PaperlayerView exact revision on arXiv

Source-linked AI summary

Secure Agentic AI and Multimodal Intelligence in 6G Communication Systems

Satyam Gaba, Devanshu Motwani, Siva Sai, Vineet Suri, Vikas Ranjan, Vinay Chamola

arXiv:2610.30436v1cs.AIeess.SP

TL;DR

Emerging 6G applications require communication infrastructures to jointly process heterogeneous data, adapt to changing environments, and support real-time decisions under strict latency, reliability, and privacy constraints. The paper develops a communication-centric survey and threat-modeling synthesis spanning multimodal perception, memory, tools, orchestration, and 6G communication layers. The survey presents a 6G-oriented architecture, structured threat model, unified attack taxonomy, and cross-layer mitigation strategies for multimodal, memory-enabled, multi-agent orchestration.

  • Problem

    Emerging 6G applications require communication infrastructures to jointly process heterogeneous data, adapt to changing environments, and support real-time decisions under strict latency, reliability, and privacy constraints.

    Source: §I · p. 1

  • Method

    The paper develops a communication-centric survey and threat-modeling synthesis spanning multimodal perception, memory, tools, orchestration, and 6G communication layers.

    Source: §I · p. 2, E. Research Gap and Positioning · p. 7, A. System Assets · p. 8

  • Results

    The survey presents a 6G-oriented architecture, structured threat model, unified attack taxonomy, and cross-layer mitigation strategies for multimodal, memory-enabled, multi-agent orchestration.

    Source: §I · p. 2, §VIII · p. 18

  • Takeaways & Limitations

    Progress toward trustworthy 6G agentic systems depends on secure multimodal fusion, verifiable orchestration, privacy-aware memory, reliable digital twins, and rigorous evaluation standards.

    Source: §VIII · p. 18

Abstract

from arXiv · show

Sixth-generation (6G) communication systems are expected to support immersive, intent-driven, and latency-critical services through tight integration of multimodal intelligence, edge computing, and autonomous network control. In this setting, agentic AI systems can reason over heterogeneous inputs, use tools and network functions, coordinate across distributed entities, and adapt to dynamic environments. These capabilities make agentic multimodal intelligence promising for 6G applications such as semantic communications, digital twins, and zero-touch network management, but they also introduce security and privacy risks that extend beyond conventional AI and network security models. Vulnerabilities can propagate across multimodal data pipelines, memory, tools, communication interfaces, and inter-agent coordination loops. We survey multimodal intelligence and agentic AI for 6G cross-layered communication systems from the perspectives of privacy and security. We present a 6G-oriented system view spanning perception, memory, tool use, and multi-agent orchestration; analyze threat models and attack surfaces across sensing, cognition, action, memory, and communication layers; organize existing attacks into a structured taxonomy; and review mitigation strategies including prompt and memory defenses, inter-agent trust mechanisms, secure orchestration, and privacy-preserving learning. We conclude by outlining open research directions for trustworthy multimodal multi-agent 6G systems.

I. Introduction

6G’s immersive and latency-critical services rely on integrating heterogeneous data, sensing, inference, and network control. The paper frames multimodal, memory-enabled agentic systems as a cross-layer security and privacy problem and surveys their threats and defenses.

A. 6G Communication Context

  • 6G is envisioned as an intelligent fabric integrating sensing, inference, orchestration, and actuation to support immersive services under latency, reliability, and privacy constraints.Examples include holographic telepresence, tactile internet, extended reality, autonomous mobility, and digital twins.Source: §I · p. 1

I. Introduction

  • Coupling multimodal inputs, persistent memory, tool use, and inter-agent coordination broadens attack surfaces and can expose network services to cascading harms.The paper surveys cross-layer threats and organizes attack and mitigation strategies for multimodal, memory-enabled, tool-using, multi-agent 6G orchestration.Source: §I · pp. 1–2

B. Multimodal Intelligence in 6G

  • Multimodal 6G services fuse text, audio, visual, haptic, and sensing inputs, while semantic communication, ISAC, and XR use these inputs for task-oriented decisions and real-time control.Corrupted or adversarial content in one modality may spread into system-wide decisions.Source: B. Multimodal Intelligence in 6G · p. 2

C. Agentic AI in Communication Systems

The paper presents agentic AI as an observe-estimate-plan-act system embedded in 6G control loops, with memory, tools, and coordination supporting network operations. It describes single-agent and role-differentiated multi-agent architectures as foundations for communication-centric security analysis.

C. Agentic AI in Communication Systems

  • An agentic 6G system embeds an LLM-based goal-directed reasoning loop, persistent memory, and tool authority in a communication control loop.The system’s actions feed back into communication state through orchestration, slice, or digital-twin interfaces.Source: C. Agentic AI in Communication Systems · pp. 2–3

D. Single-Agent Architecture

  • A single agent maps multimodal observations and operational context into guarded plans, invokes network functions through tools, and writes outcomes back to memory.The architecture combines perception, cognition, memory, action, and a tool interface; the described framework uses a trusted-execution-bound LLM, secure memory, and verified control signals.Source: C. Agentic AI in Communication Systems · p. 3, D. Single-Agent Architecture · p. 3

E. Multi-Agent Architecture

  • Multi-agent 6G systems delegate specialized tasks across network domains, using central or decentralized coordination and shared state for adaptive control.Roles can include intent understanding, multimodal fusion, edge orchestration, slice management, digital-twin support, and policy verification; this combination adds cross-domain state, network-facing tool authority, and communication-performance constraints.Source: E. Multi-Agent Architecture · p. 4

III. Related Work and Survey Positioning

The paper positions its survey across agent security, AI-enabled 6G, and multimodal safety, where existing work often treats these topics separately. It uses a systematized literature synthesis to connect persistent memory, tool authority, multimodal context, and multi-agent coordination to 6G security and privacy.

A. Survey Methodology and Source Selection

  • The systematized survey searches four research sources across five seed areas, includes works relevant to attacks, defenses, benchmarks, or deployment, and excludes work outside its AI-agent scope.Its corpus covers 2019–2026, with earlier seminal works retained; the final corpus comprises over 75 peer-reviewed works plus a small number of recent preprints.Source: A. Survey Methodology and Source… · p. 4

B. Surveys on Agentic AI and LLM Security

  • Agentic-AI security surveys establish a vocabulary of threats but primarily study assistants and enterprise or cybersecurity workflows, not latency-sensitive communication systems.They do not systematically connect memory, tool authority, multimodal context, and coordination to 6G consequences such as slice misconfiguration or QoE degradation.Source: B. Surveys on Agentic AI and LLM… · p. 5

C. Surveys on AI-Enabled 6G Systems

  • AI-for-6G surveys cover networking applications and agentic opportunities, but do not fully analyze how agent autonomy changes the attack surface of zero-touch and semantic 6G systems.The paper identifies a gap in dedicated analysis of prompt-mediated control, tool privilege boundaries, memory poisoning, cross-agent trust, and multimodal attacks in control loops.Source: C. Surveys on AI-Enabled 6G Systems · p. 5

D. Surveys on Multimodal Intelligence and Security

Multimodal surveys and attack studies commonly focus on model behavior, image-text safety, or communication architecture rather than system-level propagation. The paper positions its survey around how multimodal compromise can cross memory, tools, coordination, and 6G control boundaries.

D. Surveys on Multimodal Intelligence and Security

  • Multimodal surveys cover model architectures, training, datasets, and image-text safety, while related work examines agent interaction and cross-modal attacks, but often stops at model-level analysis.The cited literature does not generally trace retained multimodal evidence, tool invocation, or delegation into communication-layer harms.Source: D. Surveys on Multimodal Intelligence… · p. 6

E. Research Gap and Positioning

  • The paper’s gap is the lack of a unified account connecting multimodal compromise, persistent memory, tool authority, and inter-agent trust to 6G orchestration and network-control outcomes.It presents a communication-centric survey and threat-modeling synthesis; a prompt or image-based manipulation may alter semantic interpretation, contaminate memory, trigger tools, and propagate to peer agents.Source: E. Research Gap and Positioning · pp. 6–7

IV. Threat Model and Attack Surfaces in Secure Agentic 6G Systems

The threat model treats agent cognition and communication control as coupled assets, with threats defined across protected assets, trust boundaries, and adversary capabilities. Trust can shift at interfaces where content is interpreted, stored, or turned into actions, not only at the network perimeter.

A. System Assets

  • Protected assets span multimodal inputs, memory and knowledge stores, tool authority, agent identities and coordination state, and network-control or digital-twin state.Compromise can affect confidentiality and integrity as well as delay, reliability, service continuity, and operational safety.Source: A. System Assets · pp. 7–8
  • The formal model represents a system as S = (A, B, E), mapping adversary–asset pairs to communication-layer harms through runtime policy π.A denotes protected assets, B trust boundaries, and E adversary capabilities; π maps multimodal observations, memory, and available tools to network-facing actions under guardrails.Source: A. System Assets · p. 8

B. Trust Boundaries

  • Trust boundaries arise when untrusted content is interpreted, written into memory, or converted into tool calls, alongside boundaries between users, agents, tools, networks, and physical sensing.These interactions can be trusted, partially trusted, or dynamically trusted.Source: B. Trust Boundaries · pp. 8–9

C. Adversary Model

The adversary model includes external, internal, and partially trusted actors able to influence semantic inputs, stored context, tools, and agent communications. Attack surfaces span interacting layers, where local compromises can propagate through memory, delegated actions, and network-facing control loops.

C. Adversary Model

  • Adversaries may be external, internal, or partially trusted, seeking information theft, service degradation, orchestration manipulation, resource exhaustion, unsafe behavior, or covert long-horizon changes.Capabilities include altering prompts, retrieved or stored data, tools, identities, inter-agent messages, and multimodal inputs.Source: C. Adversary Model · p. 9

D. Attack Surfaces

  • The sensing layer exposes prompts, retrieved documents, visual and audio streams, telemetry, and contextual metadata to injection, adversarial inputs, cross-modal manipulation, and semantic misdirection.These attacks may distort inferred intent, network conditions, or service requirements and lead to downstream adaptation or control errors.Source: D. Attack Surfaces · p. 9
  • Reasoning and memory are vulnerable to jailbreaks, goal changes, planning failures, and memory manipulation that can distort resource allocation, user profiles, context, or policy.The described memory surfaces include context windows, persistent stores, vector databases, and retrieval-augmented generation pipelines.Source: D. Attack Surfaces · p. 9
  • Tool misuse can alter policies, disrupt services, change network behavior, or steal data, while inter-agent attacks can tamper with messages and propagate inconsistent states or decisions.In distributed 6G deployments, such attacks may spread across devices, edge nodes, and core-network functions, causing coordination failures.Source: D. Attack Surfaces · pp. 9–10
  • Figure 4 presents the attack surfaces as a cross-layer dependency graph, where compromises can propagate through state updates, delegated actions, and network-facing control loops.The figure summarizes entry points and paths by which local compromises can become system-level 6G failures.Source: D. Attack Surfaces · p. 10, Figure 4 · p. 10

E. Threat Categories

The paper groups threats by system-level harms and organizes attack instances by their primary entry vector. It presents propagation into 6G orchestration as a grounded extrapolation from adjacent-domain attack primitives that warrants dedicated empirical study.

E. Threat Categories

  • Threats are grouped into memory and reasoning integrity, tool and privilege abuse, agent trust and deception, and coordination and availability categories.The categories link attacks to assets, affected 6G layers, and harms such as QoE degradation, latency or reliability violations, policy inconsistency, unsafe control, privacy leakage, or denial of service.Source: E. Threat Categories · p. 10

F. Specific 6G Attack Propagation Scenarios

  • Table 3 presents representative attack-propagation scenarios, while adjacent-domain demonstrations support the primitives and their end-to-end 6G consequences remain extrapolations requiring investigation in testbeds.The cited primitives include prompt injection, tool misuse, memory poisoning, multimodal manipulation, audio and cross-modal attacks, federated-learning poisoning and backdoors, and inter-agent manipulation.Source: F. Specific 6G Attack Propagation… · p. 11, Table 3 · p. 11

V. Attack Taxonomy for Secure Agentic and Multimodal 6G Systems

  • The taxonomy organizes threats into prompt-hacking, socio-technical, adversarial and data-centric, and orchestration and communication-system classes by primary attack vector.Some attacks span categories, so placement aids navigation rather than implying mutual exclusivity.Source: §V · p. 11

A. Prompt-Hacking Attacks

  • Prompt-hacking manipulates the agent’s interpretation of goals or context, potentially changing reasoning, tool calls, orchestration priorities, or disclosure of sensitive state.Jailbreaks bypass behavioral guidelines and guardrails; tool-chain manipulation can contaminate later tool inputs and produce unsafe orchestration or data leakage.Source: A. Prompt-Hacking Attacks · pp. 11–12

B. Socio-Technical Attacks

Socio-technical attacks exploit human-agent workflows, persistent memory, and trust relationships. Data-centric attacks manipulate training, retrieved, stored, or multimodal inputs that shape agent behavior.

B. Socio-Technical Attacks

  • Social engineering can use deceptive content or fabricated context to influence operators through agents or agents through human intermediaries, while memory tempering biases future decisions through altered preferences, histories, or retrieval results.Memory tampering can sustain false assumptions affecting personalized responses, QoE adaptation, anomaly response, or resource scheduling, and may be difficult to detect within legitimate learned context.Source: B. Socio-Technical Attacks · p. 12
  • Trust exploitation targets reliance on compromised-agent recommendations or peer-agent inputs that are not independently authenticated.The paper notes greater likelihood in systems less developed in explainability or automation.Source: B. Socio-Technical Attacks · p. 13

C. Adversarial and Data-Centric Attacks

  • Data-centric attacks manipulate telemetry, sensor streams, operator selections, training data, retrieval information, or data stores, potentially misdirecting resource allocation, fault classification, or service prioritization.Other described attacks include event-triggered backdoors, query-based model extraction, and multimodal perturbations that can confuse reasoning across visual, audio, sensor, or fused inputs.Source: C. Adversarial and Data-Centric Attacks · p. 13

D. Orchestration and Communication-System Attacks

Orchestration attacks exploit coordination, trust, and control loops across distributed 6G systems, while the defense discussion spans input handling and persistent memory safeguards.

D. Orchestration and Communication-System Attacks

  • A compromised or malicious agent can impersonate a peer, inject false coordination messages, and cascade into corrupted recommendations, resource decisions, handoffs, or shared memory.Real-time interactions among devices, edge nodes, service platforms, and agents make communication itself an attack surface.Source: D. Orchestration and… · p. 13
  • Coordination attacks can turn a local edge-agent error into system-wide service degradation, while complex prompts or recursive tool calls can exhaust decision infrastructure and worsen latency.Control-loop attacks can target slice orchestration, digital-twin synchronization, scheduling, and semantic adaptation without touching transport or devices.Source: D. Orchestration and… · pp. 13–14

VI. Mitigation Strategies and Defense Design

  • Mitigation evidence combines controls studied in adjacent fields with 6G-oriented design principles that remain unvalidated as end-to-end solutions.This qualifies the deployment maturity of the proposed defense strategy.Source: §VI · p. 14

A. Input and Prompt Defenses

  • Input defenses include delimiting instructions, sanitizing content, validating modalities, checking cross-modal consistency, and verifying retrieved-content provenance.The pipeline should distinguish operator policy from user content, retrieved context from trusted state, and instructions from descriptive data.Source: A. Input and Prompt Defenses · p. 14

B. Memory and Knowledge Defenses

  • Memory safeguards include authenticated updates, source tracking, integrity checks, anomaly detection, rollback, and policies for retention, invalidation, and contradictions.The passage frames these controls as supporting reliable communication and service continuity during long-running 6G tasks.Source: B. Memory and Knowledge Defenses · p. 14

C. Tool and Action Defenses

The defense strategy bounds agent authority, authenticates coordination, protects communication and privacy, and balances safeguards against operational constraints.

C. Tool and Action Defenses

  • Tool defenses bound authority through least privilege, scoped capabilities, constrained execution, runtime checks, action logs, human approval for high-risk operations, and validation of tool outputs.6G implementations can use network-function isolation, API mediation, rate limits, and digital twins or shadow environments before committing actions.Source: C. Tool and Action Defenses · p. 14

D. Inter-Agent Trust and Coordination Defenses

  • Inter-agent safeguards combine strong identities, signed messages, role-based policies, evolving trust scores, provenance checks, shared-state consistency checks, and defined handoffs.Sensitive actions may require verification by multiple agents, balanced against latency limits for time-sensitive operations.Source: D. Inter-Agent Trust and Coordination… · p. 14

E. Communication- and 6G-Layer Defenses

  • Communication-layer defenses include slice isolation, secure channels, control-loop policy verification, trusted edge execution, telemetry integrity checks, and digital-twin validation before deployment.AI- and network-layer protections should be co-designed because control-layer manipulation can degrade latency, reliability, energy efficiency, or service continuity.Source: E. Communication- and 6G-Layer Defenses · pp. 14–15

F. Privacy-Preserving Intelligence Mechanisms

  • Privacy mechanisms include data minimization, selective memory retention, access-bounded retrieval, federated learning, secure aggregation, differential privacy, confidential inference, and context encryption.Distributed edge systems also need explicit policies for what may be stored, for how long, for which tasks, and under whose consent.Source: F. Privacy-Preserving Intelligence… · p. 15

G. Defense Tradeoffs and Design Principles

  • Defense design must balance security, latency, privacy, contextual utility, centralization, distributed autonomy, robustness, and computational cost.The principles call for cross-layer defenses, least privilege, bounded autonomy, provenance metadata, pre-execution verification, and lifecycle-aware memory and privacy policies.Source: G. Defense Tradeoffs and Design… · p. 15

VII. Open Challenges and Future Research Directions

Open challenges concern adversarial multimodal fusion, trustworthy orchestration, persistent-memory privacy, and semantic integrity in intent-aware communication.

A. Secure Multimodal Fusion Under Adversarial Conditions

  • Multimodal attackers can manipulate one input while preserving apparent consistency elsewhere or exploit modality disagreements, while current defenses remain limited in detecting inconsistencies and quantifying trust and uncertainty.Research directions include modality-aware trust estimation, cross-modal validation, uncertainty-calibrated fusion, and robust inference under 6G latency and resource constraints.Source: A. Secure Multimodal Fusion Under… · pp. 15–16

B. Trustworthy Multi-Agent Orchestration for Zero-Touch 6G

  • Multi-agent methods do not yet fully address 6G constraints such as bounded latency, hierarchical control domains, and safety-critical orchestration.Proposed frameworks include authenticated delegation, verifiable handoffs, role-bounded authority, conflict resolution, fault containment, and mixed-trust support.Source: B. Trustworthy Multi-Agent… · p. 16

C. Privacy-Preserving Persistent Memory

  • Long-term retention of preferences, interaction histories, sensing traces, and contextual metadata can cumulatively leak privacy even when individual interactions seem nonsensitive.Suggested memory architectures use task-restricted retention, access-bounded retrieval, encryption, and consent-aware policies.Source: C. Privacy-Preserving Persistent Memory · p. 16

D. Security of Semantic Communication and Intent-Aware Networking

  • Semantic communication creates attack opportunities to manipulate meaning, context, or inferred intent without violating transmission correctness.Research should address meaning-level integrity, semantic distortion through reasoning loops, intent manipulation, and trust metrics for semantic communication quality.Source: D. Security of Semantic Communication… · p. 17

E. Secure Digital Twins and Cross-Layer State Consistency

The survey identifies research needs in digital-twin integrity, reproducible evaluation, governance, and resource-aware defenses, and concludes that security and privacy belong to the autonomous communication stack.

E. Secure Digital Twins and Cross-Layer State Consistency

  • Digital twins can validate candidate actions before deployment only if synchronized with the physical network and resilient to manipulation.Open problems include secure physical-digital synchronization, twin-update integrity, state-divergence detection, and verification without excessive overhead.Source: E. Secure Digital Twins and… · p. 17

F. Benchmarking, Evaluation, and Reproducibility

  • Current evaluation needs benchmarks that combine multimodal pipelines, memory, tools, coordination, and communication dynamics, and report security outcomes alongside latency, QoE, continuity, privacy, recovery, and reproducibility.The proposed reporting includes threat class and reproducibility metadata for like-for-like comparisons.Source: F. Benchmarking, Evaluation, and… · p. 17

G. Governance, Standardization, and Human Oversight

  • Governance and standards should address multi-agent auditability, provenance metadata, human oversight, memory governance, tool authority, semantic integrity, interoperability, and explanations of decision reasons.The reasons include which modalities, memory entries, and peer-agent interactions influenced a decision.Source: G. Governance, Standardization, and… · p. 17

H. Sustainable and Resource-Aware Secure Intelligence

  • Security mechanisms can raise latency, energy use, and deployment cost, so scalable 6G defenses need resource-aware protection adapted to task criticality, context sensitivity, and available compute.Suggested directions include adaptive verification, event-driven monitoring, selective strong privacy mechanisms, and security-aware edge scheduling.Source: H. Sustainable and Resource-Aware… · p. 17

VIII. Conclusion

  • The survey synthesizes a 6G-oriented system view, threat model, attack taxonomy, and cross-layer mitigations, distinguishing established evidence from forward-looking 6G proposals.It concludes that security and privacy must be treated as properties of the autonomous communication stack, with progress depending on advances across fusion, orchestration, memory, semantics, digital twins, and evaluation.Source: §VIII · p. 18

Related papers

Loading 2610.30436v1…