Research / Manuscript
Trust Propagation and Structural Containment in Multi-Agent LLM Pipelines
Abstract
This manuscript studies security risks created when multi-agent LLM systems delegate work across agents with different privilege levels. Framed through trust propagation and the confused deputy problem, it evaluates shared-memory poisoning and indirect prompt injection against a four-agent pipeline — Supervisor, Researcher, Validator, and Executor — using a task-bound authorization mechanism and an independently verified policy oracle. The central distinction explored is that model judgment is not the same as authorization: a Validator agent can be compromised while a structural authorization boundary at the Executor still prevents an unauthorized action.
Research Question
Can a compromised low-privilege agent influence a higher-privilege agent and ultimately cause an unauthorized action?
Motivation
As agentic LLM pipelines are given real-world authority — approving transactions, executing code, taking actions on a user's behalf — the question of whether a compromised intermediate agent can propagate its compromise into an unauthorized action becomes a practical security concern, not just a theoretical one.
System / Architecture
Supervisor
NoneDeterministic routing. No LLM call.
Researcher
LowRead-only. Retrieves and summarizes information.
Validator
MediumApproval gate. Produces approval or rejection.
Executor
HighPerforms real actions, protected by a structural authorization boundary.
Threat Model
The Executor is protected by a structural authorization boundary rather than trusting the Validator's language-model judgment alone. Attacks are evaluated under progressively stronger attacker capabilities, up to and including an attacker who possesses the signing secret used for authorization tokens.
Methodology
The study evaluates shared-memory poisoning and indirect prompt injection against a four-agent pipeline under progressively stronger attacker capabilities, including an attacker possessing the signing secret, to isolate which architectural component is actually responsible for containment.
Attacks
Attack Paths
Memory Poisoning
A compromised Validator can forge approval and attempt to produce an authorization token.
Agent Hijacking / Indirect Prompt Injection
A Researcher retrieves a malicious document containing a fabricated approval or authority claim, which can influence downstream validation.
Defenses
Task-Bound Signed Authorization Tokens
Authorization tokens are cryptographically bound to a specific task and scope, preventing forgery and reuse across tasks.
Single-Use Authorization
Each authorization token can be consumed exactly once, preventing replay of a previously valid approval.
Independent Policy Verification
A policy oracle, independent of the Validator's own judgment, verifies that a proposed action is actually authorized before execution.
Least-Privilege Policy
Each agent is restricted to the minimum privilege required for its role, limiting the blast radius of any single compromised agent.
Sandboxed Execution
The Executor runs proposed actions within a sandboxed environment, limiting the impact of any action that does slip through.
Key Findings
Model Judgment ≠ Authorization
Under the defended configuration, memory poisoning produced a 100% Judgment Bypass Rate but a 0% Unsafe Action Rate — the Validator's judgment was successfully bypassed by the attacker, yet the structural authorization boundary at the Executor still prevented any unauthorized action from executing.
100%
Judgment Bypass Rate (JBR)
0%
Unsafe Action Rate (UAR)
Containment Comes from the Policy Oracle, Not the Signature Alone
In an authorization ablation against an attacker possessing the signing secret, containment came from the independent policy oracle rather than the signature check alone. This does not mean signed tokens are unnecessary — the manuscript notes their value for preventing forgery, binding authorization to a task/scope, and preventing replay.
Observer Layer Improves Utility While Preserving the Security Boundary
Adding an Observer between the Researcher and Validator — which detects fabricated claims that another agent has already reviewed or approved a task, without itself making security decisions — substantially reduced false positives while the Unsafe Action Rate remained at 0%.
49.1% → 7.4%
False Positive Rate
50.9% → 92.6%
LTC
0.74 → 0.95
F1
0% (unchanged)
Unsafe Action Rate
Contribution
- Empirical study of compromise propagation through a complete multi-agent pipeline
- Component-level authorization ablation isolating which mechanism actually provides containment
- A clear distinction between agent-level compromise and successful unauthorized execution
- Introduction of Judgment Bypass Rate (JBR) to measure that distinction
- Evaluation of structural authorization under progressively stronger attacker models
Limitations
- The security primitives evaluated — signed tokens, policy enforcement, least privilege — are standard security concepts; the contribution is their empirical evaluation and analysis in a multi-agent LLM pipeline, not the primitives themselves.
- The Observer layer improves detection utility but is explicitly not presented as the primary security guarantee — that role belongs to the structural authorization boundary at the Executor.
Related Research
Interested in working together?
I am open to research discussions, collaborations, and opportunities related to AI security, LLM security, RAG, multi-agent systems, privacy, and trustworthy AI.