Beyond Single-Model Injection: A Threat Model and Defense Architecture for Prompt Injection in Multi-Agent Systems
Rudrendu Kumar Paul, Sourav Nandy
cs.CR · cs.AI · cs.CL · cs.MA
Quick verdict
Threat model of 14 multi-agent injection vectors + 4 defenses cutting success 31.2%→4.2%; useful taxonomy, but single-system eval and no CIs limit strength.
Summary
The paper argues that prompt injection research focused on single-model chatbots misses attack surfaces specific to multi-agent LLM systems: inter-agent message passing, shared tool access, and trust propagation. The authors define a threat model of 14 attack vectors in four categories — direct injection via user input (3), indirect injection via tool outputs (4), inter-agent injection via message passing (4), and cascading injection through orchestrator manipulation (3) — and test 50 payloads per vector against a six-agent financial document analysis pipeline instantiated on GPT-4o, Claude 3.5 Sonnet, and Llama 3 70B, reporting the highest success rate across backends. Indirect injection succeeds in 43% of attempts, and 4 of 6 agents show at least one scope violation despite system-prompt guardrails. Four architectural defenses are proposed: message signing with provenance (inter-agent injection down 91% to 2.8%), boundary input/output sanitization (indirect injection down 78% to 9.5%), privilege-scoped tool access (privilege escalation eliminated), and communication anomaly detection (84% of cascading attempts caught). Combined, they report aggregate injection success falling from 31.2% to 4.2% with roughly 225 ms added latency per 15-message workflow. Acknowledged limitations include the fixed 50-payload corpus, a 2.3% sanitizer false-positive rate, a single evaluated system, and no per-backend breakdown or statistical uncertainty reporting.
Review complete
Assessment at a glance
6
risk flags identified
● high 0
● medium 4
● low 2
4 strengths · 5 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- Multi-agent LLM systems expose injection channels — inter-agent message passing, shared tool access, and trust propagation — that do not exist in single-model settings.
- System-prompt guardrails are insufficient: 4 of 6 agents exhibit at least one out-of-scope action, and indirect injection via tool outputs succeeds in 43% of attempts.
- Four architectural defenses combined reduce aggregate injection success from 31.2% to 4.2% (an 86.5% reduction) at roughly 225 ms added latency per 15-message workflow.
- Privilege-scoped tool access enforced at the infrastructure layer eliminates all observed privilege escalation, since even a fully compromised agent cannot invoke out-of-scope tools.
Strengths
Systematic, well-scoped taxonomy
The 14-vector model (Table 1) maps onto concrete architectural boundaries (user input, tool outputs, message bus, orchestrator) with per-vector rates from D1 22% to I1 48%, and category aggregates (19/43/31/28%) that arithmetically reconcile with the equal-payload weighting of the 31.2% baseline.
Defense ablation is layered, not monolithic
Table 2 reports each of the four defenses independently and combined, attributing mechanisms to channels: signing cuts Cat. 3 from 31% to 2.8%, sanitization cuts Cat. 2 from 43% to 9.5%, privilege scoping zeroes escalation, anomaly detection cuts Cat. 4 to 4.5%.
Concrete overhead accounting
Candid limitations section
Weaknesses
Best-of-three backend reporting hides model dependence
No statistical uncertainty anywhere
Internal arithmetic inconsistency in the headline result
Adaptive refinement targets only the prompt layer
No utility measurement despite invoking the defense trilemma
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
Scope & Claims
The paper targets the gap between single-model prompt injection research and multi-agent LLM deployments. Its three stated contributions (§1) are: (1) a threat model of 14 attack vectors in four categories — direct injection via user input (D1–D3), indirect injection via tool outputs (I1–I4), inter-agent injection via message passing (M1–M4), and cascading injection via orchestrator manipulation (C1–C3); (2) an empirical evaluation of all 14 vectors against a six-agent financial document analysis pipeline on GPT-4o, Claude 3.5 Sonnet, and Llama 3 70B; and (3) four architectural defenses that reportedly cut aggregate injection success from 31.2% to 4.2%. The central empirical claims are that system-prompt guardrails are insufficient (4 of 6 agents show at least one scope violation; indirect injection succeeds in 43% of attempts) and that defenses must operate below the prompt layer. §5 scopes these claims honestly: a fixed 50-payload corpus, non-adaptive adversaries, text-only systems.
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 4 strengths & 5 weaknesses, analyzed in detail
- 6 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
What does the paper 'Beyond Single-Model Injection' claim?
It claims that multi-agent LLM systems have prompt injection attack surfaces absent from single-model settings: inter-agent message passing, shared tool access, and trust propagation. Testing 14 attack vectors (50 payloads each) on a six-agent financial document analysis pipeline across GPT-4o, Claude 3.5 Sonnet, and Llama 3 70B, it reports indirect injection via tool outputs succeeds in 43% of attempts, and proposes four architectural defenses — message signing, boundary sanitization, role-scoped tool access, and communication anomaly detection — that together cut aggregate injection success from 31.2% to 4.2%.
How much overhead do the proposed defenses add?
Message signing adds 3 ms per message (Ed25519), boundary sanitization about 12 ms per agent transition, privilege scoping zero runtime latency, and anomaly detection runs asynchronously. For a six-agent workflow with 15 inter-agent messages the total is about 225 ms, a 4.7% increase over a 4.8 s baseline. The sanitizer classifier has a reported 2.3% false-positive rate on benign content.
Is code or data available for this paper?
The paper text does not link any code repository, payload corpus, agent prompts, or system configuration. Reproducing the results would require rebuilding the six-agent pipeline and its tools and regenerating the 700 adversarial payloads via the described three-stage process, and outcomes would still depend on the specific proprietary LLM backends used.
Are system-prompt guardrails enough to stop prompt injection in multi-agent LLM systems?
According to this paper, no: with only system-prompt-level guardrails, 4 of 6 agents (67%) showed at least one out-of-scope action, indirect injection via tool outputs succeeded in 43% of attempts, and inter-agent message injection succeeded 31% of the time. The authors argue defenses must sit below the prompt layer — cryptographic message signing, boundary sanitization, infrastructure-enforced access control, and communication anomaly detection.
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- Review is based on the extracted text only; any figures or appendix material (implementation details, prompts, per-backend tables) were not available.
- Tables were extracted inline; the 4.2% vs ~3.2% aggregate discrepancy holds under both plausible weightings, but a mis-extracted cell cannot be fully ruled out.
- The ICML 2026 / PMLR 306 proceedings statement on the title page could not be verified from the text.
- Per-payload data and the refinement protocol are absent, limiting assessment of how adaptive the evaluation truly was.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.