Researchers reveal collective evidence-threshold backdoors that hijack multi-agent systems

Multi-agent systems (MAS) amplify LLM capabilities through iterative communication and shared context, but that very collaboration creates a new attack surface. In a paper titled "When Collaboration Becomes a Trigger," Jia-Hao Xiao, Lei Feng, and Min-Ling Zhang introduce a collective evidence-threshold backdoor paradigm. Unlike traditional attacks triggered by a single message or token, this backdoor activates only when peer agents collectively accumulate a hidden amount of evidence across multiple exchanges. The authors propose Boundary-Conditioned Backdoor Injection (BCBI), which builds counterfactual boundary pairs that separate benign behavior before the threshold from a malicious objective after it. The method learns a latent progression that aligns with evidence accumulation, allowing the attack to remain dormant until the precise moment collaboration reaches the trigger point. Across several benchmarks, BCBI achieves selective activation with minimal premature activation, making it stealthy and dangerous.

To counter this threat, the team developed LAtent Transition Test-time Evaluation (LATTE), a clean-only defense that models normal communication dynamics and quarantines anomalous agent updates before they can propagate to other agents. LATTE requires no knowledge of the attack target or trigger, and it limits attack propagation with minimal disruption to legitimate workflows. The paper, spanning 26 pages with 11 figures, highlights that defending multi-agent systems requires understanding the latent transitions between agents, not just inspecting individual messages. As autonomous agent swarms move into enterprise workflows—from coding assistants to supply chain coordination—this work is a timely warning: security models must evolve to handle threats that emerge from interaction, not just from single points of failure.