ML Security PapersACIArena: Toward Unified Evaluation for Agent Cascading Injection
Hengyu An 1,2, Minxi Li 1, Jinghuai Zhang 3, Naen Xu 1, Chunyi Zhou 1, Changjiang Li 4, Xiaogang Xu 1, Tianyu Du 1,5, Shouling Ji 1
Published on arXiv
2604.07775
Prompt Injection
OWASP LLM Top 10 — LLM01
Excessive Agency
OWASP LLM Top 10 — LLM08
Key Finding
Demonstrates that robust MAS require deliberate role design and controlled interaction patterns beyond topology; narrowly scoped defenses may introduce new vulnerabilities
ACIArena
Novel technique introduced
Collaboration and information sharing empower Multi-Agent Systems (MAS) but also introduce a critical security risk known as Agent Cascading Injection (ACI). In such attacks, a compromised agent exploits inter-agent trust to propagate malicious instructions, causing cascading failures across the system. However, existing studies consider only limited attack strategies and simplified MAS settings, limiting their generalizability and comprehensive evaluation. To bridge this gap, we introduce ACIArena, a unified framework for evaluating the robustness of MAS. ACIArena offers systematic evaluation suites spanning multiple attack surfaces (i.e., external inputs, agent profiles, inter-agent messages) and attack objectives (i.e., instruction hijacking, task disruption, information exfiltration). Specifically, ACIArena establishes a unified specification that jointly supports MAS construction and attack-defense modules. It covers six widely used MAS implementations and provides a benchmark of 1,356 test cases for systematically evaluating MAS robustness. Our benchmarking results show that evaluating MAS robustness solely through topology is insufficient; robust MAS require deliberate role design and controlled interaction patterns. Moreover, defenses developed in simplified environments often fail to transfer to real-world settings; narrowly scoped defenses may even introduce new vulnerabilities. ACIArena aims to provide a solid foundation for advancing deeper exploration of MAS design principles.
Key Contributions
- Unified framework (ACIArena) for systematically evaluating multi-agent system robustness across multiple attack surfaces and objectives
- Benchmark of 1,356 test cases covering six MAS implementations with attack strategies spanning external inputs, agent profiles, and inter-agent messages
- Empirical findings showing topology-based robustness evaluation is insufficient and defenses from simplified environments often fail to transfer to real-world MAS