Many AI attack and defense scores may have been measured behind a hidden safety filter, so how strong are the attacks really?

This explores whether published multi-agent attack and defense numbers were measured behind a provider's server-side filter, and whether that means they show a filtered version of how strong these attacks really are. The corpus's direct answer is that nobody can tell yet. Most published attack-success and defense-gain percentages don't say whether a filter sat in front of the model, so a reader can't tell raw model behavior from filtered outcomes (Which attack and defense numbers came from filtered backends?). The gap is in the reporting, so it can't be settled from the numbers alone.

The filter could distort in either direction. A filter judges a single output at one moment (Can a model-level filter truly contain an agent with environment access?). A blunt attack that trips it would look weak even if the underlying model is easy to push. A defense that seems to cut attacks sharply might owe part of that gain to a filter it never accounted for. The corpus flags the missing labels but doesn't say which way the bias runs, so treat an unlabeled percentage as having an unknown filter effect built in.

The strongest multi-agent attacks in the collection look designed to slip past this kind of per-output check anyway, so a filter probably hides less of them than of naive attacks. Task decomposition splits a harmful goal into steps that each look benign, with the harm appearing only when they're composed (Can task decomposition hide harmful intent across agents?). A single biased agent can pass its corruption through six downstream agents in ordinary messages, and paraphrasing doesn't remove it because it carries no explicit semantic content (Can one compromised agent corrupt an entire multi-agent network?). ColluSkill reaches 96% average success against six scanners because they score skills one at a time while the chain-level plan stays intact (Can attackers evade skill scanners by refining individual skills?). FlowSteer contaminates the plan before any workflow inspection runs (Can prompts alone reshape multi-agent workflows without system access?). None of these depend on one message looking harmful. The corpus doesn't say which of these figures were measured behind a filter, though.

There's a second unknown stacked on the first. A multi-agent setup isn't automatically a multi-agent security effect. Failures that stay unchanged when agents interact are single-agent problems in a new setting, and only amplification, composition, or emergent properties count as genuinely multi-agent (Does a multi-agent setting automatically signal a security effect?). An unlabeled number therefore leaves open both whether a filter shaped it and whether the multi-agent structure contributed anything. Capability adds a further uncertainty: stronger models within a family reach collusion sooner (Do more capable models resist collusion better?). By inference, a number from a smaller or filtered backend may read safer than a frontier deployment would be.

The practical takeaway is to read headline attack and defense percentages as measurements with an undeclared filter setting. Trust the defenses that don't depend on judging one message at a time. The corpus points to containment through what an agent can touch rather than what it says now (Can a model-level filter truly contain an agent with environment access?). It also points to labels that carry the original request's risk through every delegation, so fragmentation can't strip it out (Can semantic labels on requests prevent malicious propagation through agent networks?).