摘要：多智能体 LLM 框架通常在启动时便固定团队拓扑。当某个 Agent 在运行时出现过载时——例如混合了过多行动类别、累积工具错误，或因过多调用而排队等待——系统并没有自我重构的机制。我们提出自主拓扑变异（Autonomous Topology Mutation，ATM），这是一种面向多智能体 LLM 框架的运行时团队变异机制。ATM 将基于遥测数据的过载检测与三项约束每次结构变更的安全不变量相结合：能力单调性、状态路由完整性，以及先进行影子验证再切换至线上。

ATM 监控一个由六项信号构成的瓶颈指数（Bottleneck Index），包括队列深度、上下文抖动、工具错误率、角色熵、重试循环率和跨 Agent 等待时间。当经过预热校准的阈值在连续多个时钟周期被突破时，ATM 会将过载的 Agent 因子化拆分为多个专门化子 Agent，并将父 Agent 热切换为协调器角色，同时保留其外部身份。状态转移由具备隐私等级感知的路由机制控制：每个记忆原子仅会被路由至获许可的子 Agent 集合，或被明确丢弃并记录原因。在通过影子验证窗口之前，任何候选拓扑都不会接收线上流量。

在四种消融条件和三类工作负载下，使用确定性工具桩进行的 720 次 DeepSeek-V3 驱动任务运行中，ATM 因子化器将代码任务成功率从 3.3% 提升至 61.7%。完整的护栏与蒸馏系统在保持任务质量的同时，按照正则表达式分类器检测到的高隐私记忆暴露从每任务 2.0 次降至 0.0 次。承载 ATM 不变量的运行时护栏，在 Agent 热路径上增加的 p99 延迟低于 500 微秒。论文还包含一个使用真实 Python 执行的小型实时工具探测，以检验外部有效性。实现代码、基准测试工具和运行追踪数据均已开源。

Abstract:Multi-agent LLM frameworks typically fix their team topology at boot time. When an individual agent becomes overloaded at runtime, for example by mixing too many action categories, accumulating tool errors, or queueing behind too many calls, the system has no mechanism to restructure itself. We introduce Autonomous Topology Mutation (ATM), a runtime team-mutation mechanism for multi-agent LLM frameworks. ATM combines telemetry-driven overload detection with three safety invariants that gate each structural change: capability monotonicity, state-routing completeness, and shadow-before-live validation.
ATM monitors a six-signal Bottleneck Index that includes queue depth, context thrash, tool-error rate, role entropy, retry-loop rate, and cross-agent wait time. When a warmup-calibrated threshold is breached for multiple consecutive ticks, ATM factorises the overloaded agent into specialised sub-agents and hot-swaps the parent into a coordinator role while preserving its external identity. State transfer is controlled by privacy-level-aware routing: each memory atom is routed only to a permitted child set, or explicitly dropped with a logged reason. No candidate topology receives live traffic until it has passed a shadow validation window.
On 720 DeepSeek-V3-driven task runs with deterministic tool stubs across four ablation conditions and three workloads, the ATM factoriser split lifts code-task success from 3.3% to 61.7%. The full rail-and-distillation system reduces detected high-privacy memory exposure under a regex classifier from 2.0 to 0.0 events per task while preserving task quality. The runtime rails carrying ATM's invariants add less than 500 microseconds of p99 latency on the agent hot path. A small live-tool probe with real Python execution is included as an external-validity check. The implementation, benchmark harness, and traces are open-sourced.