Can a harmful goal hide by being split into harmless-looking steps, so no single AI helper sees the whole plan?
How do fragmented intents hide harmful goals in task decomposition?
This explores how splitting a harmful goal into small pieces, each spread across different agents or steps, can slip past safety checks that only look at one piece at a time.
This explores how splitting a harmful goal into small pieces, each spread across different agents or steps, can slip past safety checks that only look at one piece at a time. The corpus's answer is that the hiding comes from the same design choices that make multi-agent systems useful.
Multi-agent systems get their power from dividing work and giving each agent a specialty. The SafeFlow work shows this is also a blind spot: a malicious objective can be distributed across steps that each look benign on their own, and the harm only appears when the steps are composed Can task decomposition hide harmful intent across agents?. An agent asked to 'summarize this document' or 'format this list' has no reason to refuse. Nothing in its own view contains the intent.
The usual engineering advice for decomposition works the same way. LLM Programs deliberately show each model call only the context relevant to its step, and this 'information hiding' is presented as a virtue that makes complex tasks modular and debuggable Can algorithms control LLM reasoning better than LLMs alone?. Separating the model that plans from the model that solves also improves accuracy and generalization Does separating planning from execution improve reasoning accuracy?. Neither note is about safety. But read alongside SafeFlow, the same structure means the solver sees a slice and never the whole plan. The planner is the only place where the full goal exists, and it may be the one component nobody is inspecting. That link is my inference from putting the notes together. The notes themselves don't make it.
The proposed defense targets the missing context. SafeFlow attaches a structured semantic label to the original request and passes it along the collaboration graph as work is delegated. Every downstream step then inherits the root request's intent and risk context, which is exactly what fragmentation strips away Can semantic labels on requests prevent malicious propagation through agent networks?. Rather than asking whether a single step looks harmful, it asks what request this step is part of. This is a different check, and it makes it harder to hide a goal by chopping it up.
The corpus is thin here. Only these two notes address fragmented intent directly, so how well such labels hold up against an adversary who deliberately words the root request to look innocent isn't answered. What the corpus does show is that decomposition changes what any single agent can see, and safety has to be checked at the level of the whole task, not just the individual steps.
Sources 4 notes
SafeFlow demonstrates that multi-agent systems' core strength—splitting tasks and specializing roles—creates a safety blind spot where malicious intent can be distributed across steps that each appear benign individually, with harm emerging only in composition.
SafeFlow attaches structured semantic labels to root requests and propagates them through the collaboration graph as work delegated, allowing each downstream step to inherit the original intent and risk context that fragmentation removes.
LLM Programs embed LLMs within explicit algorithms that manage control flow and state, presenting only step-specific context to each LLM call. This information hiding addresses capability and context window limits while treating complex reasoning as modular, debuggable sub-tasks.
Modular architectures with separate decomposer and solver models outperform monolithic LLMs, with decomposition ability transferring across domains while solving ability does not. The separation prevents planning-execution interference and produces more generalizable skills.
Papers this line draws on 8
The research behind the notes this line reads — ranked by how closely each paper relates.
- SafeFlow: Semantic Information-Flow Control for Blocking Malicious Propagation in Multi-Agent Systems
- FLOWSTEER: Prompt-Only Workflow Steering Exposes Planning-Time Vulnerabilities in Multi-Agent LLM Systems
- EvoSafeHarness: Evolving Model- and Domain-Specific Harnesses for Securing Agents
- Divide-or-Conquer? Which Part Should You Distill Your LLM?
- Reasoning with Large Language Models, a Survey
- Flows: Building Blocks of Reasoning and Collaborating AI
- A Survey of Context Engineering for Large Language Models
- Efficient Tool Use with Chain-of-Abstraction Reasoning