mlsanityData to 14 Oct 2026

Thought Virus: Viral Misalignment via Subliminal Prompting in Multi-Agent Systems

arXiv 2603.00131 ↗First posted 23 Feb 2026cs.MA cs.AIcited by 9

On the map: LLM reasoning → Reasoning for agents, planning and code

also in 1 more
Abstract (arXiv)

Subliminal prompting is a phenomenon in which language models are biased towards certain concepts or traits through prompting with semantically unrelated tokens. While prior work has examined subliminal prompting in user-LLM interactions, potential bias transfer in multi-agent systems and its associated security implications remain unexplored. In this work, we show that a single subliminally prompted agent can spread a weakening but persisting bias throughout its entire network. We measure this phenomenon across 6 agents using two different topologies, observing that the transferred concept maintains an elevated response rate throughout the network. To exemplify potential misalignment risks, we assess network performance on multiple-choice TruthfulQA, showing that subliminal prompting of a single agent may degrade the truthfulness of other agents. Our findings reveal that subliminal prompting introduces a new attack vector in multi-agent security, with implications for the alignment of such systems. The implementation of all experiments is publicly available at https://github.com/Multi-Agent-Security-Initiative/thought_virus .

Key facts. Cited by 9 papers in the map (data through 14 Oct 2026). Placed in Reasoning for agents, planning and code, one of 17 directions in LLM reasoning. Builds on 28 of its 29 references that are in the map. First posted on arXiv 23 Feb 2026.

Builds on

28 of 29 references.

Closest ancestors · 1

Same direction, newest first

  1. 2025Talk Isn't Always Cheap: Understanding Failure Modes in Multi-Agent Debate5 Sep

Other references · 27

  1. 2024The Llama 3 Herd of Modelscited by 14,715
  2. 2024Qwen2.5 Technical Reportcited by 4,942
  3. 2023Quantifying Language Models' Sensitivity to Spurious Features in Prompt Design or: How I learned to start worrying about prompt formattingcited by 817
  4. 2023AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Modelscited by 785
  5. 2024Large Language Model based Multi-Agents: A Survey of Progress and Challengescited by 769
  6. 2023Baseline Defenses for Adversarial Attacks Against Aligned Language Modelscited by 651
  7. 2023Prompt Injection attack against LLM-integrated Applicationscited by 605
  8. 2024Jailbreak Attacks and Defenses Against Large Language Models: A Surveycited by 230
  9. 2025Emergent Misalignment: Narrow finetuning can produce broadly misaligned LLMscited by 172
  10. 2025Multi-Agent Risks from Advanced AIcited by 163
  11. 2024ProSA: Assessing and Understanding the Prompt Sensitivity of LLMscited by 149
  12. 2025LlamaFirewall: An open source guardrail system for building secure AI agentscited by 127
15 more
  1. 2025X-Teaming: Multi-Turn Jailbreaks and Defenses with Adaptive Multi-Agentscited by 125
  2. 2025Red-Teaming LLM Multi-Agent Systems via Communication Attackscited by 122
  3. 2024On the Resilience of LLM-Based Multi-Agent Collaboration with Faulty Agentscited by 99
  4. 2024Attention Tracker: Detecting Prompt Injection Attacks in LLMscited by 95
  5. 2025Subliminal Learning: Language models transmit behavioral traits via hidden signals in datacited by 95
  6. 2025Open Challenges in Multi-Agent Security: Towards Secure Systems of Interacting AI Agentscited by 71
  7. 2025PromptShield: Deployable Detection for Prompt Injection Attackscited by 50
  8. 2025Understanding the Information Propagation Effects of Communication Topologies in LLM-based Multi-Agent Systemscited by 43
  9. 2025textitAgents Under Siege: Breaking Pragmatic Multi-Agent LLM Systems with Optimized Prompt Attackscited by 34
  10. 2025Towards Understanding Subliminal Learning: When and How Hidden Biases Transfercited by 34
  11. 2024An Early Categorization of Prompt Injection Attacks on Large Language Modelscited by 30
  12. 2025Promptception: How Sensitive Are Large Multimodal Models to Prompts?cited by 13
  13. 2024Stealthy Jailbreak Attacks on Large Language Models via Benign Data Mirroringcited by 12
  14. 2024Talking Nonsense: Probing Large Language Models' Understanding of Adversarial Gibberish Inputscited by 11
  15. 2024A Troublemaker with Contagious Jailbreak Makes Chaos in Honest Townscited by 9

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2026: 9.

9 papers.

  1. 2026Subliminal Learning Is Steering Vector Distillationcited by 13
  2. 2026Emergent and Subliminal Misalignment Through the Lens of Data-Mediated Transfercited by 8
  3. 2026Mind Viruses: Self-Propagating Ideas in Multi-Agent LLM Systemscited by 4
  4. 2026Architecture Matters for Multi-Agent Securitycited by 3
  5. 2026Mitigating Misalignment Contagion by Steering with Implicit Traitscited by 1
  6. 2026Model Hypnosis: Strong control of AI via additive subliminal effectscited by 1
  7. 2026Testing Interchangeability in LLM Agent Teamscited by 1
  8. 2026Can Data Attribution Filter Out Subliminal Learning? Not Reliablycited by 0
  9. 2026Disentangling Models from Personas in Heterogeneous LLM Simulationscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026Subliminal Transfer of Unsafe Behaviors in AI Agent Distillation
  2. 2025Exposing Weak Links in Multi-Agent Systems under Adversarial Prompting
  3. 2024Prompt Infection: LLM-to-LLM Prompt Injection within Multi-Agent Systems
  4. 2025Demonstrations of Integrity Attacks in Multi-Agent Systems
  5. 2025Subliminal Corruption: Mechanisms, Thresholds, and Interpretability
  6. 2026When Prompts Control Robots: Prompt Injection Attacks in Multi-Agent Robotic Systems
  7. 2025Thought Crime: Backdoors and Emergent Misalignment in Reasoning Models
  8. 2025Preventing Prompt Injection with Type-Directed Privilege Separation