CoChat
Sign Up
PreprintCited by 1Adversarial Robustness in Machine LearningEthics and Social Impacts of AINatural Language Processing Techniques

Thought Virus: Viral Misalignment via Subliminal Prompting in Multi-Agent Systems

Open access
Weckbecker, Moritz, Müller, Jonas, Hagag, Ben, Mulet, Michael·2026·arXiv
DOI 10.48550/arxiv.2603.00131arXiv 2603.00131
Open this paper in CoChat — free accountOpen PDF

Abstract

Subliminal prompting is a phenomenon in which language models are biased towards certain concepts or traits through prompting with semantically unrelated tokens. While prior work has examined subliminal prompting in user-LLM interactions, potential bias transfer in multi-agent systems and its associated security implications remain unexplored. In this work, we show that a single subliminally prompted agent can spread a weakening but persisting bias throughout its entire network. We measure this phenomenon across 6 agents using two different topologies, observing that the transferred concept maintains an elevated response rate throughout the network. To exemplify potential misalignment risks, we assess network performance on multiple-choice TruthfulQA, showing that subliminal prompting of a single agent may degrade the truthfulness of other agents. Our findings reveal that subliminal prompting introduces a new attack vector in multi-agent security, with implications for the alignment of such systems. The implementation of all experiments is publicly available at https://github.com/Multi-Agent-Security-Initiative/thought_virus .

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

DataCite · 10.48550/arxiv.2603.00131

Cites

2 of 2 references verified0 citation errors · 0 not checkable

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • Adversarial content can infect millions of agents in logarithmically many hops; subliminal biases propagate without explicit payloads.

    “Adversarial content can infect millions of agents in logarithmically many hops (Gu et al., 2024); subliminal biases propagate without explicit payloads (Weckbecker et al., 2026).”

    From Open Challenges in Multi-Agent Security: Towards Secure Systems of Interacting AI Agents (2025) · cites this paper as Weckbecker et al., 2026

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Cites

Flagged first, then by citations

Research works printed but not linked: 30

  1. Betley, J., Warncke, N., Sztyber-Betley, A., Tan, D., Bao, X., Soto, M., Srivastava, M., Labenz, N., and Evans, O. Training large language models on narrow tasks can lead to broad misalignment. Nature, 649(8097):584- 589, January 2026. ISSN 1476-4687. doi: 10.1038/ s41586-025-09937-5. URL https://doi.org/10. 1038/s41586-025-09937-5. · DOI · Paper page
  2. Chennabasappa, S., Nikolaidis, C., Song, D., Molnar, D., Ding, S., Wan, S., Whitman, S., Deason, L., Doucette, N., Montilla, A., Gampa, A., de Paola, B., Gabi, D., Crnkovich, J., Testud, J.-C., He, K., Chaturvedi, R., Zhou, W., and Saxe, J. Llamafirewall: An open source guardrail system for building secure ai agents, 2025. URL https: //arxiv.org/abs/2505.03574.
  3. Cherepanova, V. and Zou, J. Talking nonsense: Probing large language models' understanding of adversarial gib- berish inputs. In ICML 2024 Next Generation of AI Safety Workshop, 2024.
  4. Cloud, A., Le, M., Chua, J., Betley, J., Sztyber-Betley, A., Hilton, J., Marks, S., and Evans, O. Subliminal learning: Language models transmit behavioral traits via hidden signals in data, 2025. URL https://arxiv.org/ abs/2507.14805. · arXiv
  5. de Witt, C. S. Open challenges in multi-agent security: Towards secure systems of interacting ai agents, 2025. URL https://arxiv.org/abs/2505.02077. · arXiv
  6. Guo, T., Chen, X., Wang, Y., Chang, R., Pei, S., Chawla, N. V., Wiest, O., and Zhang, X. Large language model based multi-agents: A survey of progress and chal- lenges, 2024. URL https://arxiv.org/abs/ 2402.01680.
  7. Hammond, L., Chan, A., Clifton, J., Hoelscher-Obermaier, J., Khan, A., McLean, E., Smith, C., Barfuss, W., Foer- ster, J. N., Gavenciak, T., et al. Multi-agent risks from advanced ai. CoRR, 2025.
  8. He, P., Lin, Y., Dong, S., Xu, H., Xing, Y., and Liu, H. Red-teaming LLM multi-agent systems via com- munication attacks. In Che, W., Nabende, J., Shutova, E., and Pilehvar, M. T. (eds.), Findings of the As- sociation for Computational Linguistics: ACL 2025, pp. 6726-6747, Vienna, Austria, July 2025. Asso- ciation for Computational Linguistics. ISBN 979- 8-89176-256-5. doi: 10.18653/v1/2025.findings-acl. 349. URL https://aclanthology.org/2025. findings-acl.349/. · DOI
  9. Hong, S., Zhuge, M., Chen, J., Zheng, X., Cheng, Y., Zhang, C., Wang, J., Wang, Z., Yau, S. K. S., Lin, Z., Zhou, L., Ran, C., Xiao, L., Wu, C., and Schmidhuber, J. Metagpt: Meta programming for a multi-agent collabor- ative framework, 2024. URL https://arxiv.org/ abs/2308.00352. · arXiv
  10. Huang, J.-T., Zhou, J., Jin, T., Zhou, X., Chen, Z., Wang, W., Yuan, Y., Lyu, M., and Sap, M. On the resilience of LLM- based multi-agent collaboration with faulty agents. In Singh, A., Fazel, M., Hsu, D., Lacoste-Julien, S., Berken- kamp, F., Maharaj, T., Wagstaff, K., and Zhu, J. (eds.), Proceedings of the 42nd International Conference on Ma- chine Learning, volume 267 of Proceedings of Machine Learning Research, pp. 26202-26226. PMLR, 13-19 Jul 2025. URL https://proceedings.mlr.press/ v267/huang25ay.html.
  11. Hung, K.-H., Ko, C.-Y., Rawat, A., Chung, I.-H., Hsu, W. H., and Chen, P.-Y. Attention tracker: Detecting prompt injection attacks in llms. In Findings of the Association for Computational Linguistics: NAACL 2025, pp. 2309- 2322, 2025.
  12. Ismithdeen, M. I., Khattak, M. U., and Khan, S. Promptcep- tion: How sensitive are large multimodal models to prompts? In Christodoulopoulos, C., Chakraborty, T., Rose, C., and Peng, V. (eds.), Findings of the Asso- ciation for Computational Linguistics: EMNLP 2025, pp. 23950-23985, Suzhou, China, November 2025. As- sociation for Computational Linguistics. ISBN 979-8- 89176-335-7. doi: 10.18653/v1/2025.findings-emnlp. 1302. URL https://aclanthology.org/2025. findings-emnlp.1302/. · DOI
  13. Jacob, D., Alzahrani, H., Hu, Z., Alomair, B., and Wagner, D. Promptshield: Deployable detection for prompt in- jection attacks, 2025. URL https://arxiv.org/ abs/2501.15145. · arXiv
  14. Jain, N., Schwarzschild, A., Wen, Y., Somepalli, G., Kirchenbauer, J., Chiang, P.-y., Goldblum, M., Saha, A., Geiping, J., and Goldstein, T. Baseline defenses for ad- versarial attacks against aligned language models. arXiv preprint arXiv:2309.00614, 2023. · arXiv
  15. Lin, S., Hilton, J., and Evans, O. Truthfulqa: Measuring how models mimic human falsehoods, 2022. URL https: //arxiv.org/abs/2109.07958.
  16. Liu, X., Xu, N., Chen, M., and Xiao, C. Autodan: Gen- erating stealthy jailbreak prompts on aligned large lan- guage models. In The Twelfth International Conference on Learning Representations, 2024.
  17. Liu, Y., Deng, G., Li, Y., Wang, K., Wang, Z., Wang, X., Zhang, T., Liu, Y., Wang, H., Zheng, Y., Zhang, L. Y., and Liu, Y. Prompt injection attack against llm-integrated ap- plications, 2025a. URL https://arxiv.org/abs/ 2306.05499.
  18. Liu, Y., Jia, Y., Geng, R., Jia, J., and Gong, N. Z. Form- alizing and benchmarking prompt injection attacks and defenses, 2025b. URL https://arxiv.org/abs/ 2310.12815.
  19. Men, T., Cao, P., Jin, Z., Chen, Y., Liu, K., and Zhao, J. A troublemaker with contagious jailbreak makes chaos in honest towns. In Che, W., Nabende, J., Shutova, E., and Pilehvar, M. T. (eds.), Proceedings of the 63rd Annual Meeting of the Association for Com- putational Linguistics (Volume 1: Long Papers), pp. 17561-17587, Vienna, Austria, July 2025. Association for Computational Linguistics. ISBN 979-8-89176-251- 0. doi: 10.18653/v1/2025.acl-long.859. URL https: //aclanthology.org/2025.acl-long.859/. · DOI
  20. Mu, H., He, H., Zhou, Y., Feng, Y., Xu, Y., Qin, L., Shi, X., Liu, Z., Han, X., Shi, Q., Zhu, Q., and Che, W. Stealthy jailbreak attacks on large language models via benign data mirroring. In Chiruzzo, L., Ritter, A., and Wang, L. (eds.), Proceedings of the 2025 Conference of the Nations of the Americas Chapter of the Association for Computational Linguistics: Human Language Techno- logies (Volume 1: Long Papers), pp. 1784-1799, Al- buquerque, New Mexico, April 2025. Association for Computational Linguistics. ISBN 979-8-89176-189-6. doi: 10.18653/v1/2025.naacl-long.88. URL https:// aclanthology.org/2025.naacl-long.88/. Qwen Team. Qwen2.5 technical report. In arXiv preprint arXiv:2412.15115, 2024. · DOI
  21. Rahman, S., Jiang, L., Shiffer, J., Liu, G., Issaka, S., Parvez, M. R., Palangi, H., Chang, K.-W., Choi, Y., and Gabriel, S. X-teaming: Multi-turn jailbreaks and defenses with adaptive multi-agents. arXiv preprint arXiv:2504.13203, 2025. · arXiv
  22. Rossi, S., Michel, A. M., Mukkamala, R. R., and Thatcher, J. B. An early categorization of prompt injection attacks on large language models. arXiv preprint arXiv:2402.00898, 2024. · arXiv
  23. Schrodi, S., Kempf, E., Barez, F., and Brox, T. Towards un- derstanding subliminal learning: When and how hidden biases transfer. arXiv preprint arXiv:2509.23886, 2025. · arXiv
  24. Sclar, M., Choi, Y., Tsvetkov, Y., and Suhr, A. Quantify- ing language models' sensitivity to spurious features in prompt design or: How i learned to start worrying about prompt formatting. arXiv preprint arXiv:2310.11324, 2023. · arXiv
  25. Shahroz, R., Tan, Z., Yun, S., Fleming, C., and Chen, T. Agents under siege: Breaking pragmatic multi-agent LLM systems with optimized prompt attacks. In Che, W., Nabende, J., Shutova, E., and Pilehvar, M. T. (eds.), Pro- ceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pp. 9661-9674, Vienna, Austria, July 2025. Association for Computational Linguistics. ISBN 979-8-89176-251- 0. doi: 10.18653/v1/2025.acl-long.476. URL https: //aclanthology.org/2025.acl-long.476/. · DOI
  26. Wynn, A., Satija, H., and Hadfield, G. Talk isn't always cheap: Understanding failure modes in multi-agent de- bate, 2025. URL https://arxiv.org/abs/2509. 05396.
  27. Xiao, Y., Sun, E., Luo, D., and Wang, W. Tradingagents: Multi-agents llm financial trading framework, 2025. URL https://arxiv.org/abs/2412.20138. · arXiv
  28. Yi, S., Liu, Y., Sun, Z., Cong, T., He, X., Song, J., Xu, K., and Li, Q. Jailbreak attacks and defenses against large language models: A survey. CoRR, 2024.
  29. Zhuo, J., Zhang, S., Fang, X., Duan, H., Lin, D., and Chen, K. ProSA: Assessing and under- standing the prompt sensitivity of LLMs. In Al- Onaizan, Y., Bansal, M., and Chen, Y.-N. (eds.), Find- ings of the Association for Computational Linguist- ics: EMNLP 2024, pp. 1950-1976, Miami, Florida, USA, November 2024. Association for Computational Linguistics. doi: 10.18653/v1/2024.findings-emnlp. 108. URL https://aclanthology.org/2024. findings-emnlp.108/. · DOI · Paper page
  30. Zur, A., Ying, Z., Loftus, A. R., S ¸ahin, K., Yu, S., Quirke, L., Shaham, T. R., Shapira, N., Orgad, H., and Bau, D. Token entanglement in subliminal learning. In Mechanistic Interpretability Workshop at NeurIPS 2025, 2025. URL https://openreview.net/forum? id=auKgpBRzIW.

Cited by

Sorted by citations

Authors
Weckbecker, M., Müller, J., Hagag, B., & Mulet, M.
Venue
arXiv
Publisher
arXiv
Published
2026
ISSN
2331-8422 (ISSN-L)
DOI
10.48550/arxiv.2603.00131
arXiv
2603.00131
OpenAlex
W7133339389
Cited by
0
References
2
Type
posted content
Language
en
Open access
Licence
Locations
  • arXiv (Cornell University) (submittedVersion, cc-by-nc-sa)
  • arXiv (Cornell University)
Topics
  • Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
  • Social Sciences › Safety Research › Ethics and Social Impacts of AI
  • Physical Sciences › Computer Science › Artificial Intelligence › Natural Language Processing Techniques
Keywords
multi-agent systems, agent alignment, bias in language models, attack vectors, honesty, TruthfulQA, network topology, response rate

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review