Secure Agentic AI and Multimodal Intelligence in 6G Communication Systems
Organizations: Qualcomm Wireless Research, San Diego, CA 92121, USA · Department of Computer Science and Engineering, BITS Pilani, Pilani Campus, Rajasthan 333031, India · Department of Electrical and Computer Engineering, National University of Singapore 117583, Singapore · Department of Electrical and Electronics Engineering, BITS Pilani, Pilani Campus, Rajasthan 333031, India
Abstract
Sixth-generation (6G) communication systems are expected to support immersive, intent-driven, and latency-critical services through tight integration of multimodal intelligence, edge computing, and autonomous network control. In this setting, agentic AI systems can reason over heterogeneous inputs, use tools and network functions, coordinate across distributed entities, and adapt to dynamic environments. These capabilities make agentic multimodal intelligence promising for 6G applications such as semantic communications, digital twins, and zero-touch network management, but they also introduce security and privacy risks that extend beyond conventional AI and network security models. Vulnerabilities can propagate across multimodal data pipelines, memory, tools, communication interfaces, and inter-agent coordination loops. We survey multimodal intelligence and agentic AI for 6G cross-layered communication systems from the perspectives of privacy and security. We present a 6G-oriented system view spanning perception, memory, tool use, and multi-agent orchestration; analyze threat models and attack surfaces across sensing, cognition, action, memory, and communication layers; organize existing attacks into a structured taxonomy; and review mitigation strategies including prompt and memory defenses, inter-agent trust mechanisms, secure orchestration, and privacy-preserving learning. We conclude by outlining open research directions for trustworthy multimodal multi-agent 6G systems.
Figures & tables
| Dimension | LLM Systems | Agentic AI Systems | Multimodal Multi-Agent 6G Systems |
|---|---|---|---|
| Primary function | Text generation and question answering | Goal-directed reasoning with tools and memory | Context-aware orchestration across communication, sensing, computing, and control layers |
| Input modalities | Mostly text | Primarily text with optional structured context | Text, audio, video, sensor streams, telemetry, location, and contextual metadata |
| State handling | Largely session-bounded | Persistent memory and task history | Persistent, distributed, and cross-domain state across device, edge, RAN, core, and digital twins |
| Tool interaction | Limited or optional | Direct API and tool invocation | Tool use tied to network functions, orchestration APIs, telemetry systems, and edge/cloud services |
| Coordination pattern | Single model response | Single-agent or simple chained workflows | Multi-agent, distributed, hierarchical, and latency-sensitive coordination |
| Failure propagation | Usually localized to a session | Can persist across tasks and tools | Can propagate across agents, network domains, slices, QoE pipelines, and control loops |
| Survey direction | Agentic | Multimodal | 6G | Sec/Priv | Key limitation |
| LLM security survey [ 9 ] | Partial | Limited | No | Yes | No agent memory, tools, multi-agent, or 6G focus. |
| LLM-agent security [ 8 , 34 ] | Yes | Limited | No | Yes | No multimodal 6G orchestration or communication metrics. |
| AI-enabled 6G surveys [ 1 , 2 , 36 , 30 ] | Partial | Partial | Yes | Partial | AI used as optimizer, not prompt-driven agents. |
| 6G security & blockchain/AI [ 47 , 37 , 40 , 39 ] | Limited | Partial | Yes | Yes | No unified model of prompts, memory, trust, and tool abuse. |
| GenAI communications [ 10 , 48 , 41 ] | Yes | Partial | Yes | Partial | No cross-layer security taxonomy for 6G agent loops. |
| Multimodal MLLM safety [ 42 , 31 ] | Partial | Yes | No | Partial | Model-level only; no 6G orchestration analysis. |
| Scenario | Entry point | Propagation path | Consequence in Network | Containment direction | Violated 6G Metric |
| Zero-touch slice-management prompt injection [ 6 ] | Malicious inputs in tickets, logs, or user requests | Agent misinterprets the intent, leading to wrong slice/resource decisions | Wrong slice allocation, QoS drop, policy violation | Input sanitization, intent validation, least-privilege, human override | Slice SLA integrity; IMT-2030 sub-1 ms URLLC latency [ 66 ] |
| Cross-modal QoE spoofing (immersive apps) [ 67 ] | Adversarial visual, audio, gaze, or context signals | Faulty fusion leads to semantic misinterpretation | QoE degradation, latency mismatch, poor adaptation | Cross-modal validation, anomaly detection, fallback policies | Immersive-service QoE; IMT-2030 uplink/downlink experience targets [ 66 ] |
| Poisoned digital-twin state (edge control) [ 68 ] | Tampered telemetry or historical data | Corrupted state leading to faulty predictions | Resource misallocation, instability, repeated control errors | Authenticated data, state consistency checks, rollback | Closed-loop control reliability; 3GPP Rel-18 ZSM consistency [ 30 ] |
| Inter-agent trust compromise [ 69 , 70 ] | Spoofed agent identity or messages | False context leading to cascading coordination errors | Conflicting decisions, service disruption, unsafe actions | Agent authentication, message integrity, trust scoring, isolation | Orchestration availability; 99.999% reliability for critical services [ 66 ] |
| Threat | Description | Targeted Asset | 6G Layer Impacted | System Consequence |
| Memory poisoning | Malicious context is inserted into persistent or short-term memory to bias future decisions | Memory stores, retrieval pipelines, digital twin state | Edge/cloud intelligence, orchestration, service state | Persistent misconfiguration, incorrect personalization, and long-horizon decision drift |
| Tool misuse | agent is induced to invoke unsafe or unintended APIs, tools, or workflows | Tool interfaces, network APIs, execution permissions | Management plane, orchestration interfaces, service platforms | Unauthorized actions, workflow disruption, and operational instability |
| Privilege escalation | Agent exceeds intended authority through manipulated prompts, policies, or chained actions | Guardrails, authorization context, policy state | Control plane, slice management, policy enforcement | access to restricted resources, unsafe reconfiguration, and policy violations |
| Cascading hallucinations | Incorrect outputs are reused by downstream agents or tools as trusted facts | Inter-agent context, reasoning state, shared knowledge | Multi-agent coordination, decision loops | Propagated errors, conflicting actions, and degraded QoE |
| Data exfiltration | Sensitive information is leaked through apparently legitimate communication channels | User data, telemetry, memory, policy data | Communication services, data plane, monitoring systems | Privacy loss, intellectual property leakage, and regulatory exposure |
| Coordination exploitation | A malicious or compromised agent manipulates distributed collaboration and task handoffs | Agent identity, messaging channels, shared state | Device-edge-cloud coordination, orchestration fabric | Cross-domain failures, trust collapse, and inconsistent system behavior |
| Attack | Targeted Component | Defense Strategy | 6G Deployment Context | Residual Challenge |
| Prompt injection | Prompt interface, reasoning context, retrieved content | Input segmentation, provenance checks, instruction delimiting, policy-aware parsing | Operator interfaces, intent agents, orchestration workflows | Semantic ambiguity and long-context evasion |
| Jailbreaking | Agent cognition, safety guardrails, tool invocation logic | Alignment hardening, policy verification, bounded autonomy, runtime approval gates | Zero-touch management, service automation, edge assistants | Multimodal and cross-agent jailbreak transfer |
| Tool chaining abuse | Tool outputs, API call sequences, delegated actions | Typed interfaces, least privilege, simulation-before-execution, action logging | Network orchestration, digital twins, slice control | Complex chains spanning multiple tools and agents |
| Memory tampering | Short-term context, long-term memory, vector stores | Authenticated updates, rollback, retrieval validation, retention policies | Personalization, incident history, digital twin state | Balancing adaptability with strict memory governance |
| Data poisoning | Telemetry repositories, knowledge bases, external corpora | Source validation, anomaly detection, data provenance, agreement-based retrieval | Edge analytics, fault diagnosis, semantic knowledge bases | Subtle poisoning in dynamic and distributed data streams |
| Model extraction | Model behavior, policy-selection logic, agent responses | Query monitoring, rate limiting, watermarking, response shaping | Exposed edge services, public APIs, agent-facing interfaces | Utility loss and collaborative extraction attacks |
AI Agent Security
Artificial intelligence agent security studies attacks and safeguards for tool-using, persistent, and collaborative systems across digital and physical settings.
See all 510 papers