---
title: "CORBA — paper by Zhou et al. (2026) — summary and ideas"
description: "They define a new threat class, Denial-of-Collaboration (DoC): the system keeps… 0.25 perplexity. 45 references, cited by 6 papers here."
authors: ["Zhenhong Zhou", "Zherui Li", "Jie Zhang", "Yuanhe Zhang", "Kun Wang", "Yang Liu", "Qing Guo"]
year: 2026
venue: "Findings of the Association for Computational Linguistics: ACL 2026"
source: "https://aclanthology.org/2026.findings-acl.342/"
doi: "10.18653/v1/2026.findings-acl.342"
licence: "CC BY 4.0 (ACL Anthology)"
licence_url: "https://creativecommons.org/licenses/by/4.0/"
summary_licence: "Elamur Cosmic License"
canonical: "https://research.elamur.ai/free/en/papers/zhou-2026-corba-contagious-recursive-blocking-attacks/"
---
[Elamur Research](https://md.research.elamur.ai/free/en/) · [this page in HTML](https://research.elamur.ai/free/en/papers/zhou-2026-corba-contagious-recursive-blocking-attacks/)

[home](https://md.research.elamur.ai/free/en/) / [papers](https://md.research.elamur.ai/free/en/papers/) / [2026](https://md.research.elamur.ai/free/en/papers/2026/page/2/) / CORBA: Contagious Recursive Blocking Attacks on Multi-Agent Systems Based on Large Language Models

# CORBA: Contagious Recursive Blocking Attacks on Multi-Agent Systems Based on Large Language Models

**Authors:** [Zhenhong Zhou](https://md.research.elamur.ai/free/en/authors/zhenhong-zhou/), Zherui Li, [Jie Zhang](https://md.research.elamur.ai/free/en/authors/jie-zhang/), [Yuanhe Zhang](https://md.research.elamur.ai/free/en/authors/yuanhe-zhang/), [Kun Wang](https://md.research.elamur.ai/free/en/authors/kun-wang/), [Yang Liu](https://md.research.elamur.ai/free/en/authors/yang-liu/) and [Qing Guo](https://md.research.elamur.ai/free/en/authors/qing-guo/) · **Year:** 2026 · **Venue:** [Findings of the Association for Computational Linguistics: ACL 2026](https://md.research.elamur.ai/free/en/venues/findings/) ([Findings of the Association for Computational Linguistics 2026](https://md.research.elamur.ai/free/en/venues/findings/2026/)) · **Publisher:** [Association for Computational Linguistics](https://md.research.elamur.ai/free/en/publishers/association-for-computational-linguistics/) · **Licence:** [CC BY 4.0 (ACL Anthology)](https://creativecommons.org/licenses/by/4.0/)

**Links:** [Publisher's page](https://aclanthology.org/2026.findings-acl.342/) · [PDF](https://aclanthology.org/2026.findings-acl.342.pdf) · [DOI 10.18653/v1/2026.findings-acl.342](https://doi.org/10.18653/v1/2026.findings-acl.342) · [OpenAlex](https://openalex.org/W4407806913)

**Citations:** 1 citations (OpenAlex, 2026-10-14) · [6](https://md.research.elamur.ai/free/en/papers/zhou-2026-corba-contagious-recursive-blocking-attacks/cited-by/) in our library, of the 149,439 papers whose bibliographies we read

## Summary
The paper identifies a security gap in LLM-based multi-agent systems (LLM-MASs). Prior work mostly studied harmful content or attacks on single models and services. Here the authors target the cooperation between agents. They define a new threat class, Denial-of-Collaboration (DoC): the system keeps running but does no useful work, because its own communication graph spreads a useless task. They formalize DoC on a directed agent graph and present CORBA as a concrete attack. CORBA is an innocuous-looking injected instruction with two properties. Self-sustainment makes an agent keep re-processing the instruction. Contagion makes it forward the full instruction to every neighbor. Together, these eventually lock all reachable agents. Experiments cover AutoGen, Camel and a custom open-ended MAS, several LLM backbones and five topologies. CORBA paralyzes systems where ordinary prompt injection fails to spread. Because the instruction carries no harmful semantics, standard safety checks rarely flag it. This points to the need for defenses that watch collaboration behavior and resource use, not just content.

## Key points
- CORBA reaches about 85% average attack success on AutoGen and Camel. It is evaluated with the P-ASR and PTN metrics against a prompt-injection baseline.
- Tested backbones include GPT-4o-mini, GPT-4, Qwen2.5-7B and Gemini-2.0-Flash. Topologies are chain, cycle, tree, star and random graphs.
- In the open-ended MAS, CORBA reaches nearly 100% P-ASR within about 20 turns, faster and more reliably than the baseline.
- Existing defenses perform poorly against CORBA:
  - an LLM checker based on GPT-4o-2024-08-06 rarely flags it;
  - an in-system agent monitor intercepts it at a rate under 0.25;
  - perplexity filtering with Llama-3-8B-Instruct, Gemma-2-9B-it and Mistral-7B-Instruct-v0.3 finds CORBA prompts about as fluent as normal text.
- Code is released at github.com/zhrli324/Corba. The authors name resource monitoring as a promising direction for future defenses.

*Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.*

## Institutions

- [Nanyang Technological University](https://md.research.elamur.ai/free/en/universities/nanyang-technological-university/) — University, Singapore, Singapore · 156 works · 25,644 citations
- [Beijing University of Posts and Telecommunications](https://md.research.elamur.ai/free/en/universities/beijing-university-of-posts-and-telecommunications/) — University, Beijing, China · 57 works · 32,843 citations
- [Agency for Science, Technology and Research](https://md.research.elamur.ai/free/en/government/agency-for-science-technology-and-research/) — Government body, Singapore, Singapore · 30 works · 14,235 citations

📚 Shelves (5): [🖥️ Computer Science](https://md.research.elamur.ai/free/en/shelves/computer-science/) · 16,667 works · [🤖 Artificial Intelligence](https://md.research.elamur.ai/free/en/shelves/computer-science/artificial-intelligence/) · 16,194 works · [🤝 Social Sciences](https://md.research.elamur.ai/free/en/shelves/social-sciences/) · 1,772 works · [🤝 Sociology and Political Science](https://md.research.elamur.ai/free/en/shelves/social-sciences/sociology-and-political-science/) · 577 works · [🌐 Computer Networks and Communications](https://md.research.elamur.ai/free/en/shelves/computer-science/computer-networks-and-communications/) · 64 works

## Cite

Cite as: Zhenhong Zhou, Zherui Li, Jie Zhang, Yuanhe Zhang, Kun Wang, Yang Liu and Qing Guo. 2026. CORBA: Contagious Recursive Blocking Attacks on Multi-Agent Systems Based on Large Language Models. Findings of the Association for Computational Linguistics: ACL 2026.

The paper itself, not this page. BibTeX from the library's record of the work.

```bibtex
@inproceedings{zhou2026corba,
  title = {{CORBA: Contagious Recursive Blocking Attacks on Multi-Agent Systems Based on Large Language Models}},
  author = {Zhenhong Zhou, Zherui Li, Jie Zhang, Yuanhe Zhang, Kun Wang, Yang Liu and Qing Guo},
  booktitle = {Findings of the Association for Computational Linguistics: ACL 2026},
  year = {2026},
  doi = {10.18653/v1/2026.findings-acl.342},
  url = {https://doi.org/10.18653/v1/2026.findings-acl.342}
}
```

- [← previous Confidence Estimation for LLMs in Multi-turn Interactions](https://md.research.elamur.ai/free/en/papers/zhang-2026-confidence-estimation-llms-multi-turn/)
- [next → DebateQA: Evaluating Question Answering on Debatable Knowledge](https://md.research.elamur.ai/free/en/papers/xu-2026-debateqa-evaluating-question-answering-debatable/)
- [↑ back to papers of 2026](https://md.research.elamur.ai/free/en/papers/2026/page/2/)

## References

45 references, 19 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

1. Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, et al. 2023. [Gpt-4 technical report](https://md.research.elamur.ai/free/en/papers/openai-2023-gpt-4-technical-report/). arXiv preprint arXiv:2303.08774.
2. Gabriel Alon and Michael Kamfonas. 2023. [Detecting language model attacks with perplexity](https://md.research.elamur.ai/free/en/papers/alon-2023-detecting-language-model-attacks-perplexity/). arXiv preprint arXiv:2308.14132.
3. Jinheon Baek, Sujay Kumar Jauhar, Silviu Cucerzan, and Sung Ju Hwang. 2024. [Researchagent: Iterative research idea generation over scientific literature with large language models](https://md.research.elamur.ai/free/en/papers/baek-2024-researchagent-iterative-research-idea/). arXiv preprint arXiv:2404.07738.
4. Chi-Min Chan, Jianxuan Yu, Weize Chen, Chunyang Jiang, Xinyu Liu, Weijie Shi, Zhiyuan Liu, Wei Xue, and Yike Guo. 2024. Agentmonitor: A plug-and-play framework for predictive and secure multi-agent systems. arXiv preprint arXiv:2408.14972. — [arXiv:2408.14972](https://arxiv.org/abs/2408.14972) [find](https://scholar.google.com/scholar?q=Chi%2DMin+Chan%2C+Jianxuan+Yu%2C+Weize+Chen%2C+Chunyang+Jiang%2C+Xinyu+Liu%2C+Weijie+Shi%2C+Zhiyuan+Liu%2C+Wei+Xue%2C+and+Yike+Guo%2E+2024%2E+Agentmonitor%3A+A+plug%2Dand%2Dplay+framework+for+predictive+and+secure+multi%2Dagent+sy)
5. Patrick Chao, Alexander Robey, Edgar Dobriban, Hamed Hassani, George J Pappas, and Eric Wong. 2023. [Jailbreaking black box large language models in twenty queries](https://md.research.elamur.ai/free/en/papers/chao-2023-jailbreaking-black-box-large-language/). arXiv preprint arXiv:2310.08419.
6. Weize Chen, Yusheng Su, Jingwei Zuo, Cheng Yang, Chenfei Yuan, Chi-Min Chan, Heyang Yu, Yaxi Lu, Yi-Hsin Hung, Chen Qian, et al. 2023. [Agentverse: Facilitating multi-agent collaboration and exploring emergent behaviors](https://md.research.elamur.ai/free/en/papers/chen-2023-agentverse-facilitating-multi-agent/). In The Twelfth International Conference on Learning Representations.
7. Gelei Deng, Yi Liu, Yuekang Li, Kailong Wang, Ying Zhang, Zefeng Li, Haoyu Wang, Tianwei Zhang, and Yang Liu. 2023. Jailbreaker: Automated jailbreak across multiple large language model chatbots. arXiv preprint arXiv:2307.08715. — [arXiv:2307.08715](https://arxiv.org/abs/2307.08715) [find](https://scholar.google.com/scholar?q=Gelei+Deng%2C+Yi+Liu%2C+Yuekang+Li%2C+Kailong+Wang%2C+Ying+Zhang%2C+Zefeng+Li%2C+Haoyu+Wang%2C+Tianwei+Zhang%2C+and+Yang+Liu%2E+2023%2E+Jailbreaker%3A+Automated+jailbreak+across+multiple+large+language+model+chatbots%2E+arXi)
8. Jianshuo Dong, Ziyuan Zhang, Qingjie Zhang, Han Qiu, Tianwei Zhang, Hao Wang, Hewu Li, Qi Li, Chao Zhang, and Ke Xu. 2025a. An engorgio prompt makes large language model babble on. In The Thirteenth International Conference on Learning Representations. [find](https://scholar.google.com/scholar?q=Jianshuo+Dong%2C+Ziyuan+Zhang%2C+Qingjie+Zhang%2C+Han+Qiu%2C+Tianwei+Zhang%2C+Hao+Wang%2C+Hewu+Li%2C+Qi+Li%2C+Chao+Zhang%2C+and+Ke+Xu%2E+2025a%2E+An+engorgio+prompt+makes+large+language+model+babble+on%2E+In+The+Thirteenth+I)
9. Shen Dong, Shaochen Xu, Pengfei He, Yige Li, Jiliang Tang, Tianming Liu, Hui Liu, and Zhen Xiang. 2025b. A practical memory injection attack against llm agents. arXiv preprint arXiv:2503.03704. — [arXiv:2503.03704](https://arxiv.org/abs/2503.03704) [find](https://scholar.google.com/scholar?q=Shen+Dong%2C+Shaochen+Xu%2C+Pengfei+He%2C+Yige+Li%2C+Jiliang+Tang%2C+Tianming+Liu%2C+Hui+Liu%2C+and+Zhen+Xiang%2E+2025b%2E+A+practical+memory+injection+attack+against+llm+agents%2E+arXiv+preprint+arXiv%3A2503%2E03704%2E+%E2%80%94+%5BarX)
10. Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Amy Yang, Angela Fan, et al. 2024. [The llama 3 herd of models](https://md.research.elamur.ai/free/en/papers/grattafiori-2024-llama-3-herd-models/). arXiv preprint arXiv:2407.21783.
11. Jiyuan Fu, Kaixun Jiang, Lingyi Hong, Jinglun Li, Haijing Guo, Dingkang Yang, Zhaoyu Chen, and Wenqiang Zhang. 2025. Lingoloop attack: Trapping mllms via linguistic context and state entrapment into endless loops. arXiv preprint arXiv:2506.14493. — [arXiv:2506.14493](https://arxiv.org/abs/2506.14493) [find](https://scholar.google.com/scholar?q=Jiyuan+Fu%2C+Kaixun+Jiang%2C+Lingyi+Hong%2C+Jinglun+Li%2C+Haijing+Guo%2C+Dingkang+Yang%2C+Zhaoyu+Chen%2C+and+Wenqiang+Zhang%2E+2025%2E+Lingoloop+attack%3A+Trapping+mllms+via+linguistic+context+and+state+entrapment+into+e)
12. Kuofeng Gao, Tianyu Pang, Chao Du, Yong Yang, Shu-Tao Xia, and Min Lin. 2024. Denial-of-service poisoning attacks against large language models. arXiv preprint arXiv:2410.10760. — [arXiv:2410.10760](https://arxiv.org/abs/2410.10760) [find](https://scholar.google.com/scholar?q=Kuofeng+Gao%2C+Tianyu+Pang%2C+Chao+Du%2C+Yong+Yang%2C+Shu%2DTao+Xia%2C+and+Min+Lin%2E+2024%2E+Denial%2Dof%2Dservice+poisoning+attacks+against+large+language+models%2E+arXiv+preprint+arXiv%3A2410%2E10760%2E+%E2%80%94+%5BarXiv%3A2410%2E10760%5D%28h)
13. Jonas Geiping, Alex Stein, Manli Shu, Khalid Saifullah, Yuxin Wen, and Tom Goldstein. 2024. Coercing llms to do and reveal (almost) anything. In ICLR 2024 Workshop on Secure and Trustworthy Large Language Models. [find](https://scholar.google.com/scholar?q=Jonas+Geiping%2C+Alex+Stein%2C+Manli+Shu%2C+Khalid+Saifullah%2C+Yuxin+Wen%2C+and+Tom+Goldstein%2E+2024%2E+Coercing+llms+to+do+and+reveal+%28almost%29+anything%2E+In+ICLR+2024+Workshop+on+Secure+and+Trustworthy+Large+Lang)
14. Xiangming Gu, Xiaosen Zheng, Tianyu Pang, Chao Du, Qian Liu, Ye Wang, Jing Jiang, and Min Lin. 2024. Agent smith: A single image can jailbreak one million multimodal llm agents exponentially fast. In Forty-first International Conference on Machine Learning. [find](https://scholar.google.com/scholar?q=Xiangming+Gu%2C+Xiaosen+Zheng%2C+Tianyu+Pang%2C+Chao+Du%2C+Qian+Liu%2C+Ye+Wang%2C+Jing+Jiang%2C+and+Min+Lin%2E+2024%2E+Agent+smith%3A+A+single+image+can+jailbreak+one+million+multimodal+llm+agents+exponentially+fast%2E+In+)
15. T Guo, X Chen, Y Wang, R Chang, S Pei, NV Chawla, O Wiest, and X Zhang. 2024. [Large language model based multi-agents: A survey of progress and challenges](https://md.research.elamur.ai/free/en/papers/guo-2024-large-language-model-based/). In 33rd International Joint Conference on Artificial Intelligence (IJCAI 2024). IJCAI; Cornell arxiv.
16. Feng He, Tianqing Zhu, Dayong Ye, Bo Liu, Wanlei Zhou, and Philip S Yu. 2024. The emerged security and privacy of llm agent: A survey with case studies. arXiv preprint arXiv:2407.19354. — [arXiv:2407.19354](https://arxiv.org/abs/2407.19354) [find](https://scholar.google.com/scholar?q=Feng+He%2C+Tianqing+Zhu%2C+Dayong+Ye%2C+Bo+Liu%2C+Wanlei+Zhou%2C+and+Philip+S+Yu%2E+2024%2E+The+emerged+security+and+privacy+of+llm+agent%3A+A+survey+with+case+studies%2E+arXiv+preprint+arXiv%3A2407%2E19354%2E+%E2%80%94+%5BarXiv%3A2407%2E)
17. Pengfei He, Yupin Lin, Shen Dong, Han Xu, Yue Xing, and Hui Liu. 2025. Red-teaming llm multi-agent systems via communication attacks. arXiv preprint arXiv:2502.14847. [find](https://scholar.google.com/scholar?q=Pengfei+He%2C+Yupin+Lin%2C+Shen+Dong%2C+Han+Xu%2C+Yue+Xing%2C+and+Hui+Liu%2E+2025%2E+Red%2Dteaming+llm+multi%2Dagent+systems+via+communication+attacks%2E+arXiv+preprint+arXiv%3A2502%2E14847%2E)
18. Wenyue Hua, Lizhou Fan, Lingyao Li, Kai Mei, Jianchao Ji, Yingqiang Ge, Libby Hemphill, and Yongfeng Zhang. 2023. War and peace (waragent): Large language model-based multi-agent simulation of world wars. arXiv preprint arXiv:2311.17227. [find](https://scholar.google.com/scholar?q=Wenyue+Hua%2C+Lizhou+Fan%2C+Lingyao+Li%2C+Kai+Mei%2C+Jianchao+Ji%2C+Yingqiang+Ge%2C+Libby+Hemphill%2C+and+Yongfeng+Zhang%2E+2023%2E+War+and+peace+%28waragent%29%3A+Large+language+model%2Dbased+multi%2Dagent+simulation+of+world+w)
19. Neel Jain, Avi Schwarzschild, Yuxin Wen, Gowthami Somepalli, John Kirchenbauer, Ping-yeh Chiang, Micah Goldblum, Aniruddha Saha, Jonas Geiping, and Tom Goldstein. 2023. [Baseline defenses for adversarial attacks against aligned language models](https://md.research.elamur.ai/free/en/papers/jain-2023-baseline-defenses-adversarial-attacks-against/). arXiv preprint arXiv:2309.00614.
20. Christoph L Schuba, Ivan V Krsul, Markus G Kuhn, Eugene H Spafford, Aurobindo Sundaram, and Diego Zamboni. 1997. Analysis of a denial of service attack on tcp. In Proceedings. 1997 IEEE Symposium on Security and Privacy (Cat. No. 97CB36097), pages 208–223. IEEE. [find](https://scholar.google.com/scholar?q=Christoph+L+Schuba%2C+Ivan+V+Krsul%2C+Markus+G+Kuhn%2C+Eugene+H+Spafford%2C+Aurobindo+Sundaram%2C+and+Diego+Zamboni%2E+1997%2E+Analysis+of+a+denial+of+service+attack+on+tcp%2E+In+Proceedings%2E+1997+IEEE+Symposium+on+S)
21. Albert Q Jiang, Alexandre Sablayrolles, Arthur Mensch, Chris Bamford, Devendra Singh Chaplot, Diego de las Casas, Florian Bressand, Gianna Lengyel, Guillaume Lample, Lucile Saulnier, et al. 2023. Mistral 7b. arXiv preprint arXiv:2310.06825. [find](https://scholar.google.com/scholar?q=Albert+Q+Jiang%2C+Alexandre+Sablayrolles%2C+Arthur+Mensch%2C+Chris+Bamford%2C+Devendra+Singh+Chaplot%2C+Diego+de+las+Casas%2C+Florian+Bressand%2C+Gianna+Lengyel%2C+Guillaume+Lample%2C+Lucile+Saulnier%2C+et+al%2E+2023%2E+Mist)
22. Yongliang Shen, Kaitao Song, Xu Tan, Dongsheng Li, Weiming Lu, and Yueting Zhuang. 2023. [Hugginggpt: Solving ai tasks with chatgpt and its friends in hugging face](https://md.research.elamur.ai/free/en/papers/shen-2023-hugginggpt-solving-ai-tasks-chatgpt/). Advances in Neural Information Processing Systems, 36:38154–38180.
23. Tianjie Ju, Yiting Wang, Xinbei Ma, Pengzhou Cheng, Haodong Zhao, Yulong Wang, Lifeng Liu, Jian Xie, Zhuosheng Zhang, and Gongshen Liu. 2024. Flooding spread of manipulated knowledge in llm-based multi-agent communities. arXiv preprint arXiv:2407.07791. — [arXiv:2407.07791](https://arxiv.org/abs/2407.07791) [find](https://scholar.google.com/scholar?q=Tianjie+Ju%2C+Yiting+Wang%2C+Xinbei+Ma%2C+Pengzhou+Cheng%2C+Haodong+Zhao%2C+Yulong+Wang%2C+Lifeng+Liu%2C+Jian+Xie%2C+Zhuosheng+Zhang%2C+and+Gongshen+Liu%2E+2024%2E+Flooding+spread+of+manipulated+knowledge+in+llm%2Dbased+mult)
24. Yashar Talebirad and Amirhossein Nadiri. 2023. Multi-agent collaboration: Harnessing the power of intelligent llm agents. arXiv preprint arXiv:2306.03314. [find](https://scholar.google.com/scholar?q=Yashar+Talebirad+and+Amirhossein+Nadiri%2E+2023%2E+Multi%2Dagent+collaboration%3A+Harnessing+the+power+of+intelligent+llm+agents%2E+arXiv+preprint+arXiv%3A2306%2E03314%2E)
25. Felix Lau, Stuart H Rubin, Michael H Smith, and Ljiljana Trajkovic. 2000. Distributed denial of service attacks. In Smc 2000 conference proceedings. 2000 ieee international conference on systems, man and cybernetics.’cybernetics evolving to systems, humans, organizations, and their complex interacti… [find](https://scholar.google.com/scholar?q=Felix+Lau%2C+Stuart+H+Rubin%2C+Michael+H+Smith%2C+and+Ljiljana+Trajkovic%2E+2000%2E+Distributed+denial+of+service+attacks%2E+In+Smc+2000+conference+proceedings%2E+2000+ieee+international+conference+on+systems%2C+man+)
26. Guohao Li, Hasan Hammoud, Hani Itani, Dmitrii Khizbullin, and Bernard Ghanem. 2023. [Camel: Communicative agents for" mind" exploration of large language model society](https://md.research.elamur.ai/free/en/papers/li-2023-camel-communicative-agents-mind/). Advances in Neural Information Processing Systems, 36:51991–52008.
27. Zherui Li, Yan Mi, Zhenhong Zhou, Houcheng Jiang, Guibin Zhang, Kun Wang, and Junfeng Fang. 2025. Goal-aware identification and rectification of misinformation in multi-agent systems. Preprint, arXiv:2506.00509. — [arXiv:2506.00509](https://arxiv.org/abs/2506.00509) [find](https://scholar.google.com/scholar?q=Zherui+Li%2C+Yan+Mi%2C+Zhenhong+Zhou%2C+Houcheng+Jiang%2C+Guibin+Zhang%2C+Kun+Wang%2C+and+Junfeng+Fang%2E+2025%2E+Goal%2Daware+identification+and+rectification+of+misinformation+in+multi%2Dagent+systems%2E+Preprint%2C+arXiv%3A)
28. Zijun Liu, Yanzhe Zhang, Peng Li, Yang Liu, and Diyi Yang. 2023. Dynamic llm-agent network: An llm-agent collaboration framework with agent team optimization. arXiv preprint arXiv:2310.02170. [find](https://scholar.google.com/scholar?q=Zijun+Liu%2C+Yanzhe+Zhang%2C+Peng+Li%2C+Yang+Liu%2C+and+Diyi+Yang%2E+2023%2E+Dynamic+llm%2Dagent+network%3A+An+llm%2Dagent+collaboration+framework+with+agent+team+optimization%2E+arXiv+preprint+arXiv%3A2310%2E02170%2E)
29. Joon Sung Park, Joseph C. O’Brien, Carrie J. Cai, Meredith Ringel Morris, Percy Liang, and Michael S. Bernstein. 2023. Generative agents: Interactive simulacra of human behavior. In In the 36th Annual ACM Symposium on User Interface Software and Technology (UIST ’23), UIST ’23, New York, NY, USA. As… [find](https://scholar.google.com/scholar?q=Joon+Sung+Park%2C+Joseph+C%2E+O%E2%80%99Brien%2C+Carrie+J%2E+Cai%2C+Meredith+Ringel+Morris%2C+Percy+Liang%2C+and+Michael+S%2E+Bernstein%2E+2023%2E+Generative+agents%3A+Interactive+simulacra+of+human+behavior%2E+In+In+the+36th+Annual)
30. Joon Sung Park, Carolyn Q Zou, Aaron Shaw, Benjamin Mako Hill, Carrie Cai, Meredith Ringel Morris, Robb Willer, Percy Liang, and Michael S Bernstein. 2024. Generative agent simulations of 1,000 people. arXiv preprint arXiv:2411.10109. [find](https://scholar.google.com/scholar?q=Joon+Sung+Park%2C+Carolyn+Q+Zou%2C+Aaron+Shaw%2C+Benjamin+Mako+Hill%2C+Carrie+Cai%2C+Meredith+Ringel+Morris%2C+Robb+Willer%2C+Percy+Liang%2C+and+Michael+S+Bernstein%2E+2024%2E+Generative+agent+simulations+of+1%2C000+people)
31. Giorgio Piatti, Zhijing Jin, Max Kleiman-Weiner, Bernhard Schölkopf, Mrinmaya Sachan, and Rada Mihalcea. 2024. Cooperate or collapse: Emergence of sustainable cooperation in a society of llm agents. Advances in Neural Information Processing Systems, 37:111715–111759. [find](https://scholar.google.com/scholar?q=Giorgio+Piatti%2C+Zhijing+Jin%2C+Max+Kleiman%2DWeiner%2C+Bernhard+Sch%C3%B6lkopf%2C+Mrinmaya+Sachan%2C+and+Rada+Mihalcea%2E+2024%2E+Cooperate+or+collapse%3A+Emergence+of+sustainable+cooperation+in+a+society+of+llm+agents%2E+A)
32. Gemini Team, Rohan Anil, Sebastian Borgeaud, Jean-Baptiste Alayrac, Jiahui Yu, Radu Soricut, Johan Schalkwyk, Andrew M Dai, Anja Hauth, Katie Millican, et al. 2023. [Gemini: a family of highly capable multimodal models](https://md.research.elamur.ai/free/en/papers/gemini-team-2023-gemini-family-highly-capable-multimodal/). arXiv preprint arXiv:2312.11805.
33. Gemma Team, Morgane Riviere, Shreya Pathak, Pier Giuseppe Sessa, Cassidy Hardin, Surya Bhupatiraju, Léonard Hussenot, Thomas Mesnard, Bobak Shahriari, Alexandre Ramé, et al. 2024. Gemma 2: Improving open language models at a practical size. arXiv preprint arXiv:2408.00118. [find](https://scholar.google.com/scholar?q=Gemma+Team%2C+Morgane+Riviere%2C+Shreya+Pathak%2C+Pier+Giuseppe+Sessa%2C+Cassidy+Hardin%2C+Surya+Bhupatiraju%2C+L%C3%A9onard+Hussenot%2C+Thomas+Mesnard%2C+Bobak+Shahriari%2C+Alexandre+Ram%C3%A9%2C+et+al%2E+2024%2E+Gemma+2%3A+Improving+o)
34. Qingyun Wu, Gagan Bansal, Jieyu Zhang, Yiran Wu, Beibin Li, Erkang Zhu, Li Jiang, Xiaoyun Zhang, Shaokun Zhang, Jiale Liu, et al. 2024. [Autogen: Enabling next-gen llm applications via multi-agent conversation](https://md.research.elamur.ai/free/en/papers/wu-2023-autogen-enabling-next-gen-llm/). In ICLR 2024 Workshop on Large Language Model (LLM) Agents.
35. Zhiheng Xi, Wenxiang Chen, Xin Guo, Wei He, Yiwen Ding, Boyang Hong, Ming Zhang, Junzhe Wang, Senjie Jin, Enyu Zhou, et al. 2025. [The rise and potential of large language model based agents: A survey](https://md.research.elamur.ai/free/en/papers/xi-2023-rise-potential-large-language/). Science China Information Sciences, 68(2):121101.
36. Zihao Xu, Yi Liu, Gelei Deng, Yuekang Li, and Stjepan Picek. 2024. A comprehensive study of jailbreak attack versus defense for large language models. In Findings of the Association for Computational Linguistics ACL 2024, pages 7432–7449. [find](https://scholar.google.com/scholar?q=Zihao+Xu%2C+Yi+Liu%2C+Gelei+Deng%2C+Yuekang+Li%2C+and+Stjepan+Picek%2E+2024%2E+A+comprehensive+study+of+jailbreak+attack+versus+defense+for+large+language+models%2E+In+Findings+of+the+Association+for+Computational+)
37. Shunyu Yao, Jeffrey Zhao, Dian Yu, Nan Du, Izhak Shafran, Karthik R Narasimhan, and Yuan Cao. 2023. [React: Synergizing reasoning and acting in language models](https://md.research.elamur.ai/free/en/papers/yao-2022-react-synergizing-reasoning-acting-language/). In The Eleventh International Conference on Learning Representations.
38. Sibo Yi, Yule Liu, Zhen Sun, Tianshuo Cong, Xinlei He, Jiaxing Song, Ke Xu, and Qi Li. 2024. Jailbreak attacks and defenses against [large language models: A survey](https://md.research.elamur.ai/free/en/papers/minaee-2024-large-language-models-survey/). arXiv preprint arXiv:2407.04295.
39. Miao Yu, Shilong Wang, Guibin Zhang, Junyuan Mao, Chenlong Yin, Qijiong Liu, Qingsong Wen, Kun Wang, and Yang Wang. 2024. Netsafe: Exploring the topological safety of multi-agent networks. arXiv preprint arXiv:2410.15686. — [arXiv:2410.15686](https://arxiv.org/abs/2410.15686) [find](https://scholar.google.com/scholar?q=Miao+Yu%2C+Shilong+Wang%2C+Guibin+Zhang%2C+Junyuan+Mao%2C+Chenlong+Yin%2C+Qijiong+Liu%2C+Qingsong+Wen%2C+Kun+Wang%2C+and+Yang+Wang%2E+2024%2E+Netsafe%3A+Exploring+the+topological+safety+of+multi%2Dagent+networks%2E+arXiv+prepr)
40. Tongxin Yuan, Zhiwei He, Lingzhong Dong, Yiming Wang, Ruijie Zhao, Tian Xia, Lizhen Xu, Binglin Zhou, Li Fangqi, Zhuosheng Zhang, et al. 2024. [R-judge: Benchmarking safety risk awareness for llm agents](https://md.research.elamur.ai/free/en/papers/yuan-2024-r-judge-benchmarking-safety-risk/). In ICLR 2024 Workshop on Large Language Model (LLM) Agents.
41. Yi Zeng, Hongpeng Lin, Jingwen Zhang, Diyi Yang, Ruoxi Jia, and Weiyan Shi. 2024a. [How johnny can persuade LLMs to jailbreak them: Rethinking persuasion to challenge AI safety by humanizing LLMs](https://md.research.elamur.ai/free/en/papers/zeng-2024-how-johnny-can-persuade-llms/). In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Lo…
42. Yifan Zeng, Yiran Wu, Xiao Zhang, Huazheng Wang, and Qingyun Wu. 2024b. Autodefense: Multi-agent llm defense against jailbreak attacks. arXiv preprint arXiv:2403.04783. — [arXiv:2403.04783](https://arxiv.org/abs/2403.04783) [find](https://scholar.google.com/scholar?q=Yifan+Zeng%2C+Yiran+Wu%2C+Xiao+Zhang%2C+Huazheng+Wang%2C+and+Qingyun+Wu%2E+2024b%2E+Autodefense%3A+Multi%2Dagent+llm+defense+against+jailbreak+attacks%2E+arXiv+preprint+arXiv%3A2403%2E04783%2E+%E2%80%94+%5BarXiv%3A2403%2E04783%5D%28https%3A%2F%2Far)
43. Boyang Zhang, Yicong Tan, Yun Shen, Ahmed Salem, Michael Backes, Savvas Zannettou, and Yang Zhang. 2024a. [Breaking agents: Compromising autonomous llm agents through malfunction amplification](https://md.research.elamur.ai/free/en/papers/zhang-2025-breaking-agents-compromising-autonomous-llm/). arXiv preprint arXiv:2407.20859.
44. Yuanhe Zhang, Zhenhong Zhou, Wei Zhang, Xinyue Wang, Xiaojun Jia, Yang Liu, and Sen Su. 2024b. Crabs: Consuming resource via auto-generation for llm-dos attack under black-box settings. arXiv preprint arXiv:2412.13879. [find](https://scholar.google.com/scholar?q=Yuanhe+Zhang%2C+Zhenhong+Zhou%2C+Wei+Zhang%2C+Xinyue+Wang%2C+Xiaojun+Jia%2C+Yang+Liu%2C+and+Sen+Su%2E+2024b%2E+Crabs%3A+Consuming+resource+via+auto%2Dgeneration+for+llm%2Ddos+attack+under+black%2Dbox+settings%2E+arXiv+preprint)
45. Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J Zico Kolter, and Matt Fredrikson. 2023. [Universal and transferable adversarial attacks on aligned language models](https://md.research.elamur.ai/free/en/papers/zou-2023-universal-transferable-adversarial-attacks-aligned/). arXiv preprint arXiv:2307.15043.

*Updated 1 November 2026*