LLM‑based multi‑agent systems (MAS) can invoke tools, share memory and delegate tasks, yet they frequently encounter adversarial content. Existing defenses are usually evaluated in isolation, targeting a single attack type at a time, which leads to high cost and difficult auditing. This work structures defenses around five principles and implements DEFER1 (Deterministic‑First Enforcement with Residual judgment). The core is a cascade of 28 checks: attacks that can be blocked are stopped immediately, while the remainder are handed to a panel of four judges. Independent testing across four domains reduces attack success rates from roughly 30 % to about 3 %, with 78 % of attacks blocked by deterministic checks. In the security‑operations domain only about a quarter of proposals reach the judges, indicating that rules secure clear policy violations while judges handle cases that merely misrepresent intent. Both systems have weaknesses; for example, the risk‑score approval gate often incorrectly approves attack proposals but rarely lets legitimate requests through, highlighting the difficulty of accurate threat assessment.
Review: DEFER1 illustrates a promising blend of rule‑based filtering and human judgment, yet the mis‑calibration of the risk‑score gate shows that finer‑grained threat metrics are still needed.