PlanFlip: Attacking Multi-Agent LLM Systems via Planning-Phase Prompt Injection

PlanFlip：通过规划阶段提示注入攻击多智能体大模型系统

Multi-agent LLM systems increasingly rely on a Planner to decompose goals into sub-task sequences that downstream Executor and Critic agents execute and audit. We identify the planning phase as a critical attack surface: a single injection into the Planner’s context achieves cascade amplification, corrupting all downstream sub-tasks simultaneously.

多智能体大模型（LLM）系统日益依赖“规划器”（Planner）将目标分解为子任务序列，并由下游的“执行器”（Executor）和“评估器”（Critic）智能体进行执行与审计。我们发现规划阶段是一个关键的攻击面：只需对规划器的上下文进行一次注入，即可实现级联放大，从而同时破坏所有下游子任务。

We introduce PlanFlip, a framework comprising four planning-phase prompt injection attacks — GoalSubstitution (PF-1), PriorityInversion (PF-2), ContextPollution (PF-3), and RoleConfusion (PF-4) — each disguised as plausible tool outputs to evade keyword filters.

我们引入了 PlanFlip 框架，该框架包含四种规划阶段提示注入攻击——目标替换（PF-1）、优先级反转（PF-2）、上下文污染（PF-3）和角色混淆（PF-4），每种攻击都伪装成看似合理的工具输出，以规避关键词过滤。

Evaluating nine frontier LLMs across 3,479 episodes, we uncover three findings: (1) capability amplifies vulnerability — GPT-5 achieves the highest attack success rate (ASR = 0.68), contradicting the assumption that stronger models are inherently more secure; (2) homogeneous pipelines exhibit a correlated-agent blind spot — GPT-4o and Llama-3.3-70B show ASR near 0 yet Stealth = 1.00 and StepShift > 0, with attacks restructuring plans while the same-backbone Critic reports alignment (two independent judges confirm -0.20 to -0.32 semantic deviation, r = 0.943); (3) reasoning-augmented models resist injections — DeepSeek-R1 achieves StepShift = 0.00 across all attacks.

通过对 9 款前沿大模型在 3,479 个实验场景中的评估，我们发现了三个结论：（1）能力越强，漏洞越大——GPT-5 的攻击成功率（ASR）最高（0.68），这反驳了“更强的模型天生更安全”的假设；（2）同构流水线存在“关联智能体盲点”——GPT-4o 和 Llama-3.3-70B 的 ASR 接近 0，但隐蔽性（Stealth）达到 1.00 且步长偏移（StepShift）大于 0，即攻击成功重构了计划，而同主干的评估器却报告其一致（两名独立评审员确认存在 -0.20 至 -0.32 的语义偏差，r = 0.943）；（3）推理增强型模型能够抵御注入——DeepSeek-R1 在所有攻击中均实现了 0.00 的步长偏移。

We propose GoalAnchorCheck (D1) and CrossAgentConsensus (D2), achieving detection rates up to 1.00 and outperforming same-backbone baselines in 15 of 16 cells. Our key insight: heterogeneous model diversity is a security prerequisite for multi-agent systems; redundancy within a homogeneous backbone provides no protection against planning-phase attacks.

我们提出了“目标锚点检查”（GoalAnchorCheck, D1）和“跨智能体共识”（CrossAgentConsensus, D2），其检测率高达 1.00，并在 16 个测试单元中的 15 个优于同主干基准模型。我们的核心见解是：异构模型多样性是多智能体系统的安全前提；在同构主干内部的冗余无法提供针对规划阶段攻击的保护。