Game-Theoretic Multi-Agent Control for Robust Contextual Reasoning in LLMs

2026-06-08

AI Summary

This work addresses the vulnerability of large language models (LLMs) to prompt injection and context contamination attacks in multi-turn interactions, where existing defenses struggle with cross-turn contextual evolution. The authors propose GT-MCP, a novel framework that integrates game theory and multi-agent control into contextual safety management. GT-MCP employs a closed-loop dynamic system comprising three heterogeneous LLM agents, selecting outputs via a trust function jointly defined by causal consistency, semantic consistency, and distributional drift. It further incorporates context graph verification and a rollback-based self-healing mechanism for proactive detection and repair. Experimental results demonstrate that, over 500 adversarial rounds, 99.6% of turns exhibit controllable context drift, output win rates exceed 98%, per-token latency is only 1.63 milliseconds, and no controller-level attacks succeed.

Abstract

Large Language Models (LLMs) in multi-turn interactions maintain evolving context rather than generating isolated responses, making them vulnerable to prompt-injection and context-poisoning attacks in which locally plausible adversarial fragments gradually distort reasoning trajectories. Existing defenses mainly filter individual outputs and often ignore context evolution across turns, leaving long-horizon reasoning exposed. Although the Model Context Protocol (MCP) standardizes context exchange and tool invocation, it functions as a passive routing layer and does not enforce contextual stability. To address these limitations, we introduce the Game-Theoretic Secure Model Context Protocol (GT-MCP), a controller-driven multi-agent method that treats context management as a closed-loop dynamical process. GT-MCP coordinates three heterogeneous LLM agents and selects outputs through a trust function that jointly evaluates causal consistency against a validated context graph, semantic agreement among agents, and distributional drift over time. When instability is detected, a rollback-based self-healing mechanism restores the validated context and prevents unsupported fragments from propagating. Empirical evaluation over 500 interaction turns under an adaptive adversarial threat model shows that contextual drift remains bounded in 99.6% of turns, with recovery required in only 0.4%. Per-turn utility remains tightly concentrated, with median = -0.19, P05 = -0.72, and P95 = 0.30; severe degradation below -1 occurs in only 0.4% of cases, and no injection attempt succeeds at the controller level. Selected outputs maintain stable win rates above 98%, and computational overhead remains predictable, with latency per token = 1.63e-3 s.

Problem

• prompt-injection attacks
• context-poisoning attacks
• contextual reasoning
• multi-turn interactions
• context evolution

Innovation

• Game-Theoretic Control
• Multi-Agent LLM
• Contextual Robustness
• Self-Healing Mechanism
• Trust Function