OpenEvoShield: Dual Non-Stationary Continual Defense for Open-World Multi-Agent System Attacks

OpenEvoShield：面向开放世界多智能体系统攻击的双重非平稳持续防御

---

Abstract: LLM-based multi-agent systems (LLM-MAS) are increasingly deployed in safety-critical applications, where adversaries inject malicious instructions through inter-agent communication to propagate harmful behaviors. Unlike static threats, these attacks are doubly dynamic: adversaries refine injection strategies against deployed defenses while normal-agent behavior drifts with system expansion. Existing defenses treat deployment as a closed-world problem and degrade rapidly once either distribution shifts beyond training coverage.

摘要： 基于大语言模型的多智能体系统（LLM-MAS）正越来越多地应用于安全关键领域，攻击者通过智能体间的通信注入恶意指令，从而传播有害行为。与静态威胁不同，这些攻击具有双重动态性：攻击者会针对已部署的防御策略不断改进注入手段，同时正常智能体的行为也会随着系统的扩展而发生漂移。现有的防御方案通常将部署环境视为封闭世界问题，一旦分布发生偏移并超出训练覆盖范围，其防御性能便会迅速下降。

---

We propose OpenEvoShield, a co-evolutionary continual defense framework for LLM-MAS. An asymmetric rate controller (M1) decouples fast attack-side and slow normal-side learning rates from dual drift signals. A normal-boundary updater (M2) maintains a dynamic behavioral boundary at the slow rate, while an EWC-regularized policy ensemble (M3) fast-adapts without catastrophic forgetting. An energy-based multi-granularity detector (M4) fuses node-, subgraph-, and graph-level evidence to classify novel attacks as out-of-distribution.

我们提出了 OpenEvoShield，这是一个针对 LLM-MAS 的协同进化持续防御框架。非对称速率控制器（M1）根据双重漂移信号，将快速的攻击侧学习率与缓慢的正常侧学习率解耦。正常边界更新器（M2）以较慢的速率维护一个动态的行为边界，同时基于 EWC（弹性权重固化）正则化的策略集成（M3）能够在不发生灾难性遗忘的前提下实现快速适应。基于能量的多粒度检测器（M4）融合了节点、子图和图层面的证据，从而将新型攻击识别为分布外（OOD）数据。

---

Experiments over 100 deployment rounds across five benchmarks and four MAS topologies show that OpenEvoShield outperforms static and continual baselines, detecting most previously unseen attacks while keeping false positive rates low.

在五个基准测试和四种 MAS 拓扑结构上进行的 100 轮部署实验表明，OpenEvoShield 的表现优于静态和持续学习基准模型，能够在保持低误报率的同时，检测出绝大多数此前未见的攻击。