Research map / Multi-agent systems and games / LLM agents

Hierarchical Attacks for Multi-Modal Multi-Agent Reasoning

CVPR 2026 · Multi-agent systems and games › LLM agents · approach: Agent safety and attack benchmarks · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes HAM³, a three-layer (perception, communication, reasoning) attack framework for multimodal multi-agent systems, evaluated on GQA with OxyGent-based MAS under ReAct, Plan-and-Solve, and Reflexion.

Problem

Adversarial vulnerabilities of multi-modal multi-agent systems remain underexplored; existing multi-agent attacks focus on isolated agents or unimodal, content-level manipulations rather than topology or reasoning dynamics.

Approach

Decomposes attacks on MM-MAS into perception (cross-modal injection), communication (spoofing, structural blocking, memory pollution, shared context injection), and reasoning (chain-of-thought injection) layers, and measures how perturbations propagate to produce systemic errors across agents.

Key results

• Reasoning-layer CIA attack reaches 78.3% ASR under ReAct with Qwen2.5-VL-7B, above the best communication attack (SBA, 65.0%) and perception attack (CMA, 60.8%).
• Reflexion is the most robust paradigm; under CIA its ASR is 61.7% for Qwen-7B versus about 78% for ReAct.
• Systemic errors dominate in perception (58.8%) and reasoning (58.4%) layers, meaning multiple agents often converge on the same wrong answer.

Surprising findings

• Tool spoofing (TSA) reaches 76.7% ASR under ReAct with Qwen-7B, nearly matching the best reasoning-layer attack.
• Larger and stronger models show only modestly lower ASR, with GPT-4o still at 65.0% under CIA.

Limitations

• Evaluation is limited to GQA subset of 5,984 training-split samples and one MAS framework (OxyGent).
• Attack descriptions are high-level; key implementation details and the promised benchmark are not fully specified.
• Textual attacks generated by GPT-4o and visual attacks by Nano Banana may introduce confounds in attack quality.

Experimental setup

Datasets: GQA

Benchmarks: GQA EvoChart-QA

Metrics: Attack Success Rate Task Success Rate Hallucination Error Rate Cross-Modal Consistency

Baselines: VIA TIA TSA RMA

Builds on: ReAct Plan-and-Solve Reflexion OxyGent

Closest papers by meaning

• When Embedding-Based Defenses Fail: Rethinking Safety in LLM-Based Multi-Agent Systems (ICML 2026 · similarity 0.87)
• Securing Multi-Agent Systems Against Corruptions via Node Contribution Backpropagation (ICML 2026 · similarity 0.87)
• When Agents Go Rogue: Activation-Based Detection of Malicious Behaviors in Multi-Agent Systems (ICML 2026 · similarity 0.86)
• MAS-Orchestra: Understanding and Improving Multi-Agent Reasoning Through Holistic Orchestration and Controlled Benchmarks (ICML 2026 · similarity 0.86)
• Goal-Aware Identification and Rectification of Misinformation in Multi-Agent Systems (ICLR 2026 · similarity 0.86)
• Systematic Failures in Collective Reasoning under Distributed Information in Multi-Agent LLMs (ICML 2026 · similarity 0.85)