mlsanityData to 7 Oct 2026

The Wolf Within: Covert Injection of Malice into MLLM Societies via an MLLM Operative

arXiv 2402.14859 ↗First posted 20 Feb 2024cs.CR cs.AI cs.CYcited by 21

On the map: LLM agents and tool use → Agent threats, guardrails and governance

also in 1 more
Abstract (arXiv)

Due to their unprecedented ability to process and respond to various types of data, Multimodal Large Language Models (MLLMs) are constantly defining the new boundary of Artificial General Intelligence (AGI). As these advanced generative models increasingly form collaborative networks for complex tasks, the integrity and security of these systems are crucial. Our paper, ``The Wolf Within'', explores a novel vulnerability in MLLM societies - the indirect propagation of malicious content. Unlike direct harmful output generation for MLLMs, our research demonstrates how a single MLLM agent can be subtly influenced to generate prompts that, in turn, induce other MLLM agents in the society to output malicious content. Our findings reveal that, an MLLM agent, when manipulated to produce specific prompts or instructions, can effectively ``infect'' other agents within a society of MLLMs. This infection leads to the generation and circulation of harmful outputs, such as dangerous instructions or misinformation, across the society. We also show the transferability of these indirectly generated prompts, highlighting their possibility in propagating malice through inter-agent communication. This research provides a critical insight into a new dimension of threat posed by MLLMs, where a single agent can act as a catalyst for widespread malevolent influence. Our work underscores the urgent need for developing robust mechanisms to detect and mitigate such covert manipulations within MLLM societies, ensuring their safe and ethical utilization in societal applications.

Key facts. Cited by 21 papers in the map (data through 7 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 30 of its 36 references that are in the map. First posted on arXiv 20 Feb 2024.

Builds on

30 of 36 references.

Closest ancestors · 1

Same direction, newest first

  1. 2024Agent Smith: A Single Image Can Jailbreak One Million Multimodal LLM Agents Exponentially Fast13 Feb

Other references · 29

  1. 2017Proximal Policy Optimization Algorithmscited by 14,441
  2. 2023Visual Instruction Tuningcited by 7,792
  3. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  4. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  5. 2023Generative Agents: Interactive Simulacra of Human Behaviorcited by 3,500
  6. 2022Constitutional AI: Harmlessness from AI Feedbackcited by 2,950
  7. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 2,914
  8. 2016Categorical Reparameterization with Gumbel-Softmaxcited by 2,708
  9. 2023MetaGPT: Meta Programming for A Multi-Agent Collaborative Frameworkcited by 1,761
  10. 2023Jailbroken: How Does LLM Safety Training Fail?cited by 1,565
  11. 2023Shikra: Unleashing Multimodal LLM's Referential Dialogue Magiccited by 891
  12. 2023AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Modelscited by 738
17 more
  1. 2023NExT-GPT: Any-to-Any Multimodal LLMcited by 610
  2. 2023AgentVerse: Facilitating Multi-Agent Collaboration and Exploring Emergent Behaviorscited by 580
  3. 2024How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMscited by 533
  4. 2023Jailbreaking ChatGPT via Prompt Engineering: An Empirical Studycited by 478
  5. 2023PandaGPT: One Model To Instruction-Follow Them Allcited by 330
  6. 2023Visual Adversarial Examples Jailbreak Aligned Large Language Modelscited by 307
  7. 2017Certified Defenses for Data Poisoning Attackscited by 288
  8. 2023Jailbreak in pieces: Compositional Adversarial Attacks on Multi-Modal Language Modelscited by 260
  9. 2023Generating Images with Multimodal Language Modelscited by 259
  10. 2023Poisoning Language Models During Instruction Tuningcited by 254
  11. 2021Gradient-based Adversarial Attacks against Text Transformerscited by 233
  12. 2023Exploring Collaboration Mechanisms for LLM Agents: A Social Psychology Viewcited by 221
  13. 2023Image Hijacks: Adversarial Images can Control Generative Models at Runtimecited by 165
  14. 2024Jailbreaking Attack against Multimodal Large Language Modelcited by 128
  15. 2023Abusing Images and Sounds for Indirect Instruction Injection in Multi-Modal LLMscited by 117
  16. 2024Safety of Multimodal Large Language Models on Images and Textscited by 70
  17. 2023VLATTACK: Multimodal Adversarial Attacks on Vision-Language Tasks via Pre-trained Modelscited by 66

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 9; 2025: 9; 2026: 3.

21 papers.

Sort:

By area:

  1. 2025A Comprehensive Survey in LLM(-Agent) Full Stack Safety: Data, Training and Deploymentcited by 110
  2. 2025A Survey on Trustworthy LLM Agents: Threats and Countermeasurescited by 93
  3. 2024A Survey of Attacks on Large Vision-Language Models: Resources, Advances, and Future Trendscited by 82
  4. 2025A Survey of Safety on Large Vision-Language Models: Attacks, Defenses and Evaluationscited by 66
  5. 2025Safety at Scale: A Comprehensive Survey of Large Model and Agent Safetycited by 63
  6. 2024"Glue pizza and eat rocks" -- Exploiting Vulnerabilities in Retrieval-Augmented Generative Modelscited by 60
  7. 2025Visual Large Language Models for Generalized and Specialized Applicationscited by 35
  8. 2025AgentSafe: Safeguarding Large Language Model-based Multi-agent Systems via Hierarchical Data Managementcited by 35
  9. 2025textitAgents Under Siege: Breaking Pragmatic Multi-Agent LLM Systems with Optimized Prompt Attackscited by 31
  10. 2024NetSafe: Exploring the Topological Safety of Multi-agent Networkscited by 29
  11. 2024Towards Resilient and Efficient LLMs: A Comparative Study of Efficiency, Performance, and Adversarial Robustnesscited by 22
  12. 2024Adversarial Attacks of Vision Tasks in the Past 10 Years: A Surveycited by 22
9 more
  1. 2024Unbridled Icarus: A Survey of the Potential Perils of Image Inputs in Multimodal Large Language Model Securitycited by 18
  2. 2024The Synergy between Data and Multi-Modal Large Language Models: A Survey from Co-Development Perspectivecited by 14
  3. 2025From LLMs to MLLMs to Agents: A Survey of Emerging Paradigms in Jailbreak Attacks and Defenses within LLM Ecosystemcited by 11
  4. 2024Ontology-Aware RAG for Improved Question-Answering in Cybersecurity Educationcited by 9
  5. 2024Systematic Categorization, Construction and Evaluation of New Attacks against Multi-modal Mobile GUI Agentscited by 5
  6. 2025CyberBOT: Towards Reliable Cybersecurity Education via Ontology-Grounded Retrieval Augmented Generationcited by 1
  7. 2026When Agents Go Rogue: Activation-Based Detection of Malicious Behaviors in Multi-Agent Systemscited by 1
  8. 2026SoK: When Safe Agents Fail Together: The Security of Multi Agent LLM Systemscited by 1
  9. 2026Piggybacking on Perception: Stealthy Concurrent Audio Prompt Injections against Multimodal LLM Agentscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025Demonstrations of Integrity Attacks in Multi-Agent Systems
  2. 2026Beyond Single-Model Injection: A Threat Model and Defense Architecture for Prompt Injection in Multi-Agent Systems
  3. 2025ChatInject: Abusing Chat Templates for Prompt Injection in LLM Agents
  4. 2024Automated Red Teaming with GOAT: the Generative Offensive Agent Tester
  5. 2026Architecting Secure AI Agents: Perspectives on System-Level Defenses Against Indirect Prompt Injection Attacks
  6. 2024Prompt Infection: LLM-to-LLM Prompt Injection within Multi-Agent Systems
  7. 2026Don't Trust Stubborn Neighbors: A Security Framework for Agentic Networks
  8. 2025The Dark Side of LLMs: Agent-based Attack Vectors for System-level Compromise