Conjunctive Prompt Attacks in Multi-Agent LLM Systems
This work exposes a new attack surface for multi-agent LLM systems, motivating defenses that reason over routing and cross-agent composition.
The paper identifies a structural vulnerability in multi-agent LLM systems where a trigger key in a user query and a hidden adversarial template in a compromised agent appear benign alone but activate harmful behavior when combined via routing. Routing-aware optimization achieves high attack success across star, chain, and DAG topologies, while existing defenses fail because no single component appears malicious.
Most LLM safety work studies single-agent models, but many real applications rely on multiple interacting agents. In these systems, prompt segmentation and inter-agent routing create attack surfaces that single-agent evaluations miss. We study \emph{conjunctive prompt attacks}, where a trigger key in the user query and a hidden adversarial template in one compromised remote agent each appear benign alone but activate harmful behavior when routing brings them together. We consider an attacker who changes neither model weights nor the client agent and instead controls only trigger placement and template insertion. Across star, chain, and DAG topologies, routing-aware optimization substantially increases attack success over non-optimized baselines while keeping false activations low. Existing defenses, including PromptGuard, Llama-Guard variants, and system-level controls such as tool restrictions, do not reliably stop the attack because no single component appears malicious in isolation. These results expose a structural vulnerability in agentic LLM pipelines and motivate defenses that reason over routing and cross-agent composition. Code is available at https://github.com/UCF-ML-Research/ConjunctiveAgents.