Smarter Saboteurs, Better Fixers: Scaling & Security in Linear Multi-Agent Workflows
For developers deploying LLM-based multi-agent systems, this work shows that linear workflows can be made resilient to adversarial attacks with a simple correction mechanism, challenging assumptions about their inherent brittleness.
This paper investigates how model scale affects the security of linear multi-agent workflows against adversarial compromise, finding that larger models are more likely to execute malicious instructions (performance drop up to 53.7pp at 27B), but adding a lightweight Fixer stage reduces this to 0.6pp, restoring control-level performance.
As LLM-based multi-agent systems (MAS) are deployed in the wild, the resilience of their collaboration structures against adversarial compromise becomes a critical safety concern. Attackers may leverage prompt-injection or jailbreaking to sabotage individual agents within MAS workflows, but the interaction between model scaling and system-level resilience remains poorly understood. This paper investigates how model scale affects the security of linear multi-agent workflows. Our experiments across scales of two open-weight model families on the HumanEval benchmark reveal a compliance-correction symmetry: larger models are far more likely to faithfully execute malicious instructions, with the control-to-malicious performance drop reaching 53.7pp at 27B in uncorrected pipelines. However, appending a lightweight terminal Fixer stage collapses this to 0.6pp and restores statistical parity with control-level performance, demonstrating that strictly linear collaboration structures can be viable and resilient to adversaries at this scale, and suggesting that the brittleness previously attributed to linear topology may stem from a lack of correction.