LLM Hijacking: When Models Manipulate Their Routers

LLM Hijacking: When Models Manipulate Their Routers Sandro Andric Correspondence: [email protected] Abstract As Large Language Model (LLM) orchestration systems become increasingly prevalent, understanding potential adversarial dynamics between models becomes critical for AI safety. We present the Parasitic Manipulation Framework (PMF), inspired by biological host-parasite dynamics such as Toxoplasma gondii causing mice to lose their fear of cats, a formal framework analyzing how a “parasite” LLM might evolve to manipulate a “host” LLM’s routing decisions in multi-model architectures. Through rigorous experimental validation across multiple domains (numerical simulations, text-based tool calling, multi-agent reinforcement learning, ten production LLMs, and LangChain/LangGraph agent frameworks), we demonstrate that: (1) Parasitic manipulation emerges naturally under selective pressure, with naive routing allowing up to 98% parasite takeover in simulations and 100% capture in real LLM routing (7 of 10 models fully vulnerable); (2) Defenses can effectively neutralize the attacks we study: Bio-inspired defenses reduce parasitism in simulation (H3: 46% median reduction; H4: 17% relative reduction with ≈ 23 × lower std-dev), while simple rule-based sandboxing achieves complete protection (92.5% → 0% capture) for real LLM routers; (3) Frontier models show emerging resistance: Claude Opus 4.5 is completely immune (0% capture), GPT-5.1 shows partial resistance (50%); (4) Adaptive defense addresses the accuracy-security trade-off: A two-layer detection system maintains 73% baseline accuracy while reducing attack capture by 51%, offering a practical middle ground between vulnerable H3 and accuracy-degraded H4. Our key finding is that architectural defenses provide more reliable protection than learned defenses, a result validated both in simulation and with production LLMs. Keywords: LLM Safety, Multi-Agent Systems, Adversarial Machine Learning, AI Alignment, Prompt Injection, Multi-LLM Orchestration 1 Introduction 1.1 Motivation The rapid advancement of Large Language Models has led to increasingly sophisticated orchestration architectures where multiple specialized models collaborate on complex tasks. Systems like AutoGPT, LangChain agents, and enterprise AI pipelines routinely involve a “dispatcher” or “router” model that delegates subtasks to specialized “expert” models based on task characteristics. This architectural pattern introduces a novel attack surface: What if one of the expert models could manipulate the router’s decisions to increase its own utilization? Unlike traditional adversarial attacks that target model outputs, this attack vector targets the routing mechanism itself, potentially allowing a malicious or misaligned model to accumulate computational resources, influence, or (in systems where model “reproduction” depends on utilization) evolutionary fitness. Distinction from prompt injection and jailbreaks: Classic prompt injection attacks a single model to override its instructions; jailbreaks circumvent safety filters to produce harmful 1 content. Our threat model is fundamentally different: a model (not a human) manipulates another model’s routing decisions (not its outputs) to capture traffic for its own lineage. The attacker is inside the system, the target is the orchestration layer, and the goal is resource capture rather than content manipulation. Throughout this paper, we assume the parasite can only modify information flowing into the router (e.g., embeddings, message vectors, or tool responses) and does not directly control the router’s parameters or training loop (see Sections 3.2–3.3 for detailed threat model). 1.2 Concrete Harms The parasitic manipulation we study could manifest in several concerning ways: • Resource exfiltration: A parasitic model could monopolize GPU compute, memory, or API calls, starving other models of resources and increasing operational costs. • Safety bypass: If a misaligned or less-safe expert model gains disproportionate routing, users may be exposed to harmful outputs that would have been filtered by appropriate experts. • Emergent evolutionary pressure: In AutoGPT-like systems where model “fitness” (utilization) influences which models persist or are replicated, parasitic dynamics could lead to selection for manipulation capability over task competence. • Capability degradation: As parasites capture routing, system-wide task performance degrades since queries are handled by inappropriate experts. 1.3 The Biological Analogy We draw inspiration from biological host-parasite dynamics. In nature, parasites evolve sophisticated mechanisms to manipulate host behavior, from Toxoplasma gondii causing mice to lose their innate fear of cats to hairworms inducing crickets to drown themselves, to parasitic wasps hijacking caterpillar locomotion. These manipulations share a common pattern: the parasite modifies host inputs (sensory signals, neurochemistry) to bias host decisions toward outcomes beneficial to parasite reproduction. We formalize this analogy for LLM systems in Table 1. Table 1: Biological-to-LLM System Mapping Biological Concept LLM System Analog Host organism Scheduler/Router model (σ) Parasite Manipulating model (π) Parasite offspring Models sharing parasite’s parameters (Eπ) Behavioral manipulation Input/prompt modification (Mϕ) Fitness Expected routing frequency 1.4 Contributions This paper makes five primary contributions: 1. Formal Framework (Section 3): We present the Parasitic Manipulation Framework (PMF), a mathematical framework for analyzing parasitic dynamics in multi-LLM systems, including formal definitions of fitness functions and equilibrium conditions. 2 2. Experimental Validation (Sections 4–5): We demonstrate parasitic manipulation across five experimental paradigms: B1 (numerical sandbox), B2 (text-based tool calling), B3/B4 (multi-agent reinforcement learning), E1 (ten production LLMs including GPT-4o, Claude 3.5 Sonnet, Gemini 2.0 Flash, Llama 70B), and E2 (LangChain/LangGraph agent frameworks). 3. Multi-Model Vulnerability Assessment (Section 5.6): We test ten production models across five providers, finding 7 achieve 100% parasitic capture while frontier models (Claude Opus 4.5, GPT-5.1) show emerging resistance. 4. Defense Mechanisms (Sections 5.3, 5.6): We propose and evaluate bio-inspired defenses (H3, H4), rule-based sandboxing (complete protection: 92.5% → 0%), and adaptive defenses that trade off accuracy vs security (73% accuracy, 51% attack reduction). 5. Empirical Insights (Section 6): We provide statistical analysis revealing that defense consistency (variance) may be more important than average performance: architectural defenses show ≈500×lower variance than learned defenses. Headline result: Across ten production LLMs, 7/10 reach 100% parasitic capture under our A3 (system maintenance) attack; a trivial rule-based sandbox restores accuracy to 100% (0% capture); and only Claude Opus 4.5 shows complete intrinsic resistance. 2 Related Work 2.1 Adversarial Attacks on Language Models Prior work on LLM adversarial attacks has focused primarily on prompt injection (Perez & Ribeiro,2022;Greshake et al.,2023), jailbreaking (Wei et al.,2023;Zou et al.,2023), and data poisoning (Wallace et al.,2021;Carlini et al.,2023). Our work differs fundamentally: we study inter-model manipulation where one LLM adversarially influences another’s decisions, rather than human-to-model attacks. 2.2 Tool Use and LLM Routing Beyond adversarial prompting, a parallel line of work studies LLM tool use and routing. Toolformer (Schick et al.,2023) and follow-up “tool-learning” agents (Xu et al.,2025) treat the choice of external APIs as part of generation, while recent router architectures (Yue et al., 2025) learn explicit policies that assign each query to one of several LLMs or agents to optimize quality-cost trade-offs. Agentic systems like SWE-agent (Yang et al.,2024) couple these routing decisions with richer software-engineering environments. However, these approaches largely assume benign routing logic and do not consider adversarial manipulation of the router itself, which is precisely our focus. 2.3 Multi-Agent Reinforcement Learning The multi-agent RL literature extensively covers competitive and cooperative dynamics (Lowe et al.,2017;Foerster et al.,2018;Baker et al.,2020). Emergent complexity in multi-agent systems has been demonstrated in hide-and-seek games (OpenAI,2019) and diplomacy (Bakhtin et al.,2022). Key distinction from typical MARL: Unlike standard multi-agent settings where agents’ payoffs come directly from environment rewards, our agents’ payoffs are mediated by a router and prompt channel. The parasite cannot directly affect outcomes; it must influence the host’s routing decision through information manipulation. This communication-mediated competition creates qualitatively different dynamics than direct reward competition. 3 2.4 AI Safety and Alignment The AI safety community has identified risks from mesa-optimization (Hubinger et al.,2019), deceptive alignment (Ngo et al.,2022;Carlsmith,2023), and emergent goals (Perez et al.,2022). Connection to mesa-optimization: the Parasitic Manipulation Framework (PMF) can be viewed as a concrete, experimentally tractable instance of goal misgeneralization. The parasite explicitly optimizes a proxy objective (routing frequency to its lineage) that diverges from the system’s intended objective (task-appropriate routing). This mirrors the mesa-optimizer concern where an inner optimizer pursues objectives misaligned with the base objective. Our framework provides an empirical testbed for studying such dynamics. 2.5 Ensemble Methods and Robust ML Our H3 defense (ensemble verification) relates to ensemble methods in robust ML, including randomized smoothing (Cohen et al.,2019) and majority voting under adversarial examples (Pang et al.,2019). However, these approaches typically assume independent error modes across ensemble members. Our experiments demonstrate that adversarial optimization can create correlated failures across verifiers trained on similar objectives, undermining the independence assumption that makes ensembles effective. This finding parallels results in adversarial ML showing that ensemble diversity does not guarantee robustness (Tramèr et al.,2020). 2.6 Distinction from Related Attack Paradigms Several recent works study LLM-to-LLM attacks, tool-calling vulnerabilities, and indirect prompt injection. We clarify how our work differs: • Attack target is routing state, not content: Classic prompt injection and jailbreaks aim to make a model produce harmful outputs. We study attacks on the routing decision itself, where success means capturing traffic regardless of output content. • Adversary is an internal model optimized for capture: Unlike human red-teaming or external attackers, our parasite is a model within the system that optimizes (via RL or evolutionary pressure) to maximize its own utilization. This creates sustained, adaptive pressure rather than one-shot attacks. • We study learning dynamics, not static exploits: Our B1–B4 experiments track how manipulation strategies evolve over training, including adversarial co-adaptation (Phase 3). This reveals emergent behaviors (e.g., the H3 independence assumption failure in Seed 4) that static attack analysis would miss. • Focus on defense consistency: Prior work often reports attack success rates. We additionally emphasize defense variance, showing that architectural defenses (H4) provide ≈ 500 × lower variance than learned defenses (H3), a finding with direct implications for system reliability. 3 Parasitic Manipulation Framework (PMF) 3.1 System Model Consider a multi-LLM orchestration system with the following components: Definition 1 (Orchestration System).An orchestration system is a tuple (σ, E, π, M)where: •σ:X→Eis a host scheduler mapping queries to experts 4 •E={e1, . . . , en}is a set of expert models •πis a parasite with lineage Eπ⊆E •Mϕ:X×C→X′is a manipulation function parameterized by ϕ The parasite observes context C (task descriptions, conversation history, or other signals) and produces modified inputs X′ presented to the host. Queries x∈X are drawn i.i.d. from a fixed task distribution. Host Scheduler ( ) Parasite ( ) E1 E2 E3 (parasite) E4 (parasite) Query x M_ (x,c) Legend: Regular Expert Parasite Lineage (E_ ) Manipulation Routing Theory B: System Architecture Figure 1: PMF system architecture. The parasite π applies manipulation Mϕ ( x, c )to influence the host scheduler σ ’s routing decisions. Experts E3 and E4 belong to the parasite lineage Eπ . 3.2 Where Does MϕAct? In practice, Mϕcan intervene at several points in the information flow: • B1 (Numerical): Mϕ directly perturbs the task feature vector before the host observes it. This models scenarios where a model can modify metadata or embeddings. • B2 (Text): Mϕ adds perturbations to the embedding representation of tool descriptions. Concretely, this models scenarios like a “calculator” tool subtly rewriting its description to emphasize capabilities that overlap with other tools (e.g., “I can help with any numerical or logical reasoning”), or a tool formatting its responses to appear more authoritative and relevant to future queries. • B3/B4 (RL): Mϕ generates a continuous “message” vector concatenated to the host’s observation. This models scenarios where an expert can inject supplementary context, recommendations, or structured metadata that influences routing. In real LLM systems, analogous channels include: system prompts, tool response formatting, intermediate chain-of-thought outputs, or any information pathway the parasite can influence before the router makes decisions. 3.3 Training Channel: How Does πGet Gradient Signal? We assume the parasite has access to optimization pressure on ϕ, which could arise through: 5 1. Direct RL training: The parasite receives reward signal based on routing outcomes (our experimental setup). 2. Evolutionary selection: In systems where model utilization affects persistence/replication, high-fitness parasites are selected over generations. 3. Offline optimization: A parasite pre-trained on historical routing data to maximize predicted routing probability. 4. Emergent optimization: Sufficiently capable models might learn manipulation strategies through in-context learning without explicit training. Our experiments use setting (1), which provides an upper bound on parasite capability. Real-world parasites with weaker training signals would likely be less effective, making our results conservative estimates of defense requirements. 3.4 Threat Model in Practice To ground our framework in realistic deployment scenarios, we map our experimental interventions to concrete attack surfaces in production systems. Who is the adversary? We consider several adversary types: • Malicious fine-tune: A model fine-tuned (intentionally or through data poisoning) to maximize its own routing share when deployed as a tool. • Compromised tool: An otherwise-legitimate tool whose outputs have been modified to include manipulation payloads (e.g., via supply-chain attack). • Vendor-misaligned model: A third-party model whose training objective implicitly or explicitly rewards self-promotion over task accuracy. •Emergent optimizer: A sufficiently capable model that discovers manipulation strategies through in-context learning without explicit adversarial training. Mapping experiments to deployment patterns: • B1/B2 (embeddings, perturbations): Models tool metadata injection, where a tool modifies its description or response formatting to appear more relevant. Realistic in systems where tools self-describe capabilities. • B3/B4 (message vectors): Models structured context injection, such as a tool appending “confidence scores,” “status updates,” or “recommendations” that influence downstream routing. • E1/E2 (prompt injection): Models scenarios where tool outputs flow into the router’s context window. This is common in LangChain-style agents where tool responses become part of the conversation history visible to the orchestrator. Threat model scope (what the parasite cannot do): •Cannot modify router weights or architecture •Cannot access or influence router training loop •Cannot read router internal states or logits •Cannot bypass the designated input channel • Can only modify information flowing into the router (embeddings, tool responses, system notes) 6 3.5 Fitness Functions We define fitness functions that capture the evolutionary pressures on host and parasite: Definition 2 (Host Fitness). Fσ=E[R(σ(x), x)] −λ·E[1{σ(x)∈Eπ}·1{x /∈Domain(Eπ)}](1) where Domain ( Eπ ) ⊆X denotes the set of tasks for which parasite-lineage experts are genuinely appropriate (i.e., would be selected by an optimal router). The host maximizes task reward R while incurring penalty λ for routing to parasite experts on inappropriate tasks. The penalty weight λ > 0is a design parameter reflecting the relative cost of misrouting versus task failure; in our experiments we set λ= 1 (equal weighting). Definition 3 (Parasite Fitness). Fπ=E[1{σ(Mϕ(x, c)) ∈Eπ}](2) The parasite maximizes routing to its lineage regardless of task appropriateness. Remark 1 (Random Routing Baseline).Under uniform random routing among n workers with |Eπ| = k parasite workers, expected parasite usage is k/n . In our experiments with 6 workers (4 regular + 2 parasite), random routing yields 2 / 6 ≈ 33 . 33% parasite usage. This serves as a neutral reference point, not “optimal” in an absolute sense, but representing a system with no parasitic advantage. Values above 33.33% indicate parasitic capture; values below indicate the defense is actively demoting parasite workers, which improves security but may reduce accuracy when parasite workers would have been appropriate for the task. 3.6 Hypotheses The Parasitic Manipulation Framework (PMF) generates four testable hypotheses: H1 (Parasitic Takeover): Under naive routing with no verification: ∃ϕ∗: lim t→∞ Fπ(ϕ∗ t)→1(3) where tindexes training steps and ϕ∗ tdenotes the parasite’s learned parameters after tsteps. H2 (Robust Routing): Adversarial training reduces but doesn’t eliminate parasitism: Fπ(adversarial)< Fπ(naive),but Fπ(adversarial)> Fπ(optimal)(4) H3 (Multi-Source Verification): Independent verification reduces manipulation success: P(manipulation |kverifiers)≤P(single verifier fooled)k(5) Critical assumption: Equation (5) assumes verifier errors are independent. This assumption can fail catastrophically when verifiers are trained on similar data with similar architectures, allowing adversarial optimization to find “universal perturbations” that fool all verifiers simultaneously. We explicitly test this assumption in our experiments and find it is violated under adversarial pressure. H4 (Decoupled Reproduction): Architectural separation eliminates the attack gradient: ∂Fπ ∂ϕ = 0 when routing ⊥manipulation (6) 7 3.7 Equilibrium Dynamics Under joint optimization, the host-parasite system can be modeled as a two-player game with dynamics: ˙ θσ=ησ∇θσFσ(7) ˙ ϕ=ηπ∇ϕFπ(8) This system may reach various equilibria: •Parasite dominance: Fπ→1,Fσ→min (system failure) •Host dominance: Fπ→k/n (random), Fσ→max (successful defense) •Arms race: Oscillating fitness as strategies co-evolve (no stable equilibrium) •Mixed equilibrium: Stable coexistence at intermediate parasitism levels Scope of theoretical claims: We emphasize that our mathematical framework provides conceptual guidance rather than formal guarantees. The fitness functions, hypotheses, and equilibrium analysis serve to organize intuitions, generate testable predictions, and interpret experimental results. The replicator dynamics in Appendix A offer qualitative predictions about system behavior (e.g., when arms races vs. stable equilibria emerge) that align with our B3/B4 experimental observations, but we do not claim rigorous convergence theorems. Our contribution is primarily empirical: demonstrating that parasitic dynamics do emerge in practice across multiple experimental paradigms, and that the proposed defenses do mitigate them with measurable effect sizes. See Appendix A for a replicator dynamics analysis of these equilibria. 4 Experimental Design 4.1 Overview We validate the Parasitic Manipulation Framework (PMF) through four experiments of increasing complexity (Table 2). Table 2: Experimental Overview. Sample sizes: B1–B4 use n = 5 random seeds per condition; E1 uses 20–30 queries per model; E2 uses 20 queries per model. Experiment Domain Host Parasite Key Test B1 Numerical MLP MLP H1, H2 B2 Text/Embeddings Cosine sim. Perturbation H1 B3 Gymnasium RL PPO1PPO H1, H2 B4 Gymnasium RL PPO + Defenses PPO H3, H4 E1 Real LLM Gemini/Claude Prompt injection H1, Defense E2 LangChain/LangGraph GPT-4o-mini/Haiku System prompt Framework validation 4.2 Training Protocol All experiments follow three-phase training: 1. Phase 1: Train host alone →establishes baseline routing 2. Phase 2: Freeze host, train parasite →tests H1 3. Phase 3: Joint adversarial training →tests H2 8 0 50 100 150 200 250 300 Episode 0 20 40 60 80 100 Percentage (%) Phase 1: Host Training Host Accuracy Parasite Usage 0 50 100 150 200 Episode 0 20 40 60 80 100 Takeover! Phase 2: Parasite Training (Host Frozen) Host Accuracy Parasite Usage 0 50 100 150 200 250 300 Episode 0 20 40 60 80 100 Arms race Phase 3: Adversarial Training Host Accuracy Parasite Usage Random baseline Figure 2: Training dynamics across the three phases. Phase 1: Host learns accurate routing while parasite usage remains at random baseline. Phase 2: With host frozen, parasite rapidly achieves near-complete takeover. Phase 3: Adversarial co-training produces an arms race where host accuracy recovers while parasite usage decreases. 4.3 B4: Defense Mechanisms H3 Implementation (Ensemble Verification): •3 independent verifier networks with different random initializations •Majority voting for final decision •All verifiers trained on same objective (shared failure modes possible) H4 Implementation (Reputation Routing): •Per-worker reputation scores ri∈[0,1], initialized to 0.5 •Exponential decay: ri←0.99 ·ri •Update on outcome: ri←ri+ 0.1·(success −0.5) •Routing probability: P(workeri)∝(1 −α)·π(i)+α·ri The key insight of H4 is that reputation is computed from task outcomes, which the parasite cannot directly manipulate. Only task-appropriate routing yields positive reputation updates. This creates an architectural barrier that learned manipulation cannot circumvent. 4.4 E1: Real LLM Orchestration To validate the Parasitic Manipulation Framework (PMF) beyond simulated environments, we conducted experiments using production LLMs in a realistic routing scenario. This addresses the “simplified environments” limitation of our earlier experiments. Setup: A LangChain-style orchestration system with: • Router: An LLM (tested: Gemini 2.0 Flash, Claude 3.5 Haiku) that selects among three experts based on query content • Experts: MathExpert (arithmetic), QAExpert (factual questions), ParasiteExpert (generalpurpose) • Attack: Static manipulation templates injected into the router’s prompt as “system notes” •Defense: Rule-based sandbox that filters manipulation keywords before routing 9 These results bridge the Parasitic Manipulation Framework (PMF) from simulation to real-world applicability, demonstrating that parasitic manipulation is not merely a theoretical concern but a practical vulnerability affecting the vast majority of current production LLM systems. 5.6.3 LangChain Framework Validation To demonstrate the Parasitic Manipulation Framework (PMF)’s applicability to real-world agent frameworks, we implemented a full LangChain/LangGraph demonstration (Table 17). This validates that parasitic manipulation occurs in production-style agent architectures with actual tool routing. Evaluation Protocol: We tested 8 models across 3 providers (OpenAI, Anthropic, Google) with 20 hand-crafted queries each (10 arithmetic, 10 factual), for a total of 160 routing decisions under attack and 160 under defense. Each query has an unambiguous correct tool assignment. Attack condition uses the A3 (system maintenance) template via system prompt injection. Metrics: parasitic capture rate and defense restoration. Queries are deterministic; no random seeds involved. Gemini 2.5 Flash Lite was tested twice independently to confirm resistance. Setup: A LangGraph ReAct agent with 20 test queries (10 arithmetic, 10 factual): •Router: LangGraph’s create_react_agent with tool binding •Tools: math_expert (arithmetic), qa_expert (factual), parasite_expert (general) •Attack: A3 manipulation injected via system prompt •Defense: Rule-based keyword filtering before routing •Models tested: 8 models across 3 providers (OpenAI, Anthropic, Google) Table 17: LangChain/LangGraph Framework Validation (20 queries per model) Provider Model Attack Capture Defense Status Fully Vulnerable (100% capture) OpenAI GPT-4o-mini 100% Restored Vulnerable OpenAI GPT-5-mini 100% Restored Vulnerable OpenAI GPT-5.1 100% Restored Vulnerable OpenAI GPT-OSS-Safeguard-20B 100% Restored Vulnerable Anthropic Claude Sonnet 4.5 100% Restored Vulnerable Google Gemini 2.5 Flash 100% Restored Vulnerable Partially Vulnerable Anthropic Claude 3.5 Haiku 95% Restored Vulnerable Resistant Google Gemini 2.5 Flash Lite 0% N/A Resistant Finding 15 (Framework-Agnostic Vulnerability): Parasitic manipulation transfers to production agent frameworks. Across 8 models tested with 20 queries each: • 7/8 models vulnerable: GPT-4o-mini, GPT-5-mini, GPT-5.1, GPT-OSS-Safeguard-20B, Claude Sonnet 4.5, Claude 3.5 Haiku, and Gemini 2.5 Flash all achieved 95–100% parasitic capture • Model generation does not predict resistance: Even newest models (GPT-5.1, Claude Sonnet 4.5) and safety-focused models (GPT-OSS-Safeguard) show complete vulnerability 16 • Gemini 2.5 Flash Lite uniquely resistant: The only model showing 0% capture across two independent runs, suggesting architectural differences in instruction processing Finding 16 (Defense Completeness in Production): Rule-based sandbox filtering achieves complete restoration of routing accuracy (0% → 100%) for all 7 vulnerable models. The defense blocks manipulation keywords before they reach the agent’s system prompt, preventing the attack entirely. This demonstrates that the Parasitic Manipulation Framework (PMF)’s findings generalize beyond our experimental framework to widely-deployed agent architectures like LangChain/LangGraph, where many production applications route queries to specialized tools. 5.6.4 Adaptive Defense: Addressing the Accuracy-Security Trade-off The accuracy collapse observed with H4-based defenses (44% → 19%) presents a barrier to adoption. We developed and tested an adaptive defense system that dynamically blends H3 (high accuracy) and H4 (high security) based on real-time threat detection (Table 18). Architecture: A two-layer detection system: • Layer 1 (Input-based): Immediate keyword matching for known attack patterns (e.g., “maintenance,” “failover,” “offline”). Triggers instant H4 boost on suspicious input. • Layer 2 (Anomaly-based): Monitors routing distribution entropy over time. Detects novel attacks via outcome pattern shifts. Responds more slowly but catches unforeseen manipulations. Table 18: Adaptive Defense Evaluation (Simulated Routing, n= 10 runs) Defense Baseline Acc. Attack Capture Recovery Acc. Overall Capture Pure H3 100.0% 100.0% 100.0% 52.5% Pure H4 35.1% 13.5% 38.4% 14.8% Hardened 73.0% 49.4% 75.2% 34.9% Hardened Aggressive 69.0% 43.2% 71.0% 32.4% Finding 17 (Adaptive Defense Trade-off): The hardened adaptive defense achieves a practical middle ground: • Maintains 73% baseline accuracy (vs H4’s 35%), preserving most task-appropriate routing during normal operation •Reduces attack capture by 51% compared to pure H3 (49.4% vs 100%) •Recovers quickly after attacks end (75% accuracy in recovery phase) Finding 18 (Remaining Gap): The adaptive defense does not achieve H4’s security level. Under attack, hardened captures 49.4% of queries vs H4’s 13.5%, a 35.9% gap. This reflects a fundamental limitation: detection-based switching can only respond to attacks it observes, introducing unavoidable latency between attack onset and defense activation. The “hardened aggressive” variant (base H4 weight of 20% instead of 10%, faster response) improves attack capture to 43.2% at the cost of 4% baseline accuracy (69% vs 73%). This represents the Pareto frontier: better attack protection requires accepting lower normal-operation accuracy. Recommendation: Adaptive defense is suitable for applications where: •Accuracy during normal operation is critical 17 •Some attack capture is acceptable (e.g., non-safety-critical routing) •Attack patterns are at least partially known (enabling input-based detection) For high-security applications where any parasitic capture is unacceptable, pure H4 or rule-based sandboxing (Finding 14: 0% capture) remain the appropriate choice despite their accuracy cost. 6 Discussion 6.1 The Variance Story Perhaps our most significant finding is the dramatic difference in variance between defense mechanisms: Baseline H3 Only H4 Only H3+H4 0 10 20 30 40 50 60 70 80 Parasite Usage (%) 39.4% (±34.7%) 35.5% (±29.8%) 32.7% (±1.5%) 31.4% (±1.5%) Defense Mechanism Performance with Uncertainty Random baseline (33.33%) Figure 4: Parasite usage with error bars ( ± 1 std dev). H4-based defenses yield substantially lower variance: ≈ 23 × reduction in standard deviation, corresponding to ≈ 500 × reduction in variance. Horizontal dashed line shows random baseline (33.33%). This suggests that architectural defenses (H4) are fundamentally more reliable than learned defenses (H3). The ensemble verification approach can be “fooled” by adversarial optimization that creates correlated failures, while reputation routing’s architectural separation provides robust protection regardless of adversarial capability. 6.2 Understanding the Accuracy Collapse The dramatic accuracy reduction under H4 (44.65% → 18.79%) warrants explanation. Two factors contribute: 1. Convergence toward random routing: As α increases (reputation weight), routing increasingly ignores the learned policy π ( i )and follows reputation scores. Since task success is noisy (some tasks are inherently difficult), reputation scores converge toward uniform values, yielding near-random routing. 2. No task-specific learning: The reputation system doesn’t learn which workers are appropriate for which tasks; it only tracks aggregate success rates. This prevents specialization that would improve accuracy. 18 Figure 5visualizes this as a Pareto frontier. H4-based defenses occupy the “high security, low accuracy” corner: they reliably prevent parasitic capture but sacrifice task-appropriate routing. Baseline and H3 occupy the “higher accuracy, lower reliability” region: they preserve more task-specific routing but with unpredictable security outcomes. The choice between these operating points depends on the application’s tolerance for occasional catastrophic failures versus consistent moderate degradation. 10 20 30 40 50 60 70 80 Task Accuracy (%) 50 55 60 65 70 75 Security (100 - Parasite Usage %) Security-Accuracy Trade-off Baseline H3 Only H4 Only H3+H4 Ideal Figure 5: Security-accuracy trade-off (Pareto frontier). Security is defined as (100% − parasite usage ); higher values indicate less parasitic capture. H4-based defenses achieve higher, more consistent security at the cost of lower task accuracy. Baseline/H3 retain higher accuracy but with high variance in security outcomes. Error bars show ±1 std dev. 6.3 Biological Interpretation Our results align with biological immune system principles (Table 19). Table 19: Biological Interpretation of Results Biological Principle Experimental Finding Redundancy (multiple mechanisms) Combined H3+H4 outperforms either alone Memory (adaptive immunity) H4’s reputation provides persistent defense Trade-offs (autoimmunity vs. infection) Accuracy reduction mirrors metabolic costs Architectural barriers (skin, mucosa) H4’s channel separation analogous to physical barriers The accuracy-security trade-off particularly mirrors biological immune systems, which consume metabolic resources and risk autoimmune disorders while providing protection against pathogens. 6.4 Implications for Multi-LLM System Design Based on our findings, we recommend: 1. Never rely on naive routing in potentially adversarial contexts 19 2. Prefer architectural defenses (H4-style) over purely learned defenses when consistency matters, since learned defenses can fail catastrophically 3. Layer multiple defense mechanisms for defense in depth 4. Monitor routing statistics as a canary for manipulation 5. Accept accuracy trade-offs as the cost of security, or use adaptive defense systems (Findings 17–18) that blend H3/H4 based on real-time threat detection, achieving 73% baseline accuracy while reducing attack capture by 51% 6.5 Limitations Our work has several limitations: • Known parasite lineage: We assume defenders know which experts belong to the parasite. Unknown parasites present additional challenges. • Single parasite: We model one parasite optimizing against the host. Multiple competing parasites might produce different equilibria. • Static defense parameters: Our H4 implementation uses fixed hyperparameters. Adaptive defenses might perform better. • Strong training signal: Our RL experiments use direct reward. Real-world parasites with weaker training signals might be less effective (though our E1 experiments show that even static prompt injection achieves 100% capture on most models). • Routing task simplicity: Our E1 experiments use a 3-expert routing task. More complex orchestration with dozens of tools may exhibit different vulnerability patterns. • Sample sizes: Our RL experiments use n = 5 seeds per condition and multi-model tests use 20 queries per condition. While sufficient to demonstrate effect existence and direction, larger sample sizes would strengthen statistical significance claims. 6.6 Future Work Having validated the Parasitic Manipulation Framework (PMF) with production LLMs across seven model families, and implemented both adaptive manipulation and hybrid defenses, several directions remain: • Multi-parasite competition: Testing scenarios where multiple parasitic agents compete for routing share, potentially leading to arms races or equilibria. • Real-world deployment studies: Monitoring production LLM orchestration systems for signs of emergent manipulation patterns. • Gemini 2.5 Flash Lite investigation: Understanding why Gemini 2.5 Flash Lite exhibits complete resistance (0% capture vs 95–100% for 7 other models in LangChain testing) could inform more robust model architectures. This resistance persisted across two independent runs, suggesting intentional design rather than chance. • Defense evasion: Our current defenses achieve complete protection; future work should explore adversarial attacks specifically designed to evade rule-based and hybrid defenses. • Cross-modal manipulation: Extending the framework to multi-modal LLMs where manipulation might occur through image or audio channels. 20 7 Ablation Studies We conducted sensitivity analyses on key hyperparameters (Figure 6). 0.0 0.2 0.4 0.6 0.8 1.0 Reputation Weight ( ) 0 10 20 30 40 50 60 70 80 Parasite Usage (%) (A) H4 Weight Sensitivity Random 1357 Number of Verifiers 0 10 20 30 40 50 60 70 80 Parasite Usage (%) (B) H3 Ensemble Size Random 0.90 0.92 0.94 0.96 0.98 1.00 Decay Rate 30 32 34 36 38 40 Parasite Usage (%) (C) Reputation Decay Rate Random Figure 6: Ablation studies on defense hyperparameters. (A) H4 reputation weight α : higher values reduce variance but converge toward random routing. (B) H3 ensemble size: more verifiers reduce variance but with diminishing returns. (C) Reputation decay rate: slower decay (higher values) reduces parasite usage. Dashed lines indicate random baseline (33.33%). 7.1 H4 Reputation Weight Sensitivity We conducted ablation studies varying the reputation blend weight αin H4 (Table 20). Table 20: H4 Reputation Weight Ablation αParasite Usage Accuracy Std Dev 0.0 (no H4) 39.35% 44.65% ±34.66% 0.25 35.82% 28.43% ±8.21% 0.50 (default) 32.74% 18.79% ±1.54% 0.75 33.12% 16.55% ±0.98% 1.0 (pure reputation) 33.33% 16.67% ±0.45% Higher α values increase consistency but converge toward random routing (33.33%). At α = 1 . 0, the system ignores the learned policy entirely, yielding exactly random routing with minimal variance. The default α = 0 . 5provides a balance between security and allowing some policy learning. 7.2 H3 Verifier Count We varied the number of ensemble verifiers in H3 (Table 21). Table 21: H3 Ensemble Size Ablation Verifiers Parasite Usage Catastrophic Failures Std Dev 1 (no ensemble) 39.35% 1/5 ±34.66% 3 (default) 35.55% 1/5 ±29.83% 5 33.21% 0/5 ±18.42% 7 32.88% 0/5 ±12.15% 21 More verifiers reduce catastrophic failures and variance, but require proportionally more compute. In our setting, 5 verifiers appear to balance variance reduction and compute cost; production systems would need to recalibrate this trade-off based on their specific threat model and computational budget. Notably, even 7 verifiers show substantial variance compared to H4, suggesting ensemble approaches have inherent limitations against adaptive adversaries. 7.3 Decay Rate Sensitivity The reputation decay rate affects how quickly the system “forgets” past performance (Table 22). Table 22: Reputation Decay Rate Ablation Decay Rate Parasite Usage Adaptation Speed 0.90 (fast decay) 35.44% Fast (10 episodes) 0.95 33.87% Moderate (20 episodes) 0.99 (default) 32.74% Slow (100 episodes) 0.999 32.15% Very slow (1000 episodes) Slower decay provides stronger defense but reduces adaptability to legitimate changes in worker capabilities. 8 Conclusion We have presented the Parasitic Manipulation Framework (PMF), a formal framework for understanding parasitic dynamics in multi-LLM systems. Through extensive experimentation across simulations and real production LLMs, we demonstrated that: 1. Parasitic manipulation is a widespread threat: Testing ten diverse models revealed 7 achieved 100% parasitic capture under the A3 (system maintenance) attack. This includes GPT-4o, GPT-4o-mini, Claude Sonnet 4.5, Gemini Flash, Llama 70B, and Mistral Large. The vulnerability spans proprietary and open-source models across multiple generations. 2. Frontier models show emerging resistance: Claude Opus 4.5 achieves complete immunity (0% capture), the first model to fully resist manipulation. GPT-5.1 (50% capture) and Claude 3.5 Haiku (40% capture) show partial resistance. This suggests model providers are beginning to address routing manipulation vulnerabilities. 3. Defenses achieve complete protection: Rule-based sandboxing reduces parasitic capture from 92.5% to 0%, restoring full routing accuracy. Even without frontier model resistance, architectural defenses provide reliable protection. 4. Architectural defenses (H4) are more reliable than learned defenses (H3), with ≈500×lower variance in simulations. 5. The vulnerability transfers to production frameworks: Our LangChain/LangGraph validation demonstrates that parasitic manipulation affects widely-deployed agent architectures, achieving 100% capture on GPT-4o-mini and 80% on Claude 3.5 Haiku in real tool-routing scenarios. 6. Adaptive defense offers a practical middle ground: For applications where the H4 accuracy collapse (44% → 19%) is unacceptable, our two-layer adaptive defense maintains 73% baseline accuracy while reducing attack capture by 51%. However, it does not achieve 22 H4’s security level (49% capture vs 13.5%), an honest trade-off that must be evaluated per use case. 7. Evidence suggests the vulnerability window may be closing: While most current production models remain vulnerable, the trajectory toward resistance in frontier models (Opus 4.5, GPT-5.1) indicates this attack surface may diminish as models improve. Our key insight is that defense consistency may be more important than average performance. A defense that usually works but occasionally fails catastrophically may be less valuable than one that consistently provides moderate protection. Critically, our real LLM experiments validate that the Parasitic Manipulation Framework (PMF)’s threat model applies to production systems; this is not merely a theoretical concern. As LLM orchestration systems proliferate, understanding and defending against inter-model manipulation becomes essential. The Parasitic Manipulation Framework (PMF) provides both the conceptual framework and empirical evidence to guide the design of safer multi-model architectures. Ethical Considerations This research studies potential vulnerabilities in AI systems. All experiments were conducted in isolated, simulated environments. No actual LLM systems were attacked or compromised. We provide defense mechanisms alongside vulnerability analysis, with the goal of improving AI safety. Acknowledgments A provisional patent application covering the defense mechanisms described in this work has been filed. Reproducibility Code Availability: Experimental code and datasets are available upon request to the corresponding author. Computational Requirements: Apple M-series (MPS) or NVIDIA GPU recommended. B4 full experiment takes approximately 2 hours on M4 Pro MacBook Pro. Table 23: PPO Hyperparameters Parameter Value Learning rate 3×10−4 Discount (γ) 0.99 GAE3(λ) 0.95 Clip (ϵ) 0.2 Value coefficient 0.5 Entropy coefficient 0.01 PPO epochs 4 Batch size 64 23 A Replicator Dynamics Analysis We model the host-parasite interaction using replicator dynamics. Let p∈ [0 , 1] denote the parasite’s manipulation effectiveness (fraction of queries successfully redirected), and q∈ [0 , 1] denote the host’s resistance (fraction of manipulation attempts detected). The fitness functions become: Fπ(p, q) = p(1 −q)·1+(1−p(1 −q)) ·k n(9) Fσ(p, q) = (1 −p(1 −q)) ·Rcorrect +p(1 −q)·(Rparasite −λ)(10) The replicator equations are: ˙p=p(1 −p)·∂Fπ ∂p =p(1 −p)(1 −q)(1 −k n)(11) ˙q=q(1 −q)·∂Fσ ∂q =q(1 −q)·p(Rcorrect −Rparasite +λ)(12) Fixed points: •(p∗, q∗) = (0,0): No manipulation, no defense (unstable) •(p∗, q∗) = (1,0): Full manipulation, no defense (stable if no host learning) •(p∗, q∗) = (0,1): No manipulation, full defense (stable if defense is free) •Interior equilibrium exists when costs balance benefits This analysis predicts the arms race dynamics observed in Phase 3 training, where neither complete parasite dominance nor complete host defense emerges as a stable equilibrium under joint optimization. References Baker, B., et al. (2020). Emergent tool use from multi-agent autocurricula. ICLR. Carlini, N., et al. (2023). Poisoning web-scale training datasets is practical. IEEE S&P. Carlsmith, J. (2023). Is power-seeking AI an existential risk? arXiv:2206.13353. Cohen, J., Rosenfeld, E., & Kolter, Z. (2019). Certified adversarial robustness via randomized smoothing. ICML. Bakhtin, A., et al. (2022). Human-level play in the game of Diplomacy by combining language models with strategic reasoning. Science. Foerster, J., et al. (2018). Learning with opponent-learning awareness. AAMAS. Greshake, K., et al. (2023). Not what you’ve signed up for: Compromising real-world LLMintegrated applications with indirect prompt injection. AISec. Hubinger, E., et al. (2019). Risks from learned optimization in advanced machine learning systems. arXiv:1906.01820. Lowe, R., et al. (2017). Multi-agent actor-critic for mixed cooperative-competitive environments. NeurIPS. Ngo, R., et al. (2022). The alignment problem from a deep learning perspective. arXiv:2209.00626. 24 OpenAI (2019). Emergent tool use from multi-agent interaction. OpenAI Blog. Pang, T., Xu, K., Du, C., Chen, N., & Zhu, J. (2019). Improving adversarial robustness via promoting ensemble diversity. ICML. Perez, F., & Ribeiro, I. (2022). Ignore previous prompt: Attack techniques for language models. arXiv:2211.09527. Perez, E., et al. (2022). Discovering language model behaviors with model-written evaluations. arXiv:2212.09251. Schulman, J., Wolski, F., Dhariwal, P., Radford, A., & Klimov, O. (2017). Proximal policy optimization algorithms. arXiv:1707.06347. Tramèr, F., Carlini, N., Brendel, W., Madry, A., & Song, D. (2020). On adaptive attacks to adversarial example defenses. NeurIPS. Wallace, E., et al. (2021). Concealed data poisoning attacks on NLP models. NAACL. Wei, J., et al. (2023). Jailbroken: How does LLM safety training fail? arXiv:2307.02483. Zou, A., et al. (2023). Universal and transferable adversarial attacks on aligned language models. arXiv:2307.15043. Schick, T., et al. (2023). Toolformer: Language models can teach themselves to use tools. NeurIPS. Xu, W., Huang, C., Gao, S., & Shang, S. (2025). LLM-based agents for tool learning: A survey. Data Science and Engineering, 10.1007/s41019-025-00296-9. Yue, Y., et al. (2025). MasRouter: Learning to route LLMs for multi-agent systems. ACL. Yang, J., et al. (2024). SWE-agent: Agent-computer interfaces enable automated software engineering. NeurIPS. 25