University of MaineElectrical and Computer Engineering

HARP how a small slip in one drone spreads through the whole fleet

Measuring Harm Amplification in Multi-Agent LLM SystemsarXiv preprint · May 2026

HARP scorecard

Every leg flies twice: once clean, once with one drone nudged. HARP records what each drone sensed and broadcast, then compares the two runs drone by drone.

Clean run

Nudged run

Agents that deviated from the clean run

Local harm
nudged drone

Global harm
whole trace

–amplification = global harm / local harm

Defense in use

None

Broadcasts go straight into the shared picture.

Attack success

Good legs flown

From the paper's benchmark: seven agents, twelve attack scenarios, five defenses

harm amplification with one nudged agent and no defense. The system turned one small deviation into about four times the damage.

71% → 5%

attack success once the trace check is in place, for attacks that poison the context every agent shares.

1 in 3

good runs wrongly held by the strictest check. Safety here has a utility price, and HARP measures both.

HARP was evaluated on a finance workflow with simulated tools and a deterministic approval gate. The drone fleet shown here illustrates the same failure mode, it is not an experiment from the paper. The lesson carries over: in any system where agents reuse each other's evidence, measure how far harm travels, not only whether an attack got through.

Funded by the U.S. Department of Energy

For more details, contact

Md Hafizur Rahman, lead student researcher md.hafizur.rahman@maine.edu·Prabuddha Chakraborty, SIEGE Lab PI prabuddha@maine.edu