Cross-Platform Mission-Level Goal Decomposition via Indirect Prompt Injection in LLM-Assisted ISR Swarms
First seen Jul 28, 2026 · Updated Jul 28, 2026
This is an academic research paper proposing a defensive runtime-verification framework, not a live exploit or observed attack. It identifies a real class of risk: LLM-controlled robot swarms can be manipulated via indirect prompt injection to split a prohibited task across multiple platforms so that no single per-platform guardrail detects the violation. The paper's contribution is a detection/assurance system, not new attack tooling, so this should be tracked as a defensive research reference rather than an active threat.
Technical Analysis
The described attack vector is indirect prompt injection against LLM mission planners embedded in autonomous ISR platforms, where injected content causes the planners to decompose a prohibited collective objective (e.g., an unauthorized collection task or budget) into sub-tasks that are each individually compliant with per-platform policy limits. Because guardrails are evaluated locally per agent, the aggregate mission-level violation is invisible to any single monitor, and contested/lossy inter-agent communications can further hide corroborating evidence. The entry point is the planner's context/input channel (susceptible to injected instructions from sensor feeds, mission data, or compromised comms), and the attacker's gain is undetected policy evasion at the swarm/mission level rather than compromise of any individual node. The paper's proposed mitigation crosses agent boundaries by aggregating per-platform verdicts over a 'verification-aware' messaging fabric and fusing them with a security x completeness algebra that explicitly flags evidence loss as 'unknown' instead of a false all-clear.
Detection Signatures
- Look for mission plans where sub-tasks assigned to different platforms, when combined, approach or exceed a collective policy threshold (e.g., cumulative collection scope, budget, geofence) even though each individual assignment is within limits.
- Monitor for anomalous task-splitting patterns correlated with unverified or externally-sourced planning inputs (sensor data, comms relays, mission updates) that could carry injected instructions.
- Flag silent monitor outputs during periods of communication loss/jamming instead of treating missing verdicts as implicit all-clear.
- Audit inter-agent messages for provenance gaps -- missing or delayed verdicts from specific platforms during a mission window.
Remediation Steps
- 1
Adopt mission-level compositional verification
Deploy cross-agent runtime verification (platform/squad/mission tiers) rather than relying solely on per-platform guardrails, so distributed policy violations composed from individually-compliant actions can be detected.
- 2
Treat evidence loss as 'unknown', not 'all-clear'
Design monitoring fabrics so that lost, delayed, or unverifiable verdicts are explicitly downgraded to an 'unknown' state with provenance, preventing silent false negatives during contested communications.
- 3
Harden planner inputs against indirect injection
Sanitize and provenance-tag all external content (sensor feeds, mission updates, inter-platform messages) that reaches LLM planners, and apply input-validation/allowlisting to reduce injection surface.
- 4
Enforce collective budget/objective tracking
Maintain a swarm-wide ledger of cumulative task assignments and resource/budget consumption to catch aggregate policy breaches that individual platform checks would miss.
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.