Can adversary position unify fragmented multi-agent attack models?

The abstract introduces "an A-I-R framework that organizes attacks by adversary position, interaction interface, and resulting system-level risk, unifying otherwise fragmented attack mechanisms across MAS." Read as coordinates, an attack is placed by where the adversary stands (A), which interface it uses to reach a principal (I), and what it does to the system (R). The survey's counts fill in the axes: "six interaction interfaces, four adversary positions, seven system-level risks, and eight recurring attack paths." A path is presumably a route through those coordinates, but the excerpt does not define it, and it names none of the members of any list.

The vault's attack-side notes already sit on different cuts. How do adversarial traps target different layers of AI agents? cuts by the agent function that is targeted. How do agent security layers connect across the stack? cuts by scope, from one agent to routing to behavior over time. Do internal agent hops in pipelines need security monitoring? cuts by position in a pipeline. A-I-R adds a cut none of them has: who the adversary is relative to the system.

That axis is one the vault's notes already vary without naming it. WEBMASLAB faces "a fully external web-only adversary" (How does agent architecture affect web security vulnerabilities?). Thought Virus starts from one compromised peer agent (Can one compromised agent corrupt an entire multi-agent network?). The Werewolf work changes one agent's objective from inside (Does one misaligned agent harm a team in adversarial settings?). Whether these match the SoK's four positions is not something the excerpt lets me say. But results from those notes are hard to compare without the axis, because each sets the adversary differently. The insider-versus-adversary contrast in Why does misaligned trust between allies matter more than rule-breaking? is a two-way version of the axis, argued for one game and not matched to the SoK's four positions.

The axis matters on the defense side too. How does the authorization layer stay outside the poisoned path? notes that a 0 percent Unsafe Action Rate is evidence about an attacker positioned upstream of the reviewer, and that an attacker at token issuance or at the policy would be a different experiment. A defense figure reported without its attacker's position does not say what it excludes, and the position is the first coordinate this framework asks for.

The limit of any taxonomy applies. Coordinates make attacks comparable but do not rank the cells, so the framework says where to look and not which cell is most dangerous.

What the excerpt does not give. The names of the interfaces, positions, risks and paths, how R relates to the seven risks, and any evidence that the framework predicts or transfers.