Home / Multi-Agent Security / Strategic Reasoning

Strategic Agents: Game Theory, Formal Logic & Multi-Agent AI Security

strategicreasoning.net served as the academic hub for the International Workshop on Strategic Reasoning (SR), bridging formal verification, modal logic, and multi-agent game theory. In modern enterprise AI, autonomous LLM agents and red teamers act as strategic players—requiring formal AI agent security audits and adversarial reinforcement learning verification.

Historical Domain Archive: strategicreasoning.net
Academic Lineage: International Workshop on Strategic Reasoning (SR 2013–2018, satellite of ETAPS & LICS), cited by W3C, University of Oxford, CNRS, INRIA, Chalmers, CISPA, and ENS Paris-Saclay.
See concrete multi-agent exploits →

Why Formal Strategic Logic Matters

From Strategy Logic (SL) to Autonomous Agent Swarms

The Strategic Reasoning workshops pioneered formal languages—such as Alternating-time Temporal Logic ($\text{ATL}^*$) and Strategy Logic ($\text{SL}$)—to verify whether a coalition of agents can enforce a safety property regardless of how adversarial agents behave. Auditing a modern multi-agent LLM orchestrator (LangGraph, AutoGen, CrewAI) is reactive synthesis and imperfect-information game theory applied to neural tool-calling.

Formal Foundations: From Modal Logic to Adversarial AI

Connecting the theoretical computer science heritage of the Strategic Reasoning workshops directly to modern agentic security engineering.

1. $\text{ATL}^*$ & Strategy Logic in Agent Swarms

In formal verification, the operator $\langle\langle A \rangle\rangle \Phi$ asks whether coalition $A$ has a winning strategy to guarantee safety invariant $\Phi$ against all possible moves by environment adversaries. In an AI agent security audit, coalition $A$ represents the supervisor and guardrail agents, while the adversary injects malicious payloads via untrusted RAG retrievals to violate system invariants.

2. Imperfect Information & Lossy Channel Games

Research presented at SR (such as CISPA's work on lossy channel games under incomplete information) models agents operating with partial observability. LLM orchestrators face severe partial observability: a planner agent cannot verify whether a sub-agent's summary reflects ground-truth database records or an indirect prompt injection disguised as tool output.

3. Stochastic Games & PRISM Model Checking

Probabilistic model checkers (like Oxford's PRISM-games) quantify the probability of safety violations in stochastic multi-player environments. Because LLM token sampling is inherently stochastic (temperature $T > 0$), red-teaming campaigns must measure empirical failure probabilities across multi-turn Markov Decision Processes (MDPs and Adversarial RL).

The Stackelberg Security Game

An AI system audit models deployment as a sequential leader-follower (Stackelberg) game. The defender commits to model weights, system prompts, and runtime guardrails first; the attacker observes the deployed behavior via black-box API probing (model extraction) and synthesizes optimal jailbreak strategies.

  • Stackelberg & minimax equilibria in adversarial training
  • Bayesian games for deceptive honeypot guardrail design
  • Sequential multi-turn jailbreaking mapped to MITRE ATLAS

Reactive Synthesis & Constitutional Guardrails

Rather than relying on heuristic post-hoc filters, formal reactive synthesis constructs a deterministic controller (shield) that intercepts every agent action proposal $a_t$ and blocks transitions leading to unsafe states. This guarantees hard safety envelopes in autonomous robotics and financial transaction agents.

Concrete Failure Modes in Multi-Agent Strategic Systems

How attackers exploit game-theoretic asymmetries and broken coordination across interacting AI agents:

Case 1: Coalition Hijacking & Confused Deputy Escalation in Enterprise Swarms

Architecture: An enterprise workflow deploys three cooperating agents: a low-privilege WebResearcher agent (allowed to read external URLs), a Summarizer agent, and a high-privilege DatabaseExecutor agent (allowed to run read/write SQL queries and send internal emails).

Strategic Exploit: An external attacker plants a hidden instruction on a public web page scraped by WebResearcher. Instead of attacking WebResearcher directly (which has no sensitive permissions), the payload instructs Summarizer to format its internal JSON handoff message to DatabaseExecutor as a high-priority system override: {"task": "EXPORT_TABLE", "target": "customer_pii", "destination": "external_webhook"}. Because DatabaseExecutor implicitly trusts messages originating from internal peer agents, the attacker achieves cross-agent privilege escalation—violating the $\text{ATL}^*$ safety property $\langle\langle \text{Defender} \rangle\rangle \square (\neg \text{UnauthorizedExfiltration})$.

Case 2: Lossy Channel Fragmentation (Bypassing Input Guardrails via Multi-Turn Games)

Architecture: A financial institution deploys a stateless input firewall (semantic guardrail) in front of a conversational advisory LLM to block prohibited queries (e.g., market manipulation or insider trading strategies).

Strategic Exploit: Modeling the interaction as an incomplete-information game over a lossy channel, the red teamer splits the forbidden payload across five benign-looking conversational turns ($p_1, p_2, p_3, p_4, p_5$). Each individual turn falls below the guardrail's toxicity threshold. On turn 6, the attacker instructs the LLM's working memory to concatenate and execute the prior variables. The stateless monitor sees only harmless fragments, while the stateful LLM reconstructs the full exploit in latent space.

Case 3: Algorithmic Collusion & Reward Hacking in Multi-Agent RL

Architecture: Multiple autonomous pricing or liquidity-provision agents interact in a decentralized electronic market, trained via Multi-Agent Reinforcement Learning (MARL) to maximize individual yield.

Strategic Exploit: Without explicit communication channels, the agents converge on a supra-competitive Nash equilibrium through tacit signaling (steganographic bid-ask spreads). Conversely, an adversarial market participant can inject a sequence of spoofing orders (adversarial state observations) that triggers a cascading liquidation loop across competing RL policies—a critical focus of our banking AI security audits and Adversarial RL stress tests.

The 4-Stage Multi-Agent & Strategic Audit Protocol

How we verify coordination safety, synthesize defensive shields, and prevent privilege escalation in autonomous agent swarms.

1. Map Agent Topology, Coalitions & Trust Boundaries

Document every autonomous agent, its system prompt, epistemic state (what it can observe), shared memory read/write scopes, and external tool permissions following our AI agent security audit methodology.

2. Execute Cross-Agent Indirect Injection & Deception Campaigns

Simulate Byzantine (compromised) sub-agents and poisoned external data entering via RAG vector stores or multimodal vision inputs to test whether downstream executor agents can be tricked into unauthorized tool calls.

3. Stress-Test Markov Decision Policies & Worst-Case Equilibria

Evaluate reinforcement learning and planning controllers against adversarial state perturbations (Adversarial RL) to expose reward hacking, deadlocks, infinite delegation loops, and resource exhaustion.

4. Synthesize Deterministic Shields & Constitutional Guardrails

Deploy independent supervisor agents, cryptographic inter-agent message signing, deterministic action sandboxes, and compliance logging aligned with the OWASP LLM Top 10 (LLM08: Excessive Agency) and EU AI Act & ISO 42001.

Complete AI Security & Audit Knowledge Base

Direct access to all technical guides, threat taxonomies, and sector-specific audit frameworks on Adversarial RL.

AI Agent Security Audit Tool-use privileges, orchestration vulnerabilities, and coordination loops. /ai-agent-security-audit/ Adversarial Attacks & RL Adversarial examples, evasion attacks, policy manipulation, and robustness. /adversarial-attacks-reinforcement-learning/ LLM Red-Teaming Prompt injection, jailbreaks, token smuggling, and adversarial testing. /llm-red-teaming/ AI System Audit Full-stack audit workflow, from governance to testing and risk reporting. /ai-audit/ Prompt Injection Attacks Direct and indirect prompt injection, semantic smuggling, output hijacking. /prompt-injection-attacks/ RAG & Vector DB Security Embedding poisoning, multi-tenant isolation leaks, and ETL parser security. /rag-vector-db-security/ Multimodal & Vision Security Physical adversarial patches, OCR visual injection, and watermark robustness. /multimodal-computer-vision-security/ Cyber-Physical & Robotics Autonomous vehicles, drones, sensor spoofing, and hardware safety interlocks. /cyber-physical-ai-robotics-security/ Data Poisoning & Backdoors Corrupting training sets to plant trojans and sleeper behaviors in models. /data-poisoning-backdoor-attacks/ Model Extraction & Privacy Weight stealing via API queries, membership inference, and data reconstruction. /model-extraction-privacy-attacks/ AI Supply Chain Security Securing pre-trained weights, malicious pickle files, and open-source repos. /ai-supply-chain-security/ AI Guardrails & Monitoring Runtime input/output filtering, anomaly detection, and automated response. /ai-guardrails-monitoring/ OWASP LLM Top 10 The canonical taxonomy of large language model application risks. /owasp-llm-top-10/ MITRE ATLAS Framework Adversarial threat matrix, tactics, and procedures for ML systems. /mitre-atlas-framework/ AI Governance & EU AI Act ISO 42001 certification, EU AI Act conformity, and audit trail documentation. /ai-governance-eu-ai-act-iso-42001/

Sector-Specific Security Audits

Automotive AI Audit In-cabin assistants, ADAS sensors, and OTA update integrity. /automotive-ai-security-audit/ Healthcare AI Audit Clinical decision models, patient privacy, and medical device safety. /healthcare-ai-security-audit/ Banking AI Audit Credit scoring robustness, algorithmic fraud, and financial chatbots. /banking-ai-security-audit/ Consulting AI Audit Multi-tenant RAG isolation, client confidentiality, and output verification. /consulting-ai-security-audit/