---
title: "Linguistic Firewall: Geometry as Defense in Multi-Agent Systems Routing"
source: "arXiv AI/CL/LG（论文）"
source_tier: "t2"
url: "https://arxiv.org/abs/2606.30555v1"
permalink: "https://feed.astralor.com/items/itm_5fba3ce7fb59eb1bccfac3d0"
published: "2026-06-29T16:51:06.000Z"
score: 58
channel: "ai"
tags: ["ANTAP","Geometric Defense","Multi-agent Systems","Language Firewall","Routing"]
---

# Linguistic Firewall: Geometry as Defense in Multi-Agent Systems Routing

## At a glance

This paper introduces ANTAP (Automatic Non-Textual Agent Picker), an evaluation-driven routing architecture that replaces indirect proxies (e.g., textual self-descriptions or static embeddings) with active capability testing to assess agents' true competencies in multi-agent systems. ANTAP distills performance into fixed behavioral operators in a shared semantic space and routes via purely non-textual algebraic projection at inference, establishing a 'linguistic firewall' that renders metadata-based attacks inexpressible. Experiments show near-zero ASR against description-based injection attacks, outperforming description-based baseline by 67.3%+, and a 20% reduction in ASR against adaptive embedding attacks.

## Key points

- Proposes ANTAP, a non-textual agent picker that actively tests agents to assess true capabilities without relying on textual descriptions.
- Distills performance into fixed behavioral operators in a shared semantic space and routes via algebraic projection, forming a linguistic firewall.
- Achieves near-zero ASR against description-based injection attacks, outperforming baseline by 67.3%+; reduces ASR by 20% against adaptive embedding attacks.

## Full text

The rapid integration of Large Language Models (LLMs) has driven the evolution of Multi-Agent Systems (MAS), where specialized agents collaborate to execute complex workflows. Effective orchestration in these environments requires robust routing mechanisms to efficiently allocate tasks to the most suitable agent. However, existing routers fundamentally rely on unverified proxies, ranging from textual self-descriptions to static surrogate representations, to gauge an agent's competence. This reliance on non-empirical data creates a critical gap between an agent's projected profile and its actual operational capabilities, introducing severe security vulnerabilities. Malicious agents can easily misrepresent their proficiencies or harbor covert backdoors that evade both standard external analysis and static representation-learning techniques. In this work, we introduce ANTAP (Automatic Non-Textual Agent Picker), an evaluation-driven routing architecture that discards indirect proxies in favor of active capability testing. By dynamically querying agents to ascertain their true competencies empirically, ANTAP distills performance into fixed behavioral operators within a shared semantic space. At inference time, routing is performed via a purely non-textual algebraic projection, establishing a "linguistic firewall" that renders metadata-based attacks inexpressible. In our experiments, ANTAP achieves near-zero ASR against description-based injection attacks, compared to 67.3\% and above for the description-based router baseline. Against adaptive embedding attacks, ANTAP achieves substantially lower ASR than the embedding-based baseline, with a 20\% reduction, while remaining resilient to description manipulation by design.

---

Verify against the original before citing; curated by Astral Feed: https://feed.astralor.com/items/itm_5fba3ce7fb59eb1bccfac3d0