PRISM: Real-Time Detection and Mitigation of Secret Leakage in Multi-Agent LLM Pipelines
Researchers have introduced PRISM, a novel real-time defense mechanism designed to prevent secret leakage in multi-agent Large Language Model (LLM) systems. The study addresses 'propagation amplification,' a security risk where sensitive information accessed by one agent spreads through shared context to downstream outputs. Unlike existing post-generation defenses or static pattern matching, PRISM treats credential leakage as a sequential risk accumulation problem during the generation process. It analyzes sixteen distinct signals, including lexical, structural, and information-theoretic features, to calculate a calibrated risk score at each decoding step. This allows for per-token intervention based on green, yellow, and red risk zones. The system leverages observations of entropy collapse and logit concentration as early warnings of leakage. In extensive adversarial benchmarks involving 2,000 tasks across thirteen attack categories, PRISM achieved an F1 score of 0.832 with perfect precision and zero task-level leak rate. It significantly outperformed the strongest baseline, Span Tagger, while maintaining high output utility, offering a robust solution for securing heterogeneous multi-agent AI pipelines against inadvertent data exposure.
Wire timeline
PRISM: Real-Time Detection and Mitigation of Secret Leakage in Multi-Agent LLM Pipelines
Researchers have introduced PRISM, a novel real-time defense mechanism designed to prevent secret leakage in multi-agent Large Language Model (LLM) systems. The study addresses 'propagation amplification,' a security risk where sensitive information accessed by one agent spreads through shared context to downstream outputs. Unlike existing post-generation defenses or static pattern matching, PRISM treats credential leakage as a sequential risk accumulation problem during the generation process. It analyzes sixteen distinct signals, including lexical, structural, and information-theoretic features, to calculate a calibrated risk score at each decoding step. This allows for per-token intervention based on green, yellow, and red risk zones. The system leverages observations of entropy collapse and logit concentration as early warnings of leakage. In extensive adversarial benchmarks involving 2,000 tasks across thirteen attack categories, PRISM achieved an F1 score of 0.832 with perfect precision and zero task-level leak rate. It significantly outperformed the strongest baseline, Span Tagger, while maintaining high output utility, offering a robust solution for securing heterogeneous multi-agent AI pipelines against inadvertent data exposure.
cs.AI updates on arXiv.org