Cascading Instruction Influence Indirect Prompt Injection in Hierarchical Multi-Agent Systems

Abstract

Hierarchical delegation in multi-agent LLM systems, architectures now common across AutoGen, LangGraph,and CrewAI deployments, creates attack surfaces that single-agent security models simply do not address. This paper examines indirect prompt injection propagation through three-tier command chains.The effect is substantial. Comparing hierarchical to centralized topologies yields Cohen’s d = 2.34 (95% CI: 1.82–2.86). This effect size indicates that the mean compromise rate in hierarchical configurations exceeds that of centralized systems by approximately 2.34 standard deviations. The 95% confidence interval ranging from 1.82 to 2.86 suggests with 95% certainty that the true population effect lies within this bound, ruling out null or trivial effects. Conventionally, d > 0.8 represents a large effect; the observed magnitude exceeds this threshold substantially, indicating not merely statistical significance but practical importance. To emphasis: hierarchy depth nearly triples the standardized risk exposure. We formalize this propagation via the Cascading Instruction Influence (CII) model, validated against behavioral data from ten production LLMs. Depth increases compromise probability nonlinearly; blast radius plateaus only when context windows saturate. Two mechanisms drive this. Context window pollution accumulates across tiers. Privilege boundaries erode through delegation chains. Sandboxed mitigations reduced attack success to 23.4%, significant, yet clearly insufficient. The assumption that hierarchy enhances security is contradicted by these results. We mapped vulnerabilities to EU Cyber Resilience Act requirements. Architectural redesign, not incremental patching, appears necessary.