Compositional Check Catches Prompt Injection Split Across Robots

A three-tier framework caught an indirect injection that split a prohibited task across four platforms, invisible to every per-platform monitor, per a new arXiv paper.

Guardrails that watch one robot at a time can't catch this by design. Each platform's slice of the task is individually compliant, and the violation only exists once the actions combine. For operators running multi-robot ISR missions with LLM planners, an attack can pass every per-platform check and still add up to a banned operation.

The paper's fix is a three-tier framework: platform, squad, and mission. It splits a mission's policy into per-agent and cross-agent aspects, then aggregates the verdicts over what the authors call a verification-aware messaging fabric.

When the framework flags a compositional violation, it names which platforms jointly triggered it, not just that something went wrong somewhere. That's what caught the four-platform case. An indirect injection got real LLM planners to split a prohibited collection task across the fleet. The mission-level check saw the pattern no per-platform monitor could see alone.

The paper also ran an injected fault campaign. Under fault conditions, a best-effort central monitor emitted silent false all-clears. The verification-aware fabric emitted none.