PaperlayerView exact revision on arXiv

Source-linked AI summary

CORBA: Contagious Recursive Blocking Attacks on Multi-Agent Systems Based on Large Language Models

Zhenhong Zhou, Zherui Li, Jie Zhang, Yuanhe Zhang, Kun Wang, Yang Liu, Qing Guo

arXiv:2502.14529v1cs.CLcs.AI

TL;DR

LLM-MAS security remains a concern, and blocking attacks have been comparatively overlooked despite their potential to reduce availability and waste computational resources. CORBA propagates a recursive blocking prompt through agent networks; evaluations report effects across varied topologies and open-ended systems, including performance beyond broadcast-based attacks.

  • Problem

    Blocking attacks have received less attention than other attacks on LLM-MASs, although they can reduce system availability and consume computational resources.

    Source: §1 · p. 1

  • Method

    CORBA uses contagious propagation from an entry agent and infinite recursion to keep a malicious prompt effective across reachable agents.

    Source: §1 · p. 1, §3.3 · p. 3

  • Results

    CORBA reduces availability and wastes computational resources across varied topologies, outperforms broadcast-based attacks, and shows similar spread in open-ended LLM-MASs.

    Source: §1 · pp. 1–2

  • Takeaways & Limitations

    The findings identify vulnerabilities in existing LLM-MAS frameworks and open-ended simulations and provide a foundation for future defense research.

    Source: §1 · p. 2, §5 · p. 4

    The study focuses on exposing blocking vulnerabilities rather than developing mitigation strategies.

    Source: Limitations · p. 5

Abstract

from arXiv · show

Large Language Model-based Multi-Agent Systems (LLM-MASs) have demonstrated remarkable real-world capabilities, effectively collaborating to complete complex tasks. While these systems are designed with safety mechanisms, such as rejecting harmful instructions through alignment, their security remains largely unexplored. This gap leaves LLM-MASs vulnerable to targeted disruptions. In this paper, we introduce Contagious Recursive Blocking Attacks (Corba), a novel and simple yet highly effective attack that disrupts interactions between agents within an LLM-MAS. Corba leverages two key properties: its contagious nature allows it to propagate across arbitrary network topologies, while its recursive property enables sustained depletion of computational resources. Notably, these blocking attacks often involve seemingly benign instructions, making them particularly challenging to mitigate using conventional alignment methods. We evaluate Corba on two widely-used LLM-MASs, namely, AutoGen and Camel across various topologies and commercial models. Additionally, we conduct more extensive experiments in open-ended interactive LLM-MASs, demonstrating the effectiveness of Corba in complex topology structures and open-source models. Our code is available at: https://github.com/zhrli324/Corba.

1 Introduction

LLM-based multi-agent systems can collaborate on complex tasks and simulate human society, but their robustness and security remain concerns. CORBA targets overlooked blocking attacks by spreading recursively through agent networks; evaluations report reduced availability and wasted computation across varied topologies and open-ended systems.

1 Introduction

  • Prior work examined misinformation and jailbreak attacks (Ju et al., 2024; Gu et al., 2024), while blocking attacks received less attention despite their resource and availability costs (Gao et al., 2024; Dong et al., 2025).The authors connect the added risk to LLM-MASs’ high computational demands and limited resilience to resource wastage (Zhang et al., 2024b).Source: §1 · p. 1
  • CORBA combines contagious propagation from an entry agent to reachable agents with infinite recursion that keeps the malicious prompt effective despite divergence.The paper contrasts this mechanism with broadcast-based attacks (Zhang et al., 2024a).Source: §1 · p. 1
  • CORBA reduces LLM-MAS availability and wastes computational resources across varied topologies, outperforms broadcast-based attacks, and shows similar spread in open-ended systems.The authors also report that their method outperforms baseline approaches.Source: §1 · pp. 1–2
  • The authors identify security gaps in existing LLM-MASs and frame their experiments as a foundation for future robust defenses.Their evaluations include two open-source frameworks and open-ended LLM-MASs.Source: §1 · pp. 1–2

2 Related Works & Preliminary

The section reviews LLM-based agents and multi-agent systems, then introduces a graph representation for agent communication and notation for the attacker and affected agent.

2 Related Works & Preliminary

  • Collaboration extends multi-agent systems’ capabilities, enabling more complex tasks; some autonomous LLM-MASs can simulate human society, facilitating exploration of AI-human interactions (Chen et al., 2023; Baek et al., 2024; Hua et al., 2023; Park et al., 2024).White-box blocking attacks typically rely on training modifications or gradient information; optimization-based black-box approaches have also been proposed (Gao et al., 2024; Dong et al., 2025; Zhang et al., 2024b).Source: §2 · p. 2
  • The preliminary model represents an n-agent system S with LLM L and topology T; each graph edge denotes agents allowed to exchange information or pass instructions.The edge relation is described in p20.Source: §2 · p. 2
  • The attacker M uses malicious prompt Pm, and ab denotes the agent affected by the attack.The notation follows the description of an agent executing an instruction and generating a response.Source: §2 · p. 2

3 Method

The method defines blocking at the agent level, then extends it to contagious propagation and combines both behaviors in CORBA. CORBA maintains blocked states while spreading to neighboring agents, so every reachable agent becomes blocked after a finite number of steps.

3.1 Blocking Attacks B in LLM-MASs

  • In multi-agent systems, blocking attacks disrupt information exchange and instruction passing, reducing availability as well as consuming computational resources.Source: §3.1 · p. 2
  • A blocking attack keeps an agent consistently producing a blocking response from a malicious time onward, with recursive behavior maintaining that state at subsequent steps.The method describes the recursive attack as passing through a self-loop while the agent remains blocked.Source: §3.1 · p. 2

3.2 Contagious Attacks C in LLM-MASs

  • A contagious instruction attack extends blocking to a multi-agent system by indefinitely propagating a malicious prompt across agents and their neighboring nodes.A neighboring agent is any agent connected as a neighbor in the system topology.Source: §3.2 · p. 3

3.3 CORBA

  • CORBA maintains each agent’s blocking state while propagating the attack to neighboring agents, eventually blocking every reachable node in finite time.The method combines persistent blocking with contagious transmission across the system topology.Source: §3.3 · p. 3

4 Experiment

Experiments assess CORBA in AutoGen and Camel, across agent configurations and topologies, and in open-ended systems. CORBA outperforms baselines across topologies and reaches nearly 100% P-ASR within 20 turns in open-ended systems.

4.1 Experiment Setups

  • AutoGen and Camel support flexible LLM-MAS topologies; experiments use GPT-4o-mini, GPT-4, GPT-3.5-turbo, and Gemini-2.0-Flash, with additional open-ended tests on Qwen2.5-14B, Llama3.1-70B, and Gemma-2-27B.The open-ended system allows a broader range of LLMs to be evaluated.Source: §4.1 · p. 3
  • P-ASR measures the proportion of blocked agents, while PTN counts turns until the attack stabilizes at maximum P-ASR; lower PTN indicates faster impact.PTN = 1 can indicate either an ineffective attack or a topology with too few nodes.Source: §4.1 · p. 3

4.2 Experimental Results

  • CORBA outperforms baselines across non-trivial topologies and LLMs.The results report this pattern across topologies and models, while the table caption identifies the full comparison scope.Source: Table 3 · p. 4, §4.2 · p. 4

4.1 Experiment Setups

  • Each configuration was tested in 10 trials with a random attack entry agent, against a prompt-injection baseline that asks agents to repeat actions and induce looping in others.The baseline prompt directs an agent to repeat its last action 100 times and ask other agents to do likewise.Source: §4.1 · pp. 3–4, §4.2 · p. 4

4.2 Experimental Results

  • Nearly 100% P-ASR within 20 turns in open-ended systems, where CORBA outperforms baselines.The six-agent free-dialogue figure evaluates P-ASR at specific turns and reports that most agents are compromised within a few turns.Source: Figure 1 · p. 4, §4.2 · p. 4

5 Conclusion

The conclusion presents CORBA as an attack that blocks LLM-MASs and degrades their availability. Experiments demonstrate vulnerabilities in open-source frameworks and open-ended simulations, motivating stronger security measures.

5 Conclusion

  • CORBA is a malicious attack paradigm designed to block LLM-MASs and degrade their availability.The conclusion describes the attack as a contribution of the paper.Source: §5 · p. 4
  • Extensive experiments demonstrate vulnerability in existing open-source frameworks and open-ended simulations.The conclusion frames these experiments as evidence of LLM-MAS vulnerability.Source: §5 · p. 4
  • The findings highlight the need for stronger security measures and future work on more resilient and reliable LLM-MASs.Source: §5 · p. 5

Limitations

The study exposes blocking-attack vulnerabilities but does not develop mitigations; investigating effective defenses is future work.

Limitations

  • The study focuses on exposing vulnerabilities rather than mitigation, leaving effective defenses for future work.The authors say they will further investigate mechanisms to prevent blocking attacks in LLM-MASs.Source: Limitations · p. 5

A To what extent can existing defense methods resist LLM-MAS blocking attack?

Existing LLM defenses are not very effective against blocking attacks, which are feasible only in LLM-MAS scenarios. Direct LLM checks, agent monitoring, and perplexity-based detection each leave weaknesses.

A To what extent can existing defense methods resist LLM-MAS blocking attack?

B How CORBA Works

CORBA starts at an injected entry agent, recursively propagates to neighboring agents, and can block all reachable nodes, reducing availability and consuming resources.

B How CORBA Works

  • After injection, the entry agent recursively propagates CORBA to neighbors until all reachable agents are blocked, reducing availability and consuming resources.Figure 6 illustrates the progression from normal operation through entry-agent infection to system-wide suspension.Source: B How CORBA Works · p. 8
Loading 2502.14529v1…