{ "schema_version": 1, "builder_plan": { "scenario": "An agent reads external documents or tool responses that may contain malicious instructions.", "change": "Replay attacks and legitimate lookalikes in an isolated copy of your agent workflow.", "baseline": "Your existing checks with the same tasks, permissions, and tool responses.", "steps": [ "Locate the paper's implementation and check its license, model support, data needs, and hardware requirements. Stop here if you cannot obtain the required artifacts.", "Save a small set of representative product tasks and expected outcomes. Keep evaluation tasks out of any training or tuning, and choose quality and cost limits before running.", "Run the baseline and the proposed change on identical inputs. Keep other settings fixed and repeat paired runs to expose variation.", "Save per-task outputs, failures, timings, and all usage costs. Review regressions before expanding the test." ], "measure": "Successful attacks missed, legitimate actions blocked, detection delay, and review cost.", "decision": "Keep the change only if it meets your preselected quality and latency limits and improves the metric you care about after setup and operating costs. Otherwise retain the baseline. This is an exploration plan, not a validated recommendation." }, "builder_review": null, "arxiv_id": "2610.28397", "title": "MAS-Guard: Unified Guardrails from Individual Agents to Multi-Agent LLM Systems", "summary": "MAS-Guard replaces fragmented, single-threat defenses with a two-layer framework: per-agent task-specific guardrail experts (A-Guard) plus a system-level Control Plane enforcing developer-owned Agent Charters through deterministic route, capability, and message-format checks combined with semantic role and content assessment, with interventions of allow, reflection, confirmation, and block. It costs additional inference calls for the guardrail experts and semantic checks on agentic events, added latency per inter-agent message, and the engineering effort of authoring charters and deploying a control plane around existing agents. It can fail against opaque or compromised agents that bypass instrumentable layers, through semantic-check false positives that degrade benign-task utility, and against attack classes outside its six evaluation benchmarks.", "rationale": "Guardrails are directly deployable on a small team with API-based agents, but the defense-in-depth benefit must be validated against the reader's specific agent topology and threat model before production reliance.", "technique": "Unified layered guardrails for single- and multi-agent LLM systems", "family": "seguranca_e_guardrails", "recommendation": "testar", "published": "2026-10-20", "as_of": "2026-10-21", "editorial_status": "indexed", "source_url": "https://arxiv.org/abs/2610.28397", "independent_implementations": 1, "total_implementations": 2, "stars": 10, "citations": null, "claims": [ { "claim_id": "claim-01", "statement": "MAS-Guard replaces fragmented, single-threat defenses with a two-layer framework: per-agent task-specific guardrail experts (A-Guard) plus a system-level Control Plane enforcing developer-owned Agent Charters through deterministic route, capability, and message-format checks combined with semantic role and content assessment, with interventions of allow, reflection, confirmation, and block. It costs additional inference calls for the guardrail experts and semantic checks on agentic events, added latency per inter-agent message, and the engineering effort of authoring charters and deploying a control plane around existing agents. It can fail against opaque or compromised agents that bypass instrumentable layers, through semantic-check false positives that degrade benign-task utility, and against attack classes outside its six evaluation benchmarks.", "basis": "inferred", "result": "", "baseline": "", "conditions": "", "source_url": "https://arxiv.org/abs/2610.28397", "source_page": null, "source_excerpt": "" }, { "claim_id": "claim-02", "statement": "Reduces overall attack success rate by 71.5-86.3% relative to unguarded agents across six benchmarks and three agent LLMs, while meeting a utility reference criterion on benign tasks.", "basis": "inferred", "result": "", "baseline": "", "conditions": "", "source_url": "https://arxiv.org/abs/2610.28397", "source_page": null, "source_excerpt": "" } ], "exposure_map": [ { "dimension": "quality", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "compute", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "latency", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "operations", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "compatibility", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "security", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "data_and_training", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "reproducibility", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" } ], "risks": [], "minimum_test": [], "open_questions": [], "independent_tests": [], "lab_reproductions": [], "report_available": false, "validation_tier": "unknown", "evidence_tier": "unknown", "infrastructure_basis": "unknown", "equations": [], "equations_status": "not_fetched", "core_kind": "", "equations_fetched_at": "", "equations_source_url": "", "equations_source_sha256": "", "exposures_reviewed_at": "", "exposures_source_sha256": "" }