OpenEvoShield: защита мультиагентных LLM-систем от эволюционирующих инъекций

In July 2026, researchers published on arXiv the OpenEvoShield framework — a continual defense system for multi-agent systems based on large language models (LLM-MAS) that, over 100 deployment rounds, detects most previously unseen injection attacks at a low false-positive rate.

Which attacks it targets

OpenEvoShield protects LLM-MAS from malicious instruction injection via inter-agent communication — when an attacker slips a command to one agent, which then spreads the malicious behavior throughout the system via correspondence with other agents. According to the authors' description, such attacks are "doubly dynamic": attackers refine injection strategies against an already-deployed defense, while the behavior of normal agents drifts as the system scales. This is exactly why static defenses, trained once, quickly lose accuracy.

How the defense works

OpenEvoShield is built as a co-evolutionary continual defense — a defense that evolves alongside the attacks rather than remaining frozen after training. According to the preprint, the framework is assembled from four modules.

• M1 — asymmetric rate controller: separates fast learning on the attack side from slow learning on the normal-behavior side, using two drift signals
• M2 — norm boundary update: slowly maintains a dynamic behavioral boundary for "normal" agents
• M3 — policy ensemble with EWC regularization: quickly adapts to new threats without catastrophic forgetting of old ones
• M4 — multi-granularity energy detector: combines node-level, subgraph-level, and graph-level features to classify a new attack as an out-of-distribution anomaly
• Testing — 100 deployment rounds across 5 benchmarks and 4 multi-agent system topologies

Why does ordinary defense break?

Ordinary defense breaks because it treats deployment as a "closed world" and loses accuracy as soon as the distribution of attacks or normal behavior moves beyond the training set. According to arXiv, OpenEvoShield addresses this through separate learning rates: the attack side adapts quickly, while the norm boundary updates slowly, which keeps the system from mistaking gradual drift for an attack. Across 100 rounds, experiments showed the method outperforms both static and continual-based approaches.

"OpenEvoShield outperforms static and continual-based methods,

detecting most previously unseen attacks at a low false-positive rate," the preprint's abstract on arXiv states.

What it means

As companies assemble working pipelines out of LLM agents, the security of inter-agent correspondence is becoming a distinct engineering task. OpenEvoShield points to a direction: defense must learn continuously and in real time, distinguishing the evolution of attacks from the system's natural drift.

Frequently asked questions

What is an attack via inter-agent communication?

It's when an attacker embeds a malicious instruction in one agent's message, and it spreads through the system as agents exchange data. According to the authors' description, this is a key threat for multi-agent LLM systems in safety-critical tasks.

What was OpenEvoShield tested on?

According to the preprint, the method was run through 100 deployment rounds across 5 benchmarks and 4 multi-agent system topologies. Under these conditions, it outperformed static and continual-based approaches, catching most new attacks at a low false-positive rate.