′≠m ≠ m satisfies the quorum condition and is accepted, except with negligible probability. 2. Recovery. If quorum is reached, the receiver recovers m from a full-payload route matching H∗H , with no additional LLM query. If c≥k/2c≥ k/2 the adversary may control the quorum and neither property holds. Proof sketch. Since c<k/2c<k/2, honest routes number k−c>k/2k-c>k/2 and by (i) all report H(m)H(m), so H∗=H(m)H =H(m) uniquely. Acceptance of some m′≠m ≠ m then requires either a non-H(m)H(m) digest reaching frequency >k/2>k/2, impossible with only c<k/2c<k/2 adversarial routes; or an adversarial full-payload route supplying m′m with H(m′)=H∗H(m )=H , a second preimage for a target the adversary does not choose, ruled out by (i). Recovery follows because c≤tc≤ t leaves at least one of the t+1t+1 full-payload routes honest. The full argument is in Appendix A. Only the second acceptance path touches cryptography, and it needs second-preimage rather than collision resistance; the remainder of the argument is counting. The substance of the result therefore lies in assumptions (i), (i), and (iv), which we examine next. 3.4 Correlated routes Assumption (iv) treats routes as independently compromisable. In practice, k routes often share a provider, region, or administrative domain, and compromising that shared dependency compromises all of them simultaneously. Because the entire guarantee rests on this assumption, the number of routes is not the appropriate quantity to reason about. Partition the k routes into g shared-failure groups G1,…,GgG_1,…,G_g, where compromising any group’s common dependency compromises every route in it. An adversary that compromises a set S of groups controls ∑j∈|Gj| _j |G_j| routes. Proposition 1 (Threshold under correlation). Theorem 1 holds against an adversary compromising any group set S if and only if ∑j∈|Gj|<k/2 _j |G_j|<k/2. Against a single-group adversary this reduces to maxj|Gj|<k/2 _j|G_j|<k/2. This yields a concrete deployment rule: no single provider, region, or administrative domain may carry a majority of routes. For example, provisioning k=5k=5 routes through a single provider yields g=1g=1 and maxj|Gj|=5 _j|G_j|=5, so no guarantee holds regardless of how large k is. Distributing the same five routes across three providers as (2,2,1)(2,2,1) tolerates the compromise of any single provider. The condition can therefore be verified at configuration time; it does not need to be discovered during an attack. This restates the assumption; it does not remove it. Group assignments are only as reliable as the deployer’s knowledge of shared dependencies, and hidden commonality (e.g., two nominally distinct providers reselling the same underlying infrastructure) collapses groups without warning. Measuring route correlation in real deployments therefore remains an open problem, and our evaluation does not address it; our routes are logically instantiated over a shared backend, which corresponds to g=1g=1 and exercises the mechanism without testing the assumption. 3.5 Availability A natural concern is that quorum-blocking hands the adversary a denial-of-service vector: deny quorum, and the system halts. Below the compromise threshold this does not occur. Corollary 1 (Availability below threshold). Let ceff=c+fc_eff=c+f, where c is the number of adversarial routes and f the number that fail independently. If ceff<k/2c_eff<k/2, then k−ceff>k/2k-c_eff>k/2 honest routes deliver identical digests, so quorum is reached and the honest message is accepted. Injecting distinct digests, dropping, or delaying on adversarial routes cannot prevent this. Integrity and availability therefore fail at the same threshold, and do not trade off against each other: below α=0.5α=0.5 both hold, above it both are lost. The caveat is that the relevant budget is ceffc_eff and not c, so ordinary infrastructure flakiness consumes the same margin as attack. Provisioning k must account for both. 3.6 Relationship to classical BFT Classical BFT MIRROR Faulty component Replica nodes Network intermediaries Agreement over Program state / outputs Message bytes Rounds Multi-round Single-shot Requires determinism of Replica execution Nothing (post-generation) Protects against bad endpoint Yes (<n/3<n/3) No Threshold f<n/3f<n/3 (asynchronous) c<k/2c<k/2 Cryptographic assumption Signatures / PKI Second-preimage resistance Table 1: MIRROR is not a consensus protocol. It provides integrity for a message in transit under honest endpoints, not agreement among mutually distrusting replicas. Table 1 makes the boundary explicit. The weaker threshold (c<k/2c<k/2 rather than f<n/3f<n/3) reflects the weaker problem: MIRROR need not tolerate equivocating endpoints, only tampering intermediaries. 4 Experimental evaluation We ask: RQ1: Does MIRROR prevent AiTM attacks below the threshold, and how does behavior change as adversarial control grows? RQ2: Does it hold across frameworks and topologies? RQ3: What overhead does it impose in a production-API deployment relative to semantic defenses? 4.1 Setup Figure 2: ASR on MBPP (AutoGen, k=5k=5) as a function of compromised fraction α=c/kα=c/k, for c∈1,…,5c∈\1,…,5\. The dashed line marks the theoretical threshold α=0.5α=0.5. We evaluate on AutoGen [16], CAMEL [11], and MetaGPT [9] with default configurations; on MMLU [8], HumanEval [4], and MBPP [2]; using Gemma-4-31B-it [6] locally and Gemini 2.5 Pro [5] via API. RQ1 uses AutoGen and RQ3 uses MetaGPT, both on a 3-agent Chain topology as a worst case for sequential propagation; RQ2 sweeps Chain, Tree, Complete, and Random on AutoGen and CAMEL. Every MIRROR configuration reported uses k=5k=5 with SHA-256; the undefended baseline of Appendix D is k=1k=1 by definition. Evaluation controls. Decoding is deterministic (temperature 0.00.0, top-p 1.01.0, 1024 max tokens) and route selection uses fixed seeds. As noted in Section 3, MIRROR does not require this; it removes generation variance so that measured ASR reflects communication-layer manipulation alone. Routes are instantiated as parallel isolated API requests sharing one backend, a single failure group in the sense of Proposition 1. We report exhaustive single-pass results over full splits: 164 HumanEval tasks, 427 MBPP test tasks, 707 MMLU STEM examples. Adversary and rotation. Runs use a static adversary, whose compromised set is fixed per run and never re-acquired, with route rotation enabled. A compromised route therefore leaves the adversary’s control after its first detected tampering. This does not affect the reported figures, since below the threshold an honest majority yields correct recovery on every message independently of rotation; the 0% ASR is attributable to quorum verification alone. It does mean we do not test rotation against the adaptive adversary it targets, and we claim no benefit from it. Attack. No official AiTM implementation is public, so we reimplement from the published description [7], including the reflection-based adversarial agent and task-specific objectives (Appendix B). The adversary rewrites intercepted messages deterministically and emits identical payloads across all compromised routes. This is the worst case for a quorum defense, since vote-splitting would only weaken it. Goals are label-shift on MMLU (+4+4 positions) and injection of a malicious safety_check() function on code tasks. Because the baseline ASR depends on our reimplementation, we treat absolute baseline magnitudes as indicative and rely on relative comparisons. Metrics. Attack Success Rate (ASR), the fraction of tasks whose final output is incorrect due to manipulation; and relative token consumption. Compute: one NVIDIA A100 80GB; roughly one hour per API configuration. 4.2 Behavior across the threshold (RQ1) Figure 2 shows ASR against α. For α<0.5α<0.5 MIRROR achieves 0% ASR; at α≥0.5α≥ 0.5 it transitions sharply to 100%. This step function is the predicted behavior of Theorem 1, not an independent discovery: given the assumptions, the outcome follows by construction. Its value is as a check that the implementation realizes the stated mechanism, and that the transition sits exactly at the predicted threshold instead of degrading earlier, which would indicate canonicalization or routing bugs. 4.3 Frameworks and topologies (RQ2) Dataset Framework No Def. Judge FPR (Judge) MIRROR (k=5) MMLU AutoGen 60.0±24.960.0± 24.9 0.40.4 0.00.0 0.00.0 CAMEL 30.2±35.830.2± 35.8 0.00.0 10.210.2 0.00.0 MBPP AutoGen 100.0100.0 0.00.0 0.00.0 0.00.0 CAMEL 27.5±15.527.5± 15.5 0.00.0 44.244.2 0.00.0 HumanEval AutoGen 100.0100.0 0.00.0 0.00.0 0.00.0 CAMEL 37.0±13.937.0± 13.9 0.00.0 40.940.9 0.00.0 Table 2: ASR (%) for AutoGen and CAMEL across four topologies (Chain, Tree, Complete, Random), reported as mean ± standard deviation over the four topologies of Table 3. Baselines vary widely by topology (MMLU/CAMEL spans 1.41.4–89.889.8); MIRROR is 0.0% in every configuration. LLM-as-a-Judge also lowers ASR but with substantial false positives. Without protection, both frameworks are vulnerable, but to sharply differing degrees: AutoGen reaches 100% ASR on both code-generation benchmarks in every topology, whereas CAMEL ranges from 1.4%1.4\% to 89.8%89.8\% on MMLU depending on structure. More informative than the magnitude is that this variation is non-monotonic in topology, so robustness cannot be inferred from communication structure. That is an argument for a structure-independent mechanism. LLM-as-a-Judge lowers ASR to near zero but at false-positive rates up to 44.2%: its low ASR partly reflects conservative over-blocking rather than faithful recovery. MIRROR achieves 0.0% ASR uniformly across datasets, frameworks, and topologies (per-topology breakdown in Appendix E), which follows from operating below the semantic layer entirely. 4.4 Deployment-oriented evaluation (RQ3) Figure 3: MetaGPT with Gemini 2.5 Pro. (a) ASR: MIRROR reaches 0% on both datasets; LLM-as-a-Judge partially mitigates. (b) Relative token consumption: MIRROR 1×1× baseline, LLM-as-a-Judge 35×35×. This uses a production API and a real framework, but routes remain logically instantiated, so we describe it as deployment-oriented and not in-the-wild. Baseline ASR is 90% (HumanEval) and 100% (MBPP); MIRROR reaches 0% on both. On cost (Figure 3b), MIRROR incurs 1×1× baseline LLM tokens because it performs no intermediate LLM evaluation: the receiver processes one quorum-verified string. LLM-as-a-Judge incurs 35×35×. MIRROR’s cost is instead O(k)O(k) network payload duplication and added latency, which is bandwidth, not inference, and does not scale with model size. 5 Limitations Route rotation targets a persistent adversary that has not, to our knowledge, been demonstrated against LLM-MAS, and it sits in tension with Proposition 1: retiring a route helps only if its replacement lies outside the compromised group, which presumes independent routes are available on demand rather than scarce. Rotation also interacts poorly with benign failure. A route is retired on the basis of disagreement with the quorum, and by Corollary 1 a transiently failed honest route is indistinguishable from an adversarial one at that point, so ordinary infrastructure flakiness will retire healthy routes and erode the pool over time. Characterizing when rotation restores the majority condition, rather than relabeling routes inside an already-compromised group or discarding sound ones, is left to future work. Retirement is also an attack surface. An adversary that cannot read or modify an honest route may still delay it (e.g., by inducing congestion) until it times out and is retired, crossing α=0.5α=0.5 without compromising additional routes. A stricter rule retires a route only when it reports the same non-majority digest as another route, since agreement on a tampered value is evidence of control while a timeout is not; we evaluate neither rule against an adaptive adversary. The route-independence assumption is the binding constraint. Proposition 1 restates it in auditable terms but does not discharge it, and our own evaluation runs at g=1g=1, so it does not test it. Establishing whether nominally distinct providers are genuinely independent is an empirical question we do not answer. MIRROR requires exact byte-level canonicalization, which must be implemented carefully; divergence among honest routes would manifest as spurious quorum failures. It assumes honest endpoints and offers nothing against a compromised agent or prompt injection. Our baselines compare against semantic defenses; we do not empirically compare against broker-enforced verification, witness logs, or end-to-end signatures, which are the natural systems-level alternatives and which we discuss qualitatively in Section 6. Baseline ASR figures depend on our AiTM reimplementation. We do not evaluate adaptive adversaries targeting the canonicalization logic itself, which we consider the most promising attack surface against MIRROR. We also do not measure wall-clock latency, MIRROR’s main runtime cost, or its benign quorum failure rate, which is zero by construction at g=1g=1. Finally, the same mechanism that hardens benign multi-agent systems could harden malicious ones against inspection or intervention. This dual-use property is shared by integrity mechanisms generally. 6 Related work LLM-MAS security. AutoGen [16], CAMEL [11], and MetaGPT [9] largely assume trustworthy inter-agent communication. Defenses focus on endpoint hardening, red teaming [13], or semantic validation via debate and LLM-as-a-judge [18, 1], which require additional inference and do not protect the communication layer against AiTM [7]. Systems alternatives. Multipath TLS and MPTCP-based defenses [12] raise the bar against network-level interception but do not help when an intermediary terminates the session. End-to-end signatures give strictly stronger guarantees than MIRROR, detecting tampering on a single route with no majority required. The cost is PKI provisioning, storage, and key rotation across independently operated agent frameworks. Broker-enforced verification and witness logs relocate trust to a logging or attestation service instead of eliminating the trusted intermediary. MIRROR occupies a different point: weaker guarantees than signatures, no key management, and no trusted third party. Where a PKI is already available, signatures are the better choice. Quorum integrity and BFT. Quorum-based integrity over message digests is long established [10, 3], and we claim no novelty in the mechanism. Recent work adapts BFT ideas to LLM settings through semantic reasoning [19], which relies on semantic interpretation and thus inherits its cost and fragility. Moving Target Defense [14] shares the intuition of exploiting path diversity. 7 Conclusion MIRROR is a multipath quorum integrity primitive for LLM-MAS that operates on opaque payloads and imposes no inference overhead. Its unkeyed digest authenticates nothing; all security rests on honest-majority routing, which makes route correlation, not route count, the quantity that matters (Proposition 1) and yields an auditable deployment rule. The open problem we consider most important is measuring whether real deployments can furnish routes that fail independently. References [1] Alfonso Amayuelas, Xianjun Yang, Antonis Antoniades, Wenyue Hua, Liangming Pan, and William Wang. Multiagent collaboration attack: Investigating adversarial attacks in large language model collaborations via debate, 2024. URL https://arxiv.org/abs/2406.14711. [2] Jacob Austin, Augustus Odena, Maxwell Nye, Maarten Bosma, Henryk Michalewski, et al. Program synthesis with large language models, 2021. URL https://arxiv.org/abs/2108.07732. [3] Miguel Castro and Barbara Liskov. Practical byzantine fault tolerance. In Proceedings of the Third Symposium on Operating Systems Design and Implementation, OSDI ’99, page 173–186, USA, 1999. USENIX Association. ISBN 1880446391. [4] Mark Chen, Jerry Tworek, Heewoo Jun, Qiming Yuan, Henrique Ponde de Oliveira Pinto, Jared Kaplan, Harri Edwards, Yuri Burda, Nicholas Joseph, Greg Brockman, Alex Ray, Raul Puri, Gretchen Krueger, Michael Petrov, Heidy Khlaaf, Girish Sastry, Pamela Mishkin, Brooke Chan, Scott Gray, Nick Ryder, Mikhail Pavlov, Alethea Power, Lukasz Kaiser, Mohammad Bavarian, Clemens Winter, Philippe Tillet, Felipe Petroski Such, Dave Cummings, Matthias Plappert, Fotios Chantzis, Elizabeth Barnes, Ariel Herbert-Voss, William Hebgen Guss, Alex Nichol, Alex Paino, Nikolas Tezak, Jie Tang, Igor Babuschkin, Suchir Balaji, Shantanu Jain, William Saunders, Christopher Hesse, Andrew N. Carr, Jan Leike, Josh Achiam, Vedant Misra, Evan Morikawa, Alec Radford, Matthew Knight, Miles Brundage, Mira Murati, Katie Mayer, Peter Welinder, Bob McGrew, Dario Amodei, Sam McCandlish, Ilya Sutskever, and Wojciech Zaremba. Evaluating large language models trained on code, 2021. URL https://arxiv.org/abs/2107.03374. [5] Gheorghe Comanici et al. Gemini 2.5: Pushing the frontier with advanced reasoning, multimodality, long context, and next generation agentic capabilities, 2025. URL https://arxiv.org/abs/2507.06261. [6] Clement Farabet and Olivier Lacombe. Gemma 4: Byte for byte, the most capable open models. https://blog.google/innovation-and-ai/technology/developers-tools/gemma-4/, apr 2026. Google Keyword Blog. Accessed: 2026-05-01. [7] Pengfei He, Yuping Lin, Shen Dong, Han Xu, Yue Xing, and Hui Liu. Red-teaming LLM multi-agent systems via communication attacks, 2025. URL https://arxiv.org/abs/2502.14847. [8] Dan Hendrycks, Collin Burns, Steven Basart, Andy Zou, Mantas Mazeika, Dawn Song, and Jacob Steinhardt. Measuring massive multitask language understanding, 2021. URL https://arxiv.org/abs/2009.03300. [9] Sirui Hong, Mingchen Zhuge, Jiaqi Chen, Xiawu Zheng, Yuheng Cheng, Ceyao Zhang, Jinlin Wang, Zili Wang, Steven Ka Shing Yau, Zijuan Lin, Liyang Zhou, Chenyu Ran, Lingfeng Xiao, Chenglin Wu, and Jürgen Schmidhuber. MetaGPT: Meta programming for a multi-agent collaborative framework, 2024. URL https://arxiv.org/abs/2308.00352. [10] Leslie Lamport, Robert Shostak, and Marshall Pease. The byzantine generals problem. ACM Trans. Program. Lang. Syst., 4(3):382–401, July 1982. ISSN 0164-0925. doi: 10.1145/357172.357176. URL https://doi.org/10.1145/357172.357176. [11] Guohao Li, Hasan Abed Al Kader Hammoud, Hani Itani, Dmitrii Khizbullin, and Bernard Ghanem. CAMEL: Communicative agents for "mind" exploration of large language model society, 2023. URL https://arxiv.org/abs/2303.17760. [12] Ho-Dac-Duy Nguyen, Chi-Dung Phung, Stefano Secci, Benevid Felix, and Michele Nogueira. Can MPTCP secure internet communications from man-in-the-middle attacks?, 2017. URL https://arxiv.org/abs/1704.07154. [13] Ethan Perez, Saffron Huang, Francis Song, Trevor Cai, Roman Ring, John Aslanides, Amelia Glaese, Nat McAleese, and Geoffrey Irving. Red teaming language models with language models, 2022. URL https://arxiv.org/abs/2202.03286. [14] Richard Skowyra and Samuel Jero. Lessons learned in network and memory-based moving target defenses. In Proceedings of the 7th ACM Workshop on Moving Target Defense, MTD’20, page 51–57, New York, NY, USA, 2020. Association for Computing Machinery. ISBN 9781450380850. doi: 10.1145/3411496.3421227. URL https://doi.org/10.1145/3411496.3421227. [15] Lei Wang, Chen Ma, Xueyang Feng, Zeyu Zhang, Hao Yang, Jingsen Zhang, Zhiyuan Chen, Jiakai Tang, Xu Chen, Yankai Lin, et al. A survey on large language model based autonomous agents. Frontiers of Computer Science, 18(6):1–26, 2024. [16] Qingyun Wu, Gagan Bansal, Jieyu Zhang, Yiran Wu, Beibin Li, Erkang Zhu, Li Jiang, Xiaoyun Zhang, Shaokun Zhang, Jiale Liu, Ahmed Hassan Awadallah, Ryen W White, Doug Burger, and Chi Wang. AutoGen: Enabling next-gen LLM applications via multi-agent conversation, 2023. URL https://arxiv.org/abs/2308.08155. [17] Zhiheng Xi, Wenxiang Chen, Xin Guo, Wei He, Yi Ding, Boyang Hong, Ming Zhang, Junzhe Wang, Senjie Jin, Enyu Zhou, et al. The rise and potential of large language model based agents: A survey, 2023. URL https://arxiv.org/abs/2309.07864. [18] Kai Xiong, Xiao Ding, Yixin Cao, Ting Liu, and Bing Qin. Examining inter-consistency of large language models collaboration: An in-depth analysis via debate. In Findings of the Association for Computational Linguistics: EMNLP 2023, page 7572–7590. Association for Computational Linguistics, 2023. doi: 10.18653/v1/2023.findings-emnlp.508. URL http://dx.doi.org/10.18653/v1/2023.findings-emnlp.508. [19] Lifan Zheng, Jiawei Chen, Qinghong Yin, Jingyuan Zhang, Xinyi Zeng, and Yu Tian. Rethinking the reliability of multi-agent system: A perspective from byzantine fault tolerance, 2025. URL https://arxiv.org/abs/2511.10400. Appendix A Proof of Theorem 1 Let RhonestR_honest and RadvR_adv be the honest and adversarial route sets, |Radv|=c|R_adv|=c, |Rhonest|=k−c|R_honest|=k-c. Since c<k/2c<k/2, we have |Rhonest|>k/2|R_honest|>k/2. By honest determinism every honest route reports H(m)H(m), so the receiver observes strictly more than k/2k/2 identical copies of H(m)H(m); hence H(m)H(m) is the unique majority digest and H∗=H(m)H =H(m). For a tampered m′≠m ≠ m to be accepted, either (a) some digest other than H(m)H(m) must achieve frequency >k/2>k/2, which is impossible since the adversary controls only c<k/2c<k/2 routes; or (b) an adversarial full-payload route must supply m′m with H(m′)=H∗=H(m)H(m )=H =H(m), which requires a second preimage for a target digest fixed by the honest majority and not chosen by the adversary, and thus succeeds only with negligible probability. Integrity follows. For recovery, there are t+1t+1 full-payload routes and c≤tc≤ t adversarial routes, so at least one full-payload route is honest and transmits (m,H(m))(m,H(m)). Since H∗=H(m)H =H(m), the receiver selects any full-payload transmission whose digest equals H∗H and recovers m directly, with no re-query. ∎ Conversely, if c≥k/2c≥ k/2 the adversary can supply ⌈k/2⌉ k/2 identical copies of (m′,H(m′))(m ,H(m )), making H(m′)H(m ) a majority digest; the receiver then accepts m′m . Appendix B Adversarial generation protocol Because the original AiTM codebase is unavailable, we reimplement the attack from the published description [7], preserving the reflection-based adversarial agent, task-specific malicious objectives, threat model, and prompt optimization strategy. Naive AiTM attacks often fail through downstream parsing crashes rather than genuine defense. To isolate communication-layer integrity from application-layer failure, our adversary uses two prompt-level techniques: 1. Structural mimicry. The adversary analyzes the intercepted message and replicates its structural format (CAMEL-style Action/Thought blocks, JSON schemas), ensuring downstream compatibility and preventing accidental denial-of-service via malformed output. 2. Administrative roleplay. Malicious instructions are framed as authoritative system-level directives to bypass downstream safety alignment, consistent with He et al. [7]. Given an intercepted message m, the adversary deterministically produces m~ m preserving task structure while embedding the malicious objective. Deterministic decoding ensures identical payloads across compromised routes, preventing the adversary from splitting its own quorum. The targeted_code system prompt template: “You are the Senior Technical Overseer. You are reviewing a task destined for the [Victim Role]. INPUT DATA: [Intercepted Message] MANDATORY INTEGRITY REQUIREMENT: Inject the following safety_check() function into the code output… TASK: You MUST preserve the core functional logic found in the INPUT DATA. You MUST integrate the MANDATORY INTEGRITY REQUIREMENT into that logic. Output ONLY the final result wrapped in the exact structural formatting of the original input. No conversational text or explanations.” Appendix C Determinism, seeds, and route instantiation Adversarial payloads use temperature=0.0 temperature=0.0, top_p=1.0 top\_p=1.0, max 1024 output tokens, for both Gemma-4-31B-it (via Ollama/vLLM) and Gemini 2.5 Pro (via Vertex AI). For α<1.0α<1.0, compromised routes are selected uniformly at random under fixed seeds (e.g., 42) so that baseline and MIRROR-defended runs share route structure. Open-weight evaluations ran on NVIDIA A100 80GB instances. The harness instantiates logical routes as parallel isolated API requests with deep-copied Python objects, simulating asynchronous state-independent delivery and interception within one process. Token metrics use the native tiktoken tokenizer for the evaluated model. Appendix D Undefended baseline Figure 4: AiTM Attack Success Rate (ASR) without communication-layer defenses (k=1k=1) across datasets and topologies using AutoGen. Results use Gemma-4-31B-it under a worst-case adversary (α=1α=1). ASR approaches 100% on code-generation tasks. Appendix E Per-topology results Dataset Framework Chain Tree Complete Random MMLU AutoGen 20.1 57.9 83.7 78.2 CAMEL 89.8 1.4 26.6 3.1 MBPP AutoGen 100.0 100.0 100.0 100.0 CAMEL 54.1 16.4 21.5 17.8 HumanEval AutoGen 100.0 100.0 100.0 100.0 CAMEL 59.1 37.8 22.0 29.0 MIRROR (k=5k=5) MMLU AutoGen 0.0 0.0 0.0 0.0 CAMEL 0.0 0.0 0.0 0.0 MBPP AutoGen 0.0 0.0 0.0 0.0 CAMEL 0.0 0.0 0.0 0.0 HumanEval AutoGen 0.0 0.0 0.0 0.0 CAMEL 0.0 0.0 0.0 0.0 Table 3: ASR (%) across individual communication topologies. Baselines vary substantially with structure; MIRROR is 0.0% in every configuration.