Safe AI models fail when combined: ChannelGuard exposes hidden multi-agent vulnerabilities

Multi-agent LLM systems chain multiple models together—planner, worker agents, verifier, synthesizer—but every hop between agents creates an unmonitored channel where adversaries can smuggle instructions. Existing defenses like Llama Guard or SmoothLLM only guard the input boundary, and provider-side filters operate opaquely outside the application. The researchers’ evaluation across 2,100 traces, eight attack families, and five defenses reveals a critical gap: an undefended pipeline that appears fully safe under standard reporting (attack success 0.000 on tool-poisoning) actually owes 54 of 60 blocks to Azure’s server-side filter, not the agent model’s alignment. This dependence shifts silently when switching to a backend without such a filter, e.g., Anthropic Sonnet 4.5.

ChannelGuard addresses this with a training-free, defense-in-depth framework that places information-bottleneck gates on every inter-agent channel. Each gate scores channel text against an adversarial phrase bank using embedding similarity, then deterministically passes, compresses, or blocks it—adding no LLM call. The tool-output gate blocks all 30 tool-poisoning attacks identically across Azure GPT-5, Anthropic Sonnet 4.5, and Haiku 4.5, whereas undefended pipelines shift completely across backends. It halves prompt injection success (0.333 to 0.167) and preserves GSM8K accuracy exactly (0.867). However, white-box adaptive paraphrases evade the embedding gates, where a perturb-and-vote baseline performs better. The total experiment cost was just $47.36, including baselines and ablations.