OpenEvoShield addresses the issue of LLM-MAS protection in the context of dual non-stationarity. This is important because static detectors lose effectiveness as attacks and normal behavior evolve.
In LLM-based multi-agent systems (LLM-MAS), an attack rarely appears as a single incident. It spreads through inter-agent communication and changes as the attacker adapts. The system at this moment is also not static: new agents, tools, and scenarios emerge. This creates dual drift: the distribution of attacks changes while the normal behavior shifts simultaneously. Static filters and trained detectors assume a fixed distribution. Once this assumption is violated, the rate of missed attacks and false positives increases.
The authors propose OpenEvoShield — a continual defense solution with co-evolution. The key idea is to separate adaptation speeds. Attacks require rapid updates, while normal behavior requires slow stabilization. This is implemented through an asymmetric rate controller (M1), which evaluates two drift signals and assigns different learning rates: fast for the attack-side and slow for the normal-side. This approach is a compromise between reactivity and stability. Without it, the system either fails to keep up with the attack or begins to “panic,” mistaking normal changes for anomalies.
The architecture is divided into four modules:
- M1 (rate controller) computes drift signals through KL divergence and semantic deviations.
- M2 (normal-boundary updater) maintains a dynamic boundary of normal behavior through EMA and generative trajectory estimation.
- M3 (policy updater) rapidly adapts the ensemble of detectors with EWC regularization to avoid catastrophic forgetting.
- M4 (detector) aggregates signals at the node, subgraph, and entire graph levels and employs energy-based OOD detection for unknown attacks.
The implementation relies on a communication graph representation. This is important: attacks in MAS often manifest not at the level of a single message but as a pattern of interaction. M4 aggregates anomalies at multiple scales, allowing it to capture coordinated attacks that evade node-level methods. Additionally, the OOD head (out-of-distribution detection) classifies new types of attacks as UNKNOWN instead of falsely labeling them as “normal.”
A separate engineering challenge is forgetting. Rapid adaptation to new attacks overwrites old knowledge. Here, EWC (elastic weight consolidation) is utilized, which preserves important model parameters through Fisher information. This reduces degradation on previously known patterns but introduces a trade-off: excessive regularization slows down adaptation.
Experiments demonstrate the system’s behavior in dynamics, not just in static conditions. Under standard conditions, OpenEvoShield slightly improves metrics compared to strong baselines (e.g., INFA-GUARD). However, the key difference manifests during prolonged deployment. In a scenario of 100 rounds with evolving attacks, static methods degrade sharply. OpenEvoShield maintains a low Attack Success Rate and shows a high Novel Detection Rate (detection of new attacks). Meanwhile, the false positive rate remains low. This indicates a correct balance between adaptation and stability.
An interesting effect is recovery after injections. When a new attack emerges, the system temporarily loses accuracy but returns to its original level within a few rounds. This is the result of the interplay between M1 and M3: the first captures the drift, while the second quickly retrains the detector. Without an explicit drift signal (as in naive continual approaches), the system gradually degrades and does not recover.
There are also limitations. The approach assumes that drift can be accurately measured through the chosen metrics (KL and embedding similarity). In more chaotic environments, this may introduce noise. Additionally, there is a computational burden: multiple models, graph encoders, and OOD evaluation. For latency-sensitive systems, this could be critical.
In the industry, similar approaches reflect a general shift: the protection of AI systems is moving from static filters to adaptive mechanisms with online learning. OpenEvoShield is an example of how this idea can be implemented at the architectural level, not just at the model level.
Information source
arXiv is the largest open preprint repository (since 1991, under the auspices of Cornell), where researchers quickly post working versions of papers; the materials are publicly accessible but do not undergo full peer review, so results should be considered preliminary and, where possible, checked against updated versions or peer‑reviewed journals. arxiv.org