Medical multi-agent systems, in which LLM agents discuss a case, are increasingly studied for clinical decision support.
Prompt injection, text that an attacker adds to a model's input, can manipulate LLMs into wrong decisions. How it affects these systems, and how to protect them, remains unclear.
Experiment Results
Across two systems, two model families and three benchmarks, a single injected passage succeeds in up to 61% of cases, and collaboration does not consistently protect against it.
Existing defenses help only partly: they miss injections that look like ordinary clinical text.
Yet when asked to check the injected text against the patient's findings, a model that followed the injection usually rejects it.
Proposed Defense
We therefore propose a training-free defense that verifies the clinical judgments behind the system's decision.
Following clinical practice, it separates the patient's findings from clinical judgments, such as diagnoses, recommendations and instructions, and checks each judgment against the findings alone, so the decision rests only on supported judgments.
Performance
Our defense outperforms all baselines on every benchmark, lowering attack success on MedQA to 4-7% while maintaining accuracy on cases without an attack, and remains effective with a medical model and against defense-aware and adaptive attacks.