Abstract
Multi-agent LLM applications integrate planners, worker agents, verifiers, and synthesizers, with each hop being an unmonitored channel through which adversaries can smuggle instructions. Existing defenses only guard the input boundary (IBProtector, Llama Guard, perplexity filters, SmoothLLM) or operate outside the application as opaque, stochastic provider-side filters. We show that this gap has a rarely measured consequence: in a 2,100-trace evaluation across eight attack families, five defenses, and three model backends, an undefended pipeline appears fully safe under standard reporting (attack success 0.000 on tool- and memory-poisoning) and owes that safety almost entirely to the cloud provider's server-side filter (54 of 60 blocks on Azure GPT-5), and silently shifts to the agent model's own alignment on a backend without such a filter. Outcome-only reporting hides this dependence.
We present ChannelGuard, a training-free defense-in-depth framework placing information-bottleneck gates on every inter-agent channel; each gate scores channel text against an adversarial phrase bank by embedding similarity and deterministically passes, compresses, or blocks it, adding no LLM call, while an attribution method records which layer stopped each attack. ChannelGuard's tool-output gate blocks Tool Poisoning 30 of 30 at the application layer, identically across Azure GPT-5, Anthropic Sonnet 4.5, and Anthropic Haiku 4.5, whereas the undefended pipeline shifts entirely across backends; it also lowers Prompt Injection attack success by half (0.333 to 0.167) and preserves GSM8K accuracy exactly (0.867). White-box adaptive paraphrase evades every embedding gate, where a perturb-and-vote baseline does better. An extended appendix adds baselines, ablations, sweeps, a benign-preservation analysis, and a judge audit (kappa = 0.900), at a total cost of 47.36 USD.
Blogger's Review: ChannelGuard presents an effective defense mechanism by introducing information bottlenecks in multi-agent systems, addressing the shortcomings of existing defenses. This approach enhances system security while reducing reliance on cloud service providers, demonstrating the potential of defense-in-depth strategies. Future research could further optimize embedding similarity scoring and the construction of adversarial phrase banks.