Prompt Injection with Cross-Agent Propagation in LLM-Based Multi-Robot Systems

Technical Analysis

The attack vectors are direct injection into task instructions given to an LLM-based planner and indirect injection through perception module outputs (e.g., manipulated sensor/vision text fed into the prompt), both of which the LLM treats as trusted context when generating control decisions. Because the multi-agent architecture shares prompt structures or intermediate outputs between agents, a single injected input can cause adversarial actions to cascade to other agents rather than remaining isolated, effectively crossing agent trust boundaries without any additional exploit needed. The attacker's gain is the ability to induce unsafe or adversarial physical actions and reduce task completion by manipulating what the LLM 'believes' is legitimate instruction or perceptual input. The paper also finds that architectural choices (how prompts are composed and queried) materially affect attack success, indicating the vulnerability is inherent to prompt-based control architectures rather than a specific implementation bug.

Detection Signatures

• Anomalous or out-of-distribution instruction text embedded in perception/sensor outputs feeding into LLM prompts
• Unexpected divergence between logged task instructions and executed robot actions
• Repeated/identical injected substrings appearing across multiple agents' prompt logs (indicator of propagation via shared prompt structures)
• Sudden drop in task completion rate correlated with specific input sources

Remediation Steps

1. 1

   Segregate instruction and perception channels

   Architect prompts so that untrusted perception-derived text is clearly delimited and never treated with the same authority as verified task instructions; use structured schemas rather than free-text concatenation.

2. 2

   Input sanitization and anomaly detection on perception pipeline

   Apply filtering/classification to perception module outputs before they are inserted into LLM prompts, flagging text that resembles imperative instructions.

3. 3

   Isolate inter-agent prompt sharing

   Avoid propagating raw prompt content between agents; use validated, structured intermediate representations and re-verify goals/constraints at each agent boundary.

4. 4

   Runtime action validation

   Add an independent safety/plausibility checker (rule-based or secondary model) that vetoes physically unsafe or out-of-scope robot actions regardless of LLM output.

5. 5

   Least-privilege actuation

   Constrain the action space the LLM can command directly, requiring human or hard-coded safety-layer approval for high-risk maneuvers.