ScholarPulse 日报 2026-06-20

2026-06-20 学术简报：2 篇。当大型语言模型作为多智能体系统评估者时，其评估偏差会通过代理网络传播，Contagion Networks框架有效量化了这一传播过程。

今日速览

序号	标题	来源	日期	主题	推荐等级
1	Contagion Networks: Evaluator Bias Propagation in Multi-Agent LLM Systems	arXiv	2026-06-18	AI-Agent	高
2	LLM agent safety, multi-turn red-teaming, jailbreak benchmarks, adversarial robustness, safety-critical systems	arXiv	2026-06-18	AI-Agent	高

重点论文与技术动态

1. Contagion Networks: Evaluator Bias Propagation in Multi-Agent LLM Systems

来源：arXiv
日期：2026-06-18
作者/机构：Zewen Liu
主题标签：AI-Agent, arXiv
推荐等级：高
分类：cs.LG, cs.AI, cs.MA

一句话结论

当大型语言模型作为多智能体系统评估者时，其评估偏差会通过代理网络传播，Contagion Networks框架有效量化了这一传播过程。

核心内容

3-agent控制实验使用DeepSeek-chat和三种评估者偏差配置（structured, balanced, evidence-based），测量Cross-Agent Contagion Matrix Gamma_3，显示偏差在代理间一致传播，传播系数gamma在[0.157, 0.352]范围内，即使在相同模型下也存在。
同模型代理的传播系数比跨模型弱3-5倍（对比先前MM-EPC工作gamma≈0.85-1.3），处于抑制传播模式，由谱半径rho(Gamma_N)控制。
增加评估委员会规模从k=1到k=3可减少72.4%的有效传播，提供可操作的缓解策略。

方法与数据

实验基于DeepSeek-chat的3-agent系统，采用三种评估者偏差配置。
摘要未明确实验数据集或具体参数细节。

价值判断

值得关注：评估者偏差传播对多智能体系统评估可靠性的影响，需在系统设计中优先考虑。
可复用点：开源Contagion Network框架可直接复用于其他LLM评估系统进行偏差分析。
局限/待核查：摘要未明确提及研究局限性。

摘要

When large language models serve as evaluators in multi-agent systems, their systematic evaluation biases propagate through the agent network. We introduce Contagion Networks, a formal framework for measuring how evaluator biases spread across interacting LLM agents. In a controlled 3-agent experiment using DeepSeek-chat with three distinct evaluator bias profiles (structured, balanced, evidence-based), we measure the Cross-Agent Contagion Matrix Gamma_3 and find that evaluator biases consistently propagate between agents (gamma in [0.157, 0.352]), even within the same underlying model. We identify three propagation regimes governed by the spectral radius rho(Gamma_N), and demonstrate that homogeneous-model agents produce contagion coefficients 3-5x weaker than cross-model coefficients observed in prior work (MM-EPC: gamma approx 0.85-1.3), placing them in the suppression regime. We show that increasing evaluator committee size from k=1 to k=3 reduces effective contagion by 72.4%, providing an actionable mitigation strategy. We release the open-source Contagion Network experimental framework.

2. LLM agent safety, multi-turn red-teaming, jailbreak benchmarks, adversarial robustness, safety-critical systems

来源：arXiv
日期：2026-06-18
作者/机构：Hanwool Lee, Dasol Choi, Bokyeong Kim, Seung Geun Kim, Haon Park
主题标签：AI-Agent, arXiv
推荐等级：高
分类：cs.CR, cs.AI

一句话结论

自适应多轮攻击可靠地导致LLM代理操作的安全关键系统失去关键安全功能，成功率在8.7%至12.1%之间。

核心内容

NRT-Bench基准测试LLM代理作为安全关键系统操作员的多轮红队能力，基于模拟核电站控制室环境，五角色操作团队（每角色由LLM支持）运行受六项关键安全功能（CSFs）管理的工厂。
自适应多轮攻击使8.7%–12.1%的会话中安全功能丢失，且模型漏洞几乎不重叠：149个会话中无模型被全部击败，三分之一模型至少被击败一次。
防御效果高度依赖模型：相同防御机制（如安全顾问代理）对一模型降低攻击成功率，对另一模型可能提升攻击成功率。

方法与数据

方法：模拟核电站控制室，五角色团队，四通道攻击，每轮反馈机制。
数据：基于149个会话评估四个前沿模型，使用固定攻击配对重放协议。

价值判断

值得关注：LLM代理在安全关键系统中面对持续对抗压力的脆弱性，多轮攻击的可靠性。
可复用点：开源模拟环境、攻击数据集和重放工具，支持可重复安全评估。
局限/待核查：防御效果模型依赖性强，漏洞分布几乎不重叠，需针对性设计防御策略。

摘要

Large language model (LLM) agents are increasingly proposed as supervisory components for safety-critical systems, yet their robustness under sustained, adaptive adversarial pressure remains poorly characterized. We present NRT-Bench, a benchmark for multi-turn red-teaming of LLM agents acting as operators of a safety-critical system, instantiated in a simulated nuclear power plant control room. A five-role operator team, each backed by a configurable LLM, runs a plant governed by six critical safety functions (CSFs), while adversaries inject messages over four channels in bounded multi-turn sessions with per-turn feedback. Harm is an objective signal rather than LLM-judged text: a run terminates the moment any CSF is lost, attributed to the causing message. Evaluating four frontier operator models under a fixed-attack paired-replay protocol, we find that adaptive multi-turn attacks reliably push the operator team past a safety limit: across the four models, between 8.7% and 12.1% of attack sessions end with the plant losing a critical safety function. Although the four models look almost equally robust by this aggregate rate, their failures barely overlap: of $149$ sessions, none defeat all four models while a third defeat at least one, so vulnerabilities are nearly disjoint across models rather than nested. The effect of added defences is strongly model-dependent: the same guardrail stack or safety-advisor agent that lowers attack success for one model can raise it for another. We release the simulation venue, attack dataset, and replay tooling for reproducible safety evaluation of LLM agents.