OpenEvoShield: Defending Multi-Agent LLM Systems Against Evolving Injection Attacks

In July 2026, researchers published OpenEvoShield on arXiv, a continual defense framework for multi-agent systems built on large language models (LLM-MAS). Over 100 rounds of deployment, it detects most previously unseen injection attacks with a low false-positive rate.

Which attacks it targets

OpenEvoShield protects LLM-MAS against injection of malicious instructions through inter-agent communication. An attacker slips a command to one agent, and that agent spreads the malicious behavior across the whole system through its conversations with other agents. The authors describe these attacks as "doubly dynamic": attackers refine their injection strategies against a defense that is already deployed, while the behavior of normal agents drifts as the system grows. That is why static defenses, trained once, quickly lose accuracy.

How the defense works

OpenEvoShield is built as a co-evolutionary continual defense: it evolves alongside the attacks instead of staying frozen after training. According to the preprint, the framework consists of four modules.

• M1 — asymmetric rate controller: separates fast learning on the attack side from slow learning on the normal-behavior side, using two drift signals
• M2 — norm boundary update: slowly maintains a dynamic behavioral boundary of "normal" agents
• M3 — policy ensemble with EWC regularization: adapts quickly to new threats without catastrophically forgetting old ones
• M4 — multi-granularity energy-based detector: combines node-level, subgraph-level and graph-level features to flag a new attack as an out-of-distribution anomaly
• Testing — 100 deployment rounds on 5 benchmarks and 4 multi-agent system topologies

Why does conventional defense break?

Conventional defense breaks because it treats deployment as a "closed world" and loses accuracy as soon as the distribution of attacks or of normal behavior moves outside the training set. According to arXiv, OpenEvoShield addresses this with separate learning rates: the attack side adapts quickly, while the norm boundary updates slowly, which keeps the system from mistaking gradual drift for an attack. Across 100 rounds, the experiments showed the method outperforming both static and continual baselines.

"OpenEvoShield outperforms static and continual baselines, detecting

most previously unseen attacks with a low false-positive rate," the preprint's abstract on arXiv states.

What this means

As companies assemble working pipelines out of LLM agents, securing inter-agent communication is becoming an engineering problem in its own right. OpenEvoShield points in one direction: defense has to learn continuously and in real time, distinguishing the evolution of attacks from the natural drift of the system.

Frequently asked questions

What is an attack through inter-agent communication?

It is an attack in which a malicious instruction is injected into one agent's message and spreads through the system as agents exchange data. According to the authors, this is a key threat to multi-agent LLM systems in safety-critical tasks.

What was OpenEvoShield tested on?

According to the preprint, the method was run through 100 deployment rounds on 5 benchmarks and 4 multi-agent system topologies. Under these conditions it outperformed static and continual baseline approaches, catching most novel attacks with a low false-positive rate.