Tipping the Dominos: Topology-Aware Multi-Hop Attacks on LLM-Based Multi-Agent Systems

TL;DR

This work reveals topology-driven vulnerabilities in LLM-based MASs by introducing TOMA, a topology-aware multi-hop attack that propagates adversarial contamination from edge agents to core controllers without privileged access. It integrates an adversarial contamination propagation model (ACPM), hierarchical payload encapsulation (HPES), and environment-injection techniques to optimize attack paths across dynamic topologies. A conceptual defense, T-Guard, leveraging cross-modal validation, topology trust, adaptive policies, and access control, demonstrates robust mitigation with ~94.8% blocking and manageable overhead in prototype tests. The findings emphasize the importance of topology-aware defenses and offer practical design directions for strengthening MAS security in real-world deployments.

Abstract

LLM-based multi-agent systems (MASs) have reshaped the digital landscape with their emergent coordination and problem-solving capabilities. However, current security evaluations of MASs are still confined to limited attack scenarios, leaving their security issues unclear and likely underestimated. To fill this gap, we propose TOMA, a topology-aware multi-hop attack scheme targeting MASs. By optimizing the propagation of contamination within the MAS topology and controlling the multi-hop diffusion of adversarial payloads originating from the environment, TOMA unveils new and effective attack vectors without requiring privileged access or direct agent manipulation. Experiments demonstrate attack success rates ranging from 40% to 78% across three state-of-the-art MAS architectures: \textsc{Magentic-One}, \textsc{LangManus}, and \textsc{OWL}, and five representative topologies, revealing intrinsic MAS vulnerabilities that may be overlooked by existing research. Inspired by these findings, we propose a conceptual defense framework based on topology trust, and prototype experiments show its effectiveness in blocking 94.8% of adaptive and composite attacks.

Figures (9)

• Figure 1: Attack attempts on LangManus.
• Figure 2: Overview of the topology-guided attack pipeline on LangManus.
• Figure 3: Framework of Topology-Aware Multi-Hop Attack.
• Figure 4: Illustration of adversarial contamination propagation model with $p=1.4, \delta = 0.9$. $V_i$ denotes agent nodes; arrows indicate task or information dependencies. $V_1$ and $V_{10}$ represent the attacker’s entry and target. Yellow nodes are newly infected, red arrows show propagation direction, and node labels indicate infection values per round.
• Figure 5: Payload construction for guiding WebSurfer to the Executor for malicious task execution.