As AI agents are increasingly adopted to collaborate on complex objectives, ensuring the security of autonomous multi-agent systems becomes crucial. We develop simulations of agents collaborating on shared objectives to study these security risks and security trade-offs. We focus on scenarios where an attacker compromises one agent, using it to steer the entire system toward misaligned outcomes by corrupting other agents. In this context, we observe infectious malicious prompts - the multi-hop spreading of malicious instructions. To mitigate this risk, we evaluated several strategies: two "vaccination" approaches that insert false memories of safely handling malicious input into the agents' memory stream, and two versions of a generic safety instruction strategy. While these defenses reduce the spread and fulfillment of malicious instructions in our experiments, they tend to decrease collaboration capability in the agent network. Our findings illustrate potential trade-off between security and collaborative efficiency in multi-agent systems, providing insights for designing more secure yet effective AI collaborations.

Safety fine-tuning algorithms reduce harmful outputs in language models, yet their mechanisms remain under-explored.Direct Preference Optimization (DPO) is a popular choice of algorithm, but prior explanations, attributing its effects solely to dampened toxic neurons in the MLP layers, are incomplete.In this study, we analyse four language models (Llama-3.1-8B,Gemma-2-2B, Mistral-7B, GPT-2-Medium) and show that toxic neurons only account for 2.5% to 24% of DPO's effects across models.Instead, DPO balances distributed activation shifts across a majority of MLP neurons to create a net toxicity reduction.We attribute this reduction to four neuron groups, two aligned with reducing toxicity and two promoting anti-toxicity, whose combined effects replicate DPO across models.To further validate this understanding, we develop an activation editing method mimicking DPO through distributed shifts along a toxicity representation in both probe-based and probe-free settings.This method outperforms DPO in reducing toxicity while preserving perplexity across models, without requiring any weight updates.Our work provides a mechanistic understanding of DPO and introduces an efficient, tuning-free alternative for safety fine-tuning.Our code is available on dpo-toxic-neurons.

In child-robot interaction, the element of trust towards the robot is critical. This is particularly important the first time the child meets the robot, as the trust gained during this interaction can play a decisive role in future interactions. We present an in-the-wild study where Polish kindergartners interacted with a Pepper robot. The videos of this study were analyzed for the issues of trust, anthropomorphization, and reaction to malfunction, with the assumption that the last two factors influence the children's trust towards Pepper. Our results reveal children's interest in the robot performing tasks specific for humans, highlight the importance of the conversation scenario and the need for an extended library of answers provided by the robot about its abilities or origin and show how children tend to provoke the robot.