Stopping infectious jailbreaks in multi-agent systems with local purification

What is this?

When several multimodal agents collaborate — each with its own model, a retrieval store, a chat history, and an image album they exchange during conversation — a single compromised agent can pass its jailbreak to the others. This is infectious jailbreak: first demonstrated by the “Agent Smith” work, where one adversarial image seeded into an agent’s album is repeatedly retrieved and forwarded, so the compromise spreads across the network exponentially rather than staying contained to the first victim.

A paper posted to arXiv in May 2026, “Catching the Infection Before It Spreads: Foresight-Guided Defense in Multi-Agent Systems,” revisits this problem and proposes a defense that runs entirely at inference time. Its headline result: in a simulated 128-agent network built on LLaVA-1.5-7B, the framework cuts the maximum cumulative infection rate from over 95% down to below 5.47%, while keeping the agents’ normal interaction diversity close to a clean baseline.

How it works

The setup models each agent as a multimodal model plus a retrieval-augmented (RAG) module over an image album, a chat history, and a memory of images exchanged with peers. Each round, agents are paired as questioners and answerers; images and text flow between them, and received images land in the answerer’s album. The attack — a virus adversarial example, or VirAE — is crafted so that once it enters an album, the retriever keeps surfacing it, which maximizes the chance it gets forwarded again. That retrieval feedback loop is what turns a single infection into exponential propagation.

The paper’s central critique is of how earlier defenses respond. Prior work injects a globally shared “cure factor” — a benign artifact engineered to be even more contagious than the virus, so agents preferentially retrieve it instead. That can suppress visible malicious behavior, but it does so by biasing every agent toward the same forced response, which homogenizes the network and never actually removes the poisoned images. The authors frame this as a mismatch: the cure is a global intervention, but the infection is a set of local interaction behaviors.

Their alternative, Foresight-Guided Local Purification (FLP), is training-free and operates per agent using only chat histories and albums — no access to the underlying models or RAG modules. It has three stages. First, each agent simulates its own future interaction trajectories under several different personas, to probe how it would behave across varied contexts. Second, it uses response diversity as a diagnostic signal: benign behavior stays varied across personas, while infected behavior collapses to near-identical outputs, so persona disagreement flags infection at both the retrieval and semantic level. Third, once an agent is flagged, purification removes the offending images — a fast album rollback for recent infections, and a Recursive Binary Diagnosis that repeatedly splits the album to localize and delete embedded VirAEs for older ones. In the reported ablation, this reached a 97.7% threat-elimination rate while retaining 80.6% of benign images.

Why it matters

Multi-agent architectures are moving into production for research assistants, coding pipelines, and workflow automation, and any of them that pass images or retrieved artifacts between agents inherit this exposure. The uncomfortable property of infectious jailbreak is that the blast radius is the whole network, not one agent: an attacker who compromises a single low-value participant can, in principle, reach every agent that later retrieves the poisoned content. And the paper’s warning about “cures” generalizes beyond images — any defense that works by pushing every agent toward one safe canned behavior may be buying suppression at the cost of usefulness, and hiding rather than clearing the underlying contamination.

The honest caveats: these are simulation results, run largely on one 7B open model with same-model agents (a deliberately easy-to-infect, worst-case configuration), and additional models tested for generalization. The numbers are the authors’ own, not an independent evaluation, and the method adds inference-time cost from the per-agent foresight simulation. It is a promising research defense, not a shipped control.

Defenses

The practical lessons hold regardless of which framework you run. Treat inter-agent content — retrieved images, documents, tool outputs — as untrusted the moment it crosses an agent boundary, and do not let one agent’s memory silently become another’s retrieval source without a check. Prefer defenses that remove contamination and restore original behavior over ones that merely overwrite every agent with a uniform safe response, because homogenized agents are both less useful and still carrying the poison. Watch for the diagnostic signal the paper leans on: when an agent’s outputs suddenly collapse to low diversity or repeat across contexts, treat that as a possible infection indicator, not just a quirk. Scope and expire agent memory aggressively — bounded, FIFO-style albums and histories limit how long a planted artifact can keep being retrieved. And where a network exchanges media between agents, isolate and purge per agent rather than trusting a single global fix; a related May-2026-era line of work on infection-aware safeguarding argues the same point from the mitigation side.

Status

This is a peer-directed research defense, not a product vulnerability with an assigned identifier.

Item	Detail
Source	”Catching the Infection Before It Spreads: Foresight-Guided Defense in Multi-Agent Systems” (arXiv:2605.01758)
Posted	May 2026
Type	Defense framework (training-free, inference-time)
Threat modeled	Infectious jailbreak / virus adversarial examples in multimodal multi-agent systems
Setup	LLaVA-1.5-7B primary; also InternVL2-8B, Qwen2VL-8B, InstructBLIP-7B; 128 agents, 64 rounds
Reported result	Max cumulative infection rate cut from >95% to <5.47%; 97.7% threat elimination, 80.6% benign retention
Baselines	Agent Smith (attack), Cowpox (prior cure-factor defense)

The primary source is from within the last 90 days. The durable lesson: in agent networks, the unit to defend is the interaction, not the individual reply — and a defense that makes every agent behave identically has not cured the infection, only hidden it.