Abstract

Multi-agent LLM applications chain a planner, worker agents, a verifier, and a synthesizer, and every hop between agents is an unmonitored channel through which an adversary can smuggle instructions. Existing defenses guard only the _input_ boundary (IBProtector, Llama Guard, perplexity filters, SmoothLLM) or run _outside_ the application as opaque, stochastic provider-side content filters. We show that this gap carries a consequence practitioners rarely measure: on a 2,100-trace evaluation across eight attack families, five defenses, and three model backends, an undefended pipeline that appears fully safe under standard reporting (attack success 0 _._ 000 on tool- and memory-poisoning) owes that safety almost entirely to the cloud providers server-side filter (54 of 60 blocks on Azure GPT-5), and re-sources it silently to the agent models own alignment when run on a backend without such a filter. Outcome-only reporting hides this dependence. We present ChannelGuard, a training-free defense-in-depth framework that places information-bottleneck (IB) gates on every inter-agent channel; each scores channel text against an adversarial phrase bank by sentence-embedding similarity and deterministically passes, compresses, or blocks it, adding no LLM call, while a per-trace attribution method records which layer first stopped each attack. ChannelGuards tool-output gate blocks Tool Poisoning 30/30 at the application layer, identically across Azure GPT-5, Anthropic Sonnet 4.5, and Anthropic Haiku 4.5, whereas the undefended pipelines mechanism shifts entirely across those backends; ChannelGuard also lowers Prompt Injection attack success by 50% (0 _._ 333 0 _._ 167) and preserves GSM8K accuracy exactly (0 _._ 867). We are equally precise about the limits: white-box adaptive paraphrase evades every embedding gate, where a perturb-and-vote baseline does better. An extended appendix adds four baselines, ablations, hyperparameter sweeps, a benign-preservation analysis, and a cross-family judge audit ( __ =0 _._ 900), at a total measured cost of $47.36.