Attack the Messages, Not the Agents: A Multi-round Adaptive Stealthy Tampering Framework for LLM-MAS

TL;DR

This paper introduces MAST, a novel multi-round adaptive tampering framework that exploits communication vulnerabilities in LLM-MAS, achieving high attack success rates while maintaining stealthiness through semantic and embedding similarity constraints.

Contribution

MAST is the first framework combining Monte Carlo Tree Search and preference optimization for adaptive, stealthy attacks on LLM-MAS communication channels.

Findings

MAST outperforms baseline methods in attack success rate.

MAST maintains high stealthiness via semantic similarity constraints.

The framework is effective across diverse tasks and models.

Abstract

Large language model-based multi-agent systems (LLM-MAS) effectively accomplish complex and dynamic tasks through inter-agent communication, but this reliance introduces substantial safety vulnerabilities. Existing attack methods targeting LLM-MAS either compromise agent internals or rely on direct and overt persuasion, which limit their effectiveness, adaptability, and stealthiness. In this paper, we propose MAST, a Multi-round Adaptive Stealthy Tampering framework designed to exploit communication vulnerabilities within the system. MAST integrates Monte Carlo Tree Search with Direct Preference Optimization to train an attack policy model that adaptively generates effective multi-round tampering strategies. Furthermore, to preserve stealthiness, we impose dual semantic and embedding similarity constraints during the tampering process. Comprehensive experiments across diverse tasks, communication architectures, and LLMs demonstrate that MAST consistently achieves high attack success rates while significantly enhancing stealthiness compared to baselines. These findings highlight the effectiveness, stealthiness, and adaptability of MAST, underscoring the need for robust communication safeguards in LLM-MAS.