Multi-agent backdoors that no single message can trigger: activation waits until peer evidence crosses a hidden threshold

arXiv 2608.01085·medium signalXBlueskyLinkedInCopy link

This attack breaks the assumption behind per-message injection scanning — backdoor behavior in LLM multi-agent systems activates only when accumulated peer evidence reaches a hidden threshold, so no individual message is classifiable as malicious. Boundary-Conditioned Backdoor Injection constructs counterfactual pairs that separate normal behavior from the adversarial objective, making the trigger a property of the collective conversation rather than any input. The proposed defense, LATTE, is clean-only: it learns benign communication patterns and flags anomalous agent latent transitions before they propagate, requiring no prior knowledge of the trigger or target — the right shape of defense for anyone running agents that pass messages to each other, where input-side filtering is structurally insufficient.