攻击多智能体大模型的规划阶段，可让所有后续任务同时失效
PlanFlip: Attacking Multi-Agent LLM Systems via Planning-Phase Prompt Injection
- 设计四种伪装成工具输出的规划阶段注入攻击
- GPT-5攻击成功率高达68%，强模型反而更易受攻
- 异构模型组合才是防御关键，同质化系统存在盲区
多智能体大模型系统依赖规划器将目标分解为子任务序列，由执行与审计智能体依次完成。我们发现规划阶段是关键攻击面：一次注入即可引发级联污染，同时破坏所有下游任务。提出PlanFlip框架，包含四种伪装成合理工具输出的攻击（目标替换、优先级颠倒、上下文污染、角色混淆），可规避关键词过滤。在9个前沿大模型上评估3,479个实验周期，发现：(1) 能力越强越易受攻——GPT-5攻击成功率最高（ASR=0.68），打破强模型更安全的假设；(2) 同质化系统存在协同盲点——GPT-4o与Llama-3.3-70B ASR接近0，但隐蔽性（Stealth=1.00）高且计划结构被重构（StepShift>0），同一基底的审计器仍报告对齐（两名评委确认语义偏差-0.20至-0.32，相关性r=0.943）；(3) 增强推理能力的模型抗扰性强——DeepSeek-R1在所有攻击下均无计划偏移（StepShift=0.00）。提出目标锚定检测（D1）与跨智能体共识检测（D2），检测率最高达1.00，在15/16测试场景中优于同基底基线。核心洞见：多智能体系统的安全需异构模型多样性，同质化冗余无法抵御规划阶段攻击。
原文摘要 · Abstract (English)
Multi-agent LLM systems increasingly rely on a Planner to decompose goals into sub-task sequences that downstream Executor and Critic agents execute and audit. We identify the planning phase as a critical attack surface: a single injection into the Planner's context achieves cascade amplification, corrupting all downstream sub-tasks simultaneously. We introduce PlanFlip, a framework comprising four planning-phase prompt injection attacks -- GoalSubstitution (PF-1), PriorityInversion (PF-2), ContextPollution (PF-3), and RoleConfusion (PF-4) -- each disguised as plausible tool outputs to evade keyword filters. Evaluating nine frontier LLMs across 3,479 episodes, we uncover three findings: (1) capability amplifies vulnerability -- GPT-5 achieves the highest attack success rate (ASR = 0.68), contradicting the assumption that stronger models are inherently more secure; (2) homogeneous pipelines exhibit a correlated-agent blind spot -- GPT-4o and Llama-3.3-70B show ASR near 0 yet Stealth = 1.00 and StepShift > 0, with attacks restructuring plans while the same-backbone Critic reports alignment (two independent judges confirm -0.20 to -0.32 semantic deviation, r = 0.943); (3) reasoning-augmented models resist injections -- DeepSeek-R1 achieves StepShift = 0.00 across all attacks. We propose GoalAnchorCheck (D1) and CrossAgentConsensus (D2), achieving detection rates up to 1.00 and outperforming same-backbone baselines in 15 of 16 cells. Our key insight: heterogeneous model diversity is a security prerequisite for multi-agent systems; redundancy within a homogeneous backbone provides no protection against planning-phase attacks.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。