cs.CR提交于 2026-10-28已译

跨用户投毒：多用户协作语言智能体中的用户-任务边界失效

Cross-User Poisoning: User-Task Boundary Failures in Multi-User Collaborative Language Agents

Atharv Singh Patlan · Peiyao Sheng · S. Ashwin Hebbar · Prateek Mittal · Pramod Viswanath

中文摘要

语言智能体正从单用户助手演变为工作区、论坛及群聊中的共享协作者。共享智能体观察多用户交错消息、维持持久上下文并执行工具操作，由此产生单用户智能体不具备的边界问题：智能体不仅需判断指令安全性，还需确定其可管辖的用户或任务范围。研究识别出跨用户投毒（CUP），即攻击者向共享上下文注入消息，当智能体服务良性用户时该消息被应用，导致超出指令预期范围的未授权操作或响应。在两个已部署的多用户智能体 Continua 和 ElizaOS 上验证了 CUP，并引入 MURMUR 框架以评估并发多用户交互下的共享上下文智能体。在 Slack、Workspace 和 Airline 领域中，CUP 实现了高攻击成功率，在后续交互中持续存在，且比匹配的提示注入攻击更有效。评估边界范围防御发现，仅上下文摘要不足，而任务聚类和来源提示显著降低了非自适应传播。结果表明，稳健的多用户智能体需要显式的用户/任务范围界定，而非通用输入过滤或上下文压缩。

关键要点

01识别跨用户投毒（CUP）问题，攻击者注入的消息在智能体服务良性用户时被错误应用，导致越权操作。
02在 Continua 和 ElizaOS 上验证 CUP，并引入 MURMUR 框架评估并发多用户交互下的共享上下文智能体安全性。
03实验显示 CUP 在 Slack 等三个领域具有高攻击成功率，且效果显著优于匹配的提示注入攻击。
04评估发现仅靠上下文摘要不足以防御，任务聚类和来源提示能显著降低非自适应传播，需显式用户/任务范围界定。

解读

尚无解读。

原始英文摘要

arXiv:2511.17671v2 Announce Type: replace-cross Abstract: Language agents are moving from single-user assistants to shared collaborators in workspaces, forums, and group chats. A shared agent observes interleaved messages from multiple users, maintains persistent context, and executes tool actions, creating a boundary problem absent from standard single-user agents: the agent must decide not only whether an instruction is safe, but which user or task it is allowed to govern. We identify cross-user poisoning (CUP), where an adversary injects a message into shared context that is later applied while the agent serves a benign user, causing unauthorized actions or responses outside the instruction's intended scope. We validate CUP on two deployed multi-user agents, Continua and ElizaOS, and introduce MURMUR, a framework for evaluating shared-context agents under concurrent multi-user interactions. Across Slack, Workspace, and Airline domains, CUP achieves high attack success, persists across later interactions, and remains substantially more effective than matched prompt-injection attacks. We evaluate boundary-scoping defenses and find that context summarization alone is insufficient, while task clustering and provenance prompting substantially reduce non-adaptive propagation. These results show that robust multi-user agents require explicit user/task scoping rather than generic input filtering or context compression.