Large language model-based multi-agent systems (LLM-MAS) effectively accomplish complex and dynamic tasks through inter-agent communication, but this reliance introduces substantial safety vulnerabilities. Existing attack methods targeting LLM-MAS either compromise agent internals or rely on direct and overt persuasion, which limit their effectiveness, adaptability, and stealthiness. In this paper, we propose MAST, a Multi-round Adaptive Stealthy Tampering framework designed to exploit communication vulnerabilities within the system. MAST integrates Monte Carlo Tree Search with Direct Preference Optimization to train an attack policy model that adaptively generates effective multi-round tampering strategies. Furthermore, to preserve stealthiness, we impose dual semantic and embedding similarity constraints during the tampering process. Comprehensive experiments across diverse tasks, communication architectures, and LLMs demonstrate that MAST consistently achieves high attack success rates while significantly enhancing stealthiness compared to baselines. These findings highlight the effectiveness, stealthiness, and adaptability of MAST, underscoring the need for robust communication safeguards in LLM-MAS.

Yirui QI, Xiaoming Zhang, Ruilin Zeng, Mengyao Liu, Ziyi Zhou, Dezhuang Miao, Bingyu Yan, Zhenyu Guan. Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers). 2026.

Bingyu Yan, Xiaoming Zhang, JinYu Hou, Chaozhuo Li, Ziyi Zhou, Yiming Hei, Litian Zhang. Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers). 2026.

Large language models (LLMs) exhibit strong language understanding capabilities, but encounter challenges when integrating structured knowledge from knowledge graphs (KGs) for complex reasoning tasks such as knowledge graph question answering (KGQA). Existing methods often rely on prompt engineering or fixed templates, which obscure the relational structure and limit generalization. To address these limitations, this paper introduces the Reverse Chain-of-Thought (R-CoT) and Causal Path Verification Plugin, a modular framework that reconstructs retrieved KG triples into reverse chains of sub-questions. Each reasoning step is aligned with a supporting triple, forming interpretable multi-hop paths. In particular, Semantic Causal Scoring (SCS) module is further incorporated to evaluate the causal alignment between each reverse sub-question and the original question through dynamic semantic vector matching. The SCS design avoids frequent interactions with LLMs and effectively filters irrelevant or unsupported reasoning steps. Based on the scoring results, a template-free, model-agnostic R-CoT input format is constructed as a semi-structured sequence. This design preserves the KG structure in natural language form and enables seamless integration with standard LLMs without fine-tuning. Experimental results demonstrate that the R-CoT Plugin consistently improves factual alignment, enhances reasoning stability, and outperforms conventional prompt-based methods in both accuracy and coherence.