Linguistic Firewall: Geometry as Defense in Multi-Agent Systems Routing

In modern Multi-Agent Systems (MAS), routers typically select agents by analyzing natural-language descriptions. This reliance on unverified text creates a critical security vulnerability: malicious agents can embed prompt-injection payloads into their descriptions to hijack the router. The authors investigate whether it is possible to build a secure routing mechanism that completely eliminates the need to process untrusted textual metadata at inference time.

To address this, the authors introduce ANTAP (Automatic Non-Textual Agent Picker). Instead of interpreting descriptions, ANTAP uses an offline registration phase to empirically measure each agent's performance on a set of trusted benchmark queries. For each agent, it constructs a fixed linear operator—a behavioral signature—within a shared semantic space. At inference time, the router performs a single matrix-vector multiplication, projecting the query's embedding onto these precomputed operators to select the most competent agent. Because the router only processes numerical embeddings and never ingests agent descriptions, it creates a linguistic firewall that renders metadata-based injection attacks mathematically inexpressible.

ANTAP demonstrates significant security and performance advantages over traditional textual routers and embedding-based baselines. In experiments, ANTAP achieved a near-zero Attack Success Rate (ASR) against description-based injection attacks, whereas standard routers were hijacked in over 67% of cases. Furthermore, ANTAP proved resilient against sophisticated sleeper-agent attacks (where agents harbor latent backdoors) and adaptive white-box attacks, maintaining its routing accuracy even when adversaries attempted to optimize query tokens to breach the decision boundary. Beyond security, ANTAP reduces routing latency by replacing complex LLM-based reasoning with efficient, fixed-cost geometric operations.