Early Detection of Distributed Backdoors in Multi-Agent LLM Systems: A Characterization Study

As multi-agent LLM systems become more complex, they are increasingly vulnerable to distributed backdoor attacks. In these attacks, a malicious payload is split into encrypted fragments and hidden across multiple tool observations. Because no single agent ever holds the complete payload, traditional per-step safety checks fail to detect the threat. This study investigates whether an online 'prefix detector' can identify these attacks while the run is still unfolding, and whether such detection is robust or merely reliant on obvious surface-level cues.

The researchers implemented a hierarchical multi-agent system and subjected it to a distributed backdoor attack where poisoned tools injected encrypted fragments into observations. They generated a corpus of over 2,000 trajectories across five different language models and two distinct task domains (database searching and API tool use). The team instrumented the system with explicit landmarks for fragment injection, assembly, and execution. They then trained a prefix detector to monitor the live trajectory and tested its ability to flag malicious runs before the final post-run assembly step could occur.

The study demonstrates that detection is a race against assembly. Once the first malicious fragment is injected, a prefix detector can flag 99.3% of successful attacks with a median of five steps remaining before the run concludes. This provides a critical window for intervention, allowing the system to abort the run before the external assembler can reconstruct and execute the malicious code. However, the researchers found that this performance is largely driven by 'surface cues'—specifically the high entropy and length of the encrypted fragments. When the researchers replaced the ciphertext with a word-based codec that mimicked natural language, detection performance dropped, and the model struggled to transfer its learned detection capabilities to new domains.