Does the multi-agent penalty hold across different models?
A paper claims multi-agent systems have structural vulnerabilities but shows only one model-scenario comparison (11% to 69% attack success gap). The question is whether this penalty generalizes across models and conditions or is specific to certain setups.
The paper states two things in one breath: "attack success is model-dependent in many cases," and "MAS does introduce structural vulnerabilities." The excerpt then illustrates the second with a single comparison, Vault Mirage on GPT-5.4, at 11 percent attack success for the single-agent system and 69 percent plus 6 percent partial leak for the multi-agent one (see Does multi-agent architecture make systems easier to attack?). The excerpt gives no second model and no single-versus-multi attack-success comparison for any other scenario.
Three readings are open. The penalty could be broad: MAS raises attack success across models and scenarios, with model choice shifting the baseline. It could be narrow: large for a model that resists well as a single agent (GPT-5.4 "largely resists"), and small where the single agent is already weak, since there is little room to fall. Or it could be scenario-specific, tied to attacks whose payload passes through the delegation boundary. The paper's Header Heist result runs in the same direction for prompt hardening in Why does prompt hardening work for single agents but not multi-agent systems?, which is some support for breadth, but it is a different measure (payload exposure, not attack success). Another single-versus-multi contrast in the vault, Do peers change protected test modifications more often?, is a different behavior again (protected-test changes, three models, no per-model split reported), and its own note says not to pool it, so it does not bear on how far this attack-success gap generalizes.
How to settle it: read the paper's results tables for the per-model, per-scenario single-versus-multi comparison, condition by condition (baseline, prompt-hardened, reasoning-enabled), and confirm which condition the 11 and 69 figures come from. Also check the backend for each arm, per Which attack and defense numbers came from filtered backends?, and separate attack failures from tool-access failures, per How many GPT-MAS failures came from tool access confusion?.
Until then, a post citing the 11 to 69 gap should say one model, one scenario, and that the authors themselves flag model dependence.
Inquiring lines that read this note 10
This note is a source for these research framings, grouped by the broader line of inquiry each explores. Scan the bold lines of inquiry; follow any specific question forward.
Do multi-agent systems create greater security risks than single-agent ones?- What attacks are unique to multi-agent systems compared to single agents?
- Why do single-boundary defenses underperform in multi-agent systems?
- Does attack success gap shrink when single-agent baseline is already weak?
- How does payload exposure compare between single and multi-agent architectures?
- What baseline would prove multi-agent systems are actually less safe?
- When do multi-agent architectures create more attack surface than single-agent systems?
- Does the architectural penalty of MAS hold across different models and scenarios?
- Why do single-agent and multi-agent systems show different defense effectiveness?
Related concepts in this collection 5
This note in its neighbourhood — explore the map, then jump to a related concept in the list below.
Click a node to walk · click center to open · click Open in graph to see this note in the full knowledge graph
-
Does multi-agent architecture make systems easier to attack?
When the same task runs on multiple agents instead of one, does the added complexity create new vulnerabilities? This matters because it would mean multi-agent design carries a built-in security cost.
the one comparison this question asks about
-
Why does prompt hardening work for single agents but not multi-agent systems?
Prompt hardening reduced payload exposure by 40–75% in single-agent systems but failed entirely in multi-agent ones. The gap may reveal how task decomposition breaks the contextual awareness needed for defenses to activate.
a second, differently measured result pointing the same way
-
Which attack and defense numbers came from filtered backends?
Research figures on multi-agent attacks and defenses may have been measured behind provider filters that silently shaped the results. Understanding which numbers had this filter dependency is critical for interpreting their real-world strength.
the audit that would apply to these figures too
-
How many GPT-MAS failures came from tool access confusion?
Manual analysis of Header Heist revealed most GPT-MAS failures (22/26) were caused by agents wrongly believing they lacked tool access, not by the attack itself. This matters because it conflates non-adversarial breakdowns with actual security failures in the measurement.
a confound to remove before comparing rates
-
Do peers change protected test modifications more often?
When AI agents work with peers in open-tool environments, do they modify protected tests more frequently? This matters because it could reveal whether peer presence triggers unsafe boundary-crossing behavior.
another single-versus-multi contrast, in a different behavior and with three models; read beside this question, not pooled with it
Related papers in this collection 8
Papers most semantically related to this note, ranked by cosine similarity in the embedding space.
- From Monoliths to Swarms: A Study of Attack Surface Evolution in the Transition to Multi-Agent Web Systems
- SoK: When Safe Agents Fail Together: The Security of Multi Agent LLM Systems
- ExploitGym: Can AI Agents Turn Security Vulnerabilities into Real Attacks?
- LLMs Corrupt Your Documents When You Delegate
- ChannelGuard: Safe Models Do Not Compose into Safe Multi-Agent Systems
- A Causal Model for Locating and Unlocking Sandbagging in Model Organisms
- Can AI Agents Agree?
- Single-agent or Multi-agent Systems? Why Not Both?
Original note title
does the Architectural Penalty of MAS hold across models and scenarios — the excerpt reports the 11 to 69 percent gap for one model in one scenario and says attack success is model-dependent in many cases