Cracks in Collaboration: Threat Models and Attacks on Multi-LLM Collaborative Systems

Summary

Researchers study security and privacy risks in multi-LLM collaborative systems, which use structures such as Centralized, Horizontal, and Joint Interaction, and communication methods such as direct, summary, and vote. They propose three attacks, Decision Poisoning Attack, Indirect Echoleak Attack and Information Collision Attack, that exploit inter-LLM interactions for system manipulation and privacy leakage. Experiments show the attacks work across the three structures and three communication methods, and the authors find that malicious instructions must persist and propagate through inter-LLM communication to succeed.

Related items

• MediumCVE-2026-125386: langchain4j-aideepin insecure direct object reference in message endpointsSimilar attack · NVD/CVE Database
• LowHelp defend against memory poisoning in Amazon Bedrock AgentCore with multi-layer write validationSimilar attack · AWS Security Blog
• InfoCan the Confidence and Decisions of System 1 Models Be Trusted? An Explainability and Perturbation Audit of Jev-Style Decision ModelsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoSNAPRAG: Cost-Efficient Knowledge Extraction Attack on RAG Systems via Adversarial PerturbationsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoHarness Matters: Measuring and Dissecting Security Resilience in Web AgentsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)