Mesa能提前找出多智能体系统里最危险的通信链路，监控前10%就能拦截3倍攻击，比随机分配强多了。
多智能体系统（MAS）的通信信道面临攻击风险，单个被攻破的边可导致高达75%的攻击成功率。Mesa框架无需攻击痕迹，结合6种图论度量和2种动态探测（消融和掩蔽）对边进行安全性排序。在三个MAS场景、八种网络拓扑和Qwen、Llama、Gemma等五个开源LLM上测试，排序与经验攻击成功率平均Spearman ρ=0.60，峰值0.73。资源受限时，监控Mesa排名前10%的边可拦截约3倍于随机分配的成功攻击。
MESA: Prioritizing Vulnerable Communication Channels for Securing Multi-Agent Systems
Multi-agent systems (MAS) are increasingly used to automate complex, distributed workflows. However, their inter-agent communication channels introduce new attack surfaces that remain poorly understood and are difficult to defend against. In this paper, we address how defenders should prioritize limited security effort to protect vulnerable communication channels before attacks are observed. This is motivated by our observation that the channel-level attack impact is highly non-uniform: a single compromised edge can account for up to 75% of total attack success. We introduce Mesa, a label-free framework for proactively ranking which MAS edges are most security-critical -- that is, most likely to affect the system's decision if compromised. Mesa combines six graph-theoretic metrics and two dynamic probes (ablation and masking) without requiring attack traces. We evaluate Mesa against a dynamic misinformation attack pipeline across three diverse MAS scenarios, eight network topologies, and five open-source LLMs from Qwen, Llama, and Gemma families. Mesa rankings correlate strongly with empirical per-edge attack success rate, achieving mean Spearman $ρ=+0.60$ (peaking at $+0.73$). In resource-constrained defense deployment, monitoring the top 10% of Mesa-ranked edges intercepts about 3x the successful attacks as random allocation. We further test Mesa under varying attacker and defender models and LangGraph workflows and characterize its limits under adaptive attacks and high-redundancy graphs. Overall, our results show that edge-level risk in MAS is often concentrated and predictable, allowing proactive hardening of multi-agent infrastructures.