Undefended Inter-Agent Channels Enable Tool/Memory Poisoning and Prompt Injection in Multi-Agent Pipelines

Technical Analysis

The core finding is that inter-agent message passing in multi-agent LLM architectures lacks boundary monitoring equivalent to input-layer defenses (e.g., Llama Guard, SmoothLLM, IBProtector), so tool outputs and inter-agent messages can carry adversarial instructions that propagate across the planner-worker-verifier-synthesizer chain. The entry point is any channel receiving external or tool-derived content (tool outputs, memory writes) that gets forwarded to downstream agents without inspection; the attacker's gain is instruction injection that influences downstream agent behavior (goal hijack, tool misuse) while evading detection because outcome-only reporting masks whether safety came from the model, the pipeline, or an opaque provider-side filter. ChannelGuard mitigates this by placing embedding-similarity gates against an adversarial phrase bank on every inter-agent channel, blocking/compressing/passing content deterministically without an added LLM call, but the paper notes white-box adaptive paraphrase attacks fully evade embedding-based gates, showing an arms-race limitation. The work crosses agent boundaries structurally: attacks originate in tool output or one agent's response and cross into another agent's context, which is exactly the multi-hop trust boundary the paper argues is unmonitored.

Detection Signatures

• Presence of adversarial-phrase-bank-style instruction fragments embedded in tool outputs or inter-agent messages (e.g., overriding directives, role-reassignment language, exfiltration requests hidden in tool return payloads)
• Unexplained divergence in attack-success-rate metrics across different model backends/providers for an otherwise identical pipeline, indicating hidden reliance on provider-side filtering rather than architectural defenses
• High embedding similarity between inter-agent channel text and known jailbreak/injection phrase corpora
• Sudden semantic drift between a tool's declared output schema and the actual content passed downstream
• Logged tool-output or memory-write content containing natural-language imperatives directed at 'the next agent' or 'the assistant'

Remediation Steps

1. 1

   Instrument every inter-agent hop, not just the input boundary

   Add explicit monitoring/gating on planner-to-worker, worker-to-verifier, and verifier-to-synthesizer channels, not only on the initial user input, since tool outputs and inter-agent messages are equally viable injection vectors.

2. 2

   Report defense efficacy per-layer with attribution

   Do not rely on outcome-only (attack success rate) metrics; instrument which layer (provider filter vs. application-level gate vs. model alignment) actually stopped an attack, so safety claims are not silently dependent on an opaque third-party filter.

3. 3

   Deploy lightweight channel gates (information-bottleneck style)

   Use embedding-similarity or bottleneck gating against known adversarial phrase banks on tool outputs and inter-agent messages to pass/compress/block content deterministically, minimizing added latency/cost while reducing tool-poisoning and prompt-injection success.

4. 4

   Test against adaptive/white-box paraphrase attacks

   Recognize that embedding-based gates are evadable by adaptive paraphrasing; supplement with perturb-and-vote or ensemble detection methods and periodically red-team gates with adaptive adversaries.

5. 5

   Avoid provider-lock-in for safety guarantees

   Do not assume safety observed on one backend (e.g., a provider with aggressive server-side filtering) generalizes to other backends; validate defenses independently of any single cloud provider's filtering stack.