Shieldgraph: Topology-Aware Runtime Defense For Multi-Agent LLM Systems Against Adversarial Coordination Attacks

Abstract

Multi-agent LLM systems—where multiple language model agents coordinate through message passing to accomplish complex tasks—are rapidly entering production deployment via frameworks such as LangGraph, CrewAI, and AutoGen. However, their interconnected architecture creates novel attack surfaces wherein adversarial inputs can propagate across agent boundaries through topology-guided exploitation. This paper introduces ShieldGraph, a runtime defense framework that models multi-agent topologies as trust-annotated graphs and enforces security invariants at inter-agent communication boundaries. ShieldGraph operates through three mechanisms: (1) a formal Trust Propagation Calculus (TPC) that assigns and dynamically updates capability-bounded trust scores to each agent and communication channel, (2) a lightweight adversarial message classifier that detects prompt injection, role hijacking, and intent drift in inter-agent communications with 91.3% precision at 2.4ms per message, and (3) a topology-aware quarantine protocol that isolates compromised subgraphs while maintaining operational continuity for unaffected agents. We evaluate ShieldGraph on the TAMAS adversarial benchmark, a novel red-team suite of 847 multi-agent attack scenarios, and three production-representative orchestration topologies (centralized, hierarchical, and decentralized). ShieldGraph reduces attack success rate from 68.4% (undefended) to 7.2% while preserving 94.1% task completion on benign workloads—a 6.8× safety improvement with only 3.7% utility degradation. We further demonstrate that topology-aware defense outperforms topology-agnostic baselines by 18.3 percentage points, establishing that the structural properties of multi-agent systems are critical to effective defense design.