Beyond Single-Model Injection: A Threat Model and Defense Architecture for Prompt Injection in Multi-Agent Systems

原文：Beyond Single-Model Injection: A Threat Model and Defense Architecture for Prompt Injection in Multi-Agent Systems

作者：Rudrendu Kumar Paul, Sourav Nandy

来源：arXiv cs.AI（人工智能）

正文

Computer Science > Cryptography and Security

arXiv:2609.22949v1 (cs)

[Submitted on 19 Sep 2026]

Title:Beyond Single-Model Injection: A Threat Model and Defense Architecture for Prompt Injection in Multi-Agent Systems

Authors:Rudrendu Kumar Paul, Sourav Nandy

View a PDF of the paper titled Beyond Single-Model Injection: A Threat Model and Defense Architecture for Prompt Injection in Multi-Agent Systems, by Rudrendu Kumar Paul and 1 other authors

View PDF

HTML (experimental)

Abstract:Existing prompt injection research focuses on single-model chatbot scenarios, where an attacker manipulates one LLM through crafted input. Multi-agent systems amplify this threat through three mechanisms absent from single-model settings: inter-agent message passing creates injection channels invisible to perimeter defenses, shared tool access enables privilege escalation across agent boundaries, and trust propagation allows a compromised agent to influence upstream orchestrators. We construct a threat model enumerating 14 attack vectors across four categories: direct injection via user input (3 vectors), indirect injection via tool outputs (4 vectors), inter-agent injection via message passing (4 vectors), and cascading injection through orchestrator manipulation (3 vectors). Testing all 14 vectors against a 6-agent production-representative system, we find that 67% of agents are vulnerable to at least one scope violation even with system-prompt-level guardrails, and indirect injection via tool outputs succeeds in 43% of attempts. Four architectural defenses reduce overall injection success from 31.2% to 4.2%: message signing with provenance tracking (inter-agent injection down 91%), input/output sanitization at agent boundaries (indirect injection down 78%), privilege-scoped tool access per agent role (privilege escalation eliminated entirely), and anomaly detection on inter-agent communication patterns (84% of cascading attempts caught).

Comments:

Accepted at the AIWILD Workshop, ICML 2026. Camera-ready version

Subjects:

Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI); Computation and Language (cs.CL); Multiagent Systems (cs.MA)

Cite as:

arXiv:2609.22949 [cs.CR]

(or

arXiv:2609.22949v1 [cs.CR] for this version)

https://doi.org/10.48550/arXiv.2609.22949

Focus to learn more

arXiv-issued DOI via DataCite (pending registration)

主题

安全 · 人工智能 · 自然语言处理 · 多智能体

由「前沿雷达」于 2026-09-19 采集。正文取自原文页面，已保留出处链接。标题与正文版权归原作者所有。