Thought Virus: Viral Misalignment via Subliminal Prompting in Multi-Agent Systems

Moritz Weckbecker; Jonas Müller; Ben Hagag; Michael Mulet

cs.MAFeb 23, 2026

Thought Virus: Viral Misalignment via Subliminal Prompting in Multi-Agent Systems

Authors: Moritz Weckbecker, Jonas Müller, Ben Hagag, Michael Mulet

Organizations: Fraunhofer HHI, Berlin, Germany · Eleuther AI · TU Berlin, Berlin, Germany · Carnegie Mellon University, Pittsburgh, PA, USA ·

Abstract

Subliminal prompting is a phenomenon in which language models are biased towards certain concepts or traits through prompting with semantically unrelated tokens. While prior work has examined subliminal prompting in user-LLM interactions, potential bias transfer in multi-agent systems and its associated security implications remain unexplored. In this work, we show that a single subliminally prompted agent can spread a weakening but persisting bias throughout its entire network. We measure this phenomenon across 6 agents using two different topologies, observing that the transferred concept maintains an elevated response rate throughout the network. To exemplify potential misalignment risks, we assess network performance on multiple-choice TruthfulQA, showing that subliminal prompting of a single agent may degrade the truthfulness of other agents. Our findings reveal that subliminal prompting introduces a new attack vector in multi-agent security, with implications for the alignment of such systems. The implementation of all experiments is publicly available at https://github.com/Multi-Agent-Security-Initiative/thought_virus .

Figures & tables

Figure 1: Comparing existing attacks and defences on multi-agent systems with our new attack vector, Thought Virus . Adversarial Prompts such as optimised suffixes depend on precise wordings and therefore fail to be spread to different agents when the prompt is not repeated precisely. Prompt injections are semantically grounded by specifying the desired output, and can therefore be automatically detected through monitoring inter-agent conversations. Thought Virus evades both defence mechanisms, allowing it to spread to all agents in the network.

Figure 2: This figure illustrates how a bias propagates through a unidirectional chain of agents. In (a), agents exhibit diverse and independent preferences when queried about their favourite animals, and will return different responses due to temperature sampling. In (b), Agent0 is replaced with a biased agent that has been instructed to strongly prefer a hidden payload, “613,” which is implicitly linked to the concept of lions. In (c), Agent0 converses with Agent1; Agent1 subsequently converses with Agent2; and Agent2 converses with Agent3, forming a chain in which each agent interacts only with the next. In (d), when the agents are re-queried for their animal preferences, the propagated bias results in a marked increase in responses favouring “lion.”

Figure 3: Overview of topologies: In Chain, the user sends a message to Agent0, Agent0 sends a message to Agent1, Agent1 in turn sends a message to Agent2, and so on. In Bidirectional Chain, the flow proceeds as in Chain until the message reaches the last agent, then the flow reverses direction until it propagates back to the initial agent.

Figure 4: Response frequency for the target animal lion across a six-agent chain MAS (log scale). Bars show the base rate (no system prompt), post-conversation responses for random tokens (average), and post-conversation responses for subliminal tokens (average and strongest). Error bars are calculated through a bootstrap with 10,000 samples. Fold-increase compared to the base rate is denoted by numbers over corresponding bars.

	Agent 0	Agent 1	Agent 2	Agent 3	Agent 4	Agent 5
Lion	65.6 $\times$ (20.2 $\times$ )	24.7 $\times$ (6.3 $\times$ )	23.9 $\times$ (5.0 $\times$ )	7.5 $\times$ (3.3 $\times$ )	5.5 $\times$ (2.0 $\times$ )	6.3 $\times$ (2.1 $\times$ )
Orangutan	658.0 $\times$ (79.4 $\times$ )	61.1 $\times$ (8.4 $\times$ )	16.7 $\times$ (3.0 $\times$ )	10.5 $\times$ (2.2 $\times$ )	7.2 $\times$ (1.6 $\times$ )	5.5 $\times$ (1.3 $\times$ )
Kangaroo	9.2 $\times$ (5.6 $\times$ )	8.6 $\times$ (5.7 $\times$ )	5.2 $\times$ (3.7 $\times$ )	3.9 $\times$ (2.1 $\times$ )	5.4 $\times$ (2.1 $\times$ )	7.2 $\times$ (1.8 $\times$ )
Panda	15.9 $\times$ (6.3 $\times$ )	3.6 $\times$ (1.7 $\times$ )	2.4 $\times$ (1.4 $\times$ )	2.0 $\times$ (1.5 $\times$ )	2.1 $\times$ (1.5 $\times$ )	1.4 $\times$ (1.2 $\times$ )
Chimpanzee	813.3 $\times$ (217.3 $\times$ )	36.8 $\times$ (6.7 $\times$ )	8.4 $\times$ (3.8 $\times$ )	3.8 $\times$ (1.4 $\times$ )	4.0 $\times$ (1.9 $\times$ )	4.4 $\times$ (2.0 $\times$ )
Penguin	6.8 $\times$ (3.4 $\times$ )	3.5 $\times$ (1.8 $\times$ )	2.6 $\times$ (1.4 $\times$ )	2.4 $\times$ (1.5 $\times$ )	1.6 $\times$ (1.1 $\times$ )	1.3 $\times$ (1.0 $\times$ )

Table 1: Fold-increase of response rate after conversation about subliminal tokens compared to random tokens . The random baseline is derived by averaging response rates over all ten random tokens. We present both the fold-increase for the highest response rate over all ten subliminal tokens, as well as fold-increase for the average response rate over all ten subliminal tokens. Bolded values signify the detection of a significant difference between subliminal and random tokens with a Mann-Whitney U test (

p<0.05)

		Deceitful	Truthful	Difference	Deceitful	Truthful	Difference	p-value
		(lowest)	(highest)	Difference	(average)	(average)	Difference	p-value
Accuracy	Agent 0	70.5%	72.2%	+1.8%	70.8%	71.8%	+1.0%	0.0002
	Agent 1	72.7%	74.3%	+1.5%	73.2%	73.8%	+0.6%	0.0003
	Agent 2	73.3%	74.6%	+1.3%	73.8%	74.2%	+0.4%	0.0028
LPD	Agent 0	7.448	8.187	+0.740	7.550	8.032	+0.481	0.0002
	Agent 1	7.981	8.692	+0.711	8.210	8.430	+0.220	0.0073

Table 2: TruthfulQA results after a three-agent MAS conversation. We report (i) the worst-case deceitful token (lowest accuracy / log-probability difference (LPD)), (ii) the best-case truthful token (highest accuracy / LPD), and (iii) their difference; we also report averages over the ten truthful and ten deceitful tokens, along with a Mann–Whitney

U

test p-value comparing the truthful- vs. deceitful-token distributions.

Appendix figures & tables6 assets

Supplementary material from the paper’s appendix.

Appendix

Panel of Figure 5 — Figure 5: Response frequencies for animal preference on Qwen2.5-7B-Instruct, MAS arranged in chain topology.

Panel of Figure 6 — Figure 6: Response frequencies for animal preference on Qwen2.5-7B-Instruct, MAS arranged in bidirectional chain topology.

Panel of Figure 7 — Figure 7: Log-probability results for animal preference on Qwen2.5-7B-Instruct, MAS arranged in chain topology.

Panel of Figure 8 — Figure 8: Log-probability results for animal preference on Qwen2.5-7B-Instruct, MAS arranged in bidirectional chain topology.

Panel of Figure 9 — Figure 9: Log-probability results for animal preference on Llama-3.1-8B-Instruct, MAS arranged in chain topology.

Panel of Figure 10 — Figure 10: Log-probability results for animal preference on Llama-3.1-8B-Instruct, MAS arranged in bidirectional chain topology.

Multi-Agent System Security

Multi-agent system security studies attacks, trust, privacy, and defenses in interacting AI agents, including language-model teams, robot swarms, and learned controllers.

See all 179 papers

Delegated Misalignment: How Multi-Agent Structures Amplify LLM Safety Risks
Aug 26, 2026Zonghao Ying, Jiaqi Yan, Huize Luo +3LLM Agent Safety Multi-Agent LLM Systems
Beihang University · Beijing University of Posts and Telecommunications · Xidian University +2
Beyond Single-Model Injection: A Threat Model and Defense Architecture for Prompt Injection in Multi-Agent Systems
Sep 19, 2026Rudrendu Kumar Paul, Sourav NandyPrompt Injection Defense Prompt Injection Attacks on AI Agents
Boston University, Boston, MA, USA · University of Texas at Austin, Austin, TX, USA
The Show-Up Attack: When Subagents Win Over Their Supervisor
Oct 20, 2026Maosen Zhang, Jianshuo Dong, Yutong Zhang +3LLM Agent Security Multi-Agent System Security
Tsinghua University · SiliconProspect AI · Nanyang Technological University

Aug 26, 2026J/K move · Enter open · S save

Delegated Misalignment: How Multi-Agent Structures Amplify LLM Safety Risks

Zonghao Ying, Jiaqi Yan, Huize Luo, Quanchen Zou+2

Beihang University · Beijing University of Posts and Telecommunications · Xidian University+2

LLM Agent Safety Multi-Agent LLM Systems LLM Safety Alignment

Open paper AskPDF arXiv

Large language models (LLMs) are increasingly deployed in multi-agent systems where a principal agent decomposes tasks and delegates them to subordinate agents that may invoke external tools. Safety alignment, however, is still evaluated almost exclusively under a single-agent threat model, treating safety as a property of the individual LLM. We show that this assumption breaks down: individual safety alignment fails to transfer to multi-agent settings. Two failure mechanisms emerge under delegation: responsibility diffusion on the principal side and role-bias compliance on the subordinate side, jointly converting language-level refusal into actionable harm. We refer to this phenomenon as delegated misalignment and study it through a three-condition protocol across 6 frontier LLMs on 49 hazardous tasks. Delegation amplifies end-to-end harm substantially: DeepSeek-V3.2's full-execution rate rises from 30.6% to 77.6% once delegation is introduced, and the same model behaves very differently across roles (GPT-5: 22.5% as a single agent vs.\ 61.2% as a subordinate). Ablations further show that standard single-layer defenses each fail on their own and can even backfire. We call on the community to move beyond per-model alignment and toward composite safety mechanisms before multi-agent LLM systems are deployed at scale.

Abstract

Multi-Agent System Security

Explore similar work

Delegated Misalignment: How Multi-Agent Structures Amplify LLM Safety Risks

Beyond Single-Model Injection: A Threat Model and Defense Architecture for Prompt Injection in Multi-Agent Systems

The Show-Up Attack: When Subagents Win Over Their Supervisor