The Model Knows Better: Defending Medical Multi-Agent Systems Against Prompt Injection
The paper studies prompt-injection attacks on medical multi-agent LLM systems for clinical decision support, showing that a single malicious clinical-looking passage can sway agents into wrong decisions and that agent collaboration and existing defenses are not reliably protective. Its key insight is that even compromised models can often reject the injected claim when forced to verify each diagnosis, recommendation, or instruction against the patient findings alone, yielding a training-free defense that sharply cuts attack success while preserving clean accuracy, though the evidence is still limited to a few systems, model families, and benchmarks rather than real clinical deployments.
Abstract
Medical multi-agent systems, in which LLM agents discuss a case, are increasingly studied for clinical decision support. Prompt injection, text that an attacker adds to a model's input, can manipulate LLMs into wrong decisions. How it affects these systems, and how to protect them, remains unclear. Across two systems, two model families and three benchmarks, a single injected passage succeeds in up to 61% of cases, and collaboration does not consistently protect against it. Existing defenses help only partly: they miss injections that look like ordinary clinical text. Yet when asked to check the injected text against the patient's findings, a model that followed the injection usually rejects it. We therefore propose a training-free defense that verifies the clinical judgments behind the system's decision. Following clinical practice, it separates the patient's findings from clinical judgments, such as diagnoses, recommendations and instructions, and checks each judgment against the findings alone, so the decision rests only on supported judgments. Our defense outperforms all baselines on every benchmark, lowering attack success on MedQA to 4-7% while maintaining accuracy on cases without an attack, and remains effective with a medical model and against defense-aware and adaptive attacks.