The Wolf Within: Covert Injection of Malice into MLLM Societies via an MLLM Operative
On the map: LLM agents and tool use → Agent threats, guardrails and governance
also in 1 more
Abstract (arXiv)
Due to their unprecedented ability to process and respond to various types of data, Multimodal Large Language Models (MLLMs) are constantly defining the new boundary of Artificial General Intelligence (AGI). As these advanced generative models increasingly form collaborative networks for complex tasks, the integrity and security of these systems are crucial. Our paper, ``The Wolf Within'', explores a novel vulnerability in MLLM societies - the indirect propagation of malicious content. Unlike direct harmful output generation for MLLMs, our research demonstrates how a single MLLM agent can be subtly influenced to generate prompts that, in turn, induce other MLLM agents in the society to output malicious content. Our findings reveal that, an MLLM agent, when manipulated to produce specific prompts or instructions, can effectively ``infect'' other agents within a society of MLLMs. This infection leads to the generation and circulation of harmful outputs, such as dangerous instructions or misinformation, across the society. We also show the transferability of these indirectly generated prompts, highlighting their possibility in propagating malice through inter-agent communication. This research provides a critical insight into a new dimension of threat posed by MLLMs, where a single agent can act as a catalyst for widespread malevolent influence. Our work underscores the urgent need for developing robust mechanisms to detect and mitigate such covert manipulations within MLLM societies, ensuring their safe and ethical utilization in societal applications.
Key facts. Cited by 21 papers in the map (data through 7 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 30 of its 36 references that are in the map. First posted on arXiv 20 Feb 2024.
Builds on
30 of 36 references.
Closest ancestors · 1
Same direction, newest first
- 2024Agent Smith: A Single Image Can Jailbreak One Million Multimodal LLM Agents Exponentially Fast13 Feb
Other references · 29
- 2017Proximal Policy Optimization Algorithmscited by 14,441
- 2023Visual Instruction Tuningcited by 7,792
- 2014Explaining and Harnessing Adversarial Examplescited by 7,287
- 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
- 2023Generative Agents: Interactive Simulacra of Human Behaviorcited by 3,500
- 2022Constitutional AI: Harmlessness from AI Feedbackcited by 2,950
- 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 2,914
- 2016Categorical Reparameterization with Gumbel-Softmaxcited by 2,708
- 2023MetaGPT: Meta Programming for A Multi-Agent Collaborative Frameworkcited by 1,761
- 2023Jailbroken: How Does LLM Safety Training Fail?cited by 1,565
- 2023Shikra: Unleashing Multimodal LLM's Referential Dialogue Magiccited by 891
- 2023AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Modelscited by 738
17 more
- 2023NExT-GPT: Any-to-Any Multimodal LLMcited by 610
- 2023AgentVerse: Facilitating Multi-Agent Collaboration and Exploring Emergent Behaviorscited by 580
- 2024How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMscited by 533
- 2023Jailbreaking ChatGPT via Prompt Engineering: An Empirical Studycited by 478
- 2023PandaGPT: One Model To Instruction-Follow Them Allcited by 330
- 2023Visual Adversarial Examples Jailbreak Aligned Large Language Modelscited by 307
- 2017Certified Defenses for Data Poisoning Attackscited by 288
- 2023Jailbreak in pieces: Compositional Adversarial Attacks on Multi-Modal Language Modelscited by 260
- 2023Generating Images with Multimodal Language Modelscited by 259
- 2023Poisoning Language Models During Instruction Tuningcited by 254
- 2021Gradient-based Adversarial Attacks against Text Transformerscited by 233
- 2023Exploring Collaboration Mechanisms for LLM Agents: A Social Psychology Viewcited by 221
- 2023Image Hijacks: Adversarial Images can Control Generative Models at Runtimecited by 165
- 2024Jailbreaking Attack against Multimodal Large Language Modelcited by 128
- 2023Abusing Images and Sounds for Indirect Instruction Injection in Multi-Modal LLMscited by 117
- 2024Safety of Multimodal Large Language Models on Images and Textscited by 70
- 2023VLATTACK: Multimodal Adversarial Attacks on Vision-Language Tasks via Pre-trained Modelscited by 66
Built on by
Citing papers per year: 2024: 9; 2025: 9; 2026: 3.
21 papers.
Sort:
By area:
- 2025A Comprehensive Survey in LLM(-Agent) Full Stack Safety: Data, Training and Deploymentcited by 110
- 2025A Survey on Trustworthy LLM Agents: Threats and Countermeasurescited by 93
- 2024A Survey of Attacks on Large Vision-Language Models: Resources, Advances, and Future Trendscited by 82
- 2025A Survey of Safety on Large Vision-Language Models: Attacks, Defenses and Evaluationscited by 66
- 2025Safety at Scale: A Comprehensive Survey of Large Model and Agent Safetycited by 63
- 2024"Glue pizza and eat rocks" -- Exploiting Vulnerabilities in Retrieval-Augmented Generative Modelscited by 60
- 2025Visual Large Language Models for Generalized and Specialized Applicationscited by 35
- 2025AgentSafe: Safeguarding Large Language Model-based Multi-agent Systems via Hierarchical Data Managementcited by 35
- 2025textitAgents Under Siege: Breaking Pragmatic Multi-Agent LLM Systems with Optimized Prompt Attackscited by 31
- 2024NetSafe: Exploring the Topological Safety of Multi-agent Networkscited by 29
- 2024Towards Resilient and Efficient LLMs: A Comparative Study of Efficiency, Performance, and Adversarial Robustnesscited by 22
- 2024Adversarial Attacks of Vision Tasks in the Past 10 Years: A Surveycited by 22
9 more
- 2024Unbridled Icarus: A Survey of the Potential Perils of Image Inputs in Multimodal Large Language Model Securitycited by 18
- 2024The Synergy between Data and Multi-Modal Large Language Models: A Survey from Co-Development Perspectivecited by 14
- 2025From LLMs to MLLMs to Agents: A Survey of Emerging Paradigms in Jailbreak Attacks and Defenses within LLM Ecosystemcited by 11
- 2024Ontology-Aware RAG for Improved Question-Answering in Cybersecurity Educationcited by 9
- 2024Systematic Categorization, Construction and Evaluation of New Attacks against Multi-modal Mobile GUI Agentscited by 5
- 2025CyberBOT: Towards Reliable Cybersecurity Education via Ontology-Grounded Retrieval Augmented Generationcited by 1
- 2026When Agents Go Rogue: Activation-Based Detection of Malicious Behaviors in Multi-Agent Systemscited by 1
- 2026SoK: When Safe Agents Fail Together: The Security of Multi Agent LLM Systemscited by 1
- 2026Piggybacking on Perception: Stealthy Concurrent Audio Prompt Injections against Multimodal LLM Agentscited by 0
- 2026SoK: When Safe Agents Fail Together: The Security of Multi Agent LLM Systems1 Sep 2026
- 2026Piggybacking on Perception: Stealthy Concurrent Audio Prompt Injections against Multimodal LLM Agents30 Jul 2026
- 2026When Agents Go Rogue: Activation-Based Detection of Malicious Behaviors in Multi-Agent Systems7 Jul 2026
- 2025From LLMs to MLLMs to Agents: A Survey of Emerging Paradigms in Jailbreak Attacks and Defenses within LLM Ecosystem18 Jun 2025
- 2025A Comprehensive Survey in LLM(-Agent) Full Stack Safety: Data, Training and Deployment22 Apr 2025
- 2025CyberBOT: Towards Reliable Cybersecurity Education via Ontology-Grounded Retrieval Augmented Generation1 Apr 2025
- 2025textitAgents Under Siege: Breaking Pragmatic Multi-Agent LLM Systems with Optimized Prompt Attacks31 Mar 2025
- 2025A Survey on Trustworthy LLM Agents: Threats and Countermeasures12 Mar 2025
- 2025AgentSafe: Safeguarding Large Language Model-based Multi-agent Systems via Hierarchical Data Management6 Mar 2025
- 2025A Survey of Safety on Large Vision-Language Models: Attacks, Defenses and Evaluations14 Feb 2025
- 2025Safety at Scale: A Comprehensive Survey of Large Model and Agent Safety2 Feb 2025
- 2025Visual Large Language Models for Generalized and Specialized Applications6 Jan 2025
9 more
- 2024Ontology-Aware RAG for Improved Question-Answering in Cybersecurity Education10 Dec 2024
- 2024Adversarial Attacks of Vision Tasks in the Past 10 Years: A Survey31 Oct 2024
- 2024NetSafe: Exploring the Topological Safety of Multi-agent Networks21 Oct 2024
- 2024Towards Resilient and Efficient LLMs: A Comparative Study of Efficiency, Performance, and Adversarial Robustness8 Aug 2024
- 2024Systematic Categorization, Construction and Evaluation of New Attacks against Multi-modal Mobile GUI Agents12 Jul 2024
- 2024The Synergy between Data and Multi-Modal Large Language Models: A Survey from Co-Development Perspective11 Jul 2024
- 2024A Survey of Attacks on Large Vision-Language Models: Resources, Advances, and Future Trends10 Jul 2024
- 2024"Glue pizza and eat rocks" -- Exploiting Vulnerabilities in Retrieval-Augmented Generative Models26 Jun 2024
- 2024Unbridled Icarus: A Survey of the Potential Perils of Image Inputs in Multimodal Large Language Model Security8 Apr 2024
- 2025A Survey on Trustworthy LLM Agents: Threats and Countermeasurescited by 93
- 2025AgentSafe: Safeguarding Large Language Model-based Multi-agent Systems via Hierarchical Data Managementcited by 35
- 2025textitAgents Under Siege: Breaking Pragmatic Multi-Agent LLM Systems with Optimized Prompt Attackscited by 31
- 2024NetSafe: Exploring the Topological Safety of Multi-agent Networkscited by 29
- 2025From LLMs to MLLMs to Agents: A Survey of Emerging Paradigms in Jailbreak Attacks and Defenses within LLM Ecosystemcited by 11
- 2024Systematic Categorization, Construction and Evaluation of New Attacks against Multi-modal Mobile GUI Agentscited by 5
- 2026When Agents Go Rogue: Activation-Based Detection of Malicious Behaviors in Multi-Agent Systemscited by 1
- 2026SoK: When Safe Agents Fail Together: The Security of Multi Agent LLM Systemscited by 1
- 2026Piggybacking on Perception: Stealthy Concurrent Audio Prompt Injections against Multimodal LLM Agentscited by 0
- 2026SoK: When Safe Agents Fail Together: The Security of Multi Agent LLM Systems1 Sep 2026
- 2026Piggybacking on Perception: Stealthy Concurrent Audio Prompt Injections against Multimodal LLM Agents30 Jul 2026
- 2026When Agents Go Rogue: Activation-Based Detection of Malicious Behaviors in Multi-Agent Systems7 Jul 2026
- 2025From LLMs to MLLMs to Agents: A Survey of Emerging Paradigms in Jailbreak Attacks and Defenses within LLM Ecosystem18 Jun 2025
- 2025textitAgents Under Siege: Breaking Pragmatic Multi-Agent LLM Systems with Optimized Prompt Attacks31 Mar 2025
- 2025A Survey on Trustworthy LLM Agents: Threats and Countermeasures12 Mar 2025
- 2025AgentSafe: Safeguarding Large Language Model-based Multi-agent Systems via Hierarchical Data Management6 Mar 2025
- 2024NetSafe: Exploring the Topological Safety of Multi-agent Networks21 Oct 2024
- 2024Systematic Categorization, Construction and Evaluation of New Attacks against Multi-modal Mobile GUI Agents12 Jul 2024
- 2024A Survey of Attacks on Large Vision-Language Models: Resources, Advances, and Future Trendscited by 82
- 2025A Survey of Safety on Large Vision-Language Models: Attacks, Defenses and Evaluationscited by 66
- 2025Safety at Scale: A Comprehensive Survey of Large Model and Agent Safetycited by 63
- 2025Visual Large Language Models for Generalized and Specialized Applicationscited by 35
- 2024Adversarial Attacks of Vision Tasks in the Past 10 Years: A Surveycited by 22
- 2024Unbridled Icarus: A Survey of the Potential Perils of Image Inputs in Multimodal Large Language Model Securitycited by 18
- 2024The Synergy between Data and Multi-Modal Large Language Models: A Survey from Co-Development Perspectivecited by 14
- 2025A Survey of Safety on Large Vision-Language Models: Attacks, Defenses and Evaluations14 Feb 2025
- 2025Safety at Scale: A Comprehensive Survey of Large Model and Agent Safety2 Feb 2025
- 2025Visual Large Language Models for Generalized and Specialized Applications6 Jan 2025
- 2024Adversarial Attacks of Vision Tasks in the Past 10 Years: A Survey31 Oct 2024
- 2024The Synergy between Data and Multi-Modal Large Language Models: A Survey from Co-Development Perspective11 Jul 2024
- 2024A Survey of Attacks on Large Vision-Language Models: Resources, Advances, and Future Trends10 Jul 2024
- 2024Unbridled Icarus: A Survey of the Potential Perils of Image Inputs in Multimodal Large Language Model Security8 Apr 2024
Similar, not cited
Close in wording, no citation either way
- 2025Demonstrations of Integrity Attacks in Multi-Agent Systems
- 2026Beyond Single-Model Injection: A Threat Model and Defense Architecture for Prompt Injection in Multi-Agent Systems
- 2025ChatInject: Abusing Chat Templates for Prompt Injection in LLM Agents
- 2024Automated Red Teaming with GOAT: the Generative Offensive Agent Tester
- 2026Architecting Secure AI Agents: Perspectives on System-Level Defenses Against Indirect Prompt Injection Attacks
- 2024Prompt Infection: LLM-to-LLM Prompt Injection within Multi-Agent Systems
- 2026Don't Trust Stubborn Neighbors: A Security Framework for Agentic Networks
- 2025The Dark Side of LLMs: Agent-based Attack Vectors for System-level Compromise