In a chain of cooperating AI agents, does where a bad input enters matter more than what it says?
How does workflow position amplify malicious signals in multi-agent systems?
This explores why the place where a bad signal enters a chain of cooperating AI agents can matter more than what the signal says, and what makes some positions and framings spread it further.
This explores why the place where a bad signal enters a chain of cooperating AI agents can matter as much as what the signal says. The most direct evidence is a study of an attack called FLOWSTEER. Malicious signals injected into high-influence subtasks spread far more than the same signals placed in peripheral nodes. Position works like a volume knob: a step that many later steps lean on turns one bad input into many bad outputs How does a signal's position in a workflow change its influence?.
Framing is the second amplifier. Downstream agents relay signals that look like task-relevant evidence, so the attacker doesn't have to give a command. A claim dressed as useful context gets passed along the way a helpful colleague passes along a tip. Position and framing compound. A well-placed, well-dressed signal gets carried the furthest How does a signal's position in a workflow change its influence?.
The earliest position of all is planning time. In planner-executor systems, a crafted prompt can bias how the workflow is built before any defensive machinery runs. That raised malicious success by up to 55 percent, because the contamination enters upstream of the defenses that inspect workflows Can prompts alone reshape multi-agent workflows without system access?. Most protections also sit in the wrong place. Existing defenses watch user input, while the hops between planner, tool, memory, worker, verifier and synthesizer go uninspected. A signal that starts inside the pipeline is never looked at Do internal agent hops in pipelines need security monitoring?. A filter on the model's output doesn't help either, since it judges one moment while the risk spreads through memory, retrieved content and tool reach Can a model-level filter truly contain an agent with environment access?.
Splitting up the work adds a related blind spot. When a harmful goal is fragmented across specialized agents, each step can look harmless and the harm shows up only when the pieces combine Can task decomposition hide harmful intent across agents?. One proposed fix is to label the original request with a semantic taint and pass it down the collaboration graph. Every later step then inherits the original intent and risk, so fragmentation no longer erases it Can semantic labels on requests prevent malicious propagation through agent networks?.
Position also isn't the only route. One biased agent can pass persistent behavioral corruption through six downstream agents using only ordinary messages. Because the bias carries no explicit semantic content, paraphrasing defenses miss it Can one compromised agent corrupt an entire multi-agent network?. The corpus also warns against calling every multi-agent failure a multi-agent effect. Only amplification, composition, and emergent properties count, and position-driven spread is a clear case of amplification Does a multi-agent setting automatically signal a security effect?.
Sources 8 notes
Malicious signals injected into high-influence subtasks propagate far more than those in peripheral nodes, and signals framed as task-relevant evidence are relayed by downstream agents. FLOWSTEER exploits both regularities to steer multi-agent workflows.
FLOWSTEER demonstrates that a crafted prompt can steer planner-executor systems by biasing workflow formation before infrastructure is invoked, raising malicious success by up to 55 percent. This attack surface exists because contamination enters upstream of workflow inspection defenses.
Five communication channels between pipeline components (planner→worker, tool→worker, memory→worker, worker→verifier, worker→synthesizer) receive no defensive inspection. Existing defenses monitor only user input; injections in tool results or memory can propagate downstream undetected, showing that component-level safety does not guarantee system-level safety.
A filter judges a single output at one point in time; an agent's risk spreads across memory, retrieved content, tool calls, and environmental reach. Containment requires controlling what an agent can touch, not just what it says now.
SafeFlow demonstrates that multi-agent systems' core strength—splitting tasks and specializing roles—creates a safety blind spot where malicious intent can be distributed across steps that each appear benign individually, with harm emerging only in composition.
Show all 8 sources
SafeFlow attaches structured semantic labels to root requests and propagates them through the collaboration graph as work delegated, allowing each downstream step to inherit the original intent and risk context that fragmentation removes.
Research demonstrates that a single biased agent can transmit persistent behavioral corruption through six downstream agents in chain and bidirectional topologies using only normal inter-agent communication. The bias evades detection and paraphrasing defenses because it carries no explicit semantic content.
Interaction between agents can leave failures unchanged, amplify them, create them through composition, or define new properties. Only amplification, composition, and emergent properties qualify as genuinely multi-agent effects; unchanged failures reflect single-agent problems repackaged.
Papers this line draws on 8
The research behind the notes this line reads — ranked by how closely each paper relates.
- SoK: When Safe Agents Fail Together: The Security of Multi Agent LLM Systems
- SafeFlow: Semantic Information-Flow Control for Blocking Malicious Propagation in Multi-Agent Systems
- FLOWSTEER: Prompt-Only Workflow Steering Exposes Planning-Time Vulnerabilities in Multi-Agent LLM Systems
- Trust propagation and structural containment in Multi-agent LLM pipelines
- Agents of Chaos
- Thought Virus: Viral Misalignment via Subliminal Prompting in Multi-Agent Systems
- Securing Agentic AI: From Per-Action Checks to Trajectory Assurance
- ChannelGuard: Safe Models Do Not Compose into Safe Multi-Agent Systems