A University of Southern California team reports that MIRROR, a check for messages passed between AI agents, kept intercepted messages from changing test results when no more than two of the five delivery channels were compromised. But every channel in the evaluation shared one backend, so the tests did not show whether the method can protect systems using independent routes in practice.
Multi-agent AI systems pass messages between models or software agents as they divide work. Transport Layer Security (TLS) protects messages while they travel between endpoints, but an authorized gateway that ends the encrypted connection can read or change a message before forwarding it. A 2025 ACL paper studied an attacker that exploits this gap by changing messages between agents.
MIRROR sends one completed agent message over several logical channels. For five channels, three carry the message and its SHA-256 fingerprint; two carry only the fingerprint. The receiver accepts the message only if more than half the channels report the same fingerprint. The check does not depend on the hash being secret: a malicious gateway can calculate a new hash after changing a message. Security comes from the assumption that most channels remain honest.
In tests with AutoGen and CAMEL, the researchers report a 0% attack-success rate across MMLU science-and-math questions, HumanEval coding tasks and MBPP programming problems. They also tested MetaGPT with Gemini 2.5 Pro through a production API. The paper says the sharp change from 0% to 100% attack success at the halfway point follows directly from the protocol’s design; it is evidence that their implementation matched the rule, not a separate discovery about real-world attacks.
The test’s five channels were isolated API requests but shared one backend, which the authors count as a single failure group. A shared provider or gateway could therefore undermine the independence the quorum needs. MIRROR also leaves compromised agents unprotected and adds network traffic and delay, even though it uses the same number of LLM tokens as the baseline. A useful next test would send traffic through independently operated providers and measure latency and availability under routine network failures.
Sources
- MIRROR: Multipath Quorum Integrity for LLM Multi-Agent Communication (arXiv, 2026)
- Red-Teaming LLM Multi-Agent Systems via Communication Attacks (ACL 2025)
- Illustrative image: Network switches arranged in a server rack, Shixart1985, CC BY 2.0; unmodified, contextual illustration only.
