Abstract
Agentic large language model (LLM) networks are increasingly used in safety-critical settings where autonomous agents invoke tools, exchange context, and coordinate decisions. Prompt-injection attacks remain a significant threat to these multi-agent pipelines because they can compromise data flows between agents, bypass instruction hierarchies, and corrupt output integrity. Although defenses against injected prompts and mechanisms for cryptographically verifying model-related computations have been studied independently, no common framework unifies these complementary security perspectives in a protocol suitable for real-time agentic deployments. From the perspective of symmetry, secure inter-agent communication requires the preservation of an invariant integrity relationship between a message at its source and the corresponding message accepted at its destination. A benign communication path therefore exhibits a form of integrity symmetry, whereas prompt injection or message manipulation creates an asymmetric state in which the received payload, its semantic effect, or the receiving model’s internal activation pattern deviates from the trusted reference state. In this paper, we propose SecurePrompt-IntegrityNet (SPI-Net), a prompt-injection-resilient data integrity verification protocol that combines cryptographic attestation with anomaly-aware activation monitoring. SPI-Net provides three closely related mechanisms: a Merkle-tree-based commitment system that verifies the provenance and integrity of data payloads exchanged between agents; a layer-wise Mahalanobis-scoring Activation Anomaly Detector (AAD) that identifies distributional shifts in the intermediate representations of LLMs; and a Trust Propagation Consensus (TPC) mechanism that combines cryptographic and behavioral evidence into per-payload integrity verdicts. In this formulation, the Cryptographic Attestation Module (CAM) tests whether message-level structural symmetry is preserved between the sender and receiver, whereas the AAD detects behavioral symmetry breaking in activation space. Experiments on three multi-agent benchmarks under five adaptive attack strategies show that SPI-Net achieves a 96.8% detection rate with a 1.7% false positive rate, reduces the attack success rate by 94.3% relative to undefended baselines, verifies data integrity with 99.2% accuracy, and introduces only 38 ms of median per-message latency. These results demonstrate that jointly preserving cryptographic integrity symmetry and identifying activation-level asymmetry provides substantially stronger prompt-injection resilience than either verification mechanism alone.