CoChat
Sign Up
PreprintCited by 21Adversarial Robustness in Machine LearningSecurity and Verification in ComputingAccess Control and Trust

Red-Teaming LLM Multi-Agent Systems via Communication Attacks

Open access
He, Pengfei, Lin, Yupin, Dong, Shen, Xu, Han, Xing, Yue, Liu, Hui·2025·arXiv
DOI 10.48550/arxiv.2502.14847arXiv 2502.14847
Open this paper in CoChat — free accountOpen PDF

Abstract

Large Language Model-based Multi-Agent Systems (LLM-MAS) have revolutionized complex problem-solving capability by enabling sophisticated agent collaboration through message-based communications. While the communication framework is crucial for agent coordination, it also introduces a critical yet unexplored security vulnerability. In this work, we introduce Agent-in-the-Middle (AiTM), a novel attack that exploits the fundamental communication mechanisms in LLM-MAS by intercepting and manipulating inter-agent messages. Unlike existing attacks that compromise individual agents, AiTM demonstrates how an adversary can compromise entire multi-agent systems by only manipulating the messages passing between agents. To enable the attack under the challenges of limited control and role-restricted communication format, we develop an LLM-powered adversarial agent with a reflection mechanism that generates contextually-aware malicious instructions. Our comprehensive evaluation across various frameworks, communication structures, and real-world applications demonstrates that LLM-MAS is vulnerable to communication-based attacks, highlighting the need for robust security measures in multi-agent systems.

Integrity signals

Registry

DataCite · 10.48550/arxiv.2502.14847

Cites

0 citation errors · 0 not checkable

Statistics

Recomputing p-values needs the paper’s full text.

Claims the paper makes

We couldn’t retrieve this paper’s full text, so its claims and self-check weren’t run. The registry and citation checks still apply.

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

Cites

The publisher hasn’t deposited this paper’s reference list.

Cited by

Sorted by citations

Related

Authors
He, P., Lin, Y., Dong, S., Xu, H., Xing, Y., & Liu, H.
Affiliations
  • Michigan State University (US)
  • University of Arizona (US)
ORCID
Venue
arXiv
Publisher
arXiv
Published
2025
Pages
6726-6747
DOI
10.48550/arxiv.2502.14847
arXiv
2502.14847
OpenAlex
W4412888620
Cited by
15
References
0
Citations by year
2026: 11 · 2025: 4
FWCI
14.22
Type
conference paper
Language
en
Open access
Licence
Locations
  • Findings of the Association for Computational Linguistics: ACL (Findings of ACL) (publishedVersion, cc-by)
  • arXiv (Cornell University) (submittedVersion)
  • arXiv (Cornell University) (cc-by)
Funders
  • National Science Foundation (2405483, 2321416, 2212032, 2246050, 2234015, 2212144, 2035472, 2107215)
  • U.S. Department of Commerce
  • Bill and Melinda Gates Foundation
  • Michigan Department of Agriculture and Rural Development
Topics
  • Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
  • Physical Sciences › Computer Science › Artificial Intelligence › Security and Verification in Computing
  • Social Sciences › Sociology and Political Science › Access Control and Trust
Keywords
multi-agent LLM systems, communication attacks, interception of communications, adversarial agents, agent coordination, reflection mechanism

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review