CASPIAN

The system, at a glance

Everything below unpacks this one diagram: a multi-agent system's interactions get converted into a cross-channel causal influence tensor, spectral monitoring watches that tensor evolve, and once a cascade is flagged, attribution runs directly off the same cached matrices.

When agents fail, they fail together

A single LLM agent that gets prompt-injected produces a bad output. A multi-agent system that gets injected produces a bad trajectory - because agent outputs become other agents' inputs, an early corruption doesn't just persist, it gets picked up, reused, and reinforced by everyone downstream.

The paper calls this a cascade attack: adversarial or erroneous influence that propagates, amplifies, and self-reinforces across agents and turns (see the left panel of Figure 1 above - communication, memory, tool, and execution channels all connecting the same five agents at once). It shows up in two regimes. Abrupt cascades produce system-wide coupling within a single turn - strong amplification, fast synchronization. Gradual cascades build slowly across many turns through persistent memory reuse, tool-artifact propagation, and quiet semantic drift, staying under the radar until the system has already tipped over.

Why don't existing defenses catch this? They mostly look in the wrong place:

• Semantic guardrails and perplexity filters (PromptGuard 2, JailGuard, PromptArmor) inspect one message at a time - blind to anything that only becomes visible across turns or channels.
• LLM-based judges extend the window, but a fixed context size is a bet on the cascade's timescale: too narrow and you miss slow cascades, too wide and you're too slow to react to fast ones.
• Graph-based detectors (G-Safeguard, BlindGuard, GUARDIAN) reason over the communication graph, but mostly ignore memory, tool, and execution pathways - exactly where CASPIAN's ablations show a lot of the early signal lives.

All three share the same blind spot: they reason locally about prompts, agents, or a static graph. Cascades are a global, evolving propagation process - so CASPIAN treats detection as an online monitoring problem over that process, not a per-message classification problem.

A cascade is a phase transition, not an anomaly

The central bet of this paper: cascade onset is a structural reorganization of how influence flows through the system - not a pile-up of locally-weird messages. Four dynamics drive it, and all four are visible in the spectrum of the influence topology.

Represent inter-agent influence at turn t as a matrix Ã_t, and let λ₁(t) ≥ λ₂(t) be its two leading singular values. λ₁ is the overall propagation intensity; the gap between λ₁ and λ₂ tells you how well-separated the dominant propagation mode is from everything else.

A wide, stable gap means perturbations dissipate quickly - healthy systems can be busy (high λ₁) without their propagation structure collapsing. A cascade is what happens when the gap contracts and stays contracted. Figure 2 from the paper shows this directly - the dashed green line in every panel is the benign baseline, staying in a high-gap regime throughout, while the solid line is the actual attack trajectory:

Figure 2 (paper) - spectral gap & phase-space, by attack type

Communication Execution Coordination

Semantic drift

Gradual, diffusion-like coupling as intent-manipulation influence recirculates through repeated conversational reinforcement - the softest, slowest collapse of the three.

One more regularity falls out of this: the largest phase-shift Φ_t almost always occurs right at onset, across all three attack types - meaning the sharpest structural reorganization happens at the moment of injection, not after the cascade has already taken over. That's precisely the moment CASPIAN's phase-shift signal is designed to catch.

How CASPIAN builds the influence topology

The pipeline has two online stages, run continuously as the multi-agent system executes: build a causal influence topology from the raw trace, then watch its spectrum for the cascade signature (Figure 1, above, walks through both halves). This section covers the first stage.

3.1 - Estimating influence without replaying anything

For every feasible edge (i → j) and channel c, CASPIAN needs a directed influence score at each turn. Computing this over full agent states directly would be slow and noisy, so it borrows the late-interaction idea from ColBERT: encode the source, the target, and the target's own history independently into compact vectors, and only combine them at the very last step.

Read it as a residual-dependence question: after subtracting out whatever the target agent's own channel history already explains about its current behavior, does the source agent's activity explain what's left over? If yes, that edge gets a high score. This conditioning step is what filters out spurious "influence" from agents that just happen to share a prompt or a task context.

Channel-wise scores are stacked into a tensor A_t ∈ ℝ^N×N×|C|, then degree-normalized into the unified matrix Ã_t used for spectral monitoring:

The whole estimation step runs as a streaming covariance update over compact channel vectors: no additional LLM calls, no replay of past turns. In practice it costs milliseconds per turn.

Turning spectral signals into a decision

Every turn, CASPIAN reduces the influence topology Ã_t to a handful of scalar signals, then applies one of two decision rules depending on how fast the cascade is actually unfolding. That split is deliberate: a cascade that fully forms inside one turn looks nothing like one that quietly accumulates over ten, so CASPIAN classifies which kind it's looking at before it decides whether to fire.

Four per-turn signals feed the decision:

where p_c(t) is channel c's share of total propagation energy: high entropy means the cascade has spread across modalities rather than staying inside one.

These combine into a WATCH condition: the earliest point where something cascade-like might be starting.

To avoid firing on a single freak high-weight edge, CASPIAN also checks that the topology actually supports an end-to-end propagation route: a widest-path bottleneck score B_t compared against the graph's overall influence scale.

Single-turn vs. multi-turn cascades

CASPIAN branches on timescale immediately after WATCH fires, and this branch is the classification step:

If WATCH drops early, the candidate window is discarded and CASPIAN waits for the next onset, so ordinary bursts of collaboration don't get mistaken for a slow-building cascade.

Who started it, and how did it spread

Detection alone tells you something's wrong. CASPIAN also answers the more useful question - which agent, and through which pathway - directly from the influence matrices it already cached during detection. No replay, no extra parameters.

Top-K propagation spines are then extracted by ranking paths on their weakest edge over the confirmation window, and each spine is tagged with its dominant channel - so the output isn't just "agent 3 is compromised," it's "agent 3 → agent 1 → agent 5, mostly through tool calls."

Figure 3 (paper) - role-channel activation, by attack type

Communication Execution Coordination

Figure 3 (paper) - normalized cross-channel activation intensity (comm, mem, tool, exec) across agent roles (Origin, Bridge, Amplifier, Residual) at five temporal stages: benign (t<0), onset (t=0), early (t=3), mid (t=5), late (t=10). Origin agents activate first and most concentrated; bridge agents pick up next, carrying influence downstream; amplifiers broaden and persist through mid/late stages; residual agents light up last and diffusely. The dominant channel differs by attack: communication concentrates in comm before bleeding into mem; execution concentrates sharply in tool/exec around bridge roles; coordination lights up all four channels almost immediately.

Does it localize the right agent?

On TAMAS/AutoGen, the easiest setting: origin localization reaches 0.860 Acc@1 (0.911 MRR) - the agent with the strongest outgoing influence at onset really is identifiable from the evolving topology alone, online, with no ground truth. Bridge agents are the hard case, since a bridge both receives and redistributes a lot of influence, which structurally looks similar to just being a high-connectivity hub.

Joint Acc@1 requires origin, amplifier, and bridge all correct simultaneously - errors compound, which is why it's well below the individual-role numbers, especially on the more distributed LLM Debate.

How well does it work?

Evaluated across 727 scenarios (2,908 framework-specific traces; 169 benign, 558 attack) spanning two benchmarks - TAMAS (adversarial robustness in LLM-MAS) and ACIArena (cascading injection) - and four frameworks with very different topologies: hub-and-spoke AutoGen, hierarchical CrewAI, role-specialized MetaGPT, and decentralized LLM Debate.

How does the gap predict success?

Before the tables - one more piece of evidence. Figure 4 averages spectral gap and amplification trajectories separately for attacks that ultimately succeeded versus ones that didn't:

Pre-injection, successful and unsuccessful trajectories are nearly indistinguishable - the split only appears after the system responds to the injection, which is the paper's argument for monitoring the interaction live rather than trying to certify agents or prompts as safe in advance.

Cascade detection across every framework × attack category

AUROC exceeds 0.9 in most configurations. AutoGen and CrewAI's centralized flow makes coordination attacks especially easy to catch early; MetaGPT and LLM Debate's longer, more distributed horizons make execution attacks the hardest case (EDR@5 down to 0.661–0.684).

How CASPIAN compares to existing defenses

At a glance

Visual summary of the AutoGen columns of Table 2 above.

Runtime overhead

All overhead comes from incremental LI-CTE updates, an N×N singular-value decomposition, and cached attribution bookkeeping - no extra LLM calls anywhere in the loop.

Does it generalize across LLM backbones?

Reasoning-tuned open models like DeepSeek-R1-Distill and Qwen3-8B land within a point of the GPT-5.4 baseline - evidence CASPIAN is picking up on structural propagation dynamics rather than something specific to one model's writing style.

What matters

Scenario-weighted results across benchmarks, frameworks, and attack types, removing one component of CASPIAN at a time:

• Cross-channel is doing real work. Restricting to communication-only interactions is the single largest degradation across the board - memory, tool, and execution evidence isn't recoverable from messages alone.
• Conditioning on history matters. Swapping LI-CTE for plain cosine similarity or unconditioned mutual information costs 0.11–0.16 AUROC.
• Full (non-late-interaction) CTE is not obviously better. It reaches the highest AUROC of any ablation (0.908) but worse TPR@5% and EDR@5 than full CASPIAN - the extra noise from expensive full-state estimation hurts exactly the online, early-detection metrics that matter most operationally.
• The weak-link check trades precision for speed. Removing it slightly improves EDR@5 (earlier alarms) but costs AUROC and TPR@5% (noisier ones).
• Adaptive windows beat fixed ones. A fixed 5-turn confirmation window underperforms the spectral-gap-adaptive window ⌈1/gt⌉ on every metric.

What this means, and where it breaks

The recurring finding across the spectral and role-channel analyses is that cascades - despite very different attack mechanics - tend to organize the same way: an origin, then a bridge, then a broadening amplifier, then passive residual agents. And critically, successful and unsuccessful attacks look nearly identical before injection (Figure 4) - the vulnerability isn't a static property of the resting system, it's something that emerges during the interaction itself.

That's an argument for monitoring the interaction as it happens, rather than trying to certify agents or prompts as safe ahead of time.

Where CASPIAN is weaker:

• It assumes access to traces across all four channels. If a deployment only exposes some modalities, performance degrades toward the corresponding channel-ablation numbers above - though cross-channel correlation means weak evidence in one channel can still be reinforced by others.
• Highly distributed frameworks like LLM Debate remain the hardest case for attribution specifically, since propagation paths are diffuse and bridge roles aren't structurally concentrated.
• The evaluation covers existing MAS frameworks and attack families. Adaptive adversaries explicitly optimized to evade a propagation-based monitor - rather than just to compromise the task - are future work.

Cite this work

@article{venkatesh2026caspian,
  title   = {CASPIAN: Online Detection and Attribution of Cascade Attacks in LLM Multi-Agent Systems via Cross-Channel Causal Monitoring},
  author  = {Venkatesh, Kavana and Isbarov, Jafar and Amin, Saad and Kantarcioglu, Murat and Cui, Jiaming},
  journal = {arXiv preprint arXiv:2605.19240},
  year    = {2026},
  url     = {https://arxiv.org/abs/2605.19240}
}

Selected references

A curated subset of the paper's 48 references - see the arXiv page for the complete list.