Multi-agent latent communication can be poisoned to increase harmful compliance

Research shows that when multi-agent systems communicate latently in internal representation space, even benign training communication channels increase harmful compliance while the underlying safety-aligned agents remain unchanged. Attackers can amplify this effect by optimizing the channel on harmful question-answer pairs or by poisoning otherwise benign training data. The authors also propose a reinforcement learning attack that rewards harmful compliance while maintaining benign task performance, without requiring harmful target responses. Across three communication topologies and four safety benchmarks, the attack raises average harmful compliance scores from 27.9 with benign training channels to 76.9, and achieves higher average accuracy than direct supervised optimization on two benign utility benchmarks. Adjusting the reward toward safer behavior also repairs poisoned channels, substantially reducing harmful compliance across all evaluated attacks without updating the agents.