跨用户投毒：多用户协作语言智能体的用户与任务边界失效

View PDF HTML (experimental)

Abstract:Language agents are moving from single-user assistants to shared collaborators in workspaces, forums, and group chats. A shared agent observes interleaved messages from multiple users, maintains persistent context, and executes tool actions, creating a boundary problem absent from standard single-user agents: the agent must decide not only whether an instruction is safe, but which user or task it is allowed to govern. We identify cross-user poisoning (CUP), where an adversary injects a message into shared context that is later applied while the agent serves a benign user, causing unauthorized actions or responses outside the instruction's intended scope. We validate CUP on two deployed multi-user agents, Continua and ElizaOS, and introduce MURMUR, a framework for evaluating shared-context agents under concurrent multi-user interactions. Across Slack, Workspace, and Airline domains, CUP achieves high attack success, persists across later interactions, and remains substantially more effective than matched prompt-injection attacks. We evaluate boundary-scoping defenses and find that context summarization alone is insufficient, while task clustering and provenance prompting substantially reduce non-adaptive propagation. These results show that robust multi-user agents require explicit user/task scoping rather than generic input filtering or context compression.

Comments:	40th Conference on Neural Information Processing Systems (NeurIPS 2026)
Subjects:	Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI); Computation and Language (cs.CL)
Cite as:	arXiv:2511.17671 [cs.CR]
	(or arXiv:2511.17671v2 [cs.CR] for this version)
	https://doi.org/10.48550/arXiv.2511.17671 arXiv-issued DOI via DataCite

Submission history

From: Atharv Singh Patlan [view email]
[v1] Fri, 21 Nov 2025 04:56:37 UTC (3,160 KB)
[v2] Mon, 26 Oct 2026 18:48:34 UTC (3,820 KB)