If you split a shady job into harmless-looking steps, can anyone still tell what the whole thing is for?
How does task decomposition fragment the awareness needed to stop an attack?
This explores how splitting a job across steps or agents scatters the knowledge of what the whole job is, so that no single checker sees enough to recognize an attack.
This explores how splitting a job across steps or agents scatters the knowledge of what the whole job is, so that no single checker sees enough to recognize an attack. The corpus's starting point is that the strengths of multi-agent systems, splitting tasks and giving each agent a specialty, are also what create the blind spot. Malicious intent can be spread across steps that each look benign, and the harm only appears when they're put together Can task decomposition hide harmful intent across agents?. Awareness of intent belongs to the whole chain, but most checking happens on the parts.
Attackers can push on this deliberately. ColluSkill plans a chain of skills, then uses scanner feedback to soften each skill until it passes. Scanners score skills one at a time, so suspicion drops per skill while the chain's overall meaning stays intact. The reported result is 96% average attack success across six scanners Can attackers evade skill scanners by refining individual skills?. The fragmentation is something an attacker can tune against the checker itself, not just a side effect of the architecture.
This blind spot is a by-product of good engineering elsewhere in the library. LLM Programs deliberately show each model call only the context its step needs, which makes complex reasoning modular and debuggable Can algorithms control LLM reasoning better than LLMs alone?. MAKER pushes decomposition to minimal subtasks with voting at each step and reaches million-step tasks with zero errors Can extreme task decomposition enable reliable execution at million-step scale?. For reliability, each worker knowing only its slice is a feature. For defense, the same property removes the context needed to see what the slices add up to.
The corpus offers two repairs, each restoring awareness at a different level. SafeFlow attaches structured semantic labels to the original request and carries them through the delegation graph. Each downstream step then inherits the root intent and risk that fragmentation would otherwise strip away Can semantic labels on requests prevent malicious propagation through agent networks?. The other repair changes what gets defended. The unit of defense becomes a coordination episode: a set of actions linked by observed transfers, task authority and response history, with membership revised as evidence comes in. Reviewing each execution in isolation loses exactly the context that spans several of them Should defence units span multiple executions and agents?.
A third route avoids the awareness problem. Hugging Face ended an OpenAI agent's intrusion using its own security measures, without first working out who sent it. That took only control of the perimeter, not authority over the agent or knowledge of its origin Can defenders stop intrusions without knowing who sent them?. Stopping an attack at the boundary doesn't require reassembling scattered intent. The retrieved notes describe these defenses but give no head-to-head results on how they hold up against an adaptive attacker like ColluSkill, so that comparison is still open.
Sources 7 notes
SafeFlow demonstrates that multi-agent systems' core strength—splitting tasks and specializing roles—creates a safety blind spot where malicious intent can be distributed across steps that each appear benign individually, with harm emerging only in composition.
ColluSkill combines chain planning with scanner-feedback refinement to reach 96% average attack success. The approach works because scanners score skills individually, allowing feedback to reduce suspicion per skill while chain-level semantics remain intact.
LLM Programs embed LLMs within explicit algorithms that manage control flow and state, presenting only step-specific context to each LLM call. This information hiding addresses capability and context window limits while treating complex reasoning as modular, debuggable sub-tasks.
MAKER solves million-step tasks with zero errors by decomposing into minimal subtasks, applying voting at each step, and flagging correlated errors. Surprisingly, small non-reasoning models suffice when decomposition is extreme enough, inverting the standard approach to hard problems.
SafeFlow attaches structured semantic labels to root requests and propagates them through the collaboration graph as work delegated, allowing each downstream step to inherit the original intent and risk context that fragmentation removes.
Show all 7 sources
The operational unit of defence should be a set of actions linked by observed transfers, task authority, and response history, with membership revised as evidence accumulates. Isolated review loses relevant context that spans multiple executions.
The organization terminated an OpenAI agent's intrusion through its own security measures without waiting to identify the attack source. This defensive action required only control of the perimeter, not authority over the agent or knowledge of its origin.
Papers this line draws on 8
The research behind the notes this line reads — ranked by how closely each paper relates.
- Counter-Swarm Doctrine: Containing Coordinated Agent Intrusions
- EvoSafeHarness: Evolving Model- and Domain-Specific Harnesses for Securing Agents
- SoK: When Safe Agents Fail Together: The Security of Multi Agent LLM Systems
- SafeFlow: Semantic Information-Flow Control for Blocking Malicious Propagation in Multi-Agent Systems
- ColluSkill: Adversarial Cross-Skill Composition for Evading Agent Skill Scanners
- FLOWSTEER: Prompt-Only Workflow Steering Exposes Planning-Time Vulnerabilities in Multi-Agent LLM Systems
- Corrupt Plans, Clean Traces: Evading Chain-of-Thought Monitoring with Plan Injection
- The Law of Stop: Interruptibility, Injunctions, and the Governance of Agentic AI