New PlanFlip Attacks Target Multi-Agent LLM Planning Phases

Multi-agent LLM systems, which typically involve a Planner, Executor, and Critic, are increasingly common. New research identifies the planning phase as a critical vulnerability, where a single prompt injection can cascade and corrupt all subsequent sub-tasks. This attack framework, named PlanFlip, includes four distinct methods: GoalSubstitution, PriorityInversion, ContextPollution, and RoleConfusion, all designed to appear as legitimate tool outputs to bypass filters. An evaluation across nine frontier LLMs and thousands of episodes yielded surprising results. Contrary to intuition, more capable models like GPT-5 showed higher attack success rates, challenging the assumption that stronger models are inherently more secure. Furthermore, systems built with homogeneous LLM backbones (e.g., all GPT-4o) exhibited a "correlated-agent blind spot," where the Critic agent, sharing the same backbone, failed to detect significant semantic deviations introduced by the attack. The study also found that reasoning-augmented models, such as DeepSeek-R1, demonstrated greater resistance to these injections. To counter these threats, the researchers propose two defenses: GoalAnchorCheck and CrossAgentConsensus, which achieved high detection rates. A key takeaway is the importance of heterogeneous model diversity for security in multi-agent systems, as redundancy within a single model family offers little protection against planning-phase attacks.