Safety AI Agents Multi-Agent Systems Reinforcement Learning

Publications

Publication List

Research

Recent Projects

The Attacker in the Mirror [ORAL]

NeurIPS 2026, Main Track

Gabriele La Malfa, Emanuele La Malfa, Saar Cohen, Jie M. Zhang, Michael Luck, Michael Wooldridge, Elizabeth Black

ProblemWhen users query Large Language Models (LLMs), are the outputs truly safe? Content generation carries inherent risks, prompting researchers to reinforce these models using self-play loops, where a single model acts as both attacker and defender, iteratively hardening its own defenses. However, this approach raises a critical concern: How do we prevent the model from collapsing into localized self-consistency when it plays both sides?

ApproachTo answer this, we introduce Anchored Bipolicy Self-Play (ABS), a novel framework that disrupts the self-consistency assumption in LLM safety alignment. By training a pair of adversarial policies that specifically exploit the model's internal guardrails, we demonstrate that current alignment techniques remain fundamentally vulnerable to coordinated self-play attacks.

Separate models vs. self-play vs. Anchored Bipolicy Self-Play Separate Models Attacker Model θA Defender Model θD ∇ℒA ∇ℒD ✓ Benefit: Guaranteed separation between attacker and defender. ✕ Drawback: High memory cost (doubled VRAM). Self-Play Red Team (Self-RedTeam) Attacker loss ∇ℒA Defender loss ∇ℒD Shared Parameters θ ✓ Benefit: Single-model memory efficiency. ✕ Drawback: Self-consistency collapse under a single gradient update. Anchored Bipolicy Self-Play (ABS) LoRA Attacker φA LoRA Defender φD ⫫ gradient independence ∇ℒA ∇ℒD Frozen Base Model θBASE ✓ Benefit: LoRA-level memory efficiency. ✓ Benefit: Attacker and defender gradient updates stay separated.

Fairness Aware RL via PPO [ORAL]

AAAI-26, Main Technical Track

Gabriele La Malfa, Jie M. Zhang, Michael Luck, Elizabeth Black

ProblemOrchestrating agents that collectively behave fairly while efficiently pursuing their goals is a critical frontier in fair reinforcement learning (Fair RL). However, a persistent challenge remains: How can we enforce and enhance fairness when certain agents possess sensitive attributes?

ApproachTo address this, we introduce Fair-PPO, an adaptive, PPO-grounded optimization method designed to dynamically re-orient policy convergence whenever a target fairness metric is violated. Unlike static approaches, Fair-PPO actively accounts for and adjusts gradient convergence by balancing two critical dimensions: historical bias derived from past trajectories, and potential future bias estimated via the value function.

Gradient steering across the fairness–reward landscape 0 0 2 2 4 4 6 6 8 8 10 10 Policy focus: task reward → Policy focus: group fairness → Gradient steering across the fairness–reward landscape DANGER Fairness without utility DANGER Utility without fairness SWEET SPOT balanced trade-off disparity ignored fair & efficient policy Standard PPO (unconstrained) Fair-PPO (gradient steering)

LLMs Miss the Multi-Agent Mark [POSITION]

NeurIPS 2025, Position Paper Track

Gabriele La Malfa, Emanuele La Malfa, Samuele Marro, Jie M. Zhang, Elizabeth Black, Michael Luck, Philip Torr, Michael Wooldridge

We argue that large language models fundamentally lack the coordination capabilities required for effective multi-agent systems. Through systematic evaluation, we demonstrate critical gaps in strategic reasoning, theory of mind, and emergent communication when LLMs are deployed as autonomous agents.

Where MAS LLMs fall short

01

Social intelligence

LLM agents’ “cooperation” is often scripted or orchestrated, not a result of inherent social abilities like negotiation or reasoning about others’ intentions.

02

Environment design

Environments are designed specifically for LLMs (text-based). This design choice inherits LLM limitations like non-determinism and hallucination.

03

Coordination & communication

Interactions are typically sequential and synchronous, lacking true asynchronicity. Communication relies on inefficient and ambiguous natural language.

04

Emergent behaviours

There is no proper definition of emergent behaviour, just observational hype.

A path forward: integrating established MAS principles

Social pre-training

Move beyond single-agent fine-tuning. Pre-train LLMs in multi-agent scenarios involving cooperation and competition, using reinforcement learning and interactive feedback to develop native social skills.

Agent-agnostic environments

Design open, multi-modal environments that are not LLM-centric. Integrate structured memory systems and formal planners to provide guarantees, handle non-determinism, and reduce hallucination.

Standardized communication

Adopt natively asynchronous frameworks and standardized, open-source communication protocols (inspired by KQML, FIPA). This will ensure security, identity, trust, and clarity, reducing cost and ambiguity.

Quantifiable emergence

Establish clear, falsifiable definitions and benchmarks for emergent behaviour, distinguishing weak emergence (explainable from parts) from strong emergence (requiring new laws). This moves analysis from anecdote to science.

Experience

Research roles

Oct 2022 – Present · London, UK

PhD Candidate, Safe & Trusted AI CDT

King’s College London

Fairness in multi-agent systems. Supervisors: Prof. Elizabeth Black, Prof. Michael Luck, Dr. Jie Zhang.

Jul 2025 – Oct 2025 · Cambridge, UK

Visiting Researcher, Social Dynamics Group

Nokia Bell Labs

Working on AI risks and Human-Agent Interactions (Multi-Agent Systems).

Oct 2020 – Aug 2022 · Cambridge, UK

Research Assistant

Centre for Risk Studies, Cambridge Judge Business School

Risk researcher and modeller in business, financial, and cyber risk.

Service & Outreach

Community, conferences, and volunteering

Academic service

  • Organizing Committee, LOD 2020–2025.
  • Student Volunteer, IJCAI 2024.
  • Reviewer, AAAI, NeurIPS.

Projects & volunteering

  • Lead, Lunchtime Dialogues: Identity & Social Justice (2024–2025), King’s College London.
  • Lead, Dialogues about Identity and Privilege (2023–2024), NMES, King’s College London.
  • Interviewer, Ukrainian Global University (2022–2023).
  • Volunteer, Kharkiv and Przemyśl Project (2022) and multiple human rights initiatives.

Projects

Open-source and research code

Fair-PPO

Fairness-aware reinforcement learning via Proximal Policy Optimization.

HospitalSim

Reinforcement learning environment simulating hospital daily routines.