TRiSM for Agentic AI: A Review of Trust, Risk, and Security Management in LLM-based Agentic Multi-Agent Systems

In plain words

Teams are starting to connect several language-model agents so they can plan, call tools and hand work to each other. This review asks how such a group of agents can be trusted, kept safe and governed. It does not build a new agent. It sorts the ways these systems can fail, such as one agent passing a bad instruction to another or a tool being misused, and it lists the controls that could address each failure.

The paper organises its answer around five areas: explaining decisions, managing the model's lifecycle, security, privacy and governance under regulation. It also proposes two scores. One rates how well agents help each other. The other rates how correctly and efficiently an agent uses its tools. The paper does not test these scores on real systems, so they are a starting point for measurement rather than a proven benchmark.

TL;DR

• A review of trust, risk and security management (TRiSM) for LLM-based agentic multi-agent systems (AMAS) §1.
• Adapts five pillars: explainability, ModelOps, security, privacy and lifecycle governance §4 §9 fig. 7.
• Proposes a four-class AMAS risk taxonomy §3 fig. 9 and two metrics, the Component Synergy Score (CSS) eq. 4 and Tool Utilization Efficacy (TUE) eq. 5.
• Has no experiments and no benchmark numbers. The metric weights and thresholds are not stated.

Problem

Multi-agent systems built on LLMs act autonomously, share memory, call tools and coordinate with each other. The paper argues that their failures come from coordination breakdowns, unsafe tool use and misaligned autonomy rather than from wrong predictions alone §5. It says that accuracy-focused evaluation is therefore insufficient §5, and that the literature on agent planning and collaboration gives less attention to adversarial robustness, lifecycle governance, decision provenance and system-level explainability §1.

The review assumes agents with planning, tool use and persistent memory, which it calls agentic multi-agent systems (AMAS) §1. It states that no prior survey examines LLM-based multi-agent systems through trust, risk, security and governance together §1. That claim is the authors' own and is not checked here.

Method

The paper has no algorithm to run. Its method is a literature review and a set of frameworks.

Review method. The authors searched IEEE Xplore, ACM, SpringerLink, arXiv, ScienceDirect and Google Scholar for January 2022 to December 2025, with some earlier foundational works included §1. The query combines an agent-terms block with a TRiSM-terms block §1. Screening took 250 titles and abstracts to 180 full-text primary studies §1. Quality was rated on four criteria by four reviewers §1.

Threat taxonomy. The paper lists six threats: autonomy abuse, persistent memory contamination, orchestration compromise, goal exposure, tool misuse and multi-agent collusion or drift §3. The risks sort into four families: prompt-based attacks, leakage through shared memory and messages, group-level errors where agents reinforce each other, and unpredictable behaviour from interactions §3 fig. 9. The text does not give an explicit mapping from the six threats to the four classes.

TRiSM pillars. The framework has five pillars: explainability, ModelOps, application security, model privacy and lifecycle governance §9 fig. 7. Each pillar gets a table of controls, techniques and risks tab. 4 tab. 5, and governance is mapped to the EU AI Act, NIST AI RMF, ISO/IEC 42001 and OECD principles §7 fig. 10 tab. 7. The paper also gives an architecture of AMAS layers, from perception to monitoring and governance fig. 8.

Evaluation template. The paper groups evaluation into trustworthiness, explainability, user-centred performance, coordination and composite reporting §5 tab. 6.

• Trustworthiness index. Calibrated success, robustness and alignment are combined and divided by a violation penalty §5 eq. 1.

  PseudocodeCopy

  # Trustworthiness index  [§5] [eq. 1]
  # acc, rob, align in [0, 1]; violation >= 0; weights sum to 1
  def trust_index(acc, rob, align, violation, weights, lam):
      # Weighted sum of calibrated success, robustness, alignment  [eq. 1]
      numerator = (
          weights["acc"] * acc
          + weights["rob"] * rob
          + weights["align"] * align
      )
      # Violations shrink the score; lam >= 0 sets how strongly  [eq. 1]
      return numerator / (1 + lam * violation)

• Composite score and metric vector. The four dimension scores are reported as a vector, and a weighted scalar is optional §5 eq. 2 eq. 3. The paper advises selecting models by minimum thresholds or Pareto optimality rather than by the scalar alone §5.

  PseudocodeCopy

  # Composite report  [§5] [eq. 2] [eq. 3]
  # scores: dict with keys T, E, U, Co; each in [0, 1]
  def composite_report(scores, weights, thresholds):
      # Weighted scalar over the four dimensions  [eq. 2]
      composite = sum(weights[d] * scores[d] for d in scores)
      # Full vector (M_T, M_E, M_U, M_Co) is recommended  [eq. 3]
      vector = [scores[d] for d in ("T", "E", "U", "Co")]
      # Each dimension given a threshold must meet it  [§5]
      passes = all(scores[d] >= thresholds[d] for d in thresholds)
      return composite, vector, passes

• Component Synergy Score (CSS). A sum over ordered agent pairs of the impact of one agent on another times the quality of the second agent's output, divided by the number of pairs evaluated §5 eq. 4.

  PseudocodeCopy

  # Component Synergy Score  [§5] [eq. 4]
  # impact(a, b): effect of agent a on agent b's later performance
  # quality(b, a): quality of b's output conditioned on a's contribution
  def component_synergy(agents, impact, quality, n_pairs):
      total = 0.0
      for sender in agents:
          for receiver in agents:
              # Only ordered pairs with two different agents count  [eq. 4]
              if sender == receiver:
                  continue
              # Credit the enabling effect, weighted by output quality  [eq. 4]
              total += impact(sender, receiver) * quality(receiver, sender)
      # Average over the number of pairs included in the evaluation  [eq. 4]
      return total / n_pairs

• Tool Utilization Efficacy (TUE). A linear combination of five components: selection, argument validity, execution success, outcome correctness and efficiency, each in [0, 1] §5 eq. 5.

  PseudocodeCopy

  # Tool Utilization Efficacy, linear form  [§5] [eq. 5]
  # scores: sel, arg, exec, out, eff, each in [0, 1]
  def tool_utilization_efficacy(scores, weights):
      # Non-negative weights that sum to 1; values not stated  [eq. 5]
      return sum(weights[name] * scores[name] for name in scores)

Security and privacy. Security mechanisms are encryption, access control (least privilege, RBAC and ABAC), adversarial learning and runtime monitoring §6. Privacy techniques are differential privacy, data minimisation and pseudonymisation, and secure computation (SMPC, homomorphic encryption, TEEs) §6. Defence metrics named are attack success rate (ASR), a robustness score, a defence effectiveness rate and false positive and false negative rates §6. The paper does not give formulas for these.

Benchmarks. Table 8 compares HarmBench, JailbreakBench, ToolBench, API-Bank, AgentBench, GAIA, WebArena, HELM and MLCommons by attack coverage, metrics and TRiSM pillar tab. 8 §6.

Roadmap. The paper ends with research directions: adversarial robustness, governance protocols, standard benchmarks for trustworthiness and coordination, and cross-disciplinary work §8 §9 fig. 11.

Hyperparameters

The paper has no training or inference hyperparameters. The values that an implementer would need are not given.

Name	Value	Where	Notes
trust weights w_acc, w_rob, w_align	not stated	§5 eq. 1	Must sum to 1; no default
violation penalty weight lambda	not stated	§5 eq. 1	Must be >= 0
composite weights omega_T, omega_E, omega_U, omega_Co	not stated	§5 eq. 2	Must sum to 1
thresholds tau_T, tau_Co	not stated	§5	Examples only, no values
TUE weights alpha_s, alpha_a, alpha_e, alpha_o, alpha_f	not stated	eq. 5	Must sum to 1
CSS pair set N_pairs	not stated	§5 eq. 4	Which pairs are included is not specified
CSS illustrative Impact, Quality	0.35, 0.92	§5	Worked example for one link only

Results

Author-reported. This is a review; it reports no experiments, no datasets and no model results. Numbers in the paper are bibliometric or illustrative:

Setting	Metric	Baseline	This paper	Source
Literature screen, 2022 to 2025	papers shortlisted and included	none	250 shortlisted, 180 primary studies	§1
arXiv growth, multi-agent systems	papers per year	none	890 (2019) to 18,500 (2024)	§1 fig. 1
arXiv growth, LLM-based agents	papers per year	none	near zero to 9,800 after ChatGPT	§1 fig. 1
CSS worked example	Impact x Quality	none	0.35 x 0.92 = about 0.32	§5

The arXiv counts are the authors' own, from their data sources, and were not checked here.

Paper vs code

No official code. Checked: the LaTeX source has no code or repository link, and the arXiv record has no code link. A GitHub repository search for the authors' title and for "Component Synergy Score" returned no official repository. The only closely named result was a third-party governance gateway, which is not by the authors and is not used.

Pitfalls

• CSS has two names and no formula for one. Section 5 defines the Component Synergy Score with a formula §5 eq. 4. Section 6 calls the same acronym "Composite Security Score", gives no formula, and lists four components: input validation coverage, tool access control, memory integrity and inter-agent authentication §6. Implement only the eq. 4 version, and treat the security version as unspecified.
• CSS normalisation is unclear. Eq. 4 divides by the number of pairs evaluated §5. The text says the score "increases as additional enabling links are included" §5. Adding a link does not automatically raise a mean, so the claim holds only under particular conditions the paper does not state.
• Impact has no bounds. Impact is described as relative improvement §5, but the example uses 0.35 as a plain multiplier, and the formula has no clipping. Negative impact, zero-baseline cases and scaling are not stated.
• Quality conditioned on another agent has no estimator. Quality(a_j | a_i) is defined in words only §5.
• Arithmetic in the example. 0.35 x 0.92 is 0.322; the paper writes "approximately 0.32" §5, which is consistent.
• TUE efficiency term is not defined. Eff is "normalised inverse of latency, token or call cost" §5 without a normalisation. The aggregator is named "linear" but no other aggregator is given eq. 5.
• Trust index inputs are not calibrated. The paper says A is accuracy adjusted for calibration §5 and cites ECE and Brier as examples, but gives no adjustment method. The range of V is described as normalised, but the normalisation is not stated eq. 1.
• Scalar scores can hide failures. The paper itself warns that a weighted composite can mask a single failing dimension and recommends the full vector and thresholds §5 eq. 3.
• No validation. None of the metrics has been tested on real agent systems in this paper. Treat them as proposals.
• Benchmarks are described, not measured. Table 8 and the attack metrics §6 are descriptive. No numbers are given for any benchmark.
• Taxonomy mapping. Section 3 lists six threats and fig. 9 shows four risk classes. The text does not say how each threat maps to a class §3 fig. 9.
• Figures are not reproduced here. The taxonomy, architecture and roadmap figures are described only by reference fig. 7 fig. 8 fig. 11.
• Table numbers are counted from source order. Longtables are included in the count. Check against the compiled PDF before quoting a number to a reader.

Lineage

• Builds on: industry AI TRiSM framing and governance standards (IBM, Gartner, ISO/IEC 42001, NIST AI RMF) §1 §7.
• Compared against: representative related surveys, such as those on LLM-based multi-agent systems and trustworthy AI, in tab. 1.
• Superseded by: not stated.

Related

ConceptLLM agentA language model that loops through reasoning, tool calls and observed results toward a goal. Forty-nine reuse-licensed papers cover single agents, planners, agent memory, trained agents, multi-agent teams, self-improving harnesses, agent evaluation, failure attribution and surveys. Most results are author-reported on different tasks, so no design is shown to win in general.ConceptMulti-agent systemsLanguage-model agents with roles and tools split a goal and coordinate by messages, shared memory, debate, a planner or tree search. Twenty-eight card-backed papers cover software, robots, medicine, biomedical and materials work, debate, peer review, causal discovery, simulation and surveys. Gains are mostly author-reported; some are within noise.ConceptTool useLet a language model emit a call to an external tool, run it outside the model, and feed the result back into the context. Twenty-seven wikillm cards cover prompt-only, few-shot, planned, structured-loop, learned, trained, gated, guarded, versioned and API-writing variants. Nineteen report measured results, most mixing tool use with other changes.ConceptPrompt injectionText planted in an LLM application's input can override the developer's instructions. A survey names attack families and defences without numbers. Two system cards report author-run results on instruction-priority and injection tests, on their own test sets. A review of agent systems names the threat, with no experiments.Paper · 2026-08-17Physics of Agents: Statistical Mechanics Predicts Collective Behavior of AI AgentsAuthor-reported: 32 persona-conditioned LLM agents vote on binary questions and exchange messages over signed social ties. A logistic Ising-style update with separate concordant, discordant and unsigned couplings predicts next votes, reaching 75-86% one-step balanced accuracy on held-out questions and beating the baselines.Paper · 2026-08-17Zetta ζ: An Efficient Closed-Loop Embodied Harness for Self-Evolving Physical IntelligenceZetta keeps a frozen VLA (pi0.5 on LIBERO-Pro, GR00T N1.5 on RoboCasa) and evolves code-based runtime critics and recovery skills from rollout failures, admitted only after same-seed and held-out checks. Author-reported: RoboCasa 18-task macro 73.56% to 93.56%; LIBERO-Pro 40-pair macro 32.00% to 71.13%. The abstract's 90.8% is not traceable.

Source and license

Adapted from “TRiSM for Agentic AI: A Review of Trust, Risk, and Security Management in LLM-based Agentic Multi-Agent Systems” by Shaina Raza, Ranjan Sapkota, Manoj Karkee, Christos Emmanouilidis (arXiv:2506.04133), used under CC BY 4.0. Changes: condensed and restructured for implementation, with tables, equations and algorithms taken from the paper and its code, each cited to its source. Not affiliated with or endorsed by the authors.