面向多模态多智能体推理的分层攻击
Hierarchical Attacks for Multi-Modal Multi-Agent Reasoning
对做多模态大模型/VLM 智能体的人，这篇给出了一个可复用的分层攻击面清单：视觉输入扰动、图文融合表示扰动、共享上下文与通信拓扑篡改、以及推理链偏置，可直接用来做红队测试或设计鲁棒性防御。
原文依据 at the perception layer, HAM\textsuperscript 3 mounts attacks by perturbing visual inputs, textual inputs, and their fused visual-textual representations
摘要译文
由模型翻译 · 术语统一 · 请对照原文核对关键结论多模态多智能体系统（MM-MAS）因能够跨多种模态实现复杂推理与协同而受到越来越多的关注。随着这类系统在规模与功能上持续扩展，探究其潜在脆弱性变得日益重要。然而，现有关于多智能体系统对抗攻击的研究主要集中于孤立智能体或单模态设定，MM-MAS 的脆弱性仍 largely 未被充分探索。为填补这一空白，我们提出 HAM\textsuperscript 3，一个面向多模态多智能体系统的分层攻击框架，将攻击分解为三个相互关联的层次。具体而言，在感知层，HAM\textsuperscript 3 通过扰动视觉输入、文本输入及其融合的视觉-文本表示来实施攻击。在通信层，它执行通信级攻击，破坏消息内容与交互拓扑，例如操纵共享上下文或通信链路以扭曲集体信息流。在推理层，它实施推理级攻击，干扰每个智能体的认知流程，使推理轨迹产生偏置，并最终损害最终决策。我们在 GQA 基准上，通过基于 ReAct、Plan-and-Solve 与 Reflexion 等不同推理范式构建的多智能体系统对 HAM\textsuperscript 3 进行评估。实验表明，该框架取得了最高 78.3% 的攻击成功率，其中推理层攻击最为有效。超过半数的成功攻击导致多个智能体产生一致的错误。这些发现为构建更鲁棒、更可解释的多智能体智能提供了有价值的洞见。
英文原文摘要 1776 字符
Multi-modal multi-agent systems (MM-MAS) have gained increasing attention for their capacity to enable complex reasoning and coordination across diverse modalities. As these systems continue to expand in scale and functionality, investigating their potential vulnerabilities has become increasingly important.However, existing studies on adversarial attacks in multi-agent systems primarily focus on isolated agents or unimodal settings, leaving the vulnerabilities of MM-MAS largely underexplored. To bridge this gap, we introduce HAM\textsuperscript 3 , a Hierarchical Attack framework for multi-modal multi-agent systems that decomposes attacks into three interconnected layers. Specifically, at the perception layer, HAM\textsuperscript 3 mounts attacks by perturbing visual inputs, textual inputs, and their fused visual-textual representations. At the communication layer, it performs communication-level attacks that corrupt message content and interaction topology, such as manipulating shared context or communication links to distort collective information flow. At the reasoning layer, it conducts reasoning-level attacks that interfere with each agent's cognitive pipeline, biasing reasoning trajectories and ultimately compromising final decisions. We evaluate HAM\textsuperscript 3 on the GQA benchmark through multi-agent systems built on distinct reasoning paradigms including ReAct, Plan-and-Solve, and Reflexion. Experiments demonstrate that our framework achieves an Attack Success Rate of up to 78.3%, with reasoning-layer attacks being the most effective. More than half of the successful attacks lead multiple agents to produce consistent errors. These findings offer valuable insights for building more robust and interpretable multi-agent intelligence.