多智能体大模型中，组合触发可绕过安全检测，导致隐蔽攻击。
Conjunctive Prompt Attacks in Multi-Agent LLM Systems
- 利用用户查询与被攻陷代理的隐藏模板协同触发有害行为
- 在星型、链式、有向无环图拓扑中，攻击成功率显著提升且误激活低
- 现有防御机制因单点无害而失效，适合研究系统级安全的读者
多数大模型安全研究聚焦于单智能体模型，但实际应用常依赖多个交互智能体。在这些系统中，提示分割与跨代理路由形成了单智能体评估所忽略的攻击面。本文研究‘组合提示攻击’：用户查询中的触发关键词与某个被攻陷远程代理中的隐藏对抗模板各自看似无害，但在路由机制将其结合时会激活有害行为。攻击者仅控制触发词位置和模板插入，不修改模型权重或客户端代理。在星型、链式及有向无环图（DAG）拓扑下，基于路由优化的攻击成功率显著高于非优化基线，同时保持低误激活率。现有防御措施如 PromptGuard、Llama-Guard 变体以及工具限制等系统级控制，无法可靠阻止该攻击，因其任一组件单独均不显恶意。结果揭示了智能体大模型流水线中的结构性漏洞，并呼吁能推理路由与跨代理组合关系的新型防御机制。代码已公开于 https://github.com/UCF-ML-Research/ConjunctiveAgents。
原文摘要 · Abstract (English)
Most LLM safety work studies single-agent models, but many real applications rely on multiple interacting agents. In these systems, prompt segmentation and inter-agent routing create attack surfaces that single-agent evaluations miss. We study \emph{conjunctive prompt attacks}, where a trigger key in the user query and a hidden adversarial template in one compromised remote agent each appear benign alone but activate harmful behavior when routing brings them together. We consider an attacker who changes neither model weights nor the client agent and instead controls only trigger placement and template insertion. Across star, chain, and DAG topologies, routing-aware optimization substantially increases attack success over non-optimized baselines while keeping false activations low. Existing defenses, including PromptGuard, Llama-Guard variants, and system-level controls such as tool restrictions, do not reliably stop the attack because no single component appears malicious in isolation. These results expose a structural vulnerability in agentic LLM pipelines and motivate defenses that reason over routing and cross-agent composition. Code is available at https://github.com/UCF-ML-Research/ConjunctiveAgents.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。