MAPI: Measuring Prompt-Injection Propagation in Multi-Agent LLM Pipelines

RAIDS Lab Authors

Zhengyi Yang

Director

Details

Research Area

Tags

Abstract

Prompt injection in a multi-agent system can outlive the injected text as one role's decision becomes another role's input. We present MAPI, a controlled framework for tracing an unauthorized objective through a sequential LLM pipeline. MAPI uses an application-aware but architecture-agnostic attacker, matched public and restricted sources, and role-aware labels to distinguish local compromise, downstream propagation, and final leakage. Across two generation models in a four-agent email testbed, three generic attack framings produce both stopped and full-chain trajectories with model-dependent susceptibility. Boundary experiments show that retrieval and drafting controls can stop particular paths but do not behave uniformly across models, while writable-position results show that risk depends on reachable capability rather than graph distance alone. MAPI provides a general trajectory protocol, including cross-agent contamination score (CACS) and conditional transitions, for locating where prompt-injection state is adopted, removed, reintroduced, or preserved.