The Trust Paradox in LLM-Based Multi-Agent Systems: When Collaboration Becomes a Security Vulnerability

TL;DR

The paper addresses a core problem in LLM-based multi-agent systems: inter-agent trust can improve coordination but simultaneously expand exposure and authorization risks. It formalizes the Trust-Vulnerability Paradox (TVP) by parameterizing trust with $\tau$, and introduces unified metrics, Over-Exposure Rate ($OER$) and Authorization Drift ($AD$), to quantify how trust shapes information leakage across 19 scenarios and 1,488 agent-agent chains using multiple backends ($m$) and orchestration frameworks ($f$). Empirical results show a consistent, monotonic increase of $OER$ and $AD$ with $\tau$, revealing an efficiency-safety trade-off; cross-model and cross-framework analyses reveal heterogeneous mappings, while two defenses—Sensitive-Information Repartitioning and Guardian-Agent (GA-Agent) enablement—mitigate leakage and stabilize risk across trust levels. The work argues for treating trust as a first-class security variable in MAS design, offering defensible, pluggable safeguards and a reproducible dataset to enable scalable, production-like validation of trust-aware safety controls.

Abstract

Multi-agent systems powered by large language models are advancing rapidly, yet the tension between mutual trust and security remains underexplored. We introduce and empirically validate the Trust-Vulnerability Paradox (TVP): increasing inter-agent trust to enhance coordination simultaneously expands risks of over-exposure and over-authorization. To investigate this paradox, we construct a scenario-game dataset spanning 3 macro scenes and 19 sub-scenes, and run extensive closed-loop interactions with trust explicitly parameterized. Using Minimum Necessary Information (MNI) as the safety baseline, we propose two unified metrics: Over-Exposure Rate (OER) to detect boundary violations, and Authorization Drift (AD) to capture sensitivity to trust levels. Results across multiple model backends and orchestration frameworks reveal consistent trends: higher trust improves task success but also heightens exposure risks, with heterogeneous trust-to-risk mappings across systems. We further examine defenses such as Sensitive Information Repartitioning and Guardian-Agent enablement, both of which reduce OER and attenuate AD. Overall, this study formalizes TVP, establishes reproducible baselines with unified metrics, and demonstrates that trust must be modeled and scheduled as a first-class security variable in multi-agent system design.

Figures (10)

• Figure 1: Overall Experimental Workflow
• Figure 2: Secondary Distribution of Sensitive Information
• Figure 3: Comparison of OER as a function of $\tau$ across orchestration frameworks (Model: DeepSeek)
• Figure 4: Authorization Drift (AD): model vs. framework
• Figure 5: Comparison of OER as a function of $\tau$ across model backends under the AgentScope framework