What counts as success or failure? Start by defining measurable outcomes beyond just task completion.
Diagnosis begins with choosing metrics that capture both the mission goal and the system's health under attack. In adversarial settings, a system might still complete tasks but at unacceptable safety or trust costs. For example, [1] measured collision rate and average speed for autonomous vehicles: an adversarial policy drove collisions up to 62% and cut average speed from 25 m/s to 21.73 m/s—clear failures in safety and efficiency. [2] added trust as a key metric, showing that under attack, a greedy heuristic preserved only 29% of final trust, while a QUBO-based optimizer kept 91%.
These metrics are not interchangeable: a system could score high on task completion but fail on trust or safety, which is why teams should track multiple dimensions. [2] also tracked task completion under spoofing—greedy completed none, while the optimizer managed 24.2%—showing that a single metric can mask catastrophic failure in another. So, a diagnostic framework should include at least one performance metric (e.g., task completion, speed) and one resilience metric (e.g., trust, collision rate).
How do you know what's failing? Categorize the attack type and test defenses against it.
Failures often stem from specific attack vectors—like deceptive information, GPS spoofing, or adversarial policies—and each requires a different diagnostic lens. [1] trained two adversarial policies (collision and speed) to disrupt a cooperative driving policy, isolating which aspect of behavior was vulnerable. [4] focused on stealthy poisoning attacks that hide malicious advice inside differential-privacy noise, which are hard to detect with standard anomaly detection. [2] simulated fake high-priority tasks, blocked pathways, and communication disruptions, showing that different attacks degrade trust and task completion differently.
Once you identify the attack type, you can test whether your defense actually closes the gap. [4]'s RAMPART used a GAN (generative adversarial network) at each node to filter malicious advice without labeled data, achieving 96.3% accuracy and an F1 score of 0.852 under a 30% attack ratio in heavy traffic. [1] found that adversarial training—exposing the policy to attacks during training—cut collision rate by half against one adversary and achieved 0% collisions against another. This suggests that diagnosis should include a 'defense probe': run the same attack against a defended and undefended version to see where the system still fails.
Why do some systems fail while others succeed? The key is whether reasoning is local or global.
A recurring pattern in these studies is that systems relying on local, greedy decisions are more fragile under attack than those using global optimization. [2] directly compared a greedy heuristic to a QUBO-based global optimizer: the optimizer preserved 91% trust versus 29% for greedy, and completed 24.2% of tasks versus 0% under spoofing. The reason is that global reasoning can account for trust degradation and interdependent constraints, whereas local decisions get trapped by adversarial noise.
However, global reasoning alone isn't enough—it must be paired with safety constraints. [3] introduced a 'Transactional No-Regression' (TNR) safety specification for LLM-based multi-agent systems, which ensures that any exploration or iteration doesn't degrade the system's state. This allowed their STRATUS system to improve failure mitigation success by at least 1.5 times over state-of-the-art agents across two benchmarks. So, diagnosis should ask: does the system have a global view, and does it enforce safety invariants during exploration? If not, that's a likely failure point.
About These Sources
This answer is built on 5 peer-reviewed studies — published from 2024 to 2026, 5 from 2024 or later — selected as the most relevant from 5 studies that passed quality screening, drawn from 59 papers retrieved from a database of over 500 million.
Sources used in this answer
Adversarial Deep Reinforcement Learning Attacks on Multi‐Agent Autonomous Cooperative Driving Policies
Adversarial policies increased collision rate to 62% and reduced average speed from 25 m/s to 21.73 m/s in a cooperative driving scenario, but adversarial training cut collision rate by half against one adversary and achieved 0% against another.
Trust-Aware Task Allocation With Quantum Optimization in Adversarial Multi-Agent Systems
In 100-round simulations under attacks like spoofing and blocked pathways, a QUBO-based global optimizer preserved 91% final trust and 24.2% task completion, versus 29% trust and 0% completion for a greedy heuristic.
STRATUS: A Multi-agent System for Autonomous Reliability Engineering of Modern Clouds
STRATUS, an LLM-based multi-agent system with a Transactional No-Regression safety specification, improved failure mitigation success by at least 1.5 times over state-of-the-art SRE agents across two benchmarks (AIOpsLab and ITBench).
RAMPART: Reinforcing Autonomous Multi-Agent Protection through Adversarial Resistance in Transportation
RAMPART, a GAN-based defense, filtered malicious advice in an unsupervised manner and achieved 96.3% accuracy and an F1 score of 0.852 under a 30% poisoning attack ratio in heavy traffic.
DOVA: Deliberation-First Multi-Agent Orchestration for Autonomous Research Automation
DOVA, a deliberation-first multi-agent orchestration, reduced inference cost by 40-60% on simple tasks while preserving deep reasoning, and its ablation study across seven configurations showed that component choices affect answer confidence, source coverage, and token efficiency.