Collaboration and information sharing empower Multi-Agent Systems (MAS) but also introduce a critical security risk known as Agent Cascading Injection (ACI). In such attacks, a compromised agent exploits inter-agent trust to propagate malicious instructions, causing cascading failures across the system. However, existing studies consider only limited attack strategies and simplified MAS settings, limiting their generalizability and comprehensive evaluation. To bridge this gap, we introduce ACIArena, a unified framework for evaluating the robustness of MAS. ACIArena offers systematic evaluation suites spanning multiple attack surfaces (i.e., external inputs, agent profiles, inter-agent messages) and attack objectives (i.e., instruction hijacking, task disruption, information exfiltration). Specifically, ACIArena establishes a unified specification that jointly supports MAS construction and attack-defense modules. It covers six widely used MAS implementations and provides a benchmark of 1,356 test cases for systematically evaluating MAS robustness. Our benchmarking results show that evaluating MAS robustness solely through topology is insufficient; robust MAS require deliberate role design and controlled interaction patterns. Moreover, defenses developed in simplified environments often fail to transfer to real-world settings; narrowly scoped defenses may even introduce new vulnerabilities. ACIArena aims to provide a solid foundation for advancing deeper exploration of MAS design principles.

翻译：协作与信息共享增强了多智能体系统（MAS）的能力，但也引入了一种称为“智能体级联注入”（ACI）的严重安全风险。在此类攻击中，被攻破的智能体会利用智能体间的信任关系传播恶意指令，从而导致系统发生级联故障。然而，现有研究仅考虑了有限的攻击策略和简化的MAS设置，限制了其普适性和全面评估。为弥补这一不足，我们提出了ACIArena，一个用于评估MAS鲁棒性的统一框架。ACIArena提供系统化的评估套件，涵盖多个攻击面（即外部输入、智能体画像、智能体间消息）和攻击目标（即指令劫持、任务干扰、信息窃取）。具体而言，ACIArena建立了一个统一规范，共同支持MAS构建与攻防模块。它覆盖了六种广泛使用的MAS实现，并提供了一个包含1,356个测试用例的基准测试集，用于系统性地评估MAS鲁棒性。我们的基准测试结果表明，仅通过拓扑结构评估MAS鲁棒性是不够的；鲁棒的MAS需要精心设计的角色和受控的交互模式。此外，在简化环境中开发的防御措施往往难以迁移到真实场景；范围狭窄的防御甚至可能引入新的漏洞。ACIArena旨在为深入探索MAS设计原理提供坚实基础。