An attack can look harmless one step at a time, so why does checking the whole chain catch it?
Why do workflow-level defenses catch attacks that single-skill inspection cannot detect?
This explores why an attack that looks harmless piece by piece becomes visible when you inspect the whole sequence of steps, and where that whole-sequence view still falls short.
This is about why an attack can pass every single-skill check and still be caught when you look at the whole workflow. The corpus's short answer is that the attack isn't in any one piece. In cross-skill composition attacks, a malicious goal is split into interdependent subpayloads and packaged as separate skills. Each skill looks harmless alone, and the attack only happens when they run in order and pass artifacts to each other Can skill scanners miss attacks hidden across multiple skills?. The same pattern shows up in multi-agent systems. Splitting tasks and specializing roles is what makes them useful, and it also lets harmful intent spread across steps that each look benign Can task decomposition hide harmful intent across agents?.
The deeper reason is structural: a single-skill check has no memory, so it can't see the relationship between steps. Per-action, stateless guardrails can't even state a rule that depends on what came before. Rules like "these individually allowed actions must not add up to a violation" need a stateful monitor that tracks the composed behavior Can stateless checks ever catch sequence-level constraint violations?. Workflow-level defenses supply that memory. One version validates the assembled workflow at the moment just before an irreversible action, rebuilding the global risk picture that no single step holds Where should workflow validation gates be placed for safety?. Another treats the unit of defense as a set of actions linked by observed transfers and task authority, with membership revised as evidence comes in, because isolated review loses context that spans executions and agents Should defence units span multiple executions and agents?.
Single-skill scanning is also easy to game. An attacker who gets scanner feedback can keep tuning each sub-skill until it reads as innocent, while the chain-level meaning stays intact. That approach reached about 96% attack success across six scanners Can attackers evade skill scanners by refining individual skills?. Each skill is scored on its own, so the attacker only has to win locally.
Chain-level defense helps but doesn't finish the job. ChainGuard cut attack success to 22.5% while passing 99.5% of benign workflows, but more than one in five attacks still gets through Does chain-level inspection close the cross-skill attack blind spot?. Placement also matters. Defenses that only inspect the generated workflow are too late for attacks that bias the planning signals before the workflow exists. An input-side defense that separates task, methodological, and framing intents cut malicious success by up to 34 percent Can inspecting generated workflows catch planning-time attacks?. This planning-time surface is real, because a crafted prompt alone can steer a planner-executor system and raise malicious success by up to 55 percent Can prompts alone reshape multi-agent workflows without system access?.
So workflow-level defense is not one stronger check. Planning-boundary, per-hop, and commit-point defenses each see attacks the others miss, and the work is choosing where in the pipeline to look.
Sources 9 notes
Security scanners that inspect skills one at a time miss coordinated attacks where a malicious intent is decomposed into interdependent subpayloads packaged as separate skills. Each skill appears harmless in isolation, but their ordered execution carries out the attack through contextual dependencies and artifact passing.
SafeFlow demonstrates that multi-agent systems' core strength—splitting tasks and specializing roles—creates a safety blind spot where malicious intent can be distributed across steps that each appear benign individually, with harm emerging only in composition.
Per-action checks are structurally unable to state constraints that depend on prior history. Only stateful monitors tracking composed multi-party behavior can verify the behavioral envelopes that prevent individually permissible actions from collectively violating system-level safety.
SafeFlow validates assembled workflows at irreversible action boundaries, reconstructing the global risk picture that no single step holds. This commit-point placement complements planning-boundary and per-hop defenses, each seeing attacks the others miss.
The operational unit of defence should be a set of actions linked by observed transfers, task authority, and response history, with membership revised as evidence accumulates. Isolated review loses relevant context that spans multiple executions.
Show all 9 sources
ColluSkill combines chain planning with scanner-feedback refinement to reach 96% average attack success. The approach works because scanners score skills individually, allowing feedback to reduce suspicion per skill while chain-level semantics remain intact.
ChainGuard reduces attack success to 22.5% while passing 99.5% of benign workflows, demonstrating that inspecting chains rather than individual skills narrows the vulnerability. However, residual attack success above one in five indicates the blind spot persists despite the improved defense strategy.
Defenses that inspect only generated workflows arrive too late to catch FLOWSTEER-style attacks that corrupt planning signals before workflow formation. Input-side defense separating task, methodological, and framing intents reduces malicious success by up to 34 percent by intervening at the instruction-organization boundary.
FLOWSTEER demonstrates that a crafted prompt can steer planner-executor systems by biasing workflow formation before infrastructure is invoked, raising malicious success by up to 55 percent. This attack surface exists because contamination enters upstream of workflow inspection defenses.
Papers this line draws on 8
The research behind the notes this line reads — ranked by how closely each paper relates.
- SafeFlow: Semantic Information-Flow Control for Blocking Malicious Propagation in Multi-Agent Systems
- FLOWSTEER: Prompt-Only Workflow Steering Exposes Planning-Time Vulnerabilities in Multi-Agent LLM Systems
- ColluSkill: Adversarial Cross-Skill Composition for Evading Agent Skill Scanners
- SoK: When Safe Agents Fail Together: The Security of Multi Agent LLM Systems
- Corrupt Plans, Clean Traces: Evading Chain-of-Thought Monitoring with Plan Injection
- PACT: Can Enterprise AI Assistants Be Trusted Under Pressure?
- The Troy Moment of AI: Why Some Will Cheat and Some Will Follow?
- ChannelGuard: Safe Models Do Not Compose into Safe Multi-Agent Systems