This paper attacks an LLM-based multi-agent robot system with prompt injection, both directly through task instructions and indirectly through perception modules. Injections cause adversarial actions and lower task completion, and they can spread from one agent to others through shared prompt structure, with the damage depending on prompt composition and which agent is hit. The authors describe it as the first systematic study of prompt injection in a multi-agent LLM robot system.
Relevance
Cross-agent contamination is the LLM version of a faulty node spreading bad state through a team. It links robot security to Byzantine fault tolerance in robust robotics: which agent should the team trust once one of them has read a poisoned input?
Links
- arXiv
- Subfield: Security, Multi-robot systems, Robot learning