Securing Multi-Agent Systems Against Corruptions via Node Contribution Backpropagation

Multi-Agent Systems (MAS) have become a prevalent paradigm for Large Language Model (LLM) applications. However, the complex multi-agent design in MAS introduces unique trustworthiness concerns: adversarial agents can inject misleading information that propagates contagiously through the system, corrupting benign agents and leading to false outputs. Existing graph-based defenses model agents as nodes and communications as edges, yet are limited to static-graph defenses. In this paper, we propose a dynamic defense paradigm that models MAS communication as a signed directed acyclic graph and computes each agent's contribution to the final decision via backward propagation, enabling accurate identification and isolation of malicious agents to secure multi-agent task collaboration. Experimental results in complex and dynamic MAS environments demonstrate that our method notably outperforms existing MAS defense mechanisms, providing an effective guardrail for trustworthy MAS deployment. Our code is available at https://github.com/ChengcanWu/BPD.

Problem. AI assistants are increasingly being assembled into teams, where each member tackles part of a task and shares its work with the others. But if a single member is hijacked — through a poisoned prompt or a hidden instruction — its corrupted output can ripple through the conversation and lead the whole group to a wrong answer, even when the other members behave honestly. Solution. We built a method that pinpoints the bad member after the discussion ends. For every message exchanged, we record whether the recipient agreed or disagreed with the sender. Then, starting from the team's final answer, we trace these reactions backward toward their origin to measure how much each member shaped the outcome. A member whose influence stands out from the rest is flagged as suspicious, and its messages are removed from the conversation. Impact. Our approach catches the corrupted member over 90% of the time and restores nearly all of the accuracy lost under attack, without retraining the AI or redesigning the team. As AI teams begin handling real-world work in software engineering, healthcare, and finance, this offers developers a lightweight safeguard that keeps collaborative AI trustworthy even when one member goes rogue.