arXiv：cs.AI· Elias Hossain, Md Mehedi Hasan Nipu, Fatema Tuj Johora Faria, Shubhashis Roy Dipta, Maleeha Sheikh, Tasfia Nuzhat Ornee, Niloofar Yousefi·· 5 小时前
ChannelGuard：多智能体 LLM 中从借来的安全到应用控制的防御
ChannelGuard: From Borrowed Safety to Application-Controlled Defenses in Multi-Agent LLMs
AI 导读
针对多智能体 LLM 中恶意指令可经模型间传递信息注入的安全风险，研究者提出应用层防御方案 CHANNELGUARD，在每次信息交接处做检查，无需额外训练或增加模型调用。在超过 5,700 次测试中，它拦截了五个模型上全部藏于工具输出中的攻击，并将两个开源模型上的提示攻击成功率从 80% 降至 3%、从 77% 降至 10%，30 道数学题准确率不变。但改写后的攻击仍可能绕过该防御。
正文
Abstract:AI assistants increasingly work as teams, where one model makes a plan, others search the web, use tools, or read stored information, and another writes the final answer. This creates new security risks because harmful instructions can enter through information passed between models, not just through the user's message. Yet safety tests usually report only whether an attack succeeded, without showing what actually stopped it. We show that systems with similar safety scores can depend on very different protections. Across five agent models, attacks were stopped by a cloud provider's filter, by the model itself, or by inconsistent model behavior. This matters because protection that comes from the model or provider may disappear when either one changes. We introduce CHANNELGUARD, an application-controlled defense that checks information at each handoff without extra training or additional model calls. Across more than 5,700 test runs, it stopped all tested attacks hidden in tool outputs on all five models. On two open models, it reduced successful prompt attacks from 80% to 3% and from 77% to 10%, with no change in accuracy on 30 math problems. However, reworded attacks could still bypass the defense.
| Subjects: | Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI); Multiagent Systems (cs.MA) |
| Cite as: | arXiv:2607.19430 [cs.CR] |
| (or arXiv:2607.19430v3 [cs.CR] for this version) | |
| https://doi.org/10.48550/arXiv.2607.19430 arXiv-issued DOI via DataCite |
Submission history
From: Mehedi Hasan Nipu [view email]
[v1]
Mon, 20 Jul 2026 19:11:17 UTC (754 KB)
[v2]
Mon, 10 Aug 2026 05:30:02 UTC (754 KB)
[v3]
Sun, 11 Oct 2026 05:25:27 UTC (817 KB)
来源：arXiv：cs.AI · arxiv.org