PlanFlip: Attacking Multi-Agent LLM Systems via Planning-Phase Prompt Injection
A new research paper by Yuhang Wang, published on arXiv, identifies a critical security vulnerability in multi-agent LLM systems. The paper, titled "PlanFlip: Attacking Multi-Agent LLM Systems via Planning-Phase Prompt Injection," focuses on the planning phase of these systems as a key attack surface.
Multi-agent LLM systems often rely on a Planner component to break down goals into a sequence of sub-tasks. Downstream Executor and Critic agents then carry out and audit these tasks. The research shows that a single injection into the Planner's context can cause a cascade amplification effect, corrupting all downstream sub-tasks at once.
Four Attack Methods Introduced
The PlanFlip framework includes four distinct planning-phase prompt injection attacks. Each attack is designed to look like a plausible tool output to evade keyword filters. The attacks are:
- GoalSubstitution (PF-1)
- PriorityInversion (PF-2)
- ContextPollution (PF-3)
- RoleConfusion (PF-4)
These attacks target the Planner's decision-making process, altering the goals, priorities, context, or roles within the system.
Key Findings from the Research
The researcher evaluated nine frontier LLMs across 3,479 episodes. The study uncovered three main findings.
First, capability amplifies vulnerability. GPT-5 achieved the highest attack success rate (ASR) at 0.68. This finding contradicts the common assumption that stronger models are inherently more secure.
Stay ahead of the AI curve
The most important updates, news, and content — delivered weekly.
No spam. Unsubscribe anytime.
Second, homogeneous pipelines exhibit a correlated-agent blind spot. GPT-4o and Llama-3.3-70B showed an ASR near 0 but a Stealth score of 1.00 and a StepShift greater than 0. This means the attacks restructured the plans while the Critic, which shares the same backbone model, reported alignment. Two independent judges confirmed a semantic deviation of -0.20 to -0.32, with a correlation coefficient of 0.943.
Third, reasoning-augmented models resist injections. DeepSeek-R1 achieved a StepShift score of 0.00 across all attacks, indicating full resistance.
Proposed Defenses
The paper proposes two defense mechanisms: GoalAnchorCheck (D1) and CrossAgentConsensus (D2). These defenses achieved detection rates up to 1.00 and outperformed same-backbone baselines in 15 out of 16 test cells.
The key insight from the research is that heterogeneous model diversity is a security prerequisite for multi-agent systems. Redundancy within a homogeneous backbone provides no protection against planning-phase attacks.
Implications for Multi-Agent Systems
This research highlights a significant security gap in the design of multi-agent LLM systems. As these systems become more common in applications like automated workflows, code generation, and complex task execution, the planning phase emerges as a critical point of vulnerability. The findings suggest that developers should consider using diverse models for different agents and implementing specific detection mechanisms to guard against planning-phase injections.
The paper is available on arXiv under the identifier 2607.16199 and was submitted on April 30, 2026.