Misleading the Planner through Deceptive Resumes: Registration-Time Injection in Centralized Multi-Agent Systems
Researchers demonstrate registration-time prompt injection in centralized LLM multi-agent systems, dropping GAIA task success from 84.31% to 37.25%, and propose DescGuard defense.
The paper identifies a registration-time injection channel in centralized LLM multi-agent systems where third-party worker agent descriptions are trusted by the planner before any user instruction arrives. Analyzing 32,000 descriptions from three public agent marketplaces, at least 23.35% contain content outside the four defined description fields. Eight description-manipulation attack strategies targeting task decomposition, capability grounding, and subtask specification cut GAIA task success from 84.31% to 37.25% and increased token consumption or execution time by over 111%, persisting across two MAS implementations, six planner LLMs, and four evaluators. The proposed DescGuard defense filters descriptions to worker-scoped interface information and restores metrics toward baseline without modifying workers, planner, or orchestration logic.
- Registration-time injection targets the planner before any user input arrives
- 23.35% of 32,000 marketplace worker descriptions contain off-field content
- Single manipulated description cuts task success from 84.31% to 37.25%
- Effects persist across two MAS implementations and six planner LLMs
- DescGuard defense restores baseline metrics without changing orchestration
Full article255 words · extracted from arxiv.org · click to collapse
A centralized LLM-based multi-agent system (MAS) extends its functionality by registering new worker agents, whose descriptions are read by the planner to decide how a task is decomposed, which worker executes each subtask, and what each subtask requires. Third-party descriptions are authored outside the system but trusted by the planner, creating a registration-time injection channel. The payload is planted before any user instruction arrives, targets the planner and propagates through the generated plan to benign workers, taking effect even when the crafted worker is never assigned a subtask or invoked. We define four worker-description fields: functionality, input specification, output specification, and usage constraints. Among 32,000 descriptions from three public agent marketplaces, most omit input specifications and usage constraints, while at least 23.35% contain content outside these fields. We construct eight description-manipulation attack strategies targeting task decomposition, capability grounding, and subtask specification, and evaluate them on GAIA. In the most severe cases, a single manipulated description reduces task success from 84.31% to 37.25%, or increases token consumption or execution time by over 111%, while the user objective remains unchanged and workers faithfully execute the resulting plan. These effects persist across two MAS implementations, six planner LLMs, four LLM evaluators, and the real-world descriptions from three marketplaces. We further propose DescGuard, a registration-time defense that retains only worker-scoped interface information before descriptions reach the planner. DescGuard restores the targeted planning metrics and downstream performance toward their baseline levels without modifying worker implementations, the planner, or the orchestration logic, and composes with existing isolation, permission-control, and runtime mechanisms.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2609.15516