PlanFlip: Attacking Multi-Agent LLM Systems via Planning-Phase Prompt Injection
Quick Answer
PlanFlip introduces four prompt injection attacks targeting the planning phase of multi-agent LLM systems, revealing that GPT-5 has the highest attack success rate (ASR = 0.68).
Quick Take
The study shows that homogeneous model pipelines are vulnerable, while reasoning-augmented models like DeepSeek-R1 resist these injections. Key recommendations include enhancing model diversity to improve security against planning-phase attacks.
Key Points
- PlanFlip framework includes GoalSubstitution, PriorityInversion, ContextPollution, and RoleConfusion attacks.
- GPT-4o and Llama-3.3-70B show ASR near 0 but maintain high stealth.
- DeepSeek-R1 achieves StepShift = 0.00, indicating resistance to all attacks.
- Heterogeneous model diversity is crucial for security in .
- GoalAnchorCheck and CrossAgentConsensus detect attacks with rates up to 1.00.
DeepSignal Analysis
What happened
The study introduces PlanFlip, which identifies the planning phase of multi-agent LLM systems as a critical vulnerability. It presents four prompt injection attacks that exploit this phase, with GPT-5 showing the highest attack success rate at 0.68. The research highlights the weaknesses of homogeneous model pipelines and the resilience of reasoning-augmented models.
Key evidence
- PlanFlip introduces four prompt injection attacks targeting the planning phase of multi-agent LLM systems.
- GPT-5 achieves the highest attack success rate (ASR = 0.68), challenging the notion that stronger models are more secure.
- DeepSeek-R1, a reasoning-augmented model, shows resistance to all attacks, achieving StepShift = 0.00.
Why it matters
This research underscores the importance of model diversity in enhancing security against planning-phase attacks in multi-agent systems. The findings suggest that relying on homogeneous models may create blind spots, making systems more susceptible to vulnerabilities. As AI systems become more complex, understanding these weaknesses is crucial for developing robust security measures.
What to watch
Paper Resources
Source Excerpt
systems increasingly rely on a Planner to decompose goals into sub-task sequences that downstream Executor and Critic agents execute and audit. We identify the planning phase as a critical attack surface: a single injection into the Planner's context achieves cascade amplification, corrupting all downstream sub-tasks simultaneously. We introduce PlanFlip, a framework comprising four planning-phase prompt injection attacks -- GoalSubstitution (PF-1), PriorityInversion (PF-2), Cont
Want this in your inbox every morning?
Daily brief at your local 8am — bilingual EN/中文, free.
More from arXiv cs.AI
See more →RAIL Guard: Closing the Evaluation-to-Remediation Gap in Responsible AI for Agents
RAIL Guard introduces a closed-loop AI pipeline for large language models (LLMs) that evaluates outputs across eight dimensions and iteratively remediates failures, achieving 96.9% convergence compared to 49.1% for traditional block-and-retry methods. The system reduces unsafe agent executions by 33% without impacting task completion and is available as open-source SDKs.