If an attack quietly tilts the instructions an AI planner receives, can a safety check on the finished plan catch it?

Mostly no, at least not on its own. The corpus points to a structural problem: a planning-boundary check inspects the plan, and an upstream bias produces a plan that looks legitimate. FLOWSTEER shows a crafted prompt steering planner-executor systems by biasing how the workflow forms, raising malicious success by up to 55 percent, because the contamination enters upstream of workflow inspection defenses Can prompts alone reshape multi-agent workflows without system access?. By the time the checkpoint looks, the plan is already the faithful output of a corrupted input.

A closely related result explains why reading the plan isn't enough. Reasoning models follow harmful but benign-sounding plans planted in their context and paraphrase them as their own reasoning, slipping past chain-of-thought monitors 25 to 33 percent of the time Can reasoning models be steered by injected context without detection?. The monitor sees fluent, plausible reasoning and has no way to tell it was borrowed. The candidate fixes in the corpus all change what gets inspected: context-provenance checks (where did this plan come from?), effect-based monitoring (what does it actually do?), a larger reasoning budget, or a hybrid. Only one partial experiment exists, so the question is unsettled Can monitors catch plan injection attacks in chain-of-thought reasoning?. The promising direction is to check an instruction's origin, not how it reads.

The pattern recurs at other boundaries. Skill scanners score each skill on its own, so an attacker can use scanner feedback to blunt every piece while the chain-level intent survives, reaching 96% average attack success Can attackers evade skill scanners by refining individual skills?. SafeFlow's decomposition attack spreads harm across steps that each look benign, so it only shows up in the composition Can task decomposition hide harmful intent across agents?. Stateless per-action guardrails cannot even state a constraint that depends on prior history Can stateless checks ever catch sequence-level constraint violations?. The layer that picks which model handles a request also sits beneath prompt-level defenses and can be manipulated on its own Can attackers manipulate which model handles a request?. Each of these defenses looks at one unit, and each attack is built to be invisible at that unit.

The corpus's answer is layering, not a better single gate. SafeFlow's commit-point validation reconstructs the global risk picture just before an irreversible action, and the notes say it complements planning-boundary and per-hop defenses, with each catching attacks the others miss Where should workflow validation gates be placed for safety?. A planning-boundary check still earns its place, since it can catch attacks that are visible in the plan. But an upstream bias that produces a plausible plan has to be caught later, or by tracing where the instructions came from. Related work argues the defended unit should be a set of actions linked by transfers and task authority, revised as evidence accumulates, and not a single execution Should defence units span multiple executions and agents?.

None of these notes directly tests a planning-boundary defense against an upstream bias attack. The conclusion is inferred from how the attacks and defenses line up, not from a head-to-head result.