Prompt Injection Propagation in Multi-Agent LLM Robotic Systems

Technical Analysis

The attack surface includes both direct injection points (task/instruction inputs to the planning LLM) and indirect injection points (perception module outputs, e.g., sensor data, vision-to-text pipelines, or environmental descriptions fed into the model). Once an injected instruction influences one agent's LLM-driven plan, shared prompt structures (e.g., common context, relayed messages, or shared memory/state) allow the malicious instruction to propagate to other agents in the system, a form of cross-agent contamination analogous to lateral movement. The attacker's gain is degraded task completion and induced adversarial/unsafe physical actions, with success rate depending on prompt composition, injection strategy, and target agent architecture. This crosses agent boundaries because multi-agent robotic architectures often pass planning context or perception summaries between agents without strict provenance or sanitization, turning a single compromised input channel into a systemic risk with physical-world consequences.

Detection Signatures

• Anomalous or out-of-distribution instructions embedded in perception-module outputs (e.g., object labels, scene descriptions, OCR text) that resemble imperative commands.
• Sudden divergence between an agent's planned actions and its original task specification following receipt of shared context from another agent.
• Repeated cross-agent messages containing natural-language directives not consistent with the expected schema for inter-agent state sharing.
• Drop in task-completion metrics correlated with specific perception inputs or agent-to-agent handoffs.
• Prompt/context logs showing instruction-like text originating from sensor or non-trusted data channels rather than the operator/task specification.

Remediation Steps

1. 1

   Sanitize and isolate perception inputs

   Treat all perception-module outputs (vision, OCR, sensor-to-text) as untrusted data; strip or neutralize imperative-language patterns before they reach the planning LLM's prompt context.

2. 2

   Enforce provenance and structural separation in shared prompts

   Use strict, structured (non-natural-language) schemas for inter-agent context sharing, and cryptographically or structurally tag the origin of each field so injected text cannot masquerade as trusted task instructions.

3. 3

   Add action-level safety validation

   Implement an independent, non-LLM safety/plausibility checker that validates proposed physical actions against task goals and safety constraints before execution, regardless of which agent produced the plan.

4. 4

   Limit cross-agent prompt sharing scope

   Restrict what context is propagated between agents to the minimum necessary, avoiding verbatim relay of raw perception or instruction text that could carry injected payloads.

5. 5

   Red-team with adversarial injection benchmarks

   Adopt the paper's evaluation methodology (varying attack-goal complexity and injection strategies) as part of pre-deployment testing for any multi-agent robotic LLM system.