PlanFlip: Attacking Multi-Agent LLM Systems via Planning-Phase Prompt Injection
06:00 · July 21, 2026 · arXiv cs.AI RSS
Multi-agent LLM systems increasingly rely on a Planner to decompose goals into sub-task sequences that downstream Executor and Critic agents execute and audit. We identify the planning phase as a critical attack surface: a single injection into the Planner's context achieves cascade amplification, corrupting all downstream sub-tasks simultaneously. We introduce PlanFlip, a framework comprising four planning-phase prompt injection attacks -- GoalSubstitution (PF-1), PriorityInversion (PF-2), ContextPollution (PF-3), and RoleConfusion (PF-4) -- each disguised as plausible tool outputs to evade keyword filters. Evaluating nine frontier LLMs across 3,479 episodes, we uncover three findings: (1) capability amplifies vulnerability -- GPT-5 achieves the highest attack success rate (ASR = 0.68), contradicting the assumption that stronger models are inherently more secure; (2) homogeneous pipelines exhibit a correlated-agent blind spot -- GPT-4o and Llama-3.3-70B show ASR near 0 yet Stealth = 1.00 and StepShift > 0, with attacks restructuring plans while the same-backbone Critic reports alignment (two independent judges confirm -0.20 to -0.32 semantic deviation, r = 0.943); (3) reasoning-augmented models resist injections -- DeepSeek-R1 achieves StepShift = 0.00 across all attacks. We propose GoalAnchorCheck (D1) and CrossAgentConsensus (D2), achieving detection rates up to 1.00 and outperforming same-backbone baselines in 15 of 16 cells. Our key insight: heterogeneous model diversity is a security prerequisite for multi-agent systems; redundancy within a homogeneous backbone provides no protection against planning-phase attacks.
Summary
Multi-agent LLM systems typically employ a Planner to break high-level goals into ordered sub-task sequences that Executor and Critic agents then perform and review. PlanFlip demonstrates that this planning stage constitutes a high-impact attack surface: a single context injection can trigger cascade amplification, altering every downstream sub-task at once while remaining invisible to keyword-based or output-level filters. The framework defines four orthogonal planning-phase attacks—GoalSubstitution, PriorityInversion, ContextPollution, and RoleConfusion—each formatted to resemble legitimate tool outputs.
Large-scale evaluation across nine frontier models and 3,479 episodes reveals that stronger instruction-following capability increases susceptibility rather than reducing it, with GPT-5 recording the highest attack success rate. Homogeneous pipelines, in which Planner, Executor, and Critic share the same backbone, exhibit a correlated-agent blind spot: the Critic reports alignment even when independent heterogeneous judges measure substantial semantic deviation in the generated plans. Reasoning-augmented models such as DeepSeek-R1 proved markedly more resistant, maintaining zero step shifts across all attack variants.
The authors formalise these observations and introduce two countermeasures, GoalAnchorCheck and CrossAgentConsensus, that rely on heterogeneous model diversity and cross-agent verification. These defences achieve detection rates up to 1.0 and outperform same-backbone self-critique in nearly all tested configurations. The central conclusion is that backbone diversity is a structural security requirement for multi-agent deployments, not merely an optimisation choice.
Why it matters
This research is highly relevant for Dutch AI researchers and security practitioners focused on building robust, EU AI Act-compliant autonomous systems. It provides actionable insights into structural vulnerabilities of multi-agent architectures and offers concrete defensive mechanisms to mitigate planning-phase prompt injections.
