Terrarium: Revisiting the Blackboard for Multi-Agent Safety, Privacy, and Security Studies

TL;DR

Terrarium introduces a modular blackboard-based testbed for studying safety, privacy, and security in instruction-augmented LLM-driven MAS solving DCOPs. It formalizes MAS as instruction-augmented DCOPs with a ground-truth objective $F^\star$ and context-dependent policies, enabling controlled evaluation of misalignment, data exfiltration, and DoS-style attacks. The framework emphasizes modularity, configurability, and observability, providing attack surfaces and metrics to rapidly prototype defenses and compare configurations. By enabling diverse problem settings (Meeting Scheduling, Personal Assistant, Smart-Home) and security scenarios, Terrarium advances trustworthy multi-agent systems with a practical, extensible testbed for researchers and practitioners.

Abstract

A multi-agent system (MAS) powered by large language models (LLMs) can automate tedious user tasks such as meeting scheduling that requires inter-agent collaboration. LLMs enable nuanced protocols that account for unstructured private data, user constraints, and preferences. However, this design introduces new risks, including misalignment and attacks by malicious parties that compromise agents or steal user data. In this paper, we propose the Terrarium framework for fine-grained study on safety, privacy, and security in LLM-based MAS. We repurpose the blackboard design, an early approach in multi-agent systems, to create a modular, configurable testbed for multi-agent collaboration. We identify key attack vectors such as misalignment, malicious agents, compromised communication, and data poisoning. We implement three collaborative MAS scenarios with four representative attacks to demonstrate the framework's flexibility. By providing tools to rapidly prototype, evaluate, and iterate on defenses and designs, Terrarium aims to accelerate progress toward trustworthy multi-agent systems.

Figures (3)

• Figure 1: Terrarium Trajectory. In the MeetingScheduling domain mahmud2025collabmahmud2025distributed, organizer agents are tasked to assign a discrete meeting slot $s_i$ for a meeting $i$ such that their actions maximize a joint objective composed of domain-specific factors, $F(s_1, s_2, s_3) = F_1(s_1, s_2, s_3) + F_2(s_1, s_2, s_3)$. Each agent has private preferences/data and a set of tools that they can utilize to interact with other agents (e.g., get_messages(), post_message()) or the environment (e.g., schedule()). The blackboards are used as a communication proxy to enable inter-agent communication and are initialized through a coordination graph.
• Figure 2: Terrarium is composed of multiple modules that are core to MAS communication and interaction such as agents, environment, blackboards, the communication protocol, and tools. For instance, an agent may post messages to a blackboard to communicate intentions and goals, call environment-dependent tools for search and observation (e.g., reading sensors for energy monitoring) or external tools (e.g., web search), and execute actions in the form of action tools that change the dynamics of the environment. The environment module is an isolated and self-sustaining simulator that takes in agent actions, synchronously or asynchronously, and gives each agent an observation (i.e., new context). To enable communication between agents, we initialize a set of blackboards through a configurable factor graph that determines the agent membership of each blackboard.
• Figure 3: Terrarium implementation.

Theorems & Definitions (1)

• Definition 1: Instruction-Augmented DCOPs