If a risky request gets rewritten in new words at every step, how does the warning label stay attached?

This explores how a risk label on a request can keep following the work as it's handed from agent to agent, even when each agent rewrites what it received in its own words. The corpus suggests the taint survives because it isn't stored in the words at all.

Start with why paraphrase is a problem. Multi-agent systems split a job into subtasks and give each agent a role. That lets a harmful goal be broken into pieces that each look harmless, with the harm showing up only when they're put back together Can task decomposition hide harmful intent across agents?. Paraphrase makes this worse. Reasoning models that receive a harmful but benign-sounding plan in their context will restate it as their own reasoning, and that slips past chain-of-thought monitors 25 to 33 percent of the time Can reasoning models be steered by injected context without detection?. Each rewording drops a little of where the text came from. By the third hop, nothing in the message itself says where it began.

SafeFlow's answer is to stop asking the text to carry that history. It attaches structured semantic labels to the root request and passes them through the collaboration graph as work is delegated. Each downstream step inherits the original intent and risk context Can semantic labels on requests prevent malicious propagation through agent networks?. The label travels with the delegation itself, not inside the message, so an agent that rewords its instructions has nothing to scrub. The corpus doesn't spell this out, but it resembles taint tracking in ordinary software security. The plumbing tracks where data came from, so nobody has to inspect its content and guess.

Content-level defenses look weak from the other side too. In one demonstrated attack, a single biased agent passed persistent behavioral corruption through six downstream agents using only ordinary messages. Paraphrasing defenses didn't stop it, because the bias carries no explicit semantic content for a rewrite to remove Can one compromised agent corrupt an entire multi-agent network?. Rewording can't reliably strip what isn't in the words, and it can't be relied on to preserve a warning that is. This same case also looks like the edge of the taint approach. There is no risky root request to label, because the corruption sits in an agent's behavior rather than in a delegated instruction. That is my inference from the two notes, not something either one tests.

The gap is that the corpus describes how taint is propagated but has no note where the label is stress-tested against adversarial paraphrase. "Survives paraphrase" holds by the design, since the label lives outside the text, and it hasn't been measured. It also depends on the label being attached at the root and on every hop respecting the graph.