Guard's Blind Spot: How Domain-Camouflage Injection Attacks Evade Detection in Multi-Agent LLM Systems

Injection detectors deployed to protect LLM agents are tuned to static, template-based attack payloads. Researchers discovered a systematic blind spot: when attack payloads are generated to mimic the domain vocabulary and authority structures of the target document, standard detectors fail to catch them.

Sharp Drop in Detection Rates

• Llama 3.1 8B: 93.8% → 9.7%
• Gemini 2.0 Flash: 100% → 55.6%
• Llama Guard 3 (production safety classifier): 0% detection rate on camouflaged payloads

The researchers formalized this as the Camouflage Detection Gap (CDG). Across 3 domains, 45 tasks, and 2 model families, the CDG was statistically significant and large (Llama: chi² = 38.03, p < 0.001 / Gemini: chi² = 17.05, p < 0.001).

Amplification Effect in Multi-Agent Systems

Multi-agent debate architectures amplify static injection attacks by up to 9.9x in smaller models. In contrast, powerful models show collective resistance.

Targeted detector augmentation provided only partial improvement (Llama 10.2%, Gemini 78.7%), suggesting that the vulnerability is not incidental but an architectural issue.

The framework, task bank, and payload generator have been released publicly.