@inproceedings{wang-etal-2026-mas,
title = "{MAS}-Shield: A Defense Framework for Secure and Efficient {LLM} {MAS}",
author = "Wang, Kaixiang and
Zhou, Zhaojiacheng and
Suvonov, Bunyod and
Lou, Jiong and
Wang, Zihan and
Zheng, Yuxiang and
Lin, Yidan and
Zhang, Wutong and
Kong, Xianghan and
Wu, Chentao and
LI, Jie",
editor = "Lee, Hung-Yi and
Dev, Sunipa and
Li, Jessy and
Elliott, Desmond",
booktitle = "Findings of the {A}ssociation for {C}omputational {L}inguistics: {EMNLP} 2026",
month = oct,
year = "2026",
address = "Budapest, Hungary",
publisher = "Association for Computational Linguistics",
url = "https://aclanthology.org/2026.findings-emnlp.353/",
pages = "7378--7398",
ISBN = "979-8-89176-462-0",
abstract = "Large Language Model (LLM)-based Multi-Agent Systems (MAS) are vulnerable to semantic attacks that can trigger cascading failures across the network. Current defenses face a fundamental dilemma: lightweight single-auditor methods are prone to single points of failure, while robust committee-based approaches (e.g., voting) incur prohibitive computational costs in multi-turn interactions. To resolve this tension, we propose MAS-Shield, a secure and efficient defense framework designed with a coarse-to-fine filtering pipeline. Rather than applying uniform scrutiny, MAS-Shield dynamically allocates resources by first identifying high-influence nodes via Critical Agent Auditing Selection. These nodes undergo Light Auditing using lightweight sentry models to rapidly filter benign cases, escalating only high-risk signals to a heavyweight Two-Round Consensus mechanism. This hierarchical design optimizes the security-efficiency trade-off. Experiments demonstrate that MAS-Shield achieves a 92.5{\%} recovery rate against diverse adversarial scenarios and reduces defense latency by over 70{\%} compared to existing methods."
}<?xml version="1.0" encoding="UTF-8"?>
<modsCollection xmlns="http://www.loc.gov/mods/v3">
<mods ID="wang-etal-2026-mas">
<titleInfo>
<title>MAS-Shield: A Defense Framework for Secure and Efficient LLM MAS</title>
</titleInfo>
<name type="personal">
<namePart type="given">Kaixiang</namePart>
<namePart type="family">Wang</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Zhaojiacheng</namePart>
<namePart type="family">Zhou</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Bunyod</namePart>
<namePart type="family">Suvonov</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Jiong</namePart>
<namePart type="family">Lou</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Zihan</namePart>
<namePart type="family">Wang</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Yuxiang</namePart>
<namePart type="family">Zheng</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Yidan</namePart>
<namePart type="family">Lin</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Wutong</namePart>
<namePart type="family">Zhang</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Xianghan</namePart>
<namePart type="family">Kong</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Chentao</namePart>
<namePart type="family">Wu</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Jie</namePart>
<namePart type="family">LI</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<originInfo>
<dateIssued>2026-10</dateIssued>
</originInfo>
<typeOfResource>text</typeOfResource>
<relatedItem type="host">
<titleInfo>
<title>Findings of the Association for Computational Linguistics: EMNLP 2026</title>
</titleInfo>
<name type="personal">
<namePart type="given">Hung-Yi</namePart>
<namePart type="family">Lee</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Sunipa</namePart>
<namePart type="family">Dev</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Jessy</namePart>
<namePart type="family">Li</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Desmond</namePart>
<namePart type="family">Elliott</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<originInfo>
<publisher>Association for Computational Linguistics</publisher>
<place>
<placeTerm type="text">Budapest, Hungary</placeTerm>
</place>
</originInfo>
<genre authority="marcgt">conference publication</genre>
<identifier type="isbn">979-8-89176-462-0</identifier>
</relatedItem>
<abstract>Large Language Model (LLM)-based Multi-Agent Systems (MAS) are vulnerable to semantic attacks that can trigger cascading failures across the network. Current defenses face a fundamental dilemma: lightweight single-auditor methods are prone to single points of failure, while robust committee-based approaches (e.g., voting) incur prohibitive computational costs in multi-turn interactions. To resolve this tension, we propose MAS-Shield, a secure and efficient defense framework designed with a coarse-to-fine filtering pipeline. Rather than applying uniform scrutiny, MAS-Shield dynamically allocates resources by first identifying high-influence nodes via Critical Agent Auditing Selection. These nodes undergo Light Auditing using lightweight sentry models to rapidly filter benign cases, escalating only high-risk signals to a heavyweight Two-Round Consensus mechanism. This hierarchical design optimizes the security-efficiency trade-off. Experiments demonstrate that MAS-Shield achieves a 92.5% recovery rate against diverse adversarial scenarios and reduces defense latency by over 70% compared to existing methods.</abstract>
<identifier type="citekey">wang-etal-2026-mas</identifier>
<location>
<url>https://aclanthology.org/2026.findings-emnlp.353/</url>
</location>
<part>
<date>2026-10</date>
<extent unit="page">
<start>7378</start>
<end>7398</end>
</extent>
</part>
</mods>
</modsCollection>
%0 Conference Proceedings
%T MAS-Shield: A Defense Framework for Secure and Efficient LLM MAS
%A Wang, Kaixiang
%A Zhou, Zhaojiacheng
%A Suvonov, Bunyod
%A Lou, Jiong
%A Wang, Zihan
%A Zheng, Yuxiang
%A Lin, Yidan
%A Zhang, Wutong
%A Kong, Xianghan
%A Wu, Chentao
%A LI, Jie
%Y Lee, Hung-Yi
%Y Dev, Sunipa
%Y Li, Jessy
%Y Elliott, Desmond
%S Findings of the Association for Computational Linguistics: EMNLP 2026
%D 2026
%8 October
%I Association for Computational Linguistics
%C Budapest, Hungary
%@ 979-8-89176-462-0
%F wang-etal-2026-mas
%X Large Language Model (LLM)-based Multi-Agent Systems (MAS) are vulnerable to semantic attacks that can trigger cascading failures across the network. Current defenses face a fundamental dilemma: lightweight single-auditor methods are prone to single points of failure, while robust committee-based approaches (e.g., voting) incur prohibitive computational costs in multi-turn interactions. To resolve this tension, we propose MAS-Shield, a secure and efficient defense framework designed with a coarse-to-fine filtering pipeline. Rather than applying uniform scrutiny, MAS-Shield dynamically allocates resources by first identifying high-influence nodes via Critical Agent Auditing Selection. These nodes undergo Light Auditing using lightweight sentry models to rapidly filter benign cases, escalating only high-risk signals to a heavyweight Two-Round Consensus mechanism. This hierarchical design optimizes the security-efficiency trade-off. Experiments demonstrate that MAS-Shield achieves a 92.5% recovery rate against diverse adversarial scenarios and reduces defense latency by over 70% compared to existing methods.
%U https://aclanthology.org/2026.findings-emnlp.353/
%P 7378-7398
Markdown (Informal)
[MAS-Shield: A Defense Framework for Secure and Efficient LLM MAS](https://aclanthology.org/2026.findings-emnlp.353/) (Wang et al., Findings 2026)
ACL
- Kaixiang Wang, Zhaojiacheng Zhou, Bunyod Suvonov, Jiong Lou, Zihan Wang, Yuxiang Zheng, Yidan Lin, Wutong Zhang, Xianghan Kong, Chentao Wu, and Jie LI. 2026. MAS-Shield: A Defense Framework for Secure and Efficient LLM MAS. In Findings of the Association for Computational Linguistics: EMNLP 2026, pages 7378–7398, Budapest, Hungary. Association for Computational Linguistics.