Source-linked AI summary
MIRROR: Multipath Quorum Integrity for LLM Multi-Agent Communication
Ryuichi Yamafuji Lun, Jingzhen Wang, Shreyas Kolte, Ruiteng Li
TL;DR
Inter-agent communication is vulnerable to messages manipulated in transit, including through gateways that legitimately terminate TLS. MIRROR uses quorum agreement across routes for message integrity; the paper reports 100% ASR on code-generation tasks in an undefended AutoGen chain and frames its security threshold around route compromise and correlation.
Problem
AiTM attacks can manipulate inter-agent messages in transit, while TLS does not protect plaintext at third-party gateways that terminate it.
Source: §1 · pp. 1–2Method
MIRROR replicates opaque messages over logical routes and accepts a payload only when its digest has a strict majority.
Source: §3.1 · p. 3Results
100% ASR on code-generation tasks was reported in an undefended AutoGen chain, and the stated security threshold under correlated routes is governed by the largest shared-failure group.
Source: §1 · p. 2Takeaways & Limitations
The largest shared-failure group, rather than route count alone, governs the route-correlation threshold, and measuring real-world route independence remains an open problem.
Source: §1 · p. 2, §7 · p. 8MIRROR assumes honest endpoints, and the authors do not evaluate adaptive adversaries targeting canonicalization logic.
Source: §5 · p. 8
Abstract
from arXiv · showhide
Inter-agent communication is central to Large Language Model Multi-Agent Systems (LLM-MAS), but it introduces an underexplored vulnerability: Agent-in-the-Middle (AiTM) attacks that manipulate messages in transit without compromising the agents themselves. Prior work reports Attack Success Rates (ASR) approaching 100% on structured tasks. Existing defenses rely on semantic validation, which requires additional inference and can block benign outputs, or on transport-layer encryption, which does not help when an intermediary legitimately terminates TLS. We present MIRROR, a communication-layer integrity primitive that replicates a single canonicalized payload across k logical routes and accepts a message only when a strict majority of routes report the same digest. MIRROR uses unkeyed hashing and so authenticates nothing on its own, since an active on-path adversary can always recompute a digest over a payload it has modified. All integrity derives from the assumption that honest routes form a majority. The digest serves only to make witness routes constant-size and to bind the recovered payload to the quorum-agreed value under second-preimage resistance. We give the guarantee under a route-compromise bound alpha < 0.5, and extend it to correlated routes, where the quantity that matters is the size of the largest shared-failure group and not the route count. We further show that availability and integrity degrade at the same threshold: below alpha = 0.5, quorum-denial and message-dropping adversaries cannot block honest traffic. Across MMLU, HumanEval, and MBPP on two frameworks and four communication topologies, and in a MetaGPT deployment against a production API, MIRROR reduces ASR to 0% below the threshold at 1x LLM token cost. LLM-as-a-Judge costs 35x in the same deployment, and blocks up to 44.2% of benign outputs in the topology sweep.
1 Introduction
Inter-agent communication faces in-transit AiTM manipulation, while TLS does not protect plaintext from intermediaries that legitimately terminate it. MIRROR adapts multipath quorum integrity to this setting and scopes its guarantees to route assumptions, with correlated failures and availability addressed explicitly.
1 Introduction
- 100% ASR on code-generation tasks was reported in an undefended AutoGen chain.This motivates protection against in-transit message manipulation.Source: §1 · pp. 1–2
- MIRROR targets intermediaries that terminate TLS, unlike network eavesdroppers, without requiring a PKI.End-to-end signatures would address the gap but require key provisioning, storage, and rotation inside agent frameworks.Source: §1 · p. 2
- MIRROR is scoped to single-shot message paths through untrusted intermediaries, not node-level Byzantine consensus or compromised agents.The paper claims no algorithmic novelty over quorum-based integrity; its contribution is adaptation, scoping, evaluation, and route-independence analysis.Source: §1 · p. 2
- The correlated-route security threshold depends on the largest shared-failure group, yielding a concrete deployment rule.This is presented as a guarantee under correlated routes (Proposition 1).Source: §1 · p. 2
- Below the compromise threshold, quorum-denial and message-dropping adversaries cannot block honest traffic.The paper states this availability result in Corollary 1.Source: §1 · p. 2
- Empirical validation covers AutoGen and CAMEL across four communication topologies, plus MetaGPT against a production API.The introduction identifies this as the evaluation scope.Source: §1 · p. 2
2 System and threat model
MIRROR treats inter-agent messages as opaque payloads sent over application-level logical routes. Its threat model allows an intermediary to control, modify, or drop traffic on compromised routes, but assumes honest endpoints and fewer than half the routes compromised.
2 System and threat model
- Messages are opaque payloads that MIRROR does not interpret.Agents exchange natural-language messages, but the mechanism operates on the payload as an uninterpreted object.Source: §2 · p. 2
- A logical route is an application-level delivery channel, such as a distinct API gateway, broker, network path, or region.Sending over k routes means transmitting the message over k separately addressed channels.Source: §2 · p. 2
- On controlled routes, an AiTM adversary may read, modify, drop, delay, or replay traffic and recompute unkeyed digests.It cannot read or modify uncontrolled routes or break second-preimage resistance.Source: §2 · p. 2
- MIRROR assumes honest sending and receiving agents and offers no protection when either endpoint is compromised.It is orthogonal to, and composes with, agent-level defenses against prompt injection.Source: §2 · p. 2
- The basic compromise bound is α = c/k < 0.5, with a weaker condition for routes sharing infrastructure.The paper separately illustrates traditional sender compromise, in-transit AiTM, and MIRROR’s quorum response.Source: §2 · p. 3, Figure 1 · p. 3
- Including a monotonic sequence number and timestamp in canonicalized bytes extends the quorum logic to freshness.Replayed messages then fail to match the current-round quorum.Source: §2 · p. 3
3 MIRROR: multipath quorum integrity
MIRROR replicates one canonicalized message across logical routes and accepts it only when a strict majority agrees on its digest. Its guarantees depend on honest routes forming a majority, with correlated failures and availability bounded by the same threshold.
3.1 Mechanism
- For odd k = 2t + 1, MIRROR sends t + 1 full-payload copies and t digest-only witnesses, then accepts only a digest reported by more than k/2 routes.A route that misses the bounded timeout reports no digest, and the threshold remains based on k rather than the replies received; the LLM is queried once per message.Source: §3.1 · p. 3
3.2 What the digest does and does not provide
- The unkeyed digest authenticates nothing by itself; quorum agreement supplies integrity, while hashing compresses witnesses and binds recovered payloads under second-preimage resistance.Witnesses carry a fixed 32-byte digest, and matching the honest majority’s target digest with a different payload requires a second preimage.Source: §3.2 · pp. 3–4
3.3 Guarantee
- With c < k/2 compromised routes, MIRROR prevents acceptance of tampered payloads except with negligible probability and recovers the honest message without another LLM query.The guarantee assumes identical canonicalized bytes on honest routes, second-preimage resistance, and honest endpoints; at c ≥ k/2, neither property holds.Source: §3.3 · p. 4
3.4 Correlated routes
- For correlated routes, the guarantee holds only when compromised shared-failure groups control fewer than k/2 routes; a single group must be smaller than half.No single provider, region, or administrative domain may carry a majority of routes; the evaluation does not test this assumption because its routes share a backend.Source: §3.4 · pp. 4–5
3.6 Relationship to classical BFT
- MIRROR protects message transit between honest endpoints, not agreement among mutually distrustful replicas, unlike classical BFT.The weaker threshold reflects its narrower problem: tampering intermediaries rather than equivocating endpoints.Source: Table 1 · p. 5, §3.6 · p. 5
3.5 Availability
- Below the threshold, integrity and availability hold together; independent failures count with compromised routes, so the effective budget is ceff = c + f.Dropping or delaying adversarial routes cannot prevent quorum when ceff < k/2.Source: §3.5 · p. 5
4 Experimental evaluation
The evaluation tests MIRROR across three frameworks, three benchmarks, and multiple communication topologies, then examines threshold behavior and deployment-oriented cost. It reports 0% ASR below α = 0.5, across the framework and topology sweep, and in the MetaGPT API setting, with baseline token use.
4.1 Setup
- Experiments use AutoGen, CAMEL, and MetaGPT on MMLU, HumanEval, and MBPP; deterministic decoding and fixed route seeds isolate communication-layer manipulation.The evaluation reports exhaustive single-pass results over 164 HumanEval tasks, 427 MBPP test tasks, and 707 MMLU STEM examples.Source: §4.1 · pp. 5–6
- Because each run uses a static adversary, the evaluation does not test rotation against the adaptive adversary it targets and claims no benefit from rotation.Below the threshold, correct recovery is attributed to quorum verification alone.Source: §4.1 · pp. 5–6
- The AiTM reimplementation applies a +4-position MMLU label shift or injects a malicious safety_check() function, and baseline ASR magnitudes are treated as indicative.The attack is adapted from a published description.Source: §4.1 · p. 6
4.2 Behavior across the threshold (RQ1)
- For α < 0.5, MIRROR achieves 0% ASR; at α ≥ 0.5, ASR rises sharply to 100%, matching the predicted threshold behavior.The authors frame this as an implementation check, not an independent discovery.Source: §4.2 · p. 6, Figure 2 · p. 6
4.3 Frameworks and topologies (RQ2)
- LLM-as-a-Judge has false-positive rates up to 44.2%, so its near-zero ASR partly reflects conservative over-blocking rather than faithful recovery.The topology table reports substantial false positives alongside reduced ASR.Source: §4.3 · p. 6, Table 2 · p. 7
- MIRROR records 0.0% ASR in every configuration across datasets, frameworks, and topologies; without protection, AutoGen reaches 100% on both code-generation benchmarks in every topology, while CAMEL MMLU ranges 1.4–89.8%.Source: §4.3 · pp. 6–7, Table 2 · p. 7
4.4 Deployment-oriented evaluation (RQ3)
- In the MetaGPT production-API evaluation, MIRROR reaches 0% ASR on both datasets at 1× baseline tokens, versus 35× for LLM-as-a-Judge.The routes remain logically instantiated, so the evaluation is deployment-oriented rather than in-the-wild.Source: Figure 3 · p. 7, §4.4 · p. 7
5 Limitations
MIRROR’s limitations center on route independence and the risks of route rotation, alongside implementation and scope boundaries. The authors also note a dual-use concern.
5 Limitations
- Route rotation helps only when replacement routes lie outside the compromised group, assuming independent routes are available on demand.That persistent-adversary setting has not, to the authors’ knowledge, been demonstrated against LLM-MAS; transient failures can also cause healthy routes to be retired and erode the pool.Source: §5 · pp. 7–8
- Delaying an honest route until timeout can cause its retirement and cross α = 0.5 without compromising additional routes.The authors do not evaluate either the timeout rule or a stricter rule requiring agreement on a non-majority digest against an adaptive adversary.Source: §5 · p. 8
- Route independence remains unverified: the evaluation uses g = 1 and does not establish whether nominally distinct providers fail independently.The authors identify measuring real-deployment route independence as an open question.Source: §5 · p. 8
- MIRROR requires careful byte-level canonicalization, assumes honest endpoints, and does not protect against compromised agents or prompt injection.The study also omits comparisons with broker-enforced verification, witness logs, and end-to-end signatures, does not evaluate adaptive attacks on canonicalization, and does not measure wall-clock latency or benign quorum failure rates.Source: §5 · p. 8
- The same integrity mechanism could also harden malicious systems against inspection or intervention.The authors describe this as a dual-use property shared by integrity mechanisms generally.Source: §5 · p. 8
6 Related work
Prior LLM-MAS defenses emphasize endpoint security and semantic validation, while transport protections do not cover intermediaries that terminate TLS. MIRROR differs from signatures and established quorum mechanisms in its trust and key-management trade-offs.
6 Related work
- Existing LLM-MAS frameworks largely assume trustworthy communication, while semantic defenses require extra inference and do not protect against AiTM attacks.The passage cites AutoGen [16], CAMEL [11], MetaGPT [9], red teaming [13], debate and LLM-as-a-judge [18], and AiTM.Source: §6 · p. 8
- End-to-end signatures detect tampering on one route without a majority, but require PKI provisioning, storage, and key rotation.MIRROR offers weaker guarantees without key management or a trusted third party; where PKI is available, the authors prefer signatures.Source: §6 · p. 8
- Quorum-based digest integrity is established, and the authors claim no novelty in that mechanism.They distinguish MIRROR from semantic BFT adaptations [19] and relate its path-diversity intuition to Moving Target Defense.Source: §6 · p. 8
7 Conclusion
MIRROR applies multipath quorum integrity to opaque LLM-MAS payloads without inference overhead. Its security depends on honest-majority routing, making route correlation the key deployment concern.
7 Conclusion
- MIRROR protects opaque LLM-MAS payloads without inference overhead, but its unkeyed digest provides no authentication and security rests on honest-majority routing.Route correlation, rather than route count, governs the threshold; measuring whether real deployments provide independent routes remains an open problem.Source: §7 · p. 8
A Proof of Theorem 1
The proof establishes integrity when fewer than half the routes are adversarial, then shows recovery from an honest full-payload route. At or above the threshold, an adversary can make a tampered message the majority.
A Proof of Theorem 1
- When c < k/2, more than half the routes are honest and deterministically report H(m), making it the unique majority digest.The route sets contain c adversarial routes and k − c honest routes.Source: A Proof of Theorem 1 · p. 11
- A tampered message cannot be accepted through a majority digest; matching the honest majority’s digest instead requires a second preimage.That second-preimage event has negligible probability under the stated hash assumption.Source: A Proof of Theorem 1 · p. 11
- Recovery succeeds because at least one of the t + 1 full-payload routes is honest, allowing the receiver to select a payload matching H∗ without re-querying.The proof uses c ≤ t and H∗ = H(m).Source: A Proof of Theorem 1 · p. 11
- When c ≥ k/2, the adversary can supply ⌈k/2⌉ identical tampered payload-digest pairs and make the altered message the majority.Source: A Proof of Theorem 1 · p. 11
B Adversarial generation protocol
The protocol reimplements the published AiTM attack and uses structural mimicry and administrative roleplay to make malicious payloads compatible with downstream processing. Deterministic decoding and fixed-seed route selection keep compromised-route payloads consistent across runs.
B Adversarial generation protocol
- The attack is reimplemented from its published description because the original AiTM codebase is unavailable.The reimplementation preserves the reflection-based adversarial agent, task-specific malicious objectives, threat model, and prompt optimization strategy.Source: B Adversarial generation protocol · p. 11
- Structural mimicry preserves intercepted message formats, while administrative roleplay frames malicious instructions as authoritative system directives.These techniques target downstream compatibility and safety-alignment bypass, respectively.Source: B Adversarial generation protocol · p. 11
- Deterministic decoding makes the substituted payload identical across compromised routes, preventing the adversary from splitting its own quorum.The attack produces a task-structure-preserving message with an embedded malicious objective.Source: B Adversarial generation protocol · p. 11
C Determinism, seeds, and route instantiation
- For α < 1.0, compromised routes are selected uniformly at random under fixed seeds so baseline and defended runs share route structure.Open-weight evaluations used NVIDIA A100 80GB instances; logical routes were simulated as parallel isolated API requests with deep-copied objects.Source: C Determinism, seeds, and route… · pp. 11–12
D Undefended baseline
Without communication-layer defenses, AiTM attack success approaches 100% on code-generation tasks across the evaluated datasets and topologies in AutoGen.
D Undefended baseline
- Approaching 100% ASR on code-generation tasks is reported for undefended AutoGen under the worst-case adversary (α = 1).The figure covers datasets and topologies with k = 1, using Gemma-4-31B-it.Source: Figure 4 · p. 12
E Per-topology results
Across individual communication topologies, baseline ASR varies with structure, while MIRROR reports 0.0% in every configuration.
E Per-topology results
- 0.0% ASR is reported for MIRROR in every individual-topology configuration.The table caption says baseline ASR varies substantially with topology structure.Source: Table 3 · p. 12