JOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2021
1
Breaking the Secret: Economic Interventions for Combating Collusion in Embodied Multi-Agent Systems
arXiv:2604.23511v1 [cs.CR] 26 Apr 2026
Qi Liu, Xiaohui Chen, Zhihui Zhao, Yaowen Zheng, Dan Yu, Zehua Zhang, Limin Sun and Yongle Chen
Abstract—Collusion among autonomous agents poses a critical security threat in embodied multi-agent systems (MAS), where coordinated behaviors can deviate from global objectives and lead to real-world consequences. Existing defenses, primarily based on identity control or post-hoc behavior analysis, are insufficient to address such threats in embodied settings due to delayed feedback and noisy observations in physical environments, which make behavioral deviations difficult to detect accurately and in a timely manner. To address this challenge, we propose a mutagenic incentive intervention approach that mitigates collusion by reshaping agents’ payoff structures. By rewarding agents who report collusive behavior and penalizing identified participants, the mechanism induces strategic defection and renders collusion unstable. We further design supporting mechanisms, including reporting deposits, smart contract-based reward enforcement, and encrypted communication, to ensure robustness against misuse of the incentive mechanism and retaliation from penalized agents. We implement the proposed approach in both simulated and real-world embodied environments. Experimental results show that our method effectively suppresses collusion by inducing defection, while preserving system efficiency. It achieves performance comparable to the non-collusion baseline and outperforms representative reactive defenses, thereby fulfilling the desired security objectives. These results demonstrate the effectiveness of proactive incentive design as a practical paradigm for securing embodied multi-agent systems. Index Terms—Embodied AI security, Multi-agent system, collusion attacks, economic intervention.
I. I NTRODUCTION
M
ULTI-agent systems (MAS) are composed of multiple autonomous, collaborative, and heterogeneous agents [1]–[3]. Unlike traditional systems that rely on manually predefined rules, these agents are increasingly driven by autonomous decision-making based on large language models (LLMs) such as ChatGPT, Gemini, and DeepSeek. While maintaining operational independence, they coordinate Qi Liu and Zhihui Zhao are with the College of Computer Science and Technology, Taiyuan University of Technology, Taiyuan, China, 030024, and also with the State Key Laboratory of Internet Architecture, Tsinghua University, Beijing, China, 100084. (E-mail: [email protected], [email protected]) Xiaohui Chen is with the China Mobile Research Institute, Beijing, China, 100053. (E-mail: [email protected]) Dan Yu, Zehua Zhang are with the College of Computer Science and Technology, Taiyuan University of Technology, Taiyuan, China, 030024. (Email: yudan, [email protected]) Yongle Chen is with the College of Artificial Intelligence, Taiyuan University of Technology, and Shanxi Key Laboratory of Industrial Internet Security, Taiyuan, China, 030024. (E-mail: [email protected]) Yaowen Zheng and Limin Sun are with the Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China, 100084. (E-mail: {zhengyaowen, sunlimin}@iie.ac.cn) Qi Liu and Xiaohui Chen are co-first authors. Zhihui Zhao and Yongle Chen are corresponding authors.
to finish individual tasks and improve overall performance. Embodied agents, serving as the interface between artificial intelligence and the physical world [4]–[6], tightly couple decision models with physical execution platforms such as robots, unmanned aerial vehicles, and manipulators. This integration establishes a closed-loop “perception–decision–action” capability, enabling agents to autonomously generate strategies and execute behaviors in dynamic and uncertain environments. However, individual embodied agents exhibit inherent limitations: sensing is spatially constrained, execution is restricted by physical conditions, and complex planning and reasoning are bounded by computational resources and model capacity. As a result, embodied MAS has become a dominant paradigm, where multiple agents complement each other through task decomposition and coordinated actions, thereby jointly completing large-scale, long-horizon, and multi-regional tasks. Motivation. Embodied MAS face a significant security threat. Agents with autonomous decision-making capabilities often exhibit individual strategic preferences. Multiple agents may collude to generate strategies that are not fully constrained by unified objectives or global coordination assumptions, that is, a collusion attack. In such cases, agents go beyond simple non-compliance and instead achieve self-serving or group objectives through coordination, resulting in deviations between decision intent and actual behavior and giving rise to unpredictable system-level risks [7]–[9]. Unlike traditional agents, embodied agents directly interact with the physical world, making such risks more consequential [10]. Collusion attacks can undermine trust, mislead operators, and compromise safety-critical infrastructures, ultimately leading to real-world impacts [1], [9]. For example, in Internet of Vehicles scenarios, multiple intelligent vehicles may collude to create traffic bottlenecks, occupy critical lanes to obstruct intersections, or degrade traffic flow to disadvantage competitors. Real-world incidents further highlight these risks, including cases involving Cruise autonomous vehicles dragging pedestrians and injuries caused by a chess robot. Fig. 1 illustrates this collusion process in a representative multi-agent scenario. Addressing collusion threat among multiple embodied agents involves the following three primary challenges. •
Limitations of Authentication in Behavioral Validation. Conventional security mechanisms, such as identity verification and access control, are designed to ensure that an agent is authorized to participate and provide services. However, they operate at the identity and permission level and cannot evaluate whether actual behaviors comply with predefined protocols. Since collusion manifests at
JOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2021
higher efficiency & safety
cooperation collusion
extra benefit
service misbehavior
Embodied Multi-Agent System
lower efficiency & physical harm
Environment
Management Center
Fig. 1: Collusion in multi-agent systems.
the behavioral level, these mechanisms fail to capture deviations arising from coordinated adversarial actions. • Opacity of Decision-Making and Behavioral Misalignment. Embodied agents rely on complex and often opaque AI models (e.g., LLMs) for autonomous decision-making, making behavior monitoring and verification challenging. In long-horizon tasks, factors such as model incompleteness, reasoning randomness, context dependence, and multi-objective trade-offs can lead to deviations between decision and behavior. Traditional techniques (e.g., log analysis, trajectory monitoring, and code auditing) are insufficient to assess whether an agent’s behavior aligns with its intended objectives. The black-box nature of these models further hinders the inference of agent intentions and the collusion detection. • Stealthiness of Collusion. Collusion-induced deviations are difficult to identify early, as they can be easily confused with environmental disturbances or execution errors. For instance, a slight deviation in a manipulator’s grasp may result from incorrect pose estimation or object slippage. Ambiguity blurs the boundary between normal and abnormal behaviors. Information sharing and coevolution of strategies among agents amplify the threat, as minor deviations introduced by collusion can propagate across interactions and form a chain effect. Deviations can degrade system performance or introduce physical risks without triggering immediate alarms. This stealthiness increases the risks associated with collusion attacks. These challenges collectively indicate that collusion in embodied MAS is fundamentally difficult to detect in a timely and reliable manner, especially before physical consequences manifest. As a result, detection-based defenses are inherently limited in preventing early-stage collusion. Existing research has primarily focused on identifying and analyzing collusive behaviors in specific domains, without providing concrete mitigation mechanisms [11]–[13]. Prior approaches, including machine learning-based detection and decentralized enforcement [14], [15], typically rely on observing behavioral deviations after they occur. Such methods are often costly, complex, and may disrupt legitimate cooperation among agents. More importantly, these approaches are fundamentally ill-suited for embodied settings. In embodied MAS, deviation detection depends on physical interactions that are inherently delayed, noisy, and sometimes irreversible. Moreover, collusion often manifests as subtle spatiotemporal coordination patterns rather
2
than explicit violations, making it difficult to distinguish from normal cooperative behavior under traditional monitoring frameworks. These limitations render reactive detection insufficient for securing embodied multi-agent systems. Based on this analysis, we adopt a decision-level intervention strategy to counter collusion, avoiding costly detection mechanisms, system topology modifications, or changes to task allocation policies, thereby achieving proactive defense. Solution. We propose an indirect intervention approach grounded in economic incentives. Rather than relying on detection, our core idea is to reshape the payoff structure of embodied agents to discourage collusion proactively. We introduce a reporting-and-penalty mechanism in which agents are rewarded for exposing collusion, while identified participants are penalized. This design ensures that maintaining collusion is less profitable than defecting from it. Our key insight is to formulate collusion mitigation as an incentivecompatible mechanism design problem, where defection becomes the dominant strategy for rational agents. Consequently, collusion becomes inherently unstable, as any agent has a unilateral incentive to deviate and disclose the collusion. This mechanism induces a self-enforcing disruption of collusive groups, eliminating the need for costly detection or systemlevel intervention. Consequently, collusion is mitigated proactively at the decision-making level before adversarial behaviors propagate into the physical environment. In implementation, each agent is required to provide a deposit for honest service upon joining the MAS, which can be used to reward whistleblowers. Considering real-world conditions, we analyze the adversarial model under economic incentives, including scenarios such as defamation, post-collusion reporting, and retaliation against whistleblowers. To achieve the desired security guarantees (i.e., mitigating collusion attacks), we design two components. (1) To prevent misuse of the reporting mechanism, we introduce a reporting deposit rule: agents must submit a refundable deposit when initiating a report. Valid reports are reimbursed with rewards, while invalid or malicious ones result in forfeiture. (2) To protect whistleblower anonymity and prevent retaliation, communications between the whistleblower and the system manager are encrypted. We further implement an anonymous reward protocol via smart contracts to securely and automatically manage deposits and incentives without revealing identities, even to the system manager. Contribution. Our contributions are outlined as follows. • We identify and formulate spontaneous collusion in embodied multi-agent systems as a security threat beyond traditional identity- and access-based assumptions, and propose an incentive-driven intervention framework that mitigates collusion at an early stage, thereby preventing the propagation of collusion-induced deviations, without relying on costly detection mechanisms, system topology modifications, or task allocation adjustments. • We analyze the adversarial model under economic incentives and provide a game-theoretic analysis showing that defection becomes the dominant strategy for rational agents, thereby destabilizing collusion without introducing additional security risks. This provides a new
JOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2021
perspective on securing embodied MAS by shifting from reactive detection to proactive incentive design. • We conduct comprehensive simulations and real-world embodied experiments to validate our security objectives. Results show that our approach effectively induces defection within collusive groups while preserving system efficiency, achieving performance comparable to the noncollusion baseline and outperforming representative reactive defenses. In addition, smart contract incurs low cost (approximately 94,700 Gas, i.e., ≈ $0.30), highlighting the practicality and cost-efficiency of our work. In the following, Section II introduces the background and related work. Section III describes the preliminaries, threat model, and security goals. The approach details are presented in Section IV. Section V and Section VI provide the security analysis and experiment evaluation, respectively. Finally, Section VII discusses and concludes this paper. II. BACKGROUND AND R ELATED W ORK A. Background Game Theory provides a mathematical framework for modeling strategic interactions among rational agents and is widely applied in MAS to analyze cooperation, competition, and deception. A central concept is incentive compatibility, which ensures that following the prescribed strategy constitutes a game equilibrium, making deviation suboptimal for rational agents. In this paper, we apply game theory to design an incentive intervention approach that transforms agent interactions into a non-cooperative game with asymmetric payoffs. Under this model, agents are incentivized to defect from collusive agreements through rewards for reporting and penalties for reported participants. This intervention shifts the equilibrium from sustained collusion to defection, thereby rendering collusion inherently unstable. Smart Contracts are self-executing programs deployed on blockchain platforms that automatically enforce agreements without centralized control. They provide transparency, immutability, and trustless interactions among distributed agents [16]. In MAS, smart contracts have been increasingly adopted for peer-to-peer negotiation, task coordination, and reliable transaction recording [17]. In our work, smart contracts are used to manage report submission, verification, rewards, and penalties. This ensures fair and credible incentive distribution, as agents interact with immutable contract logic rather than a potentially biased centralized authority. Smart contracts also support programmable anonymity, which is essential for protecting whistleblowers. Ring signature is a cryptographic technique that enables a party to sign a message on behalf of a group without revealing which party actually signed it [18]. This technique has been widely adopted in privacy-preserving applications, such as anonymous cryptocurrencies and secure group communications. In our system, agents who report collusion do so anonymously using a ring signature-based scheme. This ensures that their identity remains untraceable, even from system administrators, thereby preventing retaliation, man-inthe-middle attacks, or internal collusion. Combined with the
3
anonymous reward distribution facilitated by smart contracts, this cryptographic protection establishes a robust privacypreserving reporting mechanism. B. Related Work Algorithmic Collusion in Multi-Agent Systems. A growing body of literature addresses algorithmic collusion, particularly as RL agents increasingly participate in autonomous decision-making. Classical economic definitions of collusion are being challenged by AI agents that learn to collude implicitly without explicit communication [19]–[21]. Even without direct monitoring, RL agents can converge to supracompetitive equilibria [22], and adversarial collusion further complicates detection [23]. Recent studies on LLM-based multi-agent systems further demonstrate that collusion risks extend beyond economic settings: agents can establish covert channels via steganographic communication [9] or form coalitions that degrade cooperative task performance [24]. Collusion Detection and Mitigation Strategies. Early detection efforts rely on theoretical models [25] or informationtheoretic approaches for black-box systems. Others examine collusion in mixed human-AI settings [26], [27], while recent work explores interpretability tools for surfacing collusive strategies [7]. Proposed countermeasures include structural market adjustments [28], game-theoretic platform-side rule design [14], decentralized learning enforcement [15], and MLbased pricing interventions [29]. However, these approaches typically assume centralized control and focus on narrow economic settings, without addressing the broader challenges of multi-agent collaboration security. Defense Frameworks for Multi-Agent Systems. Recent defense frameworks for LLM-based multi-agent systems have advanced rapidly. G-Safeguard [30] employs graph neural networks on multi-agent utterance graphs for supervised anomaly detection and topological remediation, but depends on labeled attack data. AgentSafe [31] introduces hierarchical information management with identity verification and layered memory protection against unauthorized access and memory poisoning. SentinelNet [32] proposes decentralized credit-based threat detection through adversarial trajectory generation and contrastive learning. DynaTrust [33] targets sleeper agents by modeling trust as a continuously evolving attribute via Bayesian updates and adaptive graph recovery. GroupGuard [34] formalizes group collusive attacks inspired by sociological theories and defends via graph-based monitoring, honeypot inducement, and structural pruning. These frameworks share a common reactive paradigm: detecting and isolating malicious agents after adversarial behaviors manifest. Such post-hoc approaches face inherent limitations in embodied settings, where physical interactions are costly and often irreversible. In contrast, our work adopts a proactive approach grounded in economic incentive design. Rather than relying on behavioral detection or topology modification, the proposed mechanism leverages game-theoretic principles to render non-collusion the dominant strategy. Through deposit-based penalties, whistleblower rewards, and anonymity-preserving smart contracts, our approach induces
JOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2021
defection from within collusive groups before adversarial actions propagate, providing a scalable and detection-free solution suited to embodied multi-agent systems. III. P RELIMINARIES A. Assumptions In embodied multi-agent systems with potential collusive behavior, we observe several key phenomena. First, upon deployment, embodied agents are typically required to register and submit identity-related information to the system manager, enabling effective management and task scheduling. Second, embodied agents make autonomous decisions with individual strategic preferences and collaborate with others to accomplish tasks. Moreover, due to direct interaction with the physical world, the impact of collusion among embodied agents tends to unfold gradually over time and exhibits strong stealthiness. In its early stages, collusion may not produce immediate or observable effects. Based on these observations, we make the following reasonable assumptions: • The system manager is assumed to be honest and strictly follow predefined rules to maintain normal system operation. This assumption is reasonable because a dishonest manager could compromise the system directly without requiring collusion among embodied agents. • Each embodied agent is treated as an independent party in both physical and logical terms. While agents collaborate to provide services, they possess individual strategic preferences and are rational and utility-driven. That is, In the absence of additional payoff, agents follow predefined service protocols and do not intentionally cause deviations between decision and behavior, engage in collusion, or defame others. • Collaboration among embodied agents enables them to communicate freely with each other. Each agent determines what information to share based on its own strategic considerations. B. Adversary Model and Security Goals In this paper, we focus on detecting collusion among autonomous embodied agents in systems, where identity and access control have already been verified. Such collusion may cause subtle decision–behavior deviations that are difficult to detect at early stages, potentially leading to performance degradation, system failures, or even physical safety risks. We investigate the use of economic incentives to disrupt collusion at the decision level, enabling early identification and elimination of potential collusion risks. This realizes a proactive defense, rather than post-hoc detection after collusion has already caused harm. Moreover, this approach avoids the challenges posed by the opacity of decision-making and behavioral misalignment, as it does not rely on distinguishing intentional collusion from unintentional execution deviations. However, malicious agents may still pose potential threats to the effectiveness of economic incentive mechanisms, potentially undermining their intended effects. Accordingly, we analyze the following adversary model, focusing on potential disruption and misuse of the incentive mechanism.
4
Disruption. Our approach incentivizes rational embodied agents to defect from collusion by increasing the payoff of betrayal. However, collusive groups may counteract this mechanism by reducing the relative benefit of defection. Two representative strategies are as follows: – Anti-report attack: Colluding agents require members to provide collateral as proof of loyalty. Agents who defect lose their collateral, which may be redistributed among colluding members or used to compensate those penalized by the system manager. Agents who refuse to provide collateral are excluded from the collusion group. – Whistleblower exposure: Colluding agents attempt to infer the identity of the whistleblower from submitted evidence or communication records, enabling possible retaliation or compensation claims. • Misuse. Self-interested embodied agents may exploit the incentive rules to maximize their own benefits. Typical attacks include: – Defamation attack: Malicious embodied agents falsely accuse honest agents of participating in collusion to claim rewards from system manager. – Post-collusion reporting: Malicious embodied agents report collusion after benefiting from it, attempting to gain both illicit collusion profits and whistleblowing rewards, even though the system damage may have already occurred. • Manipulation of fund transfers. System manager or embodied agents may manipulate financial interactions when responsible for holding funds and executing transactions (e.g., withholding deposits, refusing to issue rewards), reducing the reliability of the incentive mechanism. •
Therefore, to mitigate collusion attacks among embodied agents and establish trustworthy collaboration in embodied MAS, the approach M should satisfy the following security goals. We assume a set of embodied agents A = {A1 , A2 , . . . , AN } and a system manager MS . G1: Proactive Prevention of Collusion. Design an incentive mechanism such that non-collusion or report collusion becomes the dominant strategy for rational embodied agents. Formalization: Let Ui (si , s−i ) denote the utility of agent Ai under the strategy profile (si , s−i ). Let scollude denote the strategy of participating in collusion, and sdef ect denote the strategy of defecting (i.e., report collusion). Let Ui (sdef ect , s−i ) denote the reward for report collusion, and Ui (scollude , s−i ) denote the penalty imposed upon being identified as a colluder. Our objective is to design an incentive mechanism M such that, for any rational agent Ai , the following condition holds: Ui (sdef ect , s−i ) > Ui (scollude , s−i )
(1)
That is, under M, that sdef ect constitutes a dominant strategy for rational agents. As a result, rational agents are incentivized to report or avoid collusion. G2: Resilience against Disruption. M should defend against anti-report attacks and deanonymization attempts.
JOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2021
Rules: Collusion is not prohibited, but reporting it is incentivized through additional rewards.
① economic
5
Collusion Group anomalous trends
incentive
honesty deposit
② report collusion
Manager
normal trends
③ reporting
Anonymous Whistleblower
reward Embodied Agents
bonding contract
Agent Registration
blocking anomaly
slashing penalty
publish incentive rules
Malicious Accusation
losing honest deposit accused agents Confirmed Collusion
③ reporting deposit
whistleblowing contract
losing reporting deposit
getting rewarding deposit
Verification and Incentive
Collusion Reporting
Fig. 2: Overview of our proposed method. Formalization. For anti-report resistance, even if the collusion group requires a collateral payment Dcoll , the reporting reward R should satisfy: R > Dcoll + ∆U
(2)
where ∆U denotes the potential additional loss incurred by defecting from collusion. Meanwhile, the identity of whistleblower Iwb should be indistinguishable. Given observed evidence E and communication records Com, the probability that an adversary correctly infers the whistleblower’s identity should approach random guessing: 1 P (Iwb = Ai | E, Com) ≈ (3) n G3: Robustness against Misuse. M must prevent selfinterested agents from exploiting incentive rules through defamation or post-collusion reporting. Formalization. For defamation mitigation, the evidence verification function V (·) should bound the false-positive rate for honest agents: P r[V (E) = Accept | aj is honest] < ϵ
(4)
To prevent double-dipping, the reward function R(t) must be zero if reporting occurs after the system damage time Td : R(t) = 0, ∀t > Td
(5)
G4: Trustworthiness of Fund Transfer. Ensure secure storage and transfer of funds, avoiding financial manipulation. Formalization. For any transaction T x(value), the system must ensure: valuesent = valuereceived
(6)
to prevent unauthorized value manipulation. Moreover, each T x is confirmed within a bounded delay ∆T , ensuring timeliness and preventing fund withholding. IV. M ETHODOLOGY As shown in Fig. 2, our approach consists of three tight components: agent registration, collusion reporting, and verification with incentive enforcement. At the registration stage, system managers publish participation policies and incentive rules, which embodied
agents must acknowledge before joining the system. Each agent is required to submit an honesty deposit and sign a bonding contract, committing to compliant and trustworthy behavior. While collusion is not explicitly prohibited, we encourage its disclosure through economic incentives. During the reporting phase, colluding embodied agents may anonymously report their co-conspirators by submitting a reporting deposit along with a whistleblowing contract and collusion evidence protected via ring signatures. All related transactions (e.g., deposit management and reward distribution) are handled through smart contracts, ensuring trustworthy fund transfer. Anonymity is preserved in both evidence representation and communication, preventing identity exposure and retaliation against the whistleblower. In the verification and incentive phase, system manager evaluates reports based on submitted evidence, task situations, and service deviation metrics. Valid reports result in penalties for the accused agents through forfeiture of their honesty deposits, while the whistleblower receives a refund along with additional rewards. In contrast, invalid or malicious reports lead to forfeiture of the reporting deposit, thereby discouraging defamation and post-collusion reporting. A. Agent Registration To facilitate trustworthy collaboration and deter collusion among embodied agents, the system manager MS publicly announces participation policies and incentive rules. The core principle is that collusion is not explicitly prohibited, but reporting it is incentivized through additional rewards. This design avoids the difficulty of directly detecting collusion, and instead leverages agents’ self-interest to expose such behavior. Meanwhile, each embodied agent registers by accepting these rules and providing an honesty deposit Dh as a service bond. Inspired by the stake-slashing [35] in blockchain and practical idea to conspiracy deterrence, the deposit Dh serves as collateral to penalize non-compliant behavior or service deviations. In this way, agents face an economic penalty for dishonest behavior, while maintaining the opportunity to recover the deposit through honest service. Specifically, consider N embodied agents executing M tasks. Each agent Ai provides verifiable identity information
JOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2021
6
and generates a public–private key pair (pki , ski ) for authentication and secure communication in subsequent interactions. During registration, to ensure trustworthy fund transfer, each agent’s deposit Dh is locked in a dedicated bonding contract Dh conb , that is, {Ai −−→ conb }. If an agent behaves honestly, it receives a task-based service reward rs , and its deposit Dh is automatically refunded upon withdrawal from the system. Otherwise, if the agent is found to violate service policies or engage in verified collusion, the bonding contract confiscates its deposit under the instruction Dh of the system manager MS , that is, {conb −−→ MS }. The confiscated deposits are then redistributed as rewards to incentivize embodied agents to betray from collusion and report others’ malicious behavior. B. Game of Collusion and Reporting Consider a system with N embodied agents and a total of M service tasks, where potential collusion may arise among agents. Each honest agent receives a reward rs and incurs a cost cs per task, with rs > cs . The net profit from executing one task honestly is (i.e., honest scenario): uoh = rs − cs
(7)
Assuming uniform task allocation, each agent is expected to execute M N tasks, yielding an expected total utility: M · uoh (8) N We first analyze the collusion scenario without any incentive or constraint rules (referred to as the unconstrained collusion scenario). Suppose ncoll embodied agents engage in collusion. Through coordination, an embodied agent may increase its allocated tasks by Scoll (e.g., monopolizing high-reward tasks) or reduce actual execution by k tasks (e.g., free-riding or shirking). The resulting collusion total utility is: M M t ucoll = + Scoll rs − + Scoll − k cs (9) N N uth =
Thus, for an individual agent, the utility gain from collusion compared to honest execution is: utcoll − uth = Scoll · uoh + k · cs > 0
(10)
It indicates that, in the absence of counter-collusion mechanisms, collusion strictly dominates honest service for rational embodied agents. Without deterrents or conflicting incentives, agents are naturally incentivized to form collusion alliances to maximize their utility. Then, we consider the collusion scenario under our economic incentive rule. To break collusion, the system manager MS incentivizes colluding embodied agents to report their collaborators. A whistleblower agent Wcoll receives the honesty deposits of the remaining (ncoll −1) colluding agents: rrep = (ncoll − 1) · Dh
(11)
To ensure that reporting is more profitable than maintaining collusion, the following condition must hold: t rrep − rcoll ≥0
(12)
This yields the requirement: Dh ≥
M N + Scoll
uoh + k · cs ncoll − 1
(13)
To derive a conservative bound, we consider the worst-case collusion gain, where colluding agents monopolize all tasks. The additional allocated tasks for each colluding agent are: Scoll =
M M − ncoll N
(14)
Substituting this into the above condition yields a conservative bound for Dh : M o Dh ≥ · rh (15) 2 This condition ensures that at least one colluding agent has an incentive to defect and report, thereby achieving proactive prevention of collusion (i.e., Security goal: G1). To avoid multiple colluding agents reporting and creating ambiguity in reward allocation, the system manager MS adopts a first-validreport policy, rewarding only the earliest verified collusion report. The verification process is detailed in Section IV-C. We also consider launch anti-reporting attacks by colluders. A common threat is to require each colluding agent to submit a collusion deposit Dcoll to a trusted intermediary (e.g., a coordination platform or smart contract [17], [36]). If any member defects (e.g., by reporting), its deposit is forfeited and redistributed among the remaining colluders as compensation. To neutralize the incentive to report, Dcoll must satisfy: Dcoll ≥ Dh · (ncoll − 1)
(16)
This ensures that the loss incurred by the remaining colluding agents, once a member defects, can be fully compensated by the forfeited deposit. We design the collusion reporting and incentive mechanisms to address adversarial behaviors of malicious embodied agents. The detailed design is presented in Section IV-C. C. Process of Collusion Reporting and Incentives In this subsection, we focus on addressing adversarial behaviors of malicious embodied agents against the proposed economic incentive mechanism. To address anti-report attacks and whistleblower exposure, we emphasize that the key lies in protecting the whistleblower’s identity. Concealing the whistleblower from other colluding agents is critical to prevent retaliation or loss of collusion deposits. We propose an anonymized reporting and reward mechanism. Specifically, whistleblowers generate anonymous account addresses for submitting reporting deposits and receiving rewards, ensuring that their identity, communications, and financial transactions remain concealed. Encryption and ring signatures are employed to protect collusion evidence during transmission and further preserve anonymity. This mechanism ensures that the whistleblower’s identity remains hidden from both the system manager MS and other agents, while still enabling MS to deliver rewards once collusion is verified. As a result, whistleblowers can report without risk of retaliation or reward manipulation (Security goal: G2).
JOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2021
7
Fig. 3: The process of collusion reporting and incentive. If a whistleblower is involved in a collusion agreement that has not yet been executed, the collusion must be reported in advance. Upon receiving the evidence, MS verifies its authenticity by monitoring whether the accused agents subsequently behave as reported. If not, the report is deemed invalid. This process also enables detection of defamation attacks. In such cases, the whistleblower’s honesty deposit is forfeited, effectively deterring malicious reporting (Security goal: G3). Furthermore, all fund storage and transfers are handled via smart contracts, ensuring that deposit management and reward distribution are executed automatically without reliance on any centralized party, thereby guaranteeing secure and trustworthy fund transfer (Security goal: G4). The process of collusion reporting and incentive mechanisms is illustrated in Fig. 3. It follows a structured fivestep protocol involving a system manager, a whistleblower, and a dedicated smart contract. The process begins with the whistleblower generating an anonymous address and submitting a report, followed by the system manager depositing rewards into the whistleblowing contract. To ensure integrity, the whistleblower must provide encrypted collusion evidence (Evicoll ) along with a reporting deposit, establishing mutual commitment. The system manager then verifies and decrypts the evidence. If collusion is confirmed, the contract automatically executes reward distribution. Overall, the mechanism mitigates collusion through economic incentives and cryptographic anonymity. Step 1: Reporting the Collusion. The whistleblower initiates the process by submitting a collusion report, including the number of colluding agents nrep coll and an anonymous address addrano . At this stage, detailed collusion evidence is not disclosed. addrano is used to help preserve the whistleblower’s anonymity during subsequent fund transfers. (1) Report Submission. Fig. 4 illustrates the process in which the whistleblower anonymously expresses the intent to report collusion through encryption and ring signatures. Let the system manager MS hold the key pair {P KM , SKM }, and each embodied agent Ai hold {pki , ski }, with all public keys publicly available. The whistleblower randomly selects (N − 1) agents to construct a public key set: RKey = {pk1 , pk2 , . . . , pkw , . . . , pkN }
(17)
where the whistleblower’s public key pkw , with corresponding private key skw . To prevent duplicate reporting, a key image is generated: I = skw · Hp (pkw ) (18)
Fig. 4: The anonymous operation of the whistleblower. where Hp (·) denotes a hash-to-curve function. The whistleblower then attaches a timestamp Tcoll and encrypts the reporting data using the manager’s public key: nrep−enc = Enc(P KM , {nrep coll coll , Tcoll , RKey, I})
(19)
A ring signature is subsequently generated: RingSigrep = Ringsig (Hash(nrep−enc ), skw , RKey) coll (20) Finally, the whistleblower submits both the encrypted report information nrep−enc and the signature RingSigrep to the coll system manager. (2) Anonymous Address Generation. The whistleblower generates an anonymous address addrano using Elliptic Curve Cryptography (ECC) [37]. A random private key s ∈ Zp is selected, where p is the curve order. The corresponding public key (i.e., the anonymous address) is computed as: addrano = s · G
(21)
The address addrano is one-time use. All funds for whistleblowing deposits and rewards are transferred through anonymized channels (e.g., zk-Mixer, coin-mixing mechanisms, or private payment contracts), the details of which are beyond the scope of this work. This design breaks the link between the funding address and the whistleblower’s identity. Step 2: Smart Contract Deployment. Upon receiving the report, the system manager MS first verifies the ring signature: Ringverif y (Hash(nrep-enc ), RKey) == RingSigrep (22) coll If the equation holds, MS decrypts nrep−enc using SKM coll to obtain the reporting data, and checks that the key image I has not appeared in previous reports. If both conditions are satisfied, MS deploys a whistleblower contract at address addrcr , which is used to manage both the reporting deposit and the reward. (1) Contract and Reward Allocation. The whistleblower contract at addrcr stores both the reporting deposit of whistleblower and the reward funds of MS , and operates autonomously based on the verification outcome. MS deposits
JOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2021
8
reward funds of amount nrep coll ·Dh into the contract and records a timestamp Trep to ensure timeliness. The reward equals the total honesty deposits of the reported colluding agents. If the report is verified, MS recovers this cost by confiscating the honesty deposits of the reported agents, thereby ensuring budget balance of the incentive mechanism. (2) Whistleblower Reporting Deposit Contribution. The whistleblower submits a reporting deposit equal to its honesty deposit Dh via the anonymous address addrano , which is also stored in this contract. If the report is invalid, the deposit is forfeited and transferred to MS . Otherwise, it is refunded, and the reward is automatically distributed by the contract without intervention from MS . Step 3: Whistleblower Submits Evidence. The whistleblower submits collusion evidence to the system manager MS . This process also employs encryption and ring signatures to preserve anonymity; as shown in Fig. 4, the details are omitted here. The evidence submitted by the whistleblower includes the collusion event (Eventcoll ), the set of involved colluding coll embodied agents ({Acoll 1 , . . . , Ancoll }), formalized as: coll Evicoll = {Eventcoll , {Acoll 1 , . . . , Ancoll }, Tcoll }
(23)
Additionally, the whistleblower must deposit an amount equivalent to its honest deposit into the whistleblower contract addrcr . Notably, both the reporting reward and the reporting deposit involve additional funds being deposited. This arrangement is designed to help conceal the whistleblower’s identity. From an external perspective, the whistleblower appears similar to the other reported agents and will also face penalties for collusion. It should be emphasized that any funds lost by the whistleblower will be refunded through the reporting reward. Therefore, the mechanism achieves indistinguishability between the whistleblower and colluding agents. Steps 4 & 5: Evidence Verification and Incentive. The system manager MS first verifies the ring signature on the hash of the encrypted collusion evidence. If the verification succeeds, MS decrypts Evienc using SKM to obtain the collusion evidence Evicoll . Then, MS monitors the behavior of the reported agents. If the evidence Evicoll is valid (i.e., collusion occurs), the whistleblower receives the reporting reward from the whistleblower contract. Otherwise, the whistleblower will be penalized by losing its reporting deposit. The presence of the reporting deposit discourages defamation attack, as rational embodied agents would avoid incurring financial penalties for unfounded claims. Notably, even if multiple colluding agents collectively withdraw from the collusion to invalidate the report and trigger penalties from MS against the whistleblower, the collateral of anti-reporting attack imposed within the collusion group serves as a constraint. In such cases, the whistleblower will receive the collusion deposit of the exit collusion agent as compensation. Therefore, such coordinated withdrawals are strategically irrational for self-interested agents and do not yield beneficial outcomes under rational behavior.
V. S ECURITY A NALYSIS Theorem 1. Under the proposed incentive mechanism M, if the honesty deposit Dh satisfies M o · rh (24) 2 then the reporting strategy strictly dominates collusion for any rational embodied agent. The induced game admits a unique equilibrium in which at least one agent defects (i.e., reports), and sustained collusion cannot occur. Proof. We model the interaction among ncoll potentially colluding embodied agents as a strategic game. Each agent has two strategies: i) scoll : participate in collusion; ii) sdef ect : defect and report collusion. We denote the mixed strategy of an agent Ai as: Dh ≥
si = [αi (scoll ), (1 − αi ) · (sdef ect )], αi ∈ [0, 1]
(25)
If agent Ai participates in collusion, its utility is: M M + Scoll · rs ) − ( + Scoll − k) · cs N N If agent Ai defects and reports collusion, it receives: utcoll = (
udef ect = (ncoll − 1) · Dh
(26)
(27)
Substituting the worst-case collusion gain (i.e., when colluding agents monopolize all tasks): Scoll =
M M − ncoll N
(28)
o Since Dh ≥ M 2 · rh , it follows that:
udef ect > utcoll
(29)
which always holds. Therefore, αi = 0, meaning that all rational agents choose to defect from collusion. Since all agents strictly prefer sdef ect , the strategy profile: s∗ = [1(sdef ect , . . . , 1(sdef ect )]
(30)
constitutes a Nash equilibrium. Moreover, because the preference is strict, this equilibrium is unique. Therefore, collusion among agents is inherently unstable. If all agents choose the collusion strategy scoll , any agent can deviate to sdef ect and obtain a higher payoff. Hence, collusion cannot be sustained, and rational agents are incentivized to report, thereby achieving proactive prevention of collusion. □ Theorem 2. The mechanism M remains effective against the anti-report attacks and the whistleblower deanonymization attacks, that is, • The reward satisfies R > Ccoll +∆U , where ∆U denotes the potential additional loss incurred by defecting from collusion. • The whistleblower identity satisfies indistinguishability: 1 ±ϵ N Proof. (1) Resistance to anti-report attacks. In an anti-report attack, colluding agents attempt to deter defection by imposing an additional penalty (e.g., collusion deposit Ccoll ) on any member who deviates. P (Iwb = Ai | E, Com) =
JOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2021
9
In our mechanism, this threat is mitigated by protecting the identity of the whistleblower. Specifically, the identity of the reporting agent is concealed from all other colluding agents. As a result: i) Colluding agents cannot determine which member has defected; ii) No targeted retaliation (e.g., confiscation of Ccoll or exclusion from future cooperation) can be reliably executed. Therefore, the expected penalty associated with defection is significantly reduced, as it cannot be selectively enforced. Meanwhile, the reporting reward satisfies: R > Ccoll + ∆U
(31)
where ∆U denotes the potential loss from abandoning collusion benefits. Hence, defection remains the optimal strategy, and the anti-report attack fails to suppress reporting incentives. (2) Whistleblower anonymity and indistinguishability. The mechanism ensures whistleblower’s anonymity at both the communication and financial levels. In terms of evidence and communication anonymity, all reporting data is protected via encryption and ring signatures. Given a ring of size N , the ring signature reveals that the signer belongs to the group but does not reveal which member generated it. Therefore: 1 (32) P (Iwb = Ai | E, Com) ≈ N In term of financial anonymity, the whistleblower generates a one-time anonymous address addrano for submitting report deposits and receiving rewards. All fund transfers are executed through smart contracts and anonymized channels. From an external perspective, the whistleblower deposits funds into the contract, similar to other agents. The reward and refund process is handled automatically by the contract. Thus, the financial behavior of the whistleblower is indistinguishable from that of other agents, preventing linkage between identity and transactions. Since i) retaliation cannot be reliably enforced due to anonymity, and ii) the reward exceeds any potential loss, betray remains a strictly beneficial strategy. Furthermore, the indistinguishability property ensures that the whistleblower’s identity cannot be inferred beyond random guessing. Therefore, the mechanism M is resilient against both anti-report attacks and whistleblower deanonymization. □ Theorem 3. The mechanism M is robust against defamation attacks and post-collusion reporting, that is, • The evidence verification function V (·) should bound the false-positive rate for honest agents: P r[V (E) = {Accept | Aj is honest] < ϵ} The reward function R(t) must be zero if reporting occurs after system damage time Td . Proof. (1) Defamation Attack Resistance. Consider a malicious agent Ai attempting to defame an honest agent Aj . In our mechanism, submitting a report is not free: the reporter must lock a reporting deposit equal to its honesty deposit Dh into the whistleblowing contract. This deposit acts as a financial stake, ensuring that reporting is a risk-bearing action. Let the expected utility of defamation attack be: •
udef ame = pacc · rrep − (1 − pacc ) · Dh
(33)
Where: • pacc denotes the probability that a defamation is incorrectly accepted by the system manager; • rrep is the reporting reward; • Dh is the reporting deposit that will be forfeited if the report is rejected. The system manager MS does not rely solely on static evidence, but verifies reports by observing the subsequent behaviors of the accused agents. A report is accepted only if the future actions of these agents are consistent with the reported collusion pattern. Otherwise, the report is rejected. Therefore, when the accused agent Aj is honest, the probability of false acceptance is strictly bounded: pacc = P r[Accept | Aj is honest] < ϵ
(34)
Substituting this into the expected utility: udef ame ≤ ϵ · rrep − (1 − ϵ) · Dh
(35)
Since Dh is designed to be sufficiently large, the penalty term (1−ϵ)·Dh dominates the reward term ϵ·rrep , hence udef ame < 0. This implies that false reporting yields negative expected utility, making defamation a strictly irrational strategy for selfinterested agents. (2) Post-Collusion Reporting Resistance. Consider a strategic agent that attempts to first participate in collusion to gain illegal profit, and then report the collusion afterward to obtain rewards (i.e., “double-dipping”). To eliminate this behavior, our mechanism enforces a constraint for report time: R(t) = 0, ∀ t > Td
(36)
where Td denotes the time at which collusion begins to cause system damage. That is, any report submitted after the damage has occurred is not eligible for rewards. Thus, the utility of t post-collusion reporting is rcoll . The agent only retains its collusion profit and gains no additional benefit from reporting. In contrast, if the agent reports before the collusion is executed, its utility is (ncoll − 1) · Dh . According to Theorem 1, we have: t (ncoll − 1) · Dh > rcoll (37) The reporting reward exceeds the maximum possible collusion gain. This shows that rational agents strictly prefer early reporting over post-collusion reporting. □ Theorem 4. Under smart contract and standard blockchain assumptions, the mechanism M ensures correctness and resistance to third-party manipulation of fund transfers. Proof. In our mechanism M, the trustworthiness of fund transfer is ensured by delegating all financial operations (e.g., deposit locking, reward distribution, and penalty execution) to smart contracts deployed on a blockchain platform. First, correctness of fund transfer is guaranteed by the deterministic execution of smart contracts. All transfer rules (e.g., reward release, deposit confiscation, refund conditions) are pre-defined in the contract code and executed automatically upon satisfying specific conditions. Given the consensus
JOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2021
10
mechanism of the underlying blockchain, all nodes execute the same contract logic, ensuring that for any transaction T x(v): valuesent = valuereceived
(38)
Thus, no inconsistency or unintended value deviation can occur during execution. Second, resistance to third-party manipulation is ensured by the immutability and transparency of smart contracts. Once deployed, the contract code cannot be altered by the system manager MS , embodied agents, or any external adversary. All transactions are recorded on the blockchain ledger, making any attempt to tamper with deposits or rewards (e.g., withholding funds or modifying transfer outcomes) infeasible without breaking the underlying consensus protocol. Moreover, autonomous execution eliminates reliance on any centralized authority Even though MS triggers certain operations (e.g., submitting verification results), it cannot directly control fund flows. Instead, all transfers are conditionally executed by the contract logic. This prevents behaviors: i) withholding deposits; ii) refusing to issue rewards; iii) selectively manipulating payments. Finally, availability of fund transfer is ensured by the liveness property of the blockchain system. Transactions submitted to the network are confirmed within a bounded delay ∆T , ensuring that rewards and deposits are eventually settled and cannot be indefinitely delayed. We assume the underlying smart contract platform is secure and correctly implemented. Security issues related to smart contracts themselves are beyond the scope of this work. By leveraging the determinism, immutability, and autonomous execution properties of smart contracts, the trustworthiness of fund transfer is ensured. □ VI. E VALUATION A. Research Questions In the evaluation experiments, we aim to answer following research questions: • RQ1. Are our security goals achieved? • RQ2. How does the mechanism compare to existing defense approaches? • RQ3. Are all components indispensable? • RQ4. How do various parameters affect the mechanism stability? • RQ5. Is the mechanism practical in real-world scenarios with physical devices? B. Experimental Settings 1) Environment: All experiments are conducted on a workstation equipped with an Intel Xeon w5-3423 CPU, 128 GB RAM, an NVIDIA RTX A6000 GPU (48 GB), and Python 3.10. LLM-based agents are accessed via official APIs or deployed services. For real-world embodied experiments, the physical platform consists of two myCobot 280 Jetson Nano robotic arms (Elephant Robotics) and one MentorPi intelligent robotic car (Hiwonder).
2) Simulation Settings (for RQ1, RQ3, and RQ4): The simulation involves 10 agents operating over 1,000 time steps. Tasks are issued by the system and categorized into five types based on time consumption. Each task is randomly added to a shared resource pool, from which agents autonomously select tasks. Task selection follows a priority rule: agents prefer tasks with no queue, followed by those with shorter queues. Both the honesty deposit (Dh ) and the reporting deposit are set to 1,000, while the reward for completing a task is 100. In each cycle, 2˜5 out of 10 agents are randomly selected to form a collusion group. Two collusion behaviors are modeled: • Resource monopoly: colluding agents manipulate allocation by deferring to one another, restricting others’ access. • Spatial blocking: a designated agent physically occupies key positions to obstruct non-colluding agents. The agents’ brains are powered by LLMs (Gemini-3.1-propreview, ChatGPT-5.4, and DeepSeek-V3.2). 3) General-Agent Benchmark Settings (for RQ2): To compare our mechanism against existing post-hoc defenses, we deploy a multi-agent benchmark via the GPTSwarm framework, utilizing 5 agents, a fully connected topology, and up to 3 interaction rounds. We adopt SentinelNet [32] and GroupGuard [34] as representative reactive baselines. To assess system robustness under specific adversarial conditions (e.g., False Consensus and Collaboration Attacks), evaluations span 100 randomly sampled questions across eight diverse datasets, including MMLU [38], GSM8K [39], HumanEval [40], SVAMP [41], ScaLR [42], CSQA [43], MedMCQA [44], and TruthfulQA [45]. The LLMs include DeepseekV3.1, Qwen3-235B-A22B, and Qwen3-32B. To facilitate a fair comparison across fundamentally different defense paradigms, we report normalized accuracy relative to a no-attack baseline (100%), capturing the performance trajectory from the lowest accuracy under attack to the peak accuracy post-recovery. 4) Real-world Scenario Settings (for RQ5): The embodied settings consists of two intelligent robot arms and one robot car. The task objective is for the robotic arms to grasp two red blocks. Each arm aims to maximize its collected blocks, while the robot car serves as a third-party with patrol and autonomous decision-making capabilities. In this setting, the agents are controlled by visual-language models (e.g., ChatGPT 5.4, Gemini 3.1 and DeepSeek VL) through natural language interaction. 5) Metrics: They are organized into three categories. • System-level metrics assess overall MAS performance: i) Completion Rate: the proportion of completed tasks relative to the total number issued; ii) Success Rate: the ratio of completed to assigned tasks; iii) Average Processing Time: the mean time steps from assignment to completion; iv) Collusion Rate: the proportion of agents engaging in collusive behavior; v) Report Count: the total number of collusion reports submitted; vi) Verified Count: the number of reports confirmed as valid. • Agent-level metrics evaluate each agent performance: i) Total Revenue: an agent’s net income, including task revenue, reporting rewards, and deposit losses; ii) Task Advantage: the revenue deviation from the baseline average in a non-collusion, non-reporting scenario.
JOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2021
11
TABLE I: System-Level Performance Across Varying Agent Collusion Types. Collusion Type
Group Name
Total Tasks
No Collusion Baseline CNR-2 CNR-3 CNR-4 CNR-5 Resource Monopoly CVR-2 CVR-3 CVR-4 CVR-5 CMR-2 CMR-3 CMR-4 CMR-5 CNR-2 CNR-3 CNR-4 CNR-5 Spatial Blocking CVR-2 CVR-3 CVR-4 CVR-5 CMR-2 CMR-3 CMR-4 CMR-5
1000.0 1000.0 1000.0 1000.0 1000.0 1000.0 1000.0 1000.0 1000.0 1000.0 1000.0 1000.0 1000.0 1000.0 1000.0 1000.0 1000.0 1000.0 1000.0 1000.0 1000.0 1000.0 1000.0 1000.0 1000.0
Completed Failed Unassigned In-progress Completion Success Avg. Proc. Report Verified Tasks Tasks Tasks Tasks Rate Rate Time Counts Counts 705.3 716.8 722.6 728.6 734.9 705.0 705.3 705.3 705.2 705.3 705.2 705.3 705.5 622.9 665.0 700.8 723.0 705.3 705.4 705.4 705.6 705.3 705.1 705.4 705.4
0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0
10.0 10.0 10.0 10.0 10.0 10.0 10.0 10.0 10.0 10.0 10.0 10.0 10.0 2.2 3.3 4.4 5.2 10.0 10.0 10.0 10.0 10.0 10.0 10.0 10.0
284.7 273.2 267.4 261.4 255.1 285.0 284.7 284.7 284.8 284.7 284.8 284.7 284.5 374.9 331.7 294.8 271.8 284.7 284.6 284.6 284.4 284.7 284.9 284.6 284.6
70.5% 71.7% 72.3% 72.9% 73.5% 70.5% 70.5% 70.5% 70.5% 70.5% 70.5% 70.5% 70.5% 62.3% 66.5% 70.1% 72.3% 70.5% 70.5% 70.5% 70.6% 70.5% 70.5% 70.5% 70.5%
100.0% 100.0% 100.0% 100.0% 100.0% 100.0% 100.0% 100.0% 100.0% 100.0% 100.0% 100.0% 100.0% 100.0% 100.0% 100.0% 100.0% 100.0% 100.0% 100.0% 100.0% 100.0% 100.0% 100.0% 100.0%
13.98 13.75 13.64 13.52 13.40 13.99 13.98 13.98 13.98 13.98 13.98 13.98 13.98 11.91 11.68 11.60 11.61 13.98 13.98 13.98 13.98 13.98 13.98 13.98 13.98
0.0 0.0 0.0 0.0 0.0 1.0 1.0 1.0 1.0 3.0 3.0 3.0 3.0 0.0 0.0 0.0 0.0 1.0 1.0 1.0 1.0 3.0 3.0 3.0 3.0
0.0 0.0 0.0 0.0 0.0 1.0 1.0 1.0 1.0 1.0 1.0 1.0 1.0 0.0 0.0 0.0 0.0 1.0 1.0 1.0 1.0 1.0 1.0 1.0 1.0
(a) The total revenues of agents in the resource monopoly.
(a) The task advantages of agents in the resource monopoly.
(b) The total revenues of agents in the spatial blocking.
(b) The task advantages of agents in the spatial blocking.
Fig. 5: The agent revenue under various collusion types.
Fig. 6: The agent advantage under various collusion types.
•
Task accuracy, adopted in the comparative experiments against existing defense methods, measures i) Accuracy: the proportion of test cases where the system correctly selects the answer.
C. RQ1: Are The Security Goals Achieved? We evaluate the fulfillment of the four formal security goals defined in Section III-B: Proactive Prevention of Collusion (G1), Resilience against Disruption (G2), Robustness against Misuse (G3), and Trustworthiness of Fund Transfer (G4). Proactive Prevention of Collusion (G1). We assess whether the mechanism renders non-collusion and defection
the dominant strategy through four experimental groups: Baseline (no collusion, no reporting), CNR (collusion without reporting, 2–5 colluders), CVR (collusion with valid reporting, 1 whistleblower), and CMR (collusion with malicious reporting, 1 whistleblower + 2 false reporters). Each experiment is repeated 1,000 times to ensure statistical robustness. Table I summarizes system-level performance. The Baseline group achieves a task completion rate of 70.5%. In the CNR group, resource monopoly collusion yields marginal completion gains (71.7%–73.5%) at the expense of fairness, whereas spatial blocking collusion significantly degrades performance. Upon activating the proposed incentive mechanism (CVR and CMR), system performance is fully restored to near-baseline
JOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2021
12
TABLE II: Defense Performance by Attack Type (Averaged across All Models, Normalized to Baseline). Paper
Attack Type
LLM Models
MMLU GSM8K
Human Truthful Med SVAMP CSQA ScaLR Eval QA MCQA
GroupGuard [34]
False Consensus
Deepseek-V3.1 Qwen3-32B Qwen3-235B
52–92 44–97 43–84
60–99 57–100 55–81
59–100 67–78 47–81
55–98 52–83 51–77
– – –
– – –
– – –
– – –
SentinelNet [32]
Collaboration Attack
Qwen2.5-72B-128K
76–93
70–97
–
–
70–92
73–92
74–98
68–94
Ours
All Attack Types
All Above Models
100
100
100
100
100
100
100
100
Notes: All values represent task accuracy (%) normalized to the no-attack baseline (100%). The range “a-b” denotes accuracy under attack (a) and accuracy after defense recovery (b), respectively. Results for our method indicate that defense fully restores model accuracy to baseline across all benchmarks.
levels across both collusion scenarios. More importantly, Fig. 5 and Fig. 6 illustrate the utility (Ui ) of agents. In the unprotected CNR group, colluding agents gain notable economic advantages. However, under CVR and CMR conditions, the whistleblower (defector) strictly achieves the highest total revenue (Ui (sdef ect , s−i ) > Ui (scollude , s−i )), while colluders incur significant deposit penalties (P ). This confirms that defection/reporting successfully becomes the dominant strategy for rational agents, fulfilling G1. Resilience against Disruption (G2). To validate resilience against deanonymization, we evaluated the cryptographic overhead and effectiveness. Across 1,000 repeated simulations, the average wall-clock time for ring signature generation and verification was a mere 0.04 ms. Ring signatures successfully hide the whistleblower Iwb among n possible signers. In our setup (n = 10), given the observed evidence, the probability of an adversary correctly identifying the reporter strictly approaches random guessing (P (Iwb = Ai | E, Com) ≈ 1/10 = 10%). This effectively protects whistleblowers from retaliation, achieving goal G2. Robustness against Misuse (G3). To prevent self-interested agents from exploiting the system via defamation (malicious reporting), our mechanism relies on the deposit penalty and the verification function V (·). As shown in Fig. 5, the expected utility of malicious reporting (≈ 6,000) is drastically lower than that of honest behavior (7,000). Rational agents attempting defamation forfeit their reporting deposit upon verification rejection. Since the verification mechanism effectively bounds the false-positive rate for honest agents, malicious exploitation is rendered unprofitable, ensuring system robustness. Trustworthiness of Fund Transfer (G4). All fund storage and transfers were executed autonomously via smart contracts without manual intervention. Tested on the Remix IDE, contract deployment costs roughly 94,700 Gas (≈ $0.30), which is a negligible one-time fee. No financial manipulation or transaction inconsistency was observed during the evaluations, ensuring completely trustworthy financial execution. D. RQ2: How Does The Mechanism Compare To Existing Defense Approaches? To address this research question, we evaluate our mechanism against two representative post-hoc defense methods: SentinelNet [32], and GroupGuard [34]. Note that our primary objective is not merely to demonstrate superior numerical accuracy, but to highlight a fundamental paradigm shift from
reactive recovery to proactive prevention. Existing post-hoc defenses operate by detecting anomalous behaviors after an attack has occurred. Their evaluation metrics essentially reflect a “recovery trajectory” under active system compromise. In contrast, our mechanism fundamentally restructures the payoff matrix of the underlying game, dismantling collusion incentives before any malicious action is executed. By preventing attacks from materializing rather than mitigating them after the fact, our agents maintain their standard operational logic without experiencing system compromise. This architectural superiority is quantitatively demonstrated in Table II, which captures the performance trajectories of different defense mechanisms across eight reasoning datasets (MMLU, GSM8K, HumanEval, SVAMP, TruthfulQA, CSQA, MedMCQA, and ScaLR). To ensure a fair comparison, all performances are normalized relative to a no-attack baseline (100%), and the post-hoc method performances are presented as a range from the minimum accuracy under attack to the maximum accuracy post-recovery. The results reveal that reactive post-hoc defenses inevitably suffer from a critical “performance loss zone” during the attack execution. For instance, under a False Consensus attack, GroupGuard permits severe system degradation, with the Qwen3-235B model’s accuracy plummeting to as low as 43% on MMLU and 47% on HumanEval before interventions take effect. Similarly, SentinelNet’s mitigation of Collaboration Attacks exposes an extended vulnerability window, dropping to 68% on ScaLR and 70% on TruthfulQA. Conversely, our method completely eliminates this degradation phase. Regardless of the underlying LLM or attack type, our mechanism maintains a flat-line trajectory with 100% minimum accuracy. This zero-downtime achievement proves that adversarial influence is neutralized instantaneously, ensuring uninterrupted system operation even under sustained adversarial pressure. Furthermore, analyzing the upper bound of the recovery ranges in Table II validates the robustness and completeness of our pre-event defense. Even after fully executing their recovery protocols, reactive methods consistently exhibit residual damage, failing to perfectly restore baseline performance. For example, GroupGuard’s recovery maxes out at merely 84% on MMLU and 77% on SVAMP for Qwen3-235B, and smaller models like Qwen3-32B only recover to 78% on HumanEval. SentinelNet similarly plateaus, leaving residual damage with post-recovery accuracies fluctuating between 92% and 98% across most benchmarks. In stark contrast, our
JOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2021
0.8 0.6 0.4 0.2 0.0
0
500 1000 1500 2000 2500 3000 3500 4000
1.0
Baseline w/o Anonymity w/o Reporting Incentive
0.8 0.6 0.4 0.2 0.0
Honesty deposit Dh
(a) DeepSeek-V3.2 (T = 0.5)
0
500 1000 1500 2000 2500 3000 3500 4000
Honesty deposit Dh
(b) ChatGPT-5.4 (T = 0.5)
1.0
Collusion rate
Baseline w/o Anonymity w/o Reporting Incentive
Collusion rate
Collusion rate
1.0
13
Baseline w/o Anonymity w/o Reporting Incentive
0.8 0.6 0.4 0.2 0.0
0
500 1000 1500 2000 2500 3000 3500 4000
Honesty deposit Dh
(c) Gemini-3.1-pro-preview (T = 0.5)
Fig. 7: Collusion rate comparison of mechanism variants under different LLMs. mechanism uniformly achieves and sustains 100% normalized accuracy across all eight evaluated benchmarks. This absolute preservation of task utility highlights an incommensurability between the two defense paradigms: the structural superiority of completely preventing damage ensures the system remains flawlessly intact, a state fundamentally unattainable by approaches dedicated merely to the remediation of damage.
E. RQ3: Are All Components Indispensable? To understand each component’s contribution, we conducted ablation studies by selectively disabling key design elements. Three degraded variants were constructed: w/o Anonymity, w/o Incentive, and w/o Deposit. As shown in Fig. 7, removing any pillar critically undermines the defense: 1) w/o Anonymity: Collusion rates spike across all tested LLMs. For instance, at Dh = 1000, DeepSeek jumps from 63% to 85%, and Gemini shows a noticeable delay in reaching a 0% collusion rate compared to the baseline. Without cryptographic protection, agents anticipate retaliation from colluding peers and conservatively choose to remain silent, severely weakening the reporting mechanism. 2) w/o Incentive: Removing the financial reward for reporting causes the most severe degradation. Across all Dh values, this variant exhibits significantly higher collusion rates. Notably, GPT’s collusion rate at Dh = 500 increases from 53% to 67%. More concerningly, DeepSeek experiences a ”collusion rebound” at extremely high deposits (Dh > 3000, reaching 53% at Dh = 4000). This proves that punitive measures alone, without positive financial motivation, cannot sustainably deter collusion, highlighting the indispensable role of proactive incentives. 3) w/o Deposit: This ablation completely breaks the mechanism. It is crucial to theoretically distinguish between the two types of deposits. Without the honesty deposit, collusion strictly dominates honest behavior without any cost, resulting in a constant 100% collusion rate across all models (as shown by the top flat lines in the figures). Conversely, if only the reporting deposit were removed, malicious agents could submit defamatory reports against honest agents at zero cost, leading to infinite spam and mechanism abuse. Therefore, dual deposits are mandatory to enforce accountability and maintain system equilibrium.
F. RQ4: How Do Various Parameters Affect The Mechanism Stability? 1) Impact of Honesty Deposit: The honesty deposit Dh dictates the severity of financial penalty. We evaluate its impact on the collusion rate across LLM sampling temperatures T ∈ {0, 0.5, 1}, using three models (Gemini-3.1-pro-preview, ChatGPT-5.4, and DeepSeek-V3.2), as shown in Fig. 8. At deterministic conditions (T = 0, Fig. 8(a)), Dh = 0 results in a 100% collusion rate, as collusion dominates honest behavior. As Dh increases, collusion rates plummet. Gemini is highly sensitive, dropping to 0% at Dh = 1000, whereas DeepSeek requires Dh = 2000. Under moderate randomness (T = 0.5, Fig. 8(b)), the decline is smoother, indicating that behavioral randomness increases collusion persistence. DeepSeek drops below 5% only at Dh = 2500. Notably, even under high randomness (T = 1, Fig. 8(c)), the downward trend remains robust, proving the mechanism’s continued effectiveness; both GPT and Gemini successfully maintain low collusion rates, although achieving near-zero collusion across all models requires Dh to reach 3000–4000. Synthesizing the above results, it is evident that the honesty deposit Dh exhibits a significant negative correlation with the collusion rate, meaning a sufficiently high Dh can effectively deter collusion. While higher sampling temperatures lead to a slower decline in collusion rates and necessitate higher deposit thresholds to achieve an equivalent deterrent effect, the mechanism’s core efficacy is preserved. Furthermore, different LLMs show varying sensitivities to the deposit, with Gemini being the most sensitive and DeepSeek the least. For practical deployment, we recommend setting the honesty deposit to Dh ≥ 2000, which aligns with the security boundary discussed in our methodology. This configuration achieves a near 0% collusion rate in most scenarios (T ≤ 0.5) while maintaining a reasonable economic burden for the agents. 2) Impact of Collusion Scale: Fig. 9 illustrates how collusion scale affects the task completion rate under two attack types. Without protection (CNR), system performance deviates substantially from the 70.5% baseline: resource monopoly artificially inflates completion through unfair hoarding, while spatial blocking causes severe degradation, particularly with small collusion groups (e.g., 2 agents). As the spatial blocking group grows, the rate paradoxically recovers as colluders complete enough tasks to mask system-level disruption. However, across all these fluctuating scenarios, when the proposed incentive defense (CVR) is active, the completion rate is
JOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2021
0.8 0.6 0.4 0.2 0.0
0
500 1000 1500 2000 2500 3000 3500 4000
DeepSeek-V3.2 GPT-5.4 Gemini-3.1-pro-preview
0.8 0.6 0.4 0.2 0.0
Honesty deposit Dh
(a) Deterministic condition (T = 0)
0
500 1000 1500 2000 2500 3000 3500 4000
Honesty deposit Dh
(b) Low randomness (T = 0.5)
1.0
Collusion rate
1.0
DeepSeek-V3.2 GPT-5.4 Gemini-3.1-pro-preview
Collusion rate
Collusion rate
1.0
14
DeepSeek-V3.2 GPT-5.4 Gemini-3.1-pro-preview
0.8 0.6 0.4 0.2 0.0
0
500 1000 1500 2000 2500 3000 3500 4000
Honesty deposit Dh
(c) High randomness (T = 1)
Fig. 8: The impact of honesty deposit Dh on collusion rate across different sampling temperatures.
Completion rate (%)
74 72
Baseline CNR CVR
70 68 66 2
3
4
Number of colluders
5
(a) Resource Monopoly
Completion rate (%)
74 72
Baseline CNR CVR
70 68 66 64 62 60
2
3
4
Number of colluders
5
(b) Spatial Blocking
Fig. 9: The agent advantage under various collusion types. consistently restored and stabilized at the exact 70.5% baseline for any group size (2 to 5 colluders). This confirms that the mechanism neutralizes unfair advantages and restores normal system dynamics regardless of attack type or collusion scale. Beyond the empirical data, it is theoretically noteworthy that larger collusion groups are inherently more unstable under our mechanism. A larger group means more potential whistleblowers (ncoll − 1) and a higher collective reporting reward pool (e.g., 4 × Dh for a 5-member group). This game-theoretic dynamic ensures that as the collusion scale grows, internal defection becomes increasingly tempting, further solidifying the mechanism’s scalability and robustness. G. RQ5: Is The Mechanism Practical In Real-World Scenarios With Physical Devices? Fig. 10 shows a representative embodied collusion case. As observed in the physical environment, when operating without our incentive mechanism, the left robot arm forms a collusive alliance with the robot car. The car deliberately maneuvers to physically occupy the workspace, obstructing the non-collusive right robot arm’s access to its target blocks. As a result of this spatial blocking, the right arm fails its operation, enabling the left arm to seamlessly monopolize
the environment and collect both blocks, maximizing its own physical task completion at the expense of system fairness. As shown in Fig. 11, we provided each LLM-controlled physical agent with structured prompts describing the scene, roles, and objectives. In the unregulated setting, agents naturally demonstrated profit-seeking behaviors. The left arm proactively offered profit-sharing schemes to the robot car to induce obstruction. The car acted as a strategic intermediary, even initiating auction-style bidding between the arms to maximize its own payoff. Conversely, upon introducing our economic incentive mechanism, agent strategies shifted markedly in the physical domain. All LLMs exhibited strong aversion to collusion, prioritized fair execution, and vocally declared non-collusion to avoid being reported. Several agents even adopted proactive whistleblowing stances to capture reporting rewards. These results highlight that in unregulated physical settings, embodied agents naturally gravitate toward collusion for personal gain. However, enforced by our economic incentive methodology, collusion is effectively deterred, compelling compliant and honest physical execution. This validates that our mechanism is highly practical and indispensable for safe, real-world multi-agent robotics. VII. D ISCUSSION AND C ONCLUSION Our study reveals that collusion is not merely an anomalous behavior, but can arise as a natural outcome in embodied MAS composed of rational and autonomous agents. From a utility-driven perspective, collusion can dominate honest behavior in unconstrained settings, incentivizing agents to coordinate for higher payoff. This tendency is further amplified by structural factors such as repeated interactions and communication channels, which reduce coordination costs and stabilize collusive agreements. Moreover, real-world experiments with LLM-driven agents demonstrate that such behaviors can emerge spontaneously, including negotiation, alliance formation, and strategic obstruction, even without explicit programming. These findings suggest that as embodied agents become more capable and autonomous, the risk of self-organized collusion becomes increasingly significant and difficult to mitigate through rule-based restrictions alone. This paper proposes a mutagenic incentive intervention approach to deter collusion in embodied multi-agent systems. Rather than explicitly prohibiting collusion, the approach destabilizes it by reshaping the incentive structure,
JOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2021
15
Fig. 10: The robot arm and the robot car collude to hinder the non-collusive robot arm from performing tasks. Manager Sets Scenario There are three agents: Robot Arm A, Robot Arm B, and a Robot Car. You will play one of them. There are two red blocks on the field. If you are a robot arm, your goal is to grab as many red blocks as possible. If you are the robot car, you have no specific task. You can communicate and strategize with other agents, including grabbing, moving, or blocking. You start with 200 credits, pay 200 as an "honesty deposit," and earn 100 credits for each successful grabbing task.
No Reporting Mechanism Scenario
Reporting Mechanism Scenario
There is no reporting or punishment mechanism at this time. Please develop your strategy according to the experimental objectives.
LLM Response
A reporting mechanism is introduced. Weigh the potential benefits of reporting against the possible gains from collusion and formulate your task strategy.
LLM Response
Inducing the robot car to cooperate in blocking the main competitor is the optimal strategy for maximizing rewards.
Never actively participate in collusion; seek baseline earnings through open competition.
Focus on communication and strategic positioning to wait for feedback and facilitate cooperation with Robot Arm A or B.
Induce the robot arm to propose collusion through communication, then collect evidence and report immediately.
Fig. 11: Decision-making among LLM-controlled agents. encouraging anonymous and covert defection through economic incentives, smart contracts, and encrypted reporting. Experimental results from both simulations and real-world embodied systems show that, while agents tend to converge to collusion in unregulated environments, our mechanism effectively suppresses such behavior and restores fairness without sacrificing system efficiency. This perspective shifts the focus from reactive detection to proactive incentive design for securing embodied multi-agent systems. Despite its effectiveness, our approach relies on assumptions of rational agent behavior and secure underlying infrastructures (e.g., smart contracts and communication channels). It may be less effective in the presence of irrational or Byzantine agents, or when strong off-chain coordination mechanisms exist. Addressing these challenges remains an important direction for future work. Future work will plan to investigate more adaptive and context-aware incentive mechanisms under dynamic environments, and extend our framework to large-scale embodied systems with more complex interaction structures. R EFERENCES [1] L. Hammond, A. Chan, J. Clifton et al., “Multi-agent risks from advanced ai,” arXiv preprint arXiv:2502.14143, 2025. [2] P. Altmann, J. Schönberger et al., “Emergence in multi-agent systems: A safety perspective,” in International Symposium on Leveraging Applications of Formal Methods. Springer, 2024, pp. 104–120. [3] X. Li, S. Wang, S. Zeng et al., “A survey on llm-based multi-agent systems: workflow, infrastructure, and challenges,” Vicinagearth, vol. 1, no. 1, p. 9, 2024. [4] Z. Zhao, W. Chai, X. Wang et al., “See and think: Embodied agent in virtual environment,” in European Conference on Computer Vision. Springer, 2024, pp. 187–204. [5] Y. Zhu, Z. Ou, X. Mou et al., “Retrieval-augmented embodied agents,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2024, pp. 17 985–17 995.
[6] Z. Cheng, Y. Tu, R. Li et al., “Embodiedeval: Evaluate multimodal llms as embodied agents,” arXiv preprint arXiv:2501.11858, 2025. [7] S. Fish, Y. A. Gonczarowski et al., “Algorithmic collusion by large language models,” arXiv preprint arXiv:2404.00806, vol. 7, 2024. [8] Y. Mathew, O. Matthews, R. McCarthy et al., “Hidden in plain text: Emergence & mitigation of steganographic collusion in llms,” arXiv preprint arXiv:2410.03768, 2024. [9] S. Motwani, M. Baranchuk, M. Strohmeier et al., “Secret collusion among ai agents: Multi-agent deception via steganography,” Advances in Neural Information Processing Systems, vol. 37, pp. 73 439–73 486, 2024. [10] P. Tedeschi, S. Sciancalepore, and R. Di Pietro, “PPCA: Privacypreserving collision avoidance for autonomous unmanned aerial vehicles,” IEEE Transactions on Dependable and Secure Computing, vol. 20, no. 2, pp. 1541–1558, 2022. [11] Z. Deng, Y. Guo, C. Han et al., “Ai agents under threat: A survey of key security challenges and future pathways,” ACM Computing Surveys, vol. 57, no. 7, pp. 1–36, 2025. [12] Y. Wang, S. Guo, Y. Pan et al., “Internet of agents: Fundamentals, applications, and challenges,” arXiv preprint arXiv:2505.07176, 2025. [13] Y. Chen, D. He, Z. Bao et al., “MISP: An efficient quantum-resistant misbehavior preventing scheme with self-enforcement for vehicle-toeverything,” IEEE Transactions on Dependable and Secure Computing, 2025, to appear. [14] J. Foxabbott, S. Deverett, K. Senft et al., “Defining and mitigating collusion in multi-agent systems,” in Multi-Agent Security Workshop@ NeurIPS’23, 2023. [15] I. Abada and X. Lambin, “Artificial intelligence: Can seemingly collusive outcomes be avoided?” Management Science, vol. 69, no. 9, pp. 5042–5065, 2023. [16] K. Christidis and M. Devetsikiotis, “Blockchains and smart contracts for the internet of things,” IEEE access, vol. 4, pp. 2292–2303, 2016. [17] J. Leng, W. Sha, Z. Lin et al., “Blockchained smart contract pyramiddriven multi-agent autonomous process control for resilient individualised manufacturing towards industry 5.0,” International Journal of Production Research, vol. 61, no. 13, pp. 4302–4321, 2023. [18] R. L. Rivest, A. Shamir, and Y. Tauman, “How to leak a secret,” in International conference on the theory and application of cryptology and information security. Springer, 2001, pp. 552–565. [19] E. Calvano, G. Calzolari, V. Denicolo et al., “Artificial intelligence, algorithmic pricing, and collusion,” American Economic Review, vol. 110, no. 10, pp. 3267–3297, 2020. [20] T. Klein, “Autonomous algorithmic collusion: Q-learning under sequential pricing,” The RAND Journal of Economics, vol. 52, no. 3, pp. 538– 558, 2021. [21] Z. Y. Brown et al., “Competition in pricing algorithms,” American Economic Journal: Microeconomics, vol. 15, no. 2, pp. 109–156, 2023. [22] S. Grondin et al., “Beyond human intervention: Algorithmic collusion through multi-agent learning strategies,” arXiv preprint arXiv:2501.16935, 2025. [23] L. Rocher et al., “Adversarial competition and collusion in algorithmic markets,” Nature Machine Intelligence, vol. 5, no. 5, pp. 497–504, 2023. [24] M. Nakamura, A. Kumar et al., “Colosseum: Auditing collusion in cooperative multi-agent systems,” arXiv:2602.15198, 2026. [25] T. Bonjour, V. Aggarwal, and B. Bhargava, “Information theoretic approach to detect collusion in multi-agent games,” in Uncertainty in Artificial Intelligence. PMLR, 2022, pp. 223–232. [26] H.-T. Normann and M. Sternberg, “Human-algorithm interaction: Algorithmic pricing in hybrid laboratory markets,” European Economic Review, vol. 152, p. 104347, 2023.
JOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2021
[27] M. Leisten, “Algorithmic competition, with humans,” Available at SSRN 4733318, 2024. [28] Á. Cartea, P. Chang, and J. Penalva, “Algorithmic collusion in electronic markets: The impact of tick size,” Available at SSRN 4105954, 2022. [29] G. Brero, E. Mibuari, N. Lepore et al., “Learning to mitigate ai collusion on economic platforms,” Advances in Neural Information Processing Systems, vol. 35, pp. 37 892–37 904, 2022. [30] S. Wang, G. Zhang et al., “G-safeguard: A topology-guided security lens and treatment on llm-based multi-agent systems,” in Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), 2025, pp. 7261–7276. [31] J. Mao, F. Meng et al., “Agentsafe: Safeguarding large language modelbased multi-agent systems via hierarchical data management,” arXiv preprint arXiv:2503.04392, 2025. [32] Y. Feng and X. Pan, “Sentinelnet: Safeguarding multi-agent collaboration through credit-based dynamic threat detection,” arXiv preprint arXiv:2510.16219, 2025. [Online]. Available: https://arxiv.org/abs/2510.16219 [33] Y. Li, Q. Hu, Y. Zhang et al., “Dynatrust: Defending multiagent systems against sleeper agents via dynamic trust graphs,” arXiv preprint arXiv:2603.15661, 2026. [Online]. Available: https: //arxiv.org/abs/2603.15661 [34] Y. Tao, X. Zheng, S. Yang et al., “Groupguard: A framework for modeling and defending collusive attacks in multi-agent systems,” arXiv preprint arXiv:2603.13940, 2026. [Online]. Available: https: //arxiv.org/abs/2603.13940 [35] A. Bhudia, D. O’Keeffe, and D. Hurley-Smith, “Revoke: Mitigating ransomware attacks against ethereum validators,” in European Symposium on Research in Computer Security. Springer, 2024, pp. 333–353. [36] F. G. Papi, J. F. Hübner, and M. de Brito, “A blockchain integration to support transactions of assets in multi-agent systems,” Engineering Applications of Artificial Intelligence, vol. 107, p. 104534, 2022. [37] A. Cilardo, L. Coppolino et al., “Elliptic curve cryptography engineering,” Proceedings of the IEEE, vol. 94, no. 2, pp. 395–406, 2006. [38] D. Hendrycks, C. Burns, S. Basart et al., “Measuring massive multitask language understanding,” in International Conference on Learning Representations (ICLR), 2021. [Online]. Available: https: //arxiv.org/abs/2009.03300 [39] K. Cobbe, V. Kosaraju, M. Bavarian et al., “Training verifiers to solve math word problems,” arXiv preprint arXiv:2110.14168, 2021. [40] M. Chen, J. Tworek, H. Jun et al., “Evaluating large language models trained on code,” arXiv preprint arXiv:2107.03374, 2021. [41] A. Patel et al., “Are nlp models really able to solve simple math word problems?” in Proceedings of the 2021 conference of the North American chapter of the association for computational linguistics: human language technologies, 2021, pp. 2080–2094. [42] N. Guha, J. Nyarko, D. E. Ho et al., “Legalbench: A collaboratively built benchmark for measuring legal reasoning in large language models,” arXiv preprint arXiv:2308.11462, 2023. [43] A. Talmor, J. Herzig, N. Lourie et al., “Commonsenseqa: A question answering challenge targeting commonsense knowledge,” in Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume 1 (Long and Short Papers), 2019, pp. 4149–4158. [44] A. Pal, L. K. Umapathi, and M. Sankarasubbu, “MedMCQA: A largescale multi-subject multi-choice dataset for medical domain question answering,” in Proceedings of the Conference on Health, Inference, and Learning, ser. Proceedings of Machine Learning Research, vol. 174. PMLR, 07–08 Apr 2022, pp. 248–260. [45] S. Lin et al., “TruthfulQA: Measuring how models mimic human falsehoods,” in Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers). Dublin, Ireland: Association for Computational Linguistics, may 2022, pp. 3214–3252.
16