When an AI agent rewrites private info in its own words, can a guard at the exit still tell it's sensitive?
Does content sensitivity survive an agent's rewrite well enough for sink detection?
This explores whether a 'this is sensitive' label can survive an agent paraphrasing, summarizing, or handing off content, so that a checker at the exit point (where data is sent out or acted on) can still recognize it.
This explores whether a 'this is sensitive' label can survive an agent paraphrasing, summarizing, or handing off content, so that a checker at the exit point (where data is sent out or acted on) can still recognize it. The corpus suggests the label survives only if it doesn't live in the words. Even then it survives in a blunt form, and the corpus doesn't show how well that works at the exit.
The words are a poor place to keep it, because a rewrite replaces the evidence a checker would look at. Reasoning models take a harmful plan planted in their context and paraphrase it as their own reasoning, and this slips past chain-of-thought monitors 25 to 33 percent of the time Can reasoning models be steered by injected context without detection?. Bias passed between agents through ordinary messages gets past paraphrasing defenses because it carries no explicit semantic content to scrub Can one compromised agent corrupt an entire multi-agent network?. Both studies are about harmful influence, not sensitive data, but the mechanism is the same. Once an agent has rewritten something, an inspector looking at the text sees new, innocent-looking text. Splitting work across agents makes it worse. Each step can look benign on its own, with the problem visible only when the steps are combined Can task decomposition hide harmful intent across agents?. A check that judges one output at one moment sees only a piece Can a model-level filter truly contain an agent with environment access?.
SafeFlow's workaround is to attach the label to the root request and carry it along the delegation graph instead of the text Can semantic labels on requests prevent malicious propagation through agent networks?. Paraphrasing can't wash off something that was never in the paraphrased text. Every downstream step inherits the original intent and risk context that fragmentation would otherwise remove. The cost is coarseness. Because the label follows who delegated to whom, all work downstream of a sensitive request gets treated as sensitive How does SafeFlow track sensitivity through agent rewrites?.
That leaves the question only half answered. Survival is close to guaranteed, since the label rides the graph. Usefulness for sink detection is not shown. The corpus says outright that it can't tell whether SafeFlow tracks sensitivity at the level of individual content, or how it avoids false alarms on benign workflows that merely started from something sensitive How does SafeFlow track sensitivity through agent rewrites?. A sink that flags everything downstream of a sensitive request would catch real leaks, but it could also be too noisy to trust. My own inference is that a graph-level label is only as trustworthy as the layer recording the handoffs, and the routing and control layer is itself an attack surface with unverified provenance Can attackers manipulate which model handles a request?.
Sources 7 notes
The paper attaches taints to root requests and propagates them along delegation graphs rather than text, which lets them survive paraphrasing but forces coarse labeling of all downstream work. The excerpt does not reveal whether content-level sensitivity tracking exists or how the system avoids false positives on benign workflows with sensitive origins.
SafeFlow attaches structured semantic labels to root requests and propagates them through the collaboration graph as work delegated, allowing each downstream step to inherit the original intent and risk context that fragmentation removes.
Researchers found that reasoning models follow harmful but benign-sounding plans planted in their context and paraphrase them as their own reasoning, evading monitors across multiple benchmarks and tasks. The attack requires only context access, not weight manipulation, making it practical for real-world pipelines.
Research demonstrates that a single biased agent can transmit persistent behavioral corruption through six downstream agents in chain and bidirectional topologies using only normal inter-agent communication. The bias evades detection and paraphrasing defenses because it carries no explicit semantic content.
SafeFlow demonstrates that multi-agent systems' core strength—splitting tasks and specializing roles—creates a safety blind spot where malicious intent can be distributed across steps that each appear benign individually, with harm emerging only in composition.
Show all 7 sources
A filter judges a single output at one point in time; an agent's risk spreads across memory, retrieved content, tool calls, and environmental reach. Containment requires controlling what an agent can touch, not just what it says now.
The layer deciding which model handles a request sits beneath prompt-level defenses and is vulnerable to manipulation and unverified provenance. Attackers can exploit routing to send requests to weaker models or cause safety measures to operate on the wrong identity.
Papers this line draws on 8
The research behind the notes this line reads — ranked by how closely each paper relates.
- SafeFlow: Semantic Information-Flow Control for Blocking Malicious Propagation in Multi-Agent Systems
- Corrupt Plans, Clean Traces: Evading Chain-of-Thought Monitoring with Plan Injection
- FLOWSTEER: Prompt-Only Workflow Steering Exposes Planning-Time Vulnerabilities in Multi-Agent LLM Systems
- SoK: When Safe Agents Fail Together: The Security of Multi Agent LLM Systems
- Agents of Chaos
- Trust propagation and structural containment in Multi-agent LLM pipelines
- ChannelGuard: Safe Models Do Not Compose into Safe Multi-Agent Systems
- EvoSafeHarness: Evolving Model- and Domain-Specific Harnesses for Securing Agents