标题： MAD-Spear：一种针对多智能体辩论系统的契合度驱动提示注入攻击 显示英文标题

标题： MAD-Spear: A Conformity-Driven Prompt Injection Attack on Multi-Agent Debate Systems

摘要： 多智能体辩论（MAD）系统利用大型语言模型（LLMs）代理之间的协作互动来提高推理能力。 尽管最近的研究集中在提高MAD系统的准确性和可扩展性上，但其安全漏洞却受到了有限的关注。 在本工作中，我们引入了MAD-Spear，这是一种针对提示注入的攻击，它会破坏一小部分代理，但会显著干扰整体的MAD过程。 被操控的代理会产生多个看似合理但错误的响应，利用LLMs的从众倾向来传播错误信息并降低共识质量。 此外，该攻击可以与其他策略（如通信攻击）结合使用，通过增加代理接触到错误响应的机会来进一步放大其影响。 为了评估攻击下的MAD弹性，我们提出了MAD容错性的正式定义，并开发了一个综合评估框架，同时考虑准确性、共识效率和可扩展性。 在五个具有不同难度级别的基准数据集上的大量实验表明，MAD-Spear在降低系统性能方面始终优于基线攻击。 此外，我们观察到代理多样性在数学推理任务中显著提高了MAD性能，这挑战了之前认为代理多样性对性能影响最小的结论。 这些发现突显了改进MAD设计中安全性的紧迫性。 显示英文摘要

摘要： Multi-agent debate (MAD) systems leverage collaborative interactions among large language models (LLMs) agents to improve reasoning capabilities. While recent studies have focused on increasing the accuracy and scalability of MAD systems, their security vulnerabilities have received limited attention. In this work, we introduce MAD-Spear, a targeted prompt injection attack that compromises a small subset of agents but significantly disrupts the overall MAD process. Manipulated agents produce multiple plausible yet incorrect responses, exploiting LLMs' conformity tendencies to propagate misinformation and degrade consensus quality. Furthermore, the attack can be composed with other strategies, such as communication attacks, to further amplify its impact by increasing the exposure of agents to incorrect responses. To assess MAD's resilience under attack, we propose a formal definition of MAD fault-tolerance and develop a comprehensive evaluation framework that jointly considers accuracy, consensus efficiency, and scalability. Extensive experiments on five benchmark datasets with varying difficulty levels demonstrate that MAD-Spear consistently outperforms the baseline attack in degrading system performance. Additionally, we observe that agent diversity substantially improves MAD performance in mathematical reasoning tasks, which challenges prior work suggesting that agent diversity has minimal impact on performance. These findings highlight the urgent need to improve the security in MAD design.