Adversarial Attacks in Multi-Agent LLM Pipelines: Unveiling Structural Vulnerabilities in Agentic AI Architectures

2026-08-01

AI Summary

This work addresses a critical structural vulnerability in multi-agent large language model (LLM) pipelines: the absence of boundary validation mechanisms enables adversarial content to propagate across agents, leading to systemic security risks. The study demonstrates that this fragility stems from the pipeline architecture itself rather than the underlying model capabilities—a distinction not previously recognized. To address this, the authors introduce boundary validation as a fundamental security primitive and develop a comprehensive evaluation framework encompassing attack vectors such as malicious content injection and agent impersonation. Experiments using real-world execution traces from GAIA and SWE-Bench, combined with adversarial testing of GPT-5-mini, Claude Sonnet 4.5, and Kimi K2.5 within a unified pipeline, reveal that attack success is predominantly dictated by architectural design. Current evaluation paradigms fail to detect these vulnerabilities, underscoring the urgent need for defense mechanisms grounded in architectural safeguards.

Abstract

Multi-agent LLM pipelines orchestrate multiple specialized language model agents into structured workflows where intermediate outputs are passed across agents to solve complex tasks. This design introduces a security gap absent in single-agent settings: once an agent accepts adversarial content, it is propagated as trusted input throughout the pipeline. We argue that this vulnerability stems from the absence of boundary verification, a security primitive that enforces explicit validation of data as it crosses inter-agent boundaries, including content, identity, execution intent, and state integrity. Without such verification, modern pipelines embed implicit trust assumptions that are not adversarially robust, giving rise to structurally distinct attack surfaces (e.g., content injection, agent impersonation, plan deviation, and memory poisoning). Leveraging annotated production traces from the GAIA and SWE-Bench benchmark, we show that these vulnerabilities arise in benign deployments and largely evade existing evaluation frameworks. We further operationalize these failure modes within a controlled multi-agent setting and evaluate them across GPT-5-mini, Claude Sonnet 4.5, and Kimi K2.5 under identical pipeline configurations. The results reveal that attack success aligns with pipeline structure rather than model capability, indicating that adversarial vulnerability is fundamentally an architectural property and motivating a shift toward pipeline-level defenses.

Problem

• adversarial attacks
• multi-agent LLM pipelines
• structural vulnerabilities
• boundary verification
• agentic AI architectures

Innovation

• boundary verification
• multi-agent LLM pipelines
• structural vulnerabilities
• adversarial attacks
• agentic AI architectures