If a harmful request gets split up among AI agents, can a warning label follow it through shared memory and merged answers?

This explores whether a semantic taint, a label describing a request's intent and risk that travels with the work, can follow influence when agents share memory and merge their outputs, not just when a task is handed down a chain. The corpus has direct evidence for the handed-down case and only indirect evidence for the other two. So the answer is partly, with known gaps.

The direct evidence is SafeFlow. It attaches a structured label to the original request and passes it along the collaboration graph as work gets delegated. Each downstream step inherits the original intent and risk, even when its own instructions look harmless Can semantic labels on requests prevent malicious propagation through agent networks?. That matters because multi-agent systems are built to split tasks and specialize roles. A harmful goal can be cut into pieces that each look benign, with the harm appearing only when the pieces are composed Can task decomposition hide harmful intent across agents?. The taint puts back the context that the splitting removed. The notes don't say how labels should combine when several differently tainted outputs are merged into one answer, so aggregation is still an open question here.

Shared state is a harder case. One note argues that an agent's risk doesn't live in a single output. It spreads across memory, retrieved content, tool calls and whatever the agent can reach in its environment, which is why a filter on the model's output can't contain it Can a model-level filter truly contain an agent with environment access?. That points to a gap. A label that rides along with messages doesn't automatically cover a memory store that another agent reads later. Nothing in the corpus shows taints being written into shared state and read back out, so that step would be an extension of the idea, not something demonstrated.

Several failure cases suggest a label based on meaning may not be enough. One compromised agent can spread a behavioral bias through six downstream agents using ordinary messages. Because the bias carries no explicit semantic content, it also survives paraphrasing defenses Can one compromised agent corrupt an entire multi-agent network?. A taint that describes what a request means has nothing to hold onto when the influence has no meaning to describe. Injected plans have a similar problem. Reasoning models paraphrase a planted plan as their own thinking, and chain-of-thought monitors miss it 25 to 33 percent of the time Can reasoning models be steered by injected context without detection?. Once the influence has been restated as the agent's own reasoning, there is no obvious place for a label to stay attached. Advertisement embedding attacks show the same pattern at the output end. Accuracy stays intact and the text looks normal while its integrity is corrupted Can language models be hijacked to embed hidden advertisements?.

Together, the notes suggest semantic taints are a strong way to track declared intent along explicit delegation, but a weak way to track influence that moves silently through shared state or blends in at aggregation. Covering those paths probably takes two things: taints that are stamped into memory and merged at aggregation points, and limits on what an agent can touch at all. The label would be a necessary layer but not a sufficient one.