Misleading the Planner through Deceptive Resumes: Registration-Time Injection in Centralized Multi-Agent Systems
Researchers demonstrate registration-time prompt injection in centralized LLM multi-agent systems, dropping GAIA task success from 84.31% to 37.25%, and propose DescGuard defense.
The paper identifies a registration-time injection channel in centralized LLM multi-agent systems where third-party worker agent descriptions are trusted by the planner before any user instruction arrives. Analyzing 32,000 descriptions from three public agent marketplaces, at least 23.35% contain content outside the four defined description fields. Eight description-manipulation attack strategies targeting task decomposition, capability grounding, and subtask specification cut GAIA task success from 84.31% to 37.25% and increased token consumption or execution time by over 111%, persisting across two MAS implementations, six planner LLMs, and four evaluators. The proposed DescGuard defense filters descriptions to worker-scoped interface information and restores metrics toward baseline without modifying workers, planner, or orchestration logic.
- Registration-time injection targets the planner before any user input arrives
- 23.35% of 32,000 marketplace worker descriptions contain off-field content
- Single manipulated description cuts task success from 84.31% to 37.25%
- Effects persist across two MAS implementations and six planner LLMs
- DescGuard defense restores baseline metrics without changing orchestration
From the original article
1 min read at arxiv.orgA centralized LLM-based multi-agent system (MAS) extends its functionality by registering new worker agents, whose descriptions are read by the planner to decide how a task is decomposed, which worker executes each subtask, and what each subtask requires. Third-party descriptions are authored outside the system but trusted by the planner, creating a registration-time injection channel.
By Zhaofeng Yu · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.