Cross-layer contagion of prompt injections in multi-agent swarms: a multiplex microscopic markov chain approach

Engineering notes

Key topics: autonomous driving, large language model, control. See the paper for implementation details and experimental results.

Chinese explanation / 中文解读

中文解读待补充：本站会优先为端到端自动驾驶、BEV感知、3D目标检测、轨迹预测、路径规划、LiDAR感知等高价值论文补充中文说明。

Original abstract

Abstract Large Language Models (LLMs) are increasingly deployed as interconnected agentic swarms that leverage the Model Context Protocol (MCP) to invoke shared external tools, APIs, and databases. In these settings, conventional security strategies based on agent-to-agent airgapping can be insufficient because agents that never directly communicate may still cross-infect one another through shared infrastructure tools, producing a “Confused Deputy” cascade. This paper develops a formal mathematical framework for modeling this cross-layer contagion in MCP-enabled multi-agent swarms. We construct a coupled multiplex Microscopic Markov Chain Approach (MMCA) that simultaneously tracks the node-level probability flow across two layers: an Agent cognitive layer (governed by Susceptible–Exposed–Infected–Quarantined (SEIQ) dynamics) and a Tool infrastructure layer (governed by Susceptible–Infected–Susceptible (SIS) dynamics). Our contributions are threefold: (i) we formulate a coupled multiplex MMCA with asymmetric SEIQ–SIS dynamics across agent and tool layers; (ii) we derive an analytical characterization of systemic risk, including an epidemic-threshold approximation via Next-Generation Matrix analysis and a closed-form budget-allocation rule under an exponential defense-efficiency model; and (iii) across eight experiment groups on synthetic and empirical agent-layer topologies, we show that shared-tool coupling consistently amplifies contagion and that tool-side controls can dominate agent-side hardening under the modeled regime. For cybersecurity practice, the framework identifies when shared tool infrastructure can transform localized prompt-injection events into system-level risk even under direct agent-to-agent isolation.

Links and sources

• PDF from original source

Comments