这是篇讲多智能体LLM安全漏洞的论文，提出ChannelGuard，不额外调用LLM，在Agent间加门控，能防住工具投毒和指令注入，而且实验用了三个不同模型后端，结果很实在。
多智能体LLM应用中，Agent间传递信息的通道缺乏监控，导致指令注入攻击。现有防御主要针对输入边界或依赖云提供商过滤，隐蔽性高。论文提出ChannelGuard，在Agent间通道上设置信息瓶颈门控，通过嵌入相似度评分对比预定义攻击短语库，实现通行、压缩或阻断，无需额外LLM调用。在2,100条测试、8种攻击家族、5种防御、3种后端（Azure GPT-5、Anthropic Sonnet 4.5、Haiku 4.5）的评估中，ChannelGuard的工具输出门控在应用层100%阻断工具投毒（30/30），跨后端一致，而未防御管线完全依赖后端过滤。Prompt Injection攻击成功率从0.333降至0.167，GSM8K准确率保持0.867不变。
ChannelGuard: Safe Models Do Not Compose into Safe Multi-Agent Systems
Multi-agent LLM applications chain a planner, worker agents, a verifier, and a synthesizer, and every hop between agents is an unmonitored channel through which an adversary can smuggle instructions. Existing defenses guard only the input boundary (IBProtector, Llama Guard, perplexity filters, SmoothLLM) or run outside the application as opaque, stochastic provider-side filters. We show this gap carries a consequence rarely measured: on a 2,100-trace evaluation across eight attack families, five defenses, and three model backends, an undefended pipeline that appears fully safe under standard reporting (attack success 0.000 on tool- and memory-poisoning) owes that safety almost entirely to the cloud provider's server-side filter (54 of 60 blocks on Azure GPT-5), and silently shifts to the agent model's own alignment on a backend without such a filter. Outcome-only reporting hides this dependence. We present ChannelGuard, a training-free defense-in-depth framework placing information-bottleneck gates on every inter-agent channel; each scores channel text against an adversarial phrase bank by embedding similarity and deterministically passes, compresses, or blocks it, adding no LLM call, while an attribution method records which layer stopped each attack. ChannelGuard's tool-output gate blocks Tool Poisoning 30 of 30 at the application layer, identically across Azure GPT-5, Anthropic Sonnet 4.5, and Anthropic Haiku 4.5, whereas the undefended pipeline shifts entirely across backends; it also lowers Prompt Injection attack success by half (0.333 to 0.167) and preserves GSM8K accuracy exactly (0.867). White-box adaptive paraphrase evades every embedding gate, where a perturb-and-vote baseline does better. An extended appendix adds baselines, ablations, sweeps, a benign-preservation analysis, and a judge audit (kappa = 0.900), at a total cost of 47.36 USD.