ChannelGuard: Safe Models Do Not Compose into Safe Multi-Agent Systems

2026-07-20

AI Summary

This work addresses a critical security gap in multi-agent large language model systems, where existing defenses focus solely on input boundaries or rely on opaque cloud-based filters, thereby neglecting the vulnerability of inter-agent communication channels to adversarial exploitation. To counter this, the authors propose ChannelGuard—a training-free, defense-in-depth framework that deploys information bottleneck–based gating mechanisms on every communication channel. Messages are deterministically allowed, compressed, or blocked based on embedding similarity to an adversarial phrase library. ChannelGuard is the first to enable consistent, application-layer, cross-backend channel-level protection, exposes the implicit reliance of current evaluations on cloud-side filters, and introduces a traceable attack attribution mechanism. Experiments demonstrate that ChannelGuard completely blocks tool-poisoning attacks (30/30) across three model backends, reduces prompt injection success rates from 0.333 to 0.167, and preserves task performance on GSM8K with unchanged accuracy (0.867).

Abstract

Multi-agent LLM applications chain a planner, worker agents, a verifier, and a synthesizer, and every hop between agents is an unmonitored channel through which an adversary can smuggle instructions. Existing defenses guard only the input boundary (IBProtector, Llama Guard, perplexity filters, SmoothLLM) or run outside the application as opaque, stochastic provider-side filters. We show this gap carries a consequence rarely measured: on a 2,100-trace evaluation across eight attack families, five defenses, and three model backends, an undefended pipeline that appears fully safe under standard reporting (attack success 0.000 on tool- and memory-poisoning) owes that safety almost entirely to the cloud provider's server-side filter (54 of 60 blocks on Azure GPT-5), and silently shifts to the agent model's own alignment on a backend without such a filter. Outcome-only reporting hides this dependence. We present ChannelGuard, a training-free defense-in-depth framework placing information-bottleneck gates on every inter-agent channel; each scores channel text against an adversarial phrase bank by embedding similarity and deterministically passes, compresses, or blocks it, adding no LLM call, while an attribution method records which layer stopped each attack. ChannelGuard's tool-output gate blocks Tool Poisoning 30 of 30 at the application layer, identically across Azure GPT-5, Anthropic Sonnet 4.5, and Anthropic Haiku 4.5, whereas the undefended pipeline shifts entirely across backends; it also lowers Prompt Injection attack success by half (0.333 to 0.167) and preserves GSM8K accuracy exactly (0.867). White-box adaptive paraphrase evades every embedding gate, where a perturb-and-vote baseline does better. An extended appendix adds baselines, ablations, sweeps, a benign-preservation analysis, and a judge audit (kappa = 0.900), at a total cost of 47.36 USD.

Problem

• multi-agent systems
• adversarial attacks
• channel security
• prompt injection
• tool poisoning

Innovation

• ChannelGuard
• multi-agent safety
• adversarial phrase bank
• information-bottleneck gating
• training-free defense