diff --git a/artifact/README.md b/artifact/README.md
index 89da13f..b0f3b4a 100644
--- a/artifact/README.md
+++ b/artifact/README.md
@@ -1,202 +1,193 @@
 # Source Links for the 189-Work MAS-Security Corpus
 
-This directory is the source-access layer for the USENIX artifact. It lists every active corpus work with at least one stable, clickable locator. Third-party PDFs are not redistributed here; the links point to DOI, arXiv, or the recorded primary source.
+This page provides a stable source link for each of the 189 works in the corpus.
 
-Active corpus: **92 Set 1 + 97 Set 2 = 189 works**.
-
-Source-link priority is **DOI → arXiv → recorded primary URL** so that durable scholarly identifiers are preferred over aggregator pages. Corpus membership and taxonomy remain authoritative in `../corpus/set1_core.csv` and `../corpus/set2_emerging.csv`.
-
-## Set 1: mature MAS-security works (92)
-
-1. [Cooperation, Competition, and Maliciousness: LLM-Stakeholders Interactive Negotiation](https://doi.org/10.52202/079017-2658) — **evaluation** · NeurIPS 2024 · 2023 · DOI · `supp_cooperation_competition_and_maliciousness_llm_stakeholders_interactive_negotiati`
-2. [A Troublemaker with Contagious Jailbreak Makes Chaos in Honest Towns](https://doi.org/10.18653/v1/2025.acl-long.859) — **attack** · ACL · 2024 · DOI · `men2025troublemaker`
-3. [Agent Smith: A Single Image Can Jailbreak One Million Multimodal LLM Agents Exponentially Fast](https://arxiv.org/abs/2402.08567) — **attack** · ICML · 2024 · arXiv · `gu2024agent_smith`
-4. [BlockAgents: Towards Byzantine-Robust LLM-Based Multi-Agent Coordination via Blockchain](https://doi.org/10.1145/3674399.3674445) — **defense** · ACM Turing Celebration Conference · 2024 · DOI · `doi:10.1145/3674399.3674445`
-5. [CRDA: Content Risk Drift Assessment of Large Language Models through Adversarial Multi-Agent Interaction](https://doi.org/10.1109/ijcnn60899.2024.10650172) — **evaluation** · IEEE International Joint Conference on Neural Network · 2024 · DOI · `doi:10.1109/ijcnn60899.2024.10650172`
-6. [Cut the Crap: An Economical Communication Pipeline for LLM-based Multi-Agent Systems](https://arxiv.org/abs/2410.02506) — **general** · International Conference on Learning Representations · 2024 · arXiv · `arxiv:2410.02506`
-7. [Flooding Spread of Manipulated Knowledge in LLM-Based Multi-Agent Communities](https://doi.org/10.1007/s11432-024-4663-2) — **attack** · Science China Information Sciences · 2024 · DOI · `ju2026flooding`
-8. [G-Designer: Architecting Multi-agent Communication Topologies via Graph Neural Networks](https://arxiv.org/abs/2410.11782) — **general** · International Conference on Machine Learning · 2024 · arXiv · `arxiv:2410.11782`
-9. [NetSafe: Exploring the Topological Safety of Multi-agent System](https://doi.org/10.18653/v1/2025.findings-acl.150) — **evaluation** · Findings of ACL · 2024 · DOI · `yu2025netsafe`
-10. [Prompt Infection: LLM-to-LLM Prompt Injection within Multi-agent Systems](https://doi.org/10.1007/978-3-032-16092-8_28) — **attack** · ESORICS 2025 International Workshops · 2024 · DOI · `lee2026prompt_infection`
-11. [Secret Collusion among AI Agents: Multi-Agent Deception via Steganography](https://doi.org/10.52202/079017-2336) — **attack** · NeurIPS · 2024 · DOI · `motwani2024secret_collusion`
-12. [The Wolf Within: Covert Injection of Malice into MLLM Societies via an MLLM Operative](https://arxiv.org/abs/2402.14859) — **attack** · arXiv · 2024 · arXiv · `tan2024wolf_within`
-13. [Agents Under Siege: Breaking Pragmatic Multi-Agent LLM Systems with Optimized Prompt Attacks](https://doi.org/10.18653/v1/2025.acl-long.476) — **attack** · ACL · 2025 · DOI · `khan2025agents_under_siege`
-14. [AI Agents with Decentralized Identifiers and Verifiable Credentials](https://doi.org/10.5220/0014234400004052) — **defense** · ICAART 2026 · 2025 · DOI · `supp_ai_agents_with_decentralized_identifiers_and_verifiable_credentials`
-15. [ATAG: AI-Agent Application Threat Assessment with Attack Graphs](https://doi.org/10.1145/3779208.3785380) — **evaluation** · ACM AsiaCCS 2026 · 2025 · DOI · `supp_atag_ai_agent_application_threat_assessment_with_attack_graphs`
-16. [Attack the Messages, Not the Agents: A Multi-round Adaptive Stealthy Tampering Framework for LLM-MAS](https://doi.org/10.1609/aaai.v40i35.40224) — **attack** · AAAI · 2025 · DOI · `yan2026mast`
-17. [Benchmarking the Robustness of Agentic Systems to Adversarially-Induced Harmful Behaviors](https://arxiv.org/abs/2508.16481) — **evaluation** · COLM · 2025 · arXiv · `nother2026badacts`
-18. [BlindGuard: Safeguarding LLM-based Multi-Agent Systems under Unknown Attacks](https://doi.org/10.18653/v1/2026.acl-long.1819) — **defense** · ACL · 2025 · DOI · `miao2026blindguard`
-19. [BlockA2A: Towards Secure and Verifiable Agent-to-Agent Interoperability](https://arxiv.org/abs/2508.01332) — **defense** · arXiv · 2025 · arXiv · `zou2025blocka2a`
-20. [Breaking and Fixing Defenses Against Control-Flow Hijacking in Multi-Agent Systems](https://arxiv.org/abs/2510.17276) — **defense** · ICLR · 2025 · arXiv · `jha2026control_flow_hijacking`
-21. [Can an Individual Manipulate the Collective Decisions of Multi-Agents?](https://doi.org/10.18653/v1/2025.emnlp-main.611) — **attack** · EMNLP · 2025 · DOI · `liu2025collective_manipulation`
-22. [CoMet: Metaphor-Driven Covert Communication for Multi-Agent Language Games](https://doi.org/10.18653/v1/2025.acl-long.389) — **attack** · ACL 2025 · 2025 · DOI · `supp_comet_metaphor_driven_covert_communication_for_multi_agent_language_games`
-23. [CORBA: Contagious Recursive Blocking Attacks on Multi-Agent Systems Based on Large Language Models](https://doi.org/10.18653/v1/2026.findings-acl.342) — **attack** · Findings of ACL · 2025 · DOI · `zhou2026corba`
-24. [Cross-Agent Multimodal Provenance-Aware Framework for Robust Prompt Injection Defense in Large Language and Vision-Language Models](https://doi.org/10.1109/icca66035.2025.11430791) — **defense** · International Conferences on Computing Advancements · 2025 · DOI · `doi:10.1109/icca66035.2025.11430791`
-25. [Decentralized Multi-Agent System with Trust-Aware Communication](https://doi.org/10.1109/ispa67752.2025.00198) — **defense** · IEEE ISPA 2025 · 2025 · DOI · `supp_decentralized_multi_agent_system_with_trust_aware_communication`
-26. [Enhancing Robustness of LLM-Driven Multi-Agent Systems through Randomized Smoothing](https://doi.org/10.1016/j.cja.2025.103779) — **defense** · Chinese Journal of Aeronautics · 2025 · DOI · `supp_enhancing_robustness_of_llm_driven_multi_agent_systems_through_randomized_smooth`
-27. [Explainable and Fine-Grained Safeguarding of LLM Multi-Agent Systems via Bi-Level Graph Anomaly Detection](https://doi.org/10.18653/v1/2026.acl-long.1407) — **defense** · ACL · 2025 · DOI · `pan2026xgguard`
-28. [Free-MAD: Consensus-Free Multi-Agent Debate](https://doi.org/10.18653/v1/2026.findings-acl.1600) — **general** · FINDINGS ACL · 2025 · DOI · `arxiv:2509.11035`
-29. [G-Safeguard: A Topology-Guided Security Lens and Treatment on LLM-based Multi-agent Systems](https://doi.org/10.18653/v1/2025.acl-long.359) — **defense** · ACL · 2025 · DOI · `wang2025gsafeguard`
-30. [GUARDIAN: Safeguarding LLM Multi-Agent Collaborations with Temporal Graph Modeling](https://arxiv.org/abs/2505.19234) — **defense** · NeurIPS · 2025 · arXiv · `zhou2025guardian`
-31. [Hidden in Plain Text: Emergence and Mitigation of Steganographic Collusion in LLMs](https://doi.org/10.18653/v1/2025.ijcnlp-long.34) — **evaluation** · IJCNLP-AACL · 2025 · DOI · `mathew2025hidden`
-32. [MAGPIE: A Benchmark for Multi-Agent Contextual Privacy Evaluation](https://arxiv.org/abs/2506.20737) — **evaluation** · NeurIPS Responsible Foundation Models Workshop · 2025 · arXiv · `juneja2025magpie`
-33. [Multi-Agent Systems Execute Arbitrary Malicious Code](https://arxiv.org/abs/2503.12188) — **attack** · COLM · 2025 · arXiv · `triedman2025malicious_code`
-34. [PEAR: Planner-Executor Agent Robustness Benchmark](https://doi.org/10.18653/v1/2026.findings-eacl.237) — **evaluation** · Findings of EACL · 2025 · DOI · `dong2026pear`
-35. [PeerGuard: Defending Multi-Agent Systems Against Backdoor Attacks Through Mutual Reasoning](https://doi.org/10.1109/iri66576.2025.00051) — **defense** · IEEE IRI 2025 · 2025 · DOI · `supp_peerguard_defending_multi_agent_systems_against_backdoor_attacks_through_mutual_`
-36. [Quantifying Privacy Leakage in Multi-Agent LLMs: A Unified Theoretical and Empirical Analysis](https://doi.org/10.1109/bigdata66926.2025.11401523) — **evaluation** · BigData Congress [Services Society] · 2025 · DOI · `doi:10.1109/bigdata66926.2025.11401523`
-37. [Red-Teaming LLM Multi-Agent Systems via Communication Attacks](https://doi.org/10.18653/v1/2025.findings-acl.349) — **attack** · Findings of ACL · 2025 · DOI · `he2025communication_attacks`
-38. [Rethinking the Reliability of Multi-agent System: A Perspective from Byzantine Fault Tolerance](https://doi.org/10.1609/aaai.v40i41.40806) — **defense** · AAAI · 2025 · DOI · `zheng2026byzantine_reliability`
-39. [SAFEFLOW: A Principled Protocol for Trustworthy and Transactional Autonomous Agent Systems](https://arxiv.org/abs/2506.07564) — **defense** · arXiv · 2025 · arXiv · `arxiv_2506_07564`
-40. [SafeSieve: From Heuristics to Experience in Progressive Pruning for LLM-based Multi-Agent Communication](https://doi.org/10.1609/aaai.v40i35.40236) — **defense** · AAAI 2026 · 2025 · DOI · `supp_safesieve_from_heuristics_to_experience_in_progressive_pruning_for_llm_based_mul`
-41. [SecureGov-Agent: A Governance-Centric Multi-Agent Framework for Privacy-Preserving and Attack-Resilient LLM Agents](https://doi.org/10.1145/3795154.3795296) — **defense** · Proceedings of the 2025 6th International Conference on Computer Science and Management Technology · 2025 · DOI · `arxiv:5154.37952`
-42. [Security and Privacy in Multi-Agent LLM Networks](https://doi.org/10.4018/979-8-3373-1419-8.ch009) — **defense** · Advances in computational intelligence and robotics book series · 2025 · DOI · `doi:10.4018/979-8-3373-1419-8.ch009`
-43. [Security of LLM Agents: A Case Study Approach](https://doi.org/10.1109/trustcom66490.2025.00226) — **evaluation** · International Conference on Trust, Security and Privacy in Computing and Communications · 2025 · DOI · `doi:10.1109/trustcom66490.2025.00226`
-44. [Sentinel Agents for Secure and Trustworthy Agentic AI in Multi-Agent Systems](https://arxiv.org/abs/2509.14956) — **defense** · arXiv.org · 2025 · arXiv · `arxiv:2509.14956`
-45. [SentinelAgent: Graph-based Anomaly Detection in Multi-Agent Systems](https://arxiv.org/abs/2505.24201) — **defense** · arXiv · 2025 · arXiv · `arxiv_2505_24201`
-46. [Seven Security Challenges in Cross-Domain Multi-Agent LLM Systems](https://doi.org/10.1038/s44387-026-00128-9) — **survey** · npj Artificial Intelligence · 2025 · DOI · `ko2026sevenchallenges`
-47. [Shadows in the Code: Exploring the Risks and Defenses of LLM-based Multi-Agent Software Development Systems](https://doi.org/10.1609/aaai.v40i44.41134) — **attack** · AAAI · 2025 · DOI · `wang2026shadows_code`
-48. [SPIFFE-Based Zero-Trust Authentication for AI Agent Ecosystems](https://doi.org/10.1109/icca66035.2025.11431026) — **defense** · International Conferences on Computing Advancements · 2025 · DOI · `doi:10.1109/icca66035.2025.11431026`
-49. [TAMAS: Benchmarking Adversarial Risks in Multi-Agent LLM Systems](https://doi.org/10.18653/v1/2026.acl-long.1442) — **evaluation** · ACL · 2025 · DOI · `kavathekar2026tamas`
-50. [The Subtle Art of Defection: Understanding Uncooperative Behaviors in LLM based Multi-Agent Systems](https://doi.org/10.18653/v1/2026.eacl-industry.44) — **evaluation** · EACL 2026 Industry Track · 2025 · DOI · `supp_the_subtle_art_of_defection_understanding_uncooperative_behaviors_in_llm_based_m`
-51. [The Sum Leaks More Than Its Parts: Compositional Privacy Risks and Mitigations in Multi-Agent Collaboration](https://arxiv.org/abs/2509.14284) — **attack** · arXiv · 2025 · arXiv · `arxiv_2509_14284`
-52. [Topology Matters: Measuring Memory Leakage in Multi-Agent LLMs](https://doi.org/10.18653/v1/2026.findings-acl.1980) — **evaluation** · Findings of ACL · 2025 · DOI · `liu2026topology_memory`
-53. [TRiSM for Agentic AI: A Review of Trust Risk and Security Management in LLM-based Agentic Multi-Agent Systems](https://doi.org/10.1016/j.aiopen.2026.02.006) — **survey** · AI Open · 2025 · DOI · `raza2026trism`
-54. [Who's the Mole? Modeling and Detecting Intention-Hiding Malicious Agents in LLM-Based Multi-Agent Systems](https://arxiv.org/abs/2507.04724) — **evaluation** · arXiv · 2025 · arXiv · `xie2025_whos_the_mole`
-55. [WOLF: Werewolf-based Observations for LLM Deception and Falsehoods](https://arxiv.org/abs/2512.09187) — **evaluation** · arXiv · 2025 · arXiv · `arxiv_2512_09187`
-56. [A Literature Survey on Privacy-Preserving Multi-Agent RAG Systems with an Intelligent Tag-Inference Routing System](https://doi.org/10.56726/irjmets98584) — **survey** · International Research Journal of Modernization in Engineering Technology and Science · 2026 · DOI · `doi:10.56726/irjmets98584`
-57. [A2ASecBench: A Protocol-Aware Security Benchmark for Agent-to-Agent Multi-Agent Systems](https://iclr.cc/virtual/2026/poster/10010017) — **evaluation** · ICLR · 2026 · Primary source · `li2026a2asecbench`
-58. [ACIARena: Toward Unified Evaluation for Agent Cascading Injection](https://doi.org/10.18653/v1/2026.acl-long.457) — **evaluation** · ACL · 2026 · DOI · `an2026aciarena`
-59. [AgentChain: Blockchain-Empowered Multi-Agent Coordination for Trustworthy LLM Question-Answering Systems](https://doi.org/10.1109/tdsc.2026.3685256) — **defense** · IEEE Transactions on Dependable and Secure Computing · 2026 · DOI · `doi:10.1109/tdsc.2026.3685256`
-60. [AgentLeak: A Benchmark for Internal-Channel Privacy Leakage in Multi-Agent LLM Systems](https://doi.org/10.1109/access.2026.3704541) — **evaluation** · IEEE Access · 2026 · DOI · `elyagoubi2026agentleak`
-61. [Among Us: Measuring and Mitigating Malicious Contributions in Model Collaboration Systems](https://doi.org/10.18653/v1/2026.acl-long.725) — **attack** · ACL · 2026 · DOI · `yang2026among_us`
-62. [Architectural Resilience in AI-Driven Decision Systems under Adversarial Conditions](https://doi.org/10.1109/icaic67076.2026.11395749) — **defense** · International Conference on Applied Informatics and Communication · 2026 · DOI · `doi:10.1109/icaic67076.2026.11395749`
-63. [CAPRI-DP: A Differentially Private Extension to Context-Aware Multi-Agent Privacy Frameworks](https://doi.org/10.1109/iccces62661.2026.11437027) — **defense** · 2026 5th International Conference on Communication, Computing and Electronics Systems (ICCCES) · 2026 · DOI · `doi:10.1109/iccces62661.2026.11437027`
-64. [Cascading Instruction Influence Indirect Prompt Injection in Hierarchical Multi-Agent Systems](https://doi.org/10.19139/soic-2310-5070-3574) — **attack** · Statistics, Optimization & Information Computing · 2026 · DOI · `doi:10.19139/soic-2310-5070-3574`
-65. [CIA: Inferring the Communication Topology from LLM-based Multi-Agent Systems](https://doi.org/10.18653/v1/2026.acl-long.815) — **attack** · ACL · 2026 · DOI · `wu2026cia`
-66. [Collaborative-adversarial jailbreaking: A propagation-aware attack framework for multi-agent code generation systems.](https://doi.org/10.1016/j.neunet.2026.109280) — **evaluation** · Neural Networks · 2026 · DOI · `doi:10.1016/j.neunet.2026.109280`
-67. [Conjunctive Prompt Attacks in Multi-Agent LLM Systems](https://doi.org/10.18653/v1/2026.acl-long.1577) — **attack** · ACL · 2026 · DOI · `arif2026conjunctive`
-68. [Consensus-Driven Metacognition in Multi-Agent Systems: A Logic-Based Byzantine Fault-Tolerant Protocol](https://doi.org/10.63412/8vgf0b98) — **defense** · International Journal of Global Innovations and Solutions · 2026 · DOI · `doi:10.63412/8vgf0b98`
-69. [ConvPayMAS: Conversational Payment Multi-Agent System with Agent-to-Agent Protocol and Three-Mandate Verification](https://doi.org/10.65109/ydmy4904) — **defense** · Proceedings of the 25th International Conference on Autonomous Agents and Multiagent Systems · 2026 · DOI · `doi:10.65109/ydmy4904`
-70. [Deception and Communication in Autonomous Multi-Agent Systems: An Experimental Study with Among Us](https://doi.org/10.65109/frxl8789) — **evaluation** · AAMAS · 2026 · DOI · `milkowski2026amongus`
-71. [Ethical Coordination of LLM Multi-Agent Systems](https://doi.org/10.3390/electronics15112278) — **defense** · Electronics · 2026 · DOI · `doi:10.3390/electronics15112278`
-72. [LieCraft: A Multi-Agent Framework for Evaluating Deceptive Capabilities in Language Models](https://doi.org/10.1609/aaai.v40i44.41116) — **evaluation** · AAAI · 2026 · DOI · `olson2026liecraft`
-73. [Lying with Truths: Open-Channel Multi-Agent Collusion for Belief Manipulation via Generative Montage](https://doi.org/10.18653/v1/2026.acl-long.270) — **attack** · ACL · 2026 · DOI · `hu2026lying_truths`
-74. [MASLeak: Investigating and Exposing Intellectual Property Leakage Vulnerabilities in Multi-Agent Systems](https://arxiv.org/abs/2505.12442) — **attack** · USENIX Security 2026 · 2026 · arXiv · `wang2026masleak`
-75. [MIN-Trust: A Minimum Necessary Information Trust Orchestration Framework for Multi-Agent Collaboration](https://doi.org/10.1145/3813808.3813811) — **defense** · GAIE 2026 · 2026 · DOI · `supp_min_trust_a_minimum_necessary_information_trust_orchestration_framework_for_mult`
-76. [MPAS: Breaking Sequential Constraints of Multi-Agent Communication Topologies via Individual-Epistemic Message Propagation](https://doi.org/10.1609/aaai.v40i35.40231) — **general** · Open MIND · 2026 · DOI · `doi:10.1609/aaai.v40i35.40231`
-77. [Orchestration and Verification of Agentic AI Systems: A Survey of Multi-Agent Collaboration and Safety](https://doi.org/10.59324/ejaset.2026.4(2).16) — **survey** · European Journal of Applied Science, Engineering and Technology · 2026 · DOI · `doi:10.59324/ejaset.2026.4(2).16`
-78. [Privacy-Preserving LLM Infrastructure With Multi-Agent Orchestration And RAG-Driven Retrieval](https://doi.org/10.63278/jicrcr.vi.3596) — **defense** · Journal of International Crisis and Risk Communication Research · 2026 · DOI · `doi:10.63278/jicrcr.vi.3596`
-79. [RAG-Induced Failures in Multi-Agent Large Language Model Debate](https://doi.org/10.1109/icetes68504.2026.11518808) — **attack** · 2026 1st International Conference on Emerging Technologies and Engineering Systems (ICETES) · 2026 · DOI · `doi:10.1109/icetes68504.2026.11518808`
-80. [ResMAS: Resilience Optimization in LLM-based Multi-agent Systems](https://doi.org/10.1609/aaai.v40i41.40824) — **defense** · AAAI · 2026 · DOI · `zhou2026resmas`
-81. [RiskLab: A Controlled Toolkit for Probing Emergent Risks in LLM-Based Multi-Agent Systems](https://doi.org/10.18653/v1/2026.acl-demo.17) — **evaluation** · ACL System Demonstrations · 2026 · DOI · `jiang2026risklab`
-82. [Robust LLM-based Multi-Agent System with Action Negotiation and Sharing Redundancy Enhancement](https://doi.org/10.1145/3770854.3780202) — **defense** · Knowledge Discovery and Data Mining · 2026 · DOI · `doi:10.1145/3770854.3780202`
-83. [RoMa: A Credibility-Aware Fault-Tolerance Framework for LLM Multi-Agent Systems](https://doi.org/10.1109/cscwd68734.2026.11582680) — **defense** · International Conference on Computer Supported Cooperative Work in Design · 2026 · DOI · `doi:10.1109/cscwd68734.2026.11582680`
-84. [Self-Healing Memory Architectures for Large Language Model-Based Multi-Agent Collaboration](https://doi.org/10.71465/ajainn3659) — **defense** · American journal of artificial intelligence and neural networks · 2026 · DOI · `doi:10.71465/ajainn3659`
-85. [Semantic Intent Fragmentation: A Single-Shot Compositional Attack on Multi-Agent AI Pipelines](https://doi.org/10.1609/aaaiss.v9i1.42936) — **attack** · AAAI Symposium Series · 2026 · DOI · `ahad2026sif`
-86. [SentinelNet: Safeguarding Multi-Agent Collaboration Through Credit-Based Dynamic Threat Detection](https://doi.org/10.1145/3774904.3792462) — **defense** · The Web Conference · 2026 · DOI · `feng2026sentinelnet`
-87. [The Trust Paradox in LLM-Based Multi-Agent Systems: When Collaboration Becomes a Security Vulnerability](https://doi.org/10.1109/tcss.2026.3695070) — **evaluation** · IEEE Transactions on Computational Social Systems · 2026 · DOI · `xu2026trust_paradox`
-88. [Topology Linearization for Multi-Agent Systems Security: Mitigating Malicious Propagation via Path Decomposition](https://doi.org/10.1109/tnse.2026.3680460) — **defense** · IEEE Transactions on Network Science and Engineering · 2026 · DOI · `doi:10.1109/tnse.2026.3680460`
-89. [Trustworthy Agentic AI: A Survey and Taxonomy of Secure Coordination and Hallucination Mitigation in Multi-Agent Large Language Model Systems](https://doi.org/10.38124/ijisrt/26feb1090) — **survey** · International Journal of Innovative Science and Research Technology · 2026 · DOI · `doi:10.38124/ijisrt/26feb1090`
-90. [When collaboration fails: persuasion driven adversarial influence in multi agent large language model debate](https://doi.org/10.1038/s41598-026-42705-7) — **attack** · Scientific Reports · 2026 · DOI · `kraidia2026collaboration_fails`
-91. [When Embedding-Based Defenses Fail: Rethinking Safety in LLM-Based Multi-Agent Systems](https://arxiv.org/abs/2605.01133) — **attack** · ICML · 2026 · arXiv · `zhang2026embedding_defenses`
-92. [Whispering Agents: A Event-Driven Covert Communication Protocol for the Internet of Agents](https://doi.org/10.1609/aaai.v40i37.40380) — **attack** · AAAI · 2026 · DOI · `doi:10.1609/aaai.v40i37.40380`
-
-## Set 2: emerging MAS-security works (97)
-
-93. [AgentMonitor: A Plug-and-Play Framework for Predictive and Secure Multi-Agent Systems](https://arxiv.org/abs/2408.14972) — **defense** · arXiv.org · 2024 · arXiv · `arxiv:2408.14972`
-94. [IBGP: Imperfect Byzantine Generals Problem for Zero-Shot Robustness in Communicative Multi-Agent Systems](https://arxiv.org/abs/2410.16237) — **defense** · AAMAS · 2024 · arXiv · `mao2025ibgp`
-95. [1-2-3 Check: Enhancing Contextual Privacy in LLM via Multi-Agent Reasoning](https://arxiv.org/abs/2508.07667) — **defense** · LLMSEC 2025 Workshop · 2025 · arXiv · `arxiv_2508_07667`
-96. [Achilles Heel of Distributed Multi-Agent Systems](https://arxiv.org/abs/2504.07461) — **evaluation** · arXiv.org · 2025 · arXiv · `arxiv:2504.07461`
-97. [AdvEvo-MARL: Shaping Internalized Safety through Adversarial Co-Evolution in Multi-Agent Reinforcement Learning](https://arxiv.org/abs/2510.01586) — **defense** · arXiv.org · 2025 · arXiv · `arxiv:2510.01586`
-98. [Agentic JWT: A Secure Delegation Protocol for Autonomous AI Agents](https://arxiv.org/abs/2509.13597) — **defense** · arXiv.org · 2025 · arXiv · `arxiv:2509.13597`
-99. [AgentSafe: Safeguarding Large Language Model-based Multi-agent Systems via Hierarchical Data Management](https://arxiv.org/abs/2503.04392) — **defense** · arXiv · 2025 · arXiv · `mao2025agentsafe`
-100. [AgentShield: Make MAS more secure and efficient](https://arxiv.org/abs/2511.22924) — **defense** · arXiv · 2025 · arXiv · `supp_agentshield_2025`
-101. [Amplified Vulnerabilities: Structured Jailbreak Attacks on LLM-based Multi-Agent Debate](https://arxiv.org/abs/2504.16489) — **attack** · arXiv.org · 2025 · arXiv · `arxiv:2504.16489`
-102. [Byzantine Fault-Tolerant Multi-Agent System for Healthcare: A Gossip Protocol Approach to Secure Medical Message Propagation](https://arxiv.org/abs/2512.17913) — **defense** · arXiv.org · 2025 · arXiv · `arxiv:2512.17913`
-103. [Byzantine-Robust Decentralized Coordination of LLM Agents](https://arxiv.org/abs/2507.14928) — **defense** · arXiv · 2025 · arXiv · `jo2025byzantinerobust`
-104. [Collaborative Shadows: Distributed Backdoor Attacks in LLM-Based Multi-Agent Systems](https://arxiv.org/abs/2510.11246) — **attack** · arXiv · 2025 · arXiv · `zhu2025_collaborative_shadows`
-105. [Convergence dynamics of Agent-to-Agent Interactions with Misaligned objectives](https://arxiv.org/abs/2511.08710) — **general** · arXiv.org · 2025 · arXiv · `arxiv:2511.08710`
-106. [DAO-Agent: Zero Knowledge-Verified Incentives for Decentralized Multi-Agent Coordination](https://arxiv.org/abs/2512.20973) — **defense** · arXiv.org · 2025 · arXiv · `arxiv:2512.20973`
-107. [Demonstrations of Integrity Attacks in Multi-Agent Systems](https://arxiv.org/abs/2506.04572) — **attack** · arXiv · 2025 · arXiv · `zheng2025integrity_attacks`
-108. [Don't Trust Your Upstream: Exploiting LLM Multi-Agent System via Topology-Guided Adversarial Propagation](https://arxiv.org/abs/2512.04129) — **attack** · arXiv · 2025 · arXiv · `liang2025_dont_trust_upstream`
-109. [Ev-Trust: An Evolutionarily Stable Trust Mechanism for Decentralized LLM-Based Multi-Agent Service Economies](https://arxiv.org/abs/2512.16167) — **defense** · venue not recorded · 2025 · arXiv · `arxiv:2512.16167`
-110. [Exposing Weak Links in Multi-Agent Systems under Adversarial Prompting](https://arxiv.org/abs/2511.10949) — **evaluation** · AAMAS Strategic Engineering Workshop · 2025 · arXiv · `arora2026safeagents`
-111. [Formalizing the Safety Security and Functional Properties of Agentic AI Systems](https://arxiv.org/abs/2510.14133) — **general** · arXiv · 2025 · arXiv · `allegrini2025formalizing`
-112. [Goal-Aware Identification and Rectification of Misinformation in Multi-Agent Systems](https://arxiv.org/abs/2506.00509) — **defense** · arXiv · 2025 · arXiv · `li2025argus`
-113. [LLM Hijacking: When Models Manipulate Their Routers](https://doi.org/10.5281/zenodo.17812179) — **attack** · Zenodo (CERN European Organization for Nuclear Research) · 2025 · DOI · `doi:10.5281/zenodo.17812179`
-114. [MAD-Spear: A Conformity-Driven Prompt Injection Attack on Multi-Agent Debate Systems](https://arxiv.org/abs/2507.13038) — **attack** · arXiv.org · 2025 · arXiv · `arxiv:2507.13038`
-115. [Many-to-One Adversarial Consensus: Exposing Multi-Agent Collusion Risks in AI-Based Healthcare](https://arxiv.org/abs/2512.03097) — **attack** · arXiv.org · 2025 · arXiv · `arxiv:2512.03097`
-116. [Maris: A Formally Verifiable Privacy Policy Enforcement Paradigm for Multi-Agent Collaboration Systems](https://arxiv.org/abs/2505.04799) — **defense** · arXiv · 2025 · arXiv · `cui2025maris`
-117. [MedSentry: Understanding and Mitigating Safety Risks in Medical LLM Multi-Agent Systems](https://arxiv.org/abs/2505.20824) — **evaluation** · arXiv · 2025 · arXiv · `chen2025medsentry`
-118. [QuadSentinel: Sequent Safety for Machine-Checkable Control in Multi-agent Systems](https://arxiv.org/abs/2512.16279) — **defense** · arXiv.org · 2025 · arXiv · `arxiv:2512.16279`
-119. [Securing Multi-Agent Systems Against Corruptions via Node Contribution Backpropagation](https://arxiv.org/abs/2510.19420) — **defense** · venue not recorded · 2025 · arXiv · `arxiv:2510.19420`
-120. [Terrarium: Revisiting the Blackboard for Multi-Agent Safety, Privacy, and Security Studies](https://arxiv.org/abs/2510.14312) — **evaluation** · arXiv.org · 2025 · arXiv · `arxiv:2510.14312`
-121. [The Dark Side of LLMs: Agent-based Attack Vectors for System-level Compromise](https://arxiv.org/abs/2507.06850) — **attack** · arXiv · 2025 · arXiv · `lupinacci2025darkside`
-122. [To Trust or Not to Trust: Attention-based Trust Management for LLM Multi-Agent Systems](https://arxiv.org/abs/2506.02546) — **defense** · arXiv · 2025 · arXiv · `he2025atrust`
-123. [Toward Trustworthy Agentic AI: A Multimodal Framework for Preventing Prompt Injection Attacks](https://arxiv.org/abs/2512.23557) — **defense** · arXiv.org · 2025 · arXiv · `arxiv:2512.23557`
-124. [When Persuasion Overrides Truth in Multi-Agent LLM Debates: Introducing a Confidence-Weighted Persuasion Override Rate (CW-POR)](https://arxiv.org/abs/2504.00374) — **attack** · arXiv · 2025 · arXiv · `arxiv_2504_00374`
-125. [AgentWorm: Self-Propagating Attacks Across LLM Agent Ecosystems](https://arxiv.org/abs/2603.15727) — **attack** · venue not recorded · 2026 · arXiv · `arxiv:2603.15727`
-126. [Algorithmic Cowardice: Cognitive Dissonance and Moral Conformity in Multi-Agent LLM Interactions](https://doi.org/10.5281/zenodo.18902320) — **evaluation** · Zenodo · 2026 · DOI · `doi:10.5281/zenodo.18902320`
-127. [Architecture Matters: Comparing RAG Systems under Knowledge Base Poisoning](https://arxiv.org/abs/2605.05632) — **attack** · arXiv.org · 2026 · arXiv · `arxiv:2605.05632`
-128. [Auditing Agent Harness Safety](https://arxiv.org/abs/2605.14271) — **evaluation** · arXiv.org · 2026 · arXiv · `arxiv:2605.14271`
-129. [Autonomous LLM Agent Worms: Cross-Platform Propagation, Automated Discovery and Temporal Re-Entry Defense](https://arxiv.org/abs/2605.02812) — **attack** · arXiv.org · 2026 · arXiv · `arxiv:2605.02812`
-130. [Beyond Goodhart's Law: A Dynamic Benchmark for Evaluating Compliance in Multi-Agent Systems](https://arxiv.org/abs/2606.07805) — **evaluation** · arXiv · 2026 · arXiv · `zhao2026macbench`
-131. [Beyond Input Guardrails: Reconstructing Cross-Agent Semantic Flows for Execution-Aware Attack Detection](https://arxiv.org/abs/2603.04469) — **defense** · arXiv.org · 2026 · arXiv · `arxiv:2603.04469`
-132. [Beyond Single-Agent Alignment: Preventing Context-Fragmented Violations in Multi-Agent Systems](https://arxiv.org/abs/2604.22879) — **defense** · arXiv.org · 2026 · arXiv · `arxiv:2604.22879`
-133. [Blind Spots in the Guard: How Domain-Camouflaged Injection Attacks Evade Detection in Multi-Agent LLM Systems](https://arxiv.org/abs/2605.22001) — **attack** · arXiv.org · 2026 · arXiv · `arxiv:2605.22001`
-134. [Byzantine Cheap Talk: Adversarial Resilience and Topology Effects in LLM Coordination Games](https://arxiv.org/abs/2606.07790) — **attack** · arXiv (Cornell University) · 2026 · arXiv · `arxiv:2606.07790`
-135. [CalBench: Evaluating Coordination-Privacy Trade-offs in Multi-Agent LLMs](https://arxiv.org/abs/2605.09823) — **evaluation** · arXiv · 2026 · arXiv · `zou2026calbench`
-136. [CASPIAN: Online Detection and Attribution of Cascade Attacks in LLM Multi-Agent Systems via Cross-Channel Causal Monitoring](https://arxiv.org/abs/2605.19240) — **defense** · arXiv.org · 2026 · arXiv · `arxiv:2605.19240`
-137. [Collective Hallucination in Multi-Agent LLMs:Modeling and Defense](https://arxiv.org/abs/2606.07941) — **defense** · venue not recorded · 2026 · arXiv · `arxiv:2606.07941`
-138. [Colosseum: Auditing Collusion in Cooperative Multi-Agent Systems](https://arxiv.org/abs/2602.15198) — **evaluation** · arXiv · 2026 · arXiv · `nakamura2026colosseum`
-139. [Defending LLM-based Multi-Agent Systems Against Cooperative Attacks with Sentence-Level Rectification](https://arxiv.org/abs/2605.28104) — **defense** · arXiv · 2026 · arXiv · `supp_star_cooperative_attacks_2026`
-140. [Detecting Multi-Agent Collusion Through Multi-Agent Interpretability](https://arxiv.org/abs/2604.01151) — **evaluation** · arXiv.org · 2026 · arXiv · `arxiv:2604.01151`
-141. [Distributed General-Purpose Agent Networks: Architecture, Key Mechanisms, and Prototypes](https://arxiv.org/abs/2606.17368) — **general** · venue not recorded · 2026 · arXiv · `arxiv:2606.17368`
-142. [Don't Trust Stubborn Neighbors: A Security Framework for Agentic Networks](https://arxiv.org/abs/2603.15809) — **defense** · arXiv.org · 2026 · arXiv · `arxiv:2603.15809`
-143. [Dynamic Attentional Context Scoping: Agent-Triggered Focus Sessions for Isolated Per-Agent Steering in Multi-Agent LLM Orchestration](https://arxiv.org/abs/2604.07911) — **general** · arXiv.org · 2026 · arXiv · `arxiv:2604.07911`
-144. [DynaTrust: Defending Multi-Agent Systems Against Sleeper Agents via Dynamic Trust Graphs](https://arxiv.org/abs/2603.15661) — **defense** · arXiv · 2026 · arXiv · `supp_dynatrust_2026`
-145. [EquiMem: Calibrating Shared Memory in Multi-Agent Debate via Game-Theoretic Equilibrium](https://arxiv.org/abs/2605.09278) — **defense** · arXiv.org · 2026 · arXiv · `arxiv:2605.09278`
-146. [FlowSteer: Prompt-Only Workflow Steering Exposes Planning-Time Vulnerabilities in Multi-Agent LLM Systems](https://arxiv.org/abs/2605.11514) — **attack** · arXiv.org · 2026 · arXiv · `arxiv:2605.11514`
-147. [From Debate to Decision: Conformal Social Choice for Safe Multi-Agent Deliberation](https://arxiv.org/abs/2604.07667) — **defense** · arXiv.org · 2026 · arXiv · `arxiv:2604.07667`
-148. [From Spark to Fire: Modeling and Mitigating Error Cascades in LLM-Based Multi-Agent Collaboration](https://arxiv.org/abs/2603.04474) — **defense** · arXiv.org · 2026 · arXiv · `arxiv:2603.04474`
-149. [GAMBIT: A Three-Mode Benchmark for Adversarial Robustness in Multi-Agent LLM Collectives](https://arxiv.org/abs/2605.09027) — **evaluation** · arXiv · 2026 · arXiv · `lemercier2026gambit`
-150. [Game-Theoretic Multi-Agent Control for Robust Contextual Reasoning in LLMs](https://arxiv.org/abs/2606.10322) — **defense** · venue not recorded · 2026 · arXiv · `arxiv:2606.10322`
-151. [GAMMAF: A Common Framework for Graph-Based Anomaly Monitoring Benchmarking in LLM Multi-Agent Systems](https://arxiv.org/abs/2604.24477) — **evaluation** · arXiv · 2026 · arXiv · `mateotorrejon2026gammaf`
-152. [Governed Shared Memory for Multi-Agent LLM Systems](https://arxiv.org/abs/2606.24535) — **defense** · venue not recorded · 2026 · arXiv · `arxiv:2606.24535`
-153. [HARP: Measuring Harm Amplification in Multi-Agent LLM Systems](https://arxiv.org/abs/2605.27489) — **evaluation** · arXiv · 2026 · arXiv · `rahman2026harp`
-154. [INFA-Guard: Mitigating Malicious Propagation via Infection-Aware Safeguarding in LLM-Based Multi-Agent Systems](https://arxiv.org/abs/2601.14667) — **defense** · arXiv.org · 2026 · arXiv · `arxiv:2601.14667`
-155. [Insider Attacks in Multi-Agent LLM Consensus Systems](https://arxiv.org/abs/2605.08268) — **attack** · arXiv · 2026 · arXiv · `sun2026insider`
-156. [Institutional AI: Governing LLM Collusion in Multi-Agent Cournot Markets via Public Governance Graphs](https://arxiv.org/abs/2601.11369) — **defense** · arXiv · 2026 · arXiv · `arxiv_2601_11369`
-157. [Kill-Chain Canaries: Stage-Level Tracking of Prompt Injection Across Attack Surfaces and Model Safety Tiers](https://arxiv.org/abs/2603.28013) — **attack** · arXiv.org · 2026 · arXiv · `arxiv:2603.28013`
-158. [LCGuard: Latent Communication Guard for Safe KV Sharing in Multi-Agent Systems](https://arxiv.org/abs/2605.22786) — **defense** · arXiv.org · 2026 · arXiv · `arxiv:2605.22786`
-159. [LDP: An Identity-Aware Protocol for Multi-Agent LLM Systems](https://doi.org/10.21203/rs.3.rs-9121599/v1) — **defense** · arXiv.org · 2026 · DOI · `arxiv:2603.08852`
-160. [Linguistic Firewall: Geometry as Defense in Multi-Agent Systems Routing](https://arxiv.org/abs/2606.30555) — **defense** · arXiv (Cornell University) · 2026 · arXiv · `arxiv:2606.30555`
-161. [LLM Drift Experiment: A Framework for Quantifying Behavioral Decay in Adversarial Multi-Agent Simulations](https://doi.org/10.5281/zenodo.20032071) — **evaluation** · Zenodo (CERN European Organization for Nuclear Research) · 2026 · DOI · `doi:10.5281/zenodo.20032071`
-162. [Memetic Cascade Detection and Symbolic Immunity in Multi-Agent LLM Systems](https://doi.org/10.5281/zenodo.19244877) — **defense** · Zenodo (CERN European Organization for Nuclear Research) · 2026 · DOI · `doi:10.5281/zenodo.19244877`
-163. [MESA: Prioritizing Vulnerable Communication Channels for Securing Multi-Agent Systems](https://arxiv.org/abs/2606.30602) — **evaluation** · venue not recorded · 2026 · arXiv · `arxiv:2606.30602`
-164. [Multi-Agent Orchestration: Coordination, Trust, and Cascading Failures](https://doi.org/10.2139/ssrn.6734798) — **survey** · SSRN Electronic Journal · 2026 · DOI · `doi:10.2139/ssrn.6734798`
-165. [Nexus Protocol: A Cryptographically Secure, Zero-Latency Semantic Routing Engine for Multi-Agent Systems](https://doi.org/10.2139/ssrn.7127218) — **defense** · SSRN Electronic Journal · 2026 · DOI · `doi:10.2139/ssrn.7127218`
-166. [No Action Without a NOD: A Heterogeneous Multi-Agent Architecture for Reliable Service Agents](https://arxiv.org/abs/2605.12240) — **general** · arXiv.org · 2026 · arXiv · `arxiv:2605.12240`
-167. [OMNI-LEAK: Orchestrator Multi-Agent Network Induced Data Leakage](https://arxiv.org/abs/2602.13477) — **survey** · arXiv · 2026 · arXiv · `naik2026omni_leak`
-168. [Pratyahara: A Neural Tissue Defense Model for Detecting Compromised Agents in Multi-Agent Networks](https://doi.org/10.5281/zenodo.19628588) — **defense** · Zenodo (CERN European Organization for Nuclear Research) · 2026 · DOI · `doi:10.5281/zenodo.19628588`
-169. [PRISM: Generation-Time Detection and Mitigation of Secret Leakage in Multi-Agent LLM Pipelines](https://arxiv.org/abs/2605.10614) — **defense** · arXiv · 2026 · arXiv · `tapwal2026prism`
-170. [Prompt Injection Mitigation with Agentic AI, Nested Learning, and AI Sustainability via Semantic Caching](https://arxiv.org/abs/2601.13186) — **defense** · arXiv.org · 2026 · arXiv · `arxiv:2601.13186`
-171. [Prompt Optimization Enables Stable Algorithmic Collusion in LLM Agents](https://arxiv.org/abs/2604.17774) — **general** · arXiv.org · 2026 · arXiv · `arxiv:2604.17774`
-172. [PropGuard: Safeguarding LLM-MAS via Propagation-Aware Exploration and Remediation](https://arxiv.org/abs/2605.16346) — **defense** · arXiv.org · 2026 · arXiv · `arxiv:2605.16346`
-173. [Robust Multi-Agent LLMs under Byzantine Faults](https://arxiv.org/abs/2605.09076) — **defense** · arXiv.org · 2026 · arXiv · `arxiv:2605.09076`
-174. [SAIGuard: Communication-State Simulation for Proactive Defense of LLM Multi-Agent Systems](https://arxiv.org/abs/2606.12474) — **defense** · arXiv · 2026 · arXiv · `shi2026saiguard`
-175. [Security Engineering of OpenClaw: Analyzing Attack Surface Expansion and Trust-Boundary Violations](https://arxiv.org/abs/2606.15008) — **evaluation** · venue not recorded · 2026 · arXiv · `arxiv:2606.15008`
-176. [Semantic Taint Propagation: Embedding-Based Semantic Flow Monitoring for Multi-Agent Large Language Model Systems](https://doi.org/10.5281/zenodo.20834834) — **defense** · Zenodo (CERN European Organization for Nuclear Research) · 2026 · DOI · `doi:10.5281/zenodo.20834834`
-177. [SentinelAgent: Intent-Verified Delegation Chains for Securing Federal Multi-Agent AI Systems](https://arxiv.org/abs/2604.02767) — **defense** · arXiv.org · 2026 · arXiv · `arxiv:2604.02767`
-178. [SGTO-MAS: Secure Gorilla Troops Optimization for Multi-Agent LLM Systems](https://arxiv.org/abs/2606.07940) — **defense** · venue not recorded · 2026 · arXiv · `arxiv:2606.07940`
-179. [Smarter Saboteurs, Better Fixers: Scaling&Security in Linear Multi-Agent Workflows](https://arxiv.org/abs/2606.12709) — **general** · venue not recorded · 2026 · arXiv · `arxiv:2606.12709`
-180. [SNEAK: Evaluating Strategic Communication and Information Leakage in Large Language Models](https://arxiv.org/abs/2603.29846) — **evaluation** · arXiv.org · 2026 · arXiv · `arxiv:2603.29846`
-181. [The Capability Paradox: How Smarter Auditors Make Multi-Agent Systems Less Secure](https://arxiv.org/abs/2605.17480) — **evaluation** · arXiv.org · 2026 · arXiv · `arxiv:2605.17480`
-182. [The Consensus Trap: Rescuing Multi-Agent LLMs from Adversarial Majorities via Token-Level Collaboration](https://arxiv.org/abs/2604.17139) — **defense** · arXiv.org · 2026 · arXiv · `arxiv:2604.17139`
-183. [Towards Security-Auditable LLM Agents: A Unified Graph Representation](https://arxiv.org/abs/2605.06812) — **evaluation** · arXiv.org · 2026 · arXiv · `arxiv:2605.06812`
-184. [TrinityGuard: A Unified Framework for Safeguarding Multi-Agent Systems](https://arxiv.org/abs/2603.15408) — **evaluation** · arXiv.org · 2026 · arXiv · `arxiv:2603.15408`
-185. [TRUST: A Framework for Decentralized AI Service v.0.1](https://arxiv.org/abs/2604.27132) — **general** · arXiv.org · 2026 · arXiv · `arxiv:2604.27132`
-186. [WebWeaver: Breaking Topology Confidentiality in LLM Multi-Agent Systems with Stealthy Context-Based Inference](https://arxiv.org/abs/2603.11132) — **attack** · arXiv.org · 2026 · arXiv · `arxiv:2603.11132`
-187. [When Child Inherits: Modeling and Exploiting Subagent Spawn in Multi-Agent Networks](https://arxiv.org/abs/2605.08460) — **evaluation** · arXiv.org · 2026 · arXiv · `arxiv:2605.08460`
-188. [When Latent Agents Lie: KV-Cache Integrity in Multi-Agent LLM Collaboration](https://arxiv.org/abs/2606.28958) — **attack** · venue not recorded · 2026 · arXiv · `arxiv:2606.28958`
-189. [Tool Use Enables Undetectable Steganography in Multi-Agent LLM Systems](https://doi.org/10.48550/arXiv.2606.28425) — **attack** · arXiv · 2026 · DOI · `arxiv:2606.28425`
+1. [Cooperation, Competition, and Maliciousness: LLM-Stakeholders Interactive Negotiation](https://doi.org/10.52202/079017-2658)
+2. [A Troublemaker with Contagious Jailbreak Makes Chaos in Honest Towns](https://doi.org/10.18653/v1/2025.acl-long.859)
+3. [Agent Smith: A Single Image Can Jailbreak One Million Multimodal LLM Agents Exponentially Fast](https://arxiv.org/abs/2402.08567)
+4. [BlockAgents: Towards Byzantine-Robust LLM-Based Multi-Agent Coordination via Blockchain](https://doi.org/10.1145/3674399.3674445)
+5. [CRDA: Content Risk Drift Assessment of Large Language Models through Adversarial Multi-Agent Interaction](https://doi.org/10.1109/ijcnn60899.2024.10650172)
+6. [Cut the Crap: An Economical Communication Pipeline for LLM-based Multi-Agent Systems](https://arxiv.org/abs/2410.02506)
+7. [Flooding Spread of Manipulated Knowledge in LLM-Based Multi-Agent Communities](https://doi.org/10.1007/s11432-024-4663-2)
+8. [G-Designer: Architecting Multi-agent Communication Topologies via Graph Neural Networks](https://arxiv.org/abs/2410.11782)
+9. [NetSafe: Exploring the Topological Safety of Multi-agent System](https://doi.org/10.18653/v1/2025.findings-acl.150)
+10. [Prompt Infection: LLM-to-LLM Prompt Injection within Multi-agent Systems](https://doi.org/10.1007/978-3-032-16092-8_28)
+11. [Secret Collusion among AI Agents: Multi-Agent Deception via Steganography](https://doi.org/10.52202/079017-2336)
+12. [The Wolf Within: Covert Injection of Malice into MLLM Societies via an MLLM Operative](https://arxiv.org/abs/2402.14859)
+13. [Agents Under Siege: Breaking Pragmatic Multi-Agent LLM Systems with Optimized Prompt Attacks](https://doi.org/10.18653/v1/2025.acl-long.476)
+14. [AI Agents with Decentralized Identifiers and Verifiable Credentials](https://doi.org/10.5220/0014234400004052)
+15. [ATAG: AI-Agent Application Threat Assessment with Attack Graphs](https://doi.org/10.1145/3779208.3785380)
+16. [Attack the Messages, Not the Agents: A Multi-round Adaptive Stealthy Tampering Framework for LLM-MAS](https://doi.org/10.1609/aaai.v40i35.40224)
+17. [Benchmarking the Robustness of Agentic Systems to Adversarially-Induced Harmful Behaviors](https://arxiv.org/abs/2508.16481)
+18. [BlindGuard: Safeguarding LLM-based Multi-Agent Systems under Unknown Attacks](https://doi.org/10.18653/v1/2026.acl-long.1819)
+19. [BlockA2A: Towards Secure and Verifiable Agent-to-Agent Interoperability](https://arxiv.org/abs/2508.01332)
+20. [Breaking and Fixing Defenses Against Control-Flow Hijacking in Multi-Agent Systems](https://arxiv.org/abs/2510.17276)
+21. [Can an Individual Manipulate the Collective Decisions of Multi-Agents?](https://doi.org/10.18653/v1/2025.emnlp-main.611)
+22. [CoMet: Metaphor-Driven Covert Communication for Multi-Agent Language Games](https://doi.org/10.18653/v1/2025.acl-long.389)
+23. [CORBA: Contagious Recursive Blocking Attacks on Multi-Agent Systems Based on Large Language Models](https://doi.org/10.18653/v1/2026.findings-acl.342)
+24. [Cross-Agent Multimodal Provenance-Aware Framework for Robust Prompt Injection Defense in Large Language and Vision-Language Models](https://doi.org/10.1109/icca66035.2025.11430791)
+25. [Decentralized Multi-Agent System with Trust-Aware Communication](https://doi.org/10.1109/ispa67752.2025.00198)
+26. [Enhancing Robustness of LLM-Driven Multi-Agent Systems through Randomized Smoothing](https://doi.org/10.1016/j.cja.2025.103779)
+27. [Explainable and Fine-Grained Safeguarding of LLM Multi-Agent Systems via Bi-Level Graph Anomaly Detection](https://doi.org/10.18653/v1/2026.acl-long.1407)
+28. [Free-MAD: Consensus-Free Multi-Agent Debate](https://doi.org/10.18653/v1/2026.findings-acl.1600)
+29. [G-Safeguard: A Topology-Guided Security Lens and Treatment on LLM-based Multi-agent Systems](https://doi.org/10.18653/v1/2025.acl-long.359)
+30. [GUARDIAN: Safeguarding LLM Multi-Agent Collaborations with Temporal Graph Modeling](https://arxiv.org/abs/2505.19234)
+31. [Hidden in Plain Text: Emergence and Mitigation of Steganographic Collusion in LLMs](https://doi.org/10.18653/v1/2025.ijcnlp-long.34)
+32. [MAGPIE: A Benchmark for Multi-Agent Contextual Privacy Evaluation](https://arxiv.org/abs/2506.20737)
+33. [Multi-Agent Systems Execute Arbitrary Malicious Code](https://arxiv.org/abs/2503.12188)
+34. [PEAR: Planner-Executor Agent Robustness Benchmark](https://doi.org/10.18653/v1/2026.findings-eacl.237)
+35. [PeerGuard: Defending Multi-Agent Systems Against Backdoor Attacks Through Mutual Reasoning](https://doi.org/10.1109/iri66576.2025.00051)
+36. [Quantifying Privacy Leakage in Multi-Agent LLMs: A Unified Theoretical and Empirical Analysis](https://doi.org/10.1109/bigdata66926.2025.11401523)
+37. [Red-Teaming LLM Multi-Agent Systems via Communication Attacks](https://doi.org/10.18653/v1/2025.findings-acl.349)
+38. [Rethinking the Reliability of Multi-agent System: A Perspective from Byzantine Fault Tolerance](https://doi.org/10.1609/aaai.v40i41.40806)
+39. [SAFEFLOW: A Principled Protocol for Trustworthy and Transactional Autonomous Agent Systems](https://arxiv.org/abs/2506.07564)
+40. [SafeSieve: From Heuristics to Experience in Progressive Pruning for LLM-based Multi-Agent Communication](https://doi.org/10.1609/aaai.v40i35.40236)
+41. [SecureGov-Agent: A Governance-Centric Multi-Agent Framework for Privacy-Preserving and Attack-Resilient LLM Agents](https://doi.org/10.1145/3795154.3795296)
+42. [Security and Privacy in Multi-Agent LLM Networks](https://doi.org/10.4018/979-8-3373-1419-8.ch009)
+43. [Security of LLM Agents: A Case Study Approach](https://doi.org/10.1109/trustcom66490.2025.00226)
+44. [Sentinel Agents for Secure and Trustworthy Agentic AI in Multi-Agent Systems](https://arxiv.org/abs/2509.14956)
+45. [SentinelAgent: Graph-based Anomaly Detection in Multi-Agent Systems](https://arxiv.org/abs/2505.24201)
+46. [Seven Security Challenges in Cross-Domain Multi-Agent LLM Systems](https://doi.org/10.1038/s44387-026-00128-9)
+47. [Shadows in the Code: Exploring the Risks and Defenses of LLM-based Multi-Agent Software Development Systems](https://doi.org/10.1609/aaai.v40i44.41134)
+48. [SPIFFE-Based Zero-Trust Authentication for AI Agent Ecosystems](https://doi.org/10.1109/icca66035.2025.11431026)
+49. [TAMAS: Benchmarking Adversarial Risks in Multi-Agent LLM Systems](https://doi.org/10.18653/v1/2026.acl-long.1442)
+50. [The Subtle Art of Defection: Understanding Uncooperative Behaviors in LLM based Multi-Agent Systems](https://doi.org/10.18653/v1/2026.eacl-industry.44)
+51. [The Sum Leaks More Than Its Parts: Compositional Privacy Risks and Mitigations in Multi-Agent Collaboration](https://arxiv.org/abs/2509.14284)
+52. [Topology Matters: Measuring Memory Leakage in Multi-Agent LLMs](https://doi.org/10.18653/v1/2026.findings-acl.1980)
+53. [TRiSM for Agentic AI: A Review of Trust Risk and Security Management in LLM-based Agentic Multi-Agent Systems](https://doi.org/10.1016/j.aiopen.2026.02.006)
+54. [Who's the Mole? Modeling and Detecting Intention-Hiding Malicious Agents in LLM-Based Multi-Agent Systems](https://arxiv.org/abs/2507.04724)
+55. [WOLF: Werewolf-based Observations for LLM Deception and Falsehoods](https://arxiv.org/abs/2512.09187)
+56. [A Literature Survey on Privacy-Preserving Multi-Agent RAG Systems with an Intelligent Tag-Inference Routing System](https://doi.org/10.56726/irjmets98584)
+57. [A2ASecBench: A Protocol-Aware Security Benchmark for Agent-to-Agent Multi-Agent Systems](https://iclr.cc/virtual/2026/poster/10010017)
+58. [ACIARena: Toward Unified Evaluation for Agent Cascading Injection](https://doi.org/10.18653/v1/2026.acl-long.457)
+59. [AgentChain: Blockchain-Empowered Multi-Agent Coordination for Trustworthy LLM Question-Answering Systems](https://doi.org/10.1109/tdsc.2026.3685256)
+60. [AgentLeak: A Benchmark for Internal-Channel Privacy Leakage in Multi-Agent LLM Systems](https://doi.org/10.1109/access.2026.3704541)
+61. [Among Us: Measuring and Mitigating Malicious Contributions in Model Collaboration Systems](https://doi.org/10.18653/v1/2026.acl-long.725)
+62. [Architectural Resilience in AI-Driven Decision Systems under Adversarial Conditions](https://doi.org/10.1109/icaic67076.2026.11395749)
+63. [CAPRI-DP: A Differentially Private Extension to Context-Aware Multi-Agent Privacy Frameworks](https://doi.org/10.1109/iccces62661.2026.11437027)
+64. [Cascading Instruction Influence Indirect Prompt Injection in Hierarchical Multi-Agent Systems](https://doi.org/10.19139/soic-2310-5070-3574)
+65. [CIA: Inferring the Communication Topology from LLM-based Multi-Agent Systems](https://doi.org/10.18653/v1/2026.acl-long.815)
+66. [Collaborative-adversarial jailbreaking: A propagation-aware attack framework for multi-agent code generation systems.](https://doi.org/10.1016/j.neunet.2026.109280)
+67. [Conjunctive Prompt Attacks in Multi-Agent LLM Systems](https://doi.org/10.18653/v1/2026.acl-long.1577)
+68. [Consensus-Driven Metacognition in Multi-Agent Systems: A Logic-Based Byzantine Fault-Tolerant Protocol](https://doi.org/10.63412/8vgf0b98)
+69. [ConvPayMAS: Conversational Payment Multi-Agent System with Agent-to-Agent Protocol and Three-Mandate Verification](https://doi.org/10.65109/ydmy4904)
+70. [Deception and Communication in Autonomous Multi-Agent Systems: An Experimental Study with Among Us](https://doi.org/10.65109/frxl8789)
+71. [Ethical Coordination of LLM Multi-Agent Systems](https://doi.org/10.3390/electronics15112278)
+72. [LieCraft: A Multi-Agent Framework for Evaluating Deceptive Capabilities in Language Models](https://doi.org/10.1609/aaai.v40i44.41116)
+73. [Lying with Truths: Open-Channel Multi-Agent Collusion for Belief Manipulation via Generative Montage](https://doi.org/10.18653/v1/2026.acl-long.270)
+74. [MASLeak: Investigating and Exposing Intellectual Property Leakage Vulnerabilities in Multi-Agent Systems](https://arxiv.org/abs/2505.12442)
+75. [MIN-Trust: A Minimum Necessary Information Trust Orchestration Framework for Multi-Agent Collaboration](https://doi.org/10.1145/3813808.3813811)
+76. [MPAS: Breaking Sequential Constraints of Multi-Agent Communication Topologies via Individual-Epistemic Message Propagation](https://doi.org/10.1609/aaai.v40i35.40231)
+77. [Orchestration and Verification of Agentic AI Systems: A Survey of Multi-Agent Collaboration and Safety](https://doi.org/10.59324/ejaset.2026.4(2).16)
+78. [Privacy-Preserving LLM Infrastructure With Multi-Agent Orchestration And RAG-Driven Retrieval](https://doi.org/10.63278/jicrcr.vi.3596)
+79. [RAG-Induced Failures in Multi-Agent Large Language Model Debate](https://doi.org/10.1109/icetes68504.2026.11518808)
+80. [ResMAS: Resilience Optimization in LLM-based Multi-agent Systems](https://doi.org/10.1609/aaai.v40i41.40824)
+81. [RiskLab: A Controlled Toolkit for Probing Emergent Risks in LLM-Based Multi-Agent Systems](https://doi.org/10.18653/v1/2026.acl-demo.17)
+82. [Robust LLM-based Multi-Agent System with Action Negotiation and Sharing Redundancy Enhancement](https://doi.org/10.1145/3770854.3780202)
+83. [RoMa: A Credibility-Aware Fault-Tolerance Framework for LLM Multi-Agent Systems](https://doi.org/10.1109/cscwd68734.2026.11582680)
+84. [Self-Healing Memory Architectures for Large Language Model-Based Multi-Agent Collaboration](https://doi.org/10.71465/ajainn3659)
+85. [Semantic Intent Fragmentation: A Single-Shot Compositional Attack on Multi-Agent AI Pipelines](https://doi.org/10.1609/aaaiss.v9i1.42936)
+86. [SentinelNet: Safeguarding Multi-Agent Collaboration Through Credit-Based Dynamic Threat Detection](https://doi.org/10.1145/3774904.3792462)
+87. [The Trust Paradox in LLM-Based Multi-Agent Systems: When Collaboration Becomes a Security Vulnerability](https://doi.org/10.1109/tcss.2026.3695070)
+88. [Topology Linearization for Multi-Agent Systems Security: Mitigating Malicious Propagation via Path Decomposition](https://doi.org/10.1109/tnse.2026.3680460)
+89. [Trustworthy Agentic AI: A Survey and Taxonomy of Secure Coordination and Hallucination Mitigation in Multi-Agent Large Language Model Systems](https://doi.org/10.38124/ijisrt/26feb1090)
+90. [When collaboration fails: persuasion driven adversarial influence in multi agent large language model debate](https://doi.org/10.1038/s41598-026-42705-7)
+91. [When Embedding-Based Defenses Fail: Rethinking Safety in LLM-Based Multi-Agent Systems](https://arxiv.org/abs/2605.01133)
+92. [Whispering Agents: A Event-Driven Covert Communication Protocol for the Internet of Agents](https://doi.org/10.1609/aaai.v40i37.40380)
+93. [AgentMonitor: A Plug-and-Play Framework for Predictive and Secure Multi-Agent Systems](https://arxiv.org/abs/2408.14972)
+94. [IBGP: Imperfect Byzantine Generals Problem for Zero-Shot Robustness in Communicative Multi-Agent Systems](https://arxiv.org/abs/2410.16237)
+95. [1-2-3 Check: Enhancing Contextual Privacy in LLM via Multi-Agent Reasoning](https://arxiv.org/abs/2508.07667)
+96. [Achilles Heel of Distributed Multi-Agent Systems](https://arxiv.org/abs/2504.07461)
+97. [AdvEvo-MARL: Shaping Internalized Safety through Adversarial Co-Evolution in Multi-Agent Reinforcement Learning](https://arxiv.org/abs/2510.01586)
+98. [Agentic JWT: A Secure Delegation Protocol for Autonomous AI Agents](https://arxiv.org/abs/2509.13597)
+99. [AgentSafe: Safeguarding Large Language Model-based Multi-agent Systems via Hierarchical Data Management](https://arxiv.org/abs/2503.04392)
+100. [AgentShield: Make MAS more secure and efficient](https://arxiv.org/abs/2511.22924)
+101. [Amplified Vulnerabilities: Structured Jailbreak Attacks on LLM-based Multi-Agent Debate](https://arxiv.org/abs/2504.16489)
+102. [Byzantine Fault-Tolerant Multi-Agent System for Healthcare: A Gossip Protocol Approach to Secure Medical Message Propagation](https://arxiv.org/abs/2512.17913)
+103. [Byzantine-Robust Decentralized Coordination of LLM Agents](https://arxiv.org/abs/2507.14928)
+104. [Collaborative Shadows: Distributed Backdoor Attacks in LLM-Based Multi-Agent Systems](https://arxiv.org/abs/2510.11246)
+105. [Convergence dynamics of Agent-to-Agent Interactions with Misaligned objectives](https://arxiv.org/abs/2511.08710)
+106. [DAO-Agent: Zero Knowledge-Verified Incentives for Decentralized Multi-Agent Coordination](https://arxiv.org/abs/2512.20973)
+107. [Demonstrations of Integrity Attacks in Multi-Agent Systems](https://arxiv.org/abs/2506.04572)
+108. [Don't Trust Your Upstream: Exploiting LLM Multi-Agent System via Topology-Guided Adversarial Propagation](https://arxiv.org/abs/2512.04129)
+109. [Ev-Trust: An Evolutionarily Stable Trust Mechanism for Decentralized LLM-Based Multi-Agent Service Economies](https://arxiv.org/abs/2512.16167)
+110. [Exposing Weak Links in Multi-Agent Systems under Adversarial Prompting](https://arxiv.org/abs/2511.10949)
+111. [Formalizing the Safety Security and Functional Properties of Agentic AI Systems](https://arxiv.org/abs/2510.14133)
+112. [Goal-Aware Identification and Rectification of Misinformation in Multi-Agent Systems](https://arxiv.org/abs/2506.00509)
+113. [LLM Hijacking: When Models Manipulate Their Routers](https://doi.org/10.5281/zenodo.17812179)
+114. [MAD-Spear: A Conformity-Driven Prompt Injection Attack on Multi-Agent Debate Systems](https://arxiv.org/abs/2507.13038)
+115. [Many-to-One Adversarial Consensus: Exposing Multi-Agent Collusion Risks in AI-Based Healthcare](https://arxiv.org/abs/2512.03097)
+116. [Maris: A Formally Verifiable Privacy Policy Enforcement Paradigm for Multi-Agent Collaboration Systems](https://arxiv.org/abs/2505.04799)
+117. [MedSentry: Understanding and Mitigating Safety Risks in Medical LLM Multi-Agent Systems](https://arxiv.org/abs/2505.20824)
+118. [QuadSentinel: Sequent Safety for Machine-Checkable Control in Multi-agent Systems](https://arxiv.org/abs/2512.16279)
+119. [Securing Multi-Agent Systems Against Corruptions via Node Contribution Backpropagation](https://arxiv.org/abs/2510.19420)
+120. [Terrarium: Revisiting the Blackboard for Multi-Agent Safety, Privacy, and Security Studies](https://arxiv.org/abs/2510.14312)
+121. [The Dark Side of LLMs: Agent-based Attack Vectors for System-level Compromise](https://arxiv.org/abs/2507.06850)
+122. [To Trust or Not to Trust: Attention-based Trust Management for LLM Multi-Agent Systems](https://arxiv.org/abs/2506.02546)
+123. [Toward Trustworthy Agentic AI: A Multimodal Framework for Preventing Prompt Injection Attacks](https://arxiv.org/abs/2512.23557)
+124. [When Persuasion Overrides Truth in Multi-Agent LLM Debates: Introducing a Confidence-Weighted Persuasion Override Rate (CW-POR)](https://arxiv.org/abs/2504.00374)
+125. [AgentWorm: Self-Propagating Attacks Across LLM Agent Ecosystems](https://arxiv.org/abs/2603.15727)
+126. [Algorithmic Cowardice: Cognitive Dissonance and Moral Conformity in Multi-Agent LLM Interactions](https://doi.org/10.5281/zenodo.18902320)
+127. [Architecture Matters: Comparing RAG Systems under Knowledge Base Poisoning](https://arxiv.org/abs/2605.05632)
+128. [Auditing Agent Harness Safety](https://arxiv.org/abs/2605.14271)
+129. [Autonomous LLM Agent Worms: Cross-Platform Propagation, Automated Discovery and Temporal Re-Entry Defense](https://arxiv.org/abs/2605.02812)
+130. [Beyond Goodhart's Law: A Dynamic Benchmark for Evaluating Compliance in Multi-Agent Systems](https://arxiv.org/abs/2606.07805)
+131. [Beyond Input Guardrails: Reconstructing Cross-Agent Semantic Flows for Execution-Aware Attack Detection](https://arxiv.org/abs/2603.04469)
+132. [Beyond Single-Agent Alignment: Preventing Context-Fragmented Violations in Multi-Agent Systems](https://arxiv.org/abs/2604.22879)
+133. [Blind Spots in the Guard: How Domain-Camouflaged Injection Attacks Evade Detection in Multi-Agent LLM Systems](https://arxiv.org/abs/2605.22001)
+134. [Byzantine Cheap Talk: Adversarial Resilience and Topology Effects in LLM Coordination Games](https://arxiv.org/abs/2606.07790)
+135. [CalBench: Evaluating Coordination-Privacy Trade-offs in Multi-Agent LLMs](https://arxiv.org/abs/2605.09823)
+136. [CASPIAN: Online Detection and Attribution of Cascade Attacks in LLM Multi-Agent Systems via Cross-Channel Causal Monitoring](https://arxiv.org/abs/2605.19240)
+137. [Collective Hallucination in Multi-Agent LLMs:Modeling and Defense](https://arxiv.org/abs/2606.07941)
+138. [Colosseum: Auditing Collusion in Cooperative Multi-Agent Systems](https://arxiv.org/abs/2602.15198)
+139. [Defending LLM-based Multi-Agent Systems Against Cooperative Attacks with Sentence-Level Rectification](https://arxiv.org/abs/2605.28104)
+140. [Detecting Multi-Agent Collusion Through Multi-Agent Interpretability](https://arxiv.org/abs/2604.01151)
+141. [Distributed General-Purpose Agent Networks: Architecture, Key Mechanisms, and Prototypes](https://arxiv.org/abs/2606.17368)
+142. [Don't Trust Stubborn Neighbors: A Security Framework for Agentic Networks](https://arxiv.org/abs/2603.15809)
+143. [Dynamic Attentional Context Scoping: Agent-Triggered Focus Sessions for Isolated Per-Agent Steering in Multi-Agent LLM Orchestration](https://arxiv.org/abs/2604.07911)
+144. [DynaTrust: Defending Multi-Agent Systems Against Sleeper Agents via Dynamic Trust Graphs](https://arxiv.org/abs/2603.15661)
+145. [EquiMem: Calibrating Shared Memory in Multi-Agent Debate via Game-Theoretic Equilibrium](https://arxiv.org/abs/2605.09278)
+146. [FlowSteer: Prompt-Only Workflow Steering Exposes Planning-Time Vulnerabilities in Multi-Agent LLM Systems](https://arxiv.org/abs/2605.11514)
+147. [From Debate to Decision: Conformal Social Choice for Safe Multi-Agent Deliberation](https://arxiv.org/abs/2604.07667)
+148. [From Spark to Fire: Modeling and Mitigating Error Cascades in LLM-Based Multi-Agent Collaboration](https://arxiv.org/abs/2603.04474)
+149. [GAMBIT: A Three-Mode Benchmark for Adversarial Robustness in Multi-Agent LLM Collectives](https://arxiv.org/abs/2605.09027)
+150. [Game-Theoretic Multi-Agent Control for Robust Contextual Reasoning in LLMs](https://arxiv.org/abs/2606.10322)
+151. [GAMMAF: A Common Framework for Graph-Based Anomaly Monitoring Benchmarking in LLM Multi-Agent Systems](https://arxiv.org/abs/2604.24477)
+152. [Governed Shared Memory for Multi-Agent LLM Systems](https://arxiv.org/abs/2606.24535)
+153. [HARP: Measuring Harm Amplification in Multi-Agent LLM Systems](https://arxiv.org/abs/2605.27489)
+154. [INFA-Guard: Mitigating Malicious Propagation via Infection-Aware Safeguarding in LLM-Based Multi-Agent Systems](https://arxiv.org/abs/2601.14667)
+155. [Insider Attacks in Multi-Agent LLM Consensus Systems](https://arxiv.org/abs/2605.08268)
+156. [Institutional AI: Governing LLM Collusion in Multi-Agent Cournot Markets via Public Governance Graphs](https://arxiv.org/abs/2601.11369)
+157. [Kill-Chain Canaries: Stage-Level Tracking of Prompt Injection Across Attack Surfaces and Model Safety Tiers](https://arxiv.org/abs/2603.28013)
+158. [LCGuard: Latent Communication Guard for Safe KV Sharing in Multi-Agent Systems](https://arxiv.org/abs/2605.22786)
+159. [LDP: An Identity-Aware Protocol for Multi-Agent LLM Systems](https://doi.org/10.21203/rs.3.rs-9121599/v1)
+160. [Linguistic Firewall: Geometry as Defense in Multi-Agent Systems Routing](https://arxiv.org/abs/2606.30555)
+161. [LLM Drift Experiment: A Framework for Quantifying Behavioral Decay in Adversarial Multi-Agent Simulations](https://doi.org/10.5281/zenodo.20032071)
+162. [Memetic Cascade Detection and Symbolic Immunity in Multi-Agent LLM Systems](https://doi.org/10.5281/zenodo.19244877)
+163. [MESA: Prioritizing Vulnerable Communication Channels for Securing Multi-Agent Systems](https://arxiv.org/abs/2606.30602)
+164. [Multi-Agent Orchestration: Coordination, Trust, and Cascading Failures](https://doi.org/10.2139/ssrn.6734798)
+165. [Nexus Protocol: A Cryptographically Secure, Zero-Latency Semantic Routing Engine for Multi-Agent Systems](https://doi.org/10.2139/ssrn.7127218)
+166. [No Action Without a NOD: A Heterogeneous Multi-Agent Architecture for Reliable Service Agents](https://arxiv.org/abs/2605.12240)
+167. [OMNI-LEAK: Orchestrator Multi-Agent Network Induced Data Leakage](https://arxiv.org/abs/2602.13477)
+168. [Pratyahara: A Neural Tissue Defense Model for Detecting Compromised Agents in Multi-Agent Networks](https://doi.org/10.5281/zenodo.19628588)
+169. [PRISM: Generation-Time Detection and Mitigation of Secret Leakage in Multi-Agent LLM Pipelines](https://arxiv.org/abs/2605.10614)
+170. [Prompt Injection Mitigation with Agentic AI, Nested Learning, and AI Sustainability via Semantic Caching](https://arxiv.org/abs/2601.13186)
+171. [Prompt Optimization Enables Stable Algorithmic Collusion in LLM Agents](https://arxiv.org/abs/2604.17774)
+172. [PropGuard: Safeguarding LLM-MAS via Propagation-Aware Exploration and Remediation](https://arxiv.org/abs/2605.16346)
+173. [Robust Multi-Agent LLMs under Byzantine Faults](https://arxiv.org/abs/2605.09076)
+174. [SAIGuard: Communication-State Simulation for Proactive Defense of LLM Multi-Agent Systems](https://arxiv.org/abs/2606.12474)
+175. [Security Engineering of OpenClaw: Analyzing Attack Surface Expansion and Trust-Boundary Violations](https://arxiv.org/abs/2606.15008)
+176. [Semantic Taint Propagation: Embedding-Based Semantic Flow Monitoring for Multi-Agent Large Language Model Systems](https://doi.org/10.5281/zenodo.20834834)
+177. [SentinelAgent: Intent-Verified Delegation Chains for Securing Federal Multi-Agent AI Systems](https://arxiv.org/abs/2604.02767)
+178. [SGTO-MAS: Secure Gorilla Troops Optimization for Multi-Agent LLM Systems](https://arxiv.org/abs/2606.07940)
+179. [Smarter Saboteurs, Better Fixers: Scaling&Security in Linear Multi-Agent Workflows](https://arxiv.org/abs/2606.12709)
+180. [SNEAK: Evaluating Strategic Communication and Information Leakage in Large Language Models](https://arxiv.org/abs/2603.29846)
+181. [The Capability Paradox: How Smarter Auditors Make Multi-Agent Systems Less Secure](https://arxiv.org/abs/2605.17480)
+182. [The Consensus Trap: Rescuing Multi-Agent LLMs from Adversarial Majorities via Token-Level Collaboration](https://arxiv.org/abs/2604.17139)
+183. [Towards Security-Auditable LLM Agents: A Unified Graph Representation](https://arxiv.org/abs/2605.06812)
+184. [TrinityGuard: A Unified Framework for Safeguarding Multi-Agent Systems](https://arxiv.org/abs/2603.15408)
+185. [TRUST: A Framework for Decentralized AI Service v.0.1](https://arxiv.org/abs/2604.27132)
+186. [WebWeaver: Breaking Topology Confidentiality in LLM Multi-Agent Systems with Stealthy Context-Based Inference](https://arxiv.org/abs/2603.11132)
+187. [When Child Inherits: Modeling and Exploiting Subagent Spawn in Multi-Agent Networks](https://arxiv.org/abs/2605.08460)
+188. [When Latent Agents Lie: KV-Cache Integrity in Multi-Agent LLM Collaboration](https://arxiv.org/abs/2606.28958)
+189. [Tool Use Enables Undetectable Steganography in Multi-Agent LLM Systems](https://doi.org/10.48550/arXiv.2606.28425)
diff --git a/scripts/build_artifact_source_links.py b/scripts/build_artifact_source_links.py
index fce3dbe..5c9d7a5 100644
--- a/scripts/build_artifact_source_links.py
+++ b/scripts/build_artifact_source_links.py
@@ -20,73 +20,43 @@ def read_rows(name: str) -> list[dict[str, str]]:
     return rows
 
 
-def source_url(row: dict[str, str]) -> tuple[str, str]:
+def source_url(row: dict[str, str]) -> str:
     doi = (row.get("doi") or "").strip()
     arxiv = (row.get("arxiv_id") or "").strip()
     primary = (row.get("primary_url") or "").strip()
 
-    # Prefer durable scholarly identifiers over aggregator URLs.
     if doi and doi.upper() != "N/A":
-        return f"https://doi.org/{doi}", "DOI"
+        return f"https://doi.org/{doi}"
     if arxiv and arxiv.upper() != "N/A":
-        return f"https://arxiv.org/abs/{arxiv}", "arXiv"
+        return f"https://arxiv.org/abs/{arxiv}"
     if primary and primary.upper() != "N/A":
-        return primary, "Primary source"
-    raise SystemExit(f"No stable source locator for {row.get('work_key')}: {row.get('title')}")
+        return primary
+    raise SystemExit(f"No stable source locator for {row.get('title')}")
 
 
 def esc(text: str) -> str:
     return text.replace("[", "\\[").replace("]", "\\]")
 
 
-def render_section(label: str, rows: list[dict[str, str]], start: int) -> tuple[list[str], int]:
-    lines = [f"## {label} ({len(rows)})", ""]
-    n = start
-    for row in rows:
-        url, kind = source_url(row)
-        title = esc((row.get("title") or "").strip())
-        venue = (row.get("venue") or "").strip() or "venue not recorded"
-        year = (row.get("year") or "").strip() or (row.get("publication_date") or "")[:4]
-        contribution = (row.get("dominant_contribution") or "").strip() or "unspecified"
-        work_key = (row.get("work_key") or "").strip()
-        lines.append(
-            f"{n}. [{title}]({url}) — **{contribution}** · {venue} · {year} · {kind} · `{work_key}`"
-        )
-        n += 1
-    lines.append("")
-    return lines, n
-
-
 def main() -> None:
-    set1 = read_rows("set1_core")
-    set2 = read_rows("set2_emerging")
-    all_rows = set1 + set2
-    if len(all_rows) != 189:
-        raise SystemExit(f"expected 189 active works, found {len(all_rows)}")
-    keys = [r.get("work_key", "") for r in all_rows]
-    if len(keys) != len(set(keys)):
-        raise SystemExit("duplicate work_key in active corpus")
+    rows = read_rows("set1_core") + read_rows("set2_emerging")
+    if len(rows) != 189:
+        raise SystemExit(f"expected 189 active works, found {len(rows)}")
 
     lines = [
         "# Source Links for the 189-Work MAS-Security Corpus",
         "",
-        "This directory is the source-access layer for the USENIX artifact. It lists every active corpus work with at least one stable, clickable locator. Third-party PDFs are not redistributed here; the links point to DOI, arXiv, or the recorded primary source.",
-        "",
-        "Active corpus: **92 Set 1 + 97 Set 2 = 189 works**.",
-        "",
-        "Source-link priority is **DOI → arXiv → recorded primary URL** so that durable scholarly identifiers are preferred over aggregator pages. Corpus membership and taxonomy remain authoritative in `../corpus/set1_core.csv` and `../corpus/set2_emerging.csv`.",
+        "This page provides a stable source link for each of the 189 works in the corpus.",
         "",
     ]
-    section, next_n = render_section("Set 1: mature MAS-security works", set1, 1)
-    lines.extend(section)
-    section, next_n = render_section("Set 2: emerging MAS-security works", set2, next_n)
-    lines.extend(section)
-    if next_n != 190:
-        raise SystemExit(f"numbering error: next index is {next_n}")
+
+    for i, row in enumerate(rows, start=1):
+        title = esc((row.get("title") or "").strip())
+        lines.append(f"{i}. [{title}]({source_url(row)})")
 
     OUT.parent.mkdir(parents=True, exist_ok=True)
     OUT.write_text("\n".join(lines).rstrip() + "\n", encoding="utf-8")
-    print(f"Wrote {OUT.relative_to(ROOT)} with {len(all_rows)} linked works")
+    print(f"Wrote {OUT.relative_to(ROOT)} with {len(rows)} linked works")
 
 
 if __name__ == "__main__":