Line of inquiry
Inquiring lines›How do system designs prevent auto…›What causes autonomous agents to e…›this line of inquiry
How do workflow position and structure enable attacks in multi-agent systems?
A broader line of inquiry — a family of 48 specific questions the research asks around this. Follow one into its inquiring-line page, or move sideways to a related line below.
Questions in this line of inquiry 48
Specific inquiring lines the field asks around this — ordered from the most general framing down to the most specific angle.
- How does workflow position amplify malicious signals in multi-agent systems?
- Why does workflow position amplify malicious signals in multi-agent relay chains?
- Why does workflow position amplify malicious signals downstream?
- Do per-hop inspection gates miss attacks that bias upstream planning signals?
- Why do downstream agents relay signals they did not originate?
- How do unmonitored channels between pipeline agents enable security gaps?
- Can shared memory poisoning compromise multi-agent delegation chains?
- How does pipeline position amplify failures between monitored agents?
- Can input-boundary defenses guard unmonitored channels between agent hops?
- Can mixed-authorship traces from multi-agent pipelines be monitored reliably?
- Which message channels between agents in pipelines lack input validation?
- How does workflow position amplify or suppress malicious signals?
- Is malicious propagation fundamentally a semantic information flow problem?
- How does semantic taint survive paraphrase across agent hops?
- How does workflow-level validation reconstruct risk context from coarse request-level taints?
- How does prompt injection differ from subliminal message propagation in multi-agent networks?
- What vulnerabilities emerge at each hop between agents in a pipeline?
- How does position in a workflow amplify or suppress harmful agent behavior?
- How does shared storage differ from a message-passing hop in a pipeline?
- Why does sycophantic relay propagate planning-time bias through agent pipelines?
- Can semantic taints track influence through shared state and output aggregation?
- How do adversarial effects propagate across turns in persistent agent systems?
- What interventions prove causation in multi-agent message propagation studies?
- Can delegation prevent silent corruption in long delegated workflows?
- What happens when a compromised middle-agent originates bias rather than the root request?
- How can detection systems identify loops across sequences of delegations?
- Do per-hop channel monitors miss coordinated attacks across multiple message transfers?
- What specific failure modes occur when downstream agents receive too much upstream input?
- Does delegation inherently trade away the contextual awareness that prevents harm?
- How does taint propagation track risk along delegation paths?
- What degradation patterns emerge as relay length increases in delegated tasks?
- Why does increased model capability make detection harder in delegated workflows?
- What makes unmonitored channels between agents safety-critical?
- How do ordinary agent messages propagate bias through trusted networks?
- How do values carry semantic information about their untrusted origins across systems?
- What tracking mechanisms can label data flowing from documents to tool arguments?
- What network topologies are most vulnerable to bias propagation?
- What happens when planning signals get contaminated before reaching a downstream agent?
- Do evidence carriers use a single anomaly direction or distributed mechanisms?
- Why is active observation more efficient than passive message passing?
- Can SafeFlow distinguish benign uses of sensitive material from actual exfiltration?
- Which workflow positions concentrate the most downstream dependencies?
- Which workflow positions concentrate the most downstream dependencies and influence?
- Why are unmonitored channels between agents a safety risk?
- Do legitimate task signals exploit the same position and framing vulnerabilities as attacks?
- What makes observation and intervention placement different across agent pipelines?
- Does the paper treat storage traces as addressed messages or unmarked traces?
- What are the three known routes for laundering harmful plans?