Does chain-level inspection close the cross-skill attack blind spot?
ChainGuard inspects skill chains rather than individual skills, reducing attack success to 22.5%. The question is whether this chain-level approach can fully eliminate the vulnerability window that adversarial composition exploits.
The paper's defense is ChainGuard, and the excerpt gives its outcome rather than its mechanism: it "reduces the ASR to 22.5% while allowing 99.5% of benign workflows to pass," which the authors take as motivation for "chain-level defenses." The two figures answer different questions. The second says the defense does not buy its result by blocking chains wholesale: only 0.5 percent of benign workflows are stopped, on a benign set the excerpt does not size. The first says the blind spot is narrowed and not closed, since more than one attack in five still succeeds. The SoK's abstract names "path closure" as a key challenge for multi-agent defenses, though the excerpt defines none of the contract's five parts (Can multi-agent defenses close attack paths completely?). Reading this residual as a measured case of that challenge is the vault's pairing, since the excerpt does not say ChainGuard is among the works the SoK surveys.
What changes is the unit of inspection, from the skill to the chain, which is the level where the attack lives (Can skill scanners miss attacks hidden across multiple skills?). The vault now holds several defenses that differ mainly in where they look. Can inspecting generated workflows catch planning-time attacks? argues that placement decides what a defense can catch, and FLOWGUARD moves upstream to the planning boundary. Where should workflow validation gates be placed for safety? takes the assembled workflow as the unit, and ChainGuard, by the excerpt's description, does the same for skills. The tension already logged in ops/tensions about whether the defense unit is the flow or the channel gains a further point on the flow side. That reading is mine; the excerpt compares ChainGuard with neither defense. A chain-level check also has to see a sequence, which fits Can stateless checks ever catch sequence-level constraint violations?, though the excerpt does not say how ChainGuard holds that state.
Two cautions. The figure is given as a reduction "to 22.5%" with no starting point. Reading it as a drop from ColluSkill's 96.0 percent is natural but not confirmed in the excerpt. And whether the attack was adapted to ChainGuard, the way it was adapted to the scanners, is the open question in Does ChainGuard's defense hold against adaptive attacks?.
What the excerpt does not give. What ChainGuard inspects (the packaged chain, an execution trace, or both), when it runs, the attack set behind the 22.5, the size of the benign set, and any cost or latency.
Inquiring lines that read this note 10
This note is a source for these research framings, grouped by the broader line of inquiry each explores. Scan the bold lines of inquiry; follow any specific question forward.
Can defenses detect attacks composed across multiple skills?- Does ChainGuard maintain effectiveness when attackers adapt their approach to the defense?
- Why do workflow-level defenses catch attacks that single-skill inspection cannot detect?
- Why does scanning skill pairs not fully prevent cross-skill attacks?
- Can defenses check skill chains at execution time instead of scan time?
- How do chain-level defenses differ from per-skill scanner detection approaches?
- What feedback does ChainGuard return that an attacker could optimize against?
- Can skill scanners detect attacks spanning multiple skills in a chain?
- How can a trust boundary check be evaluated to confirm it specifies the defense?
Related concepts in this collection 7
This note in its neighbourhood — explore the map, then jump to a related concept in the list below.
Click a node to walk · click center to open · click Open in graph to see this note in the full knowledge graph
-
Can skill scanners miss attacks hidden across multiple skills?
Current security scanners check each skill individually for malicious behavior. This explores whether attackers can split a harmful objective across multiple benign-looking skills that pass inspection separately but form a dangerous chain when composed together.
the blind spot this defense targets
-
Can attackers evade skill scanners by refining individual skills?
Explores whether feedback from per-skill scanners can be weaponized to make malicious multi-skill chains undetectable. Matters because it tests a core assumption of skill-level defense mechanisms.
the attack result the defense is measured against, if the 22.5 is a reduction from it
-
Does ChainGuard's defense hold against adaptive attacks?
ChainGuard reduced attack success to 22.5%, but the paper doesn't report whether the attacker refined its strategy specifically against ChainGuard's feedback, as it did against other scanners. Testing against an unadapted attacker gives defenders an unfair advantage.
the open question on this number
-
Can inspecting generated workflows catch planning-time attacks?
Does examining a workflow after it's created catch attacks that corrupt the planning signals upstream? This matters because if contamination enters earlier, downstream inspection might miss malicious intent laundered into legitimate-looking structure.
placement as the deciding variable; ChainGuard is a second placement, at the composition instead of upstream
-
Where should workflow validation gates be placed for safety?
Can a single defense point catch attacks that fragment across planning, messaging, and execution? The note explores whether workflow-level validation at commit points reconstructs risk context that individual steps cannot see alone.
the same choice of unit in a multi-agent setting
-
Can stateless checks ever catch sequence-level constraint violations?
Explores whether per-action guardrails can express constraints that depend on history, and what structural limits prevent stateless checks from reasoning about composed behavior over time.
a chain-level check needs sequence state; how ChainGuard gets it is not in the excerpt
-
Can multi-agent defenses close attack paths completely?
Research organizes defenses by five contract components and identifies path closure as a key unsolved challenge. The question asks whether current defenses can fully block attack paths or only narrow them.
the survey-level frame that names closure as unsolved; this note's residual is the vault's measured case of it
Related papers in this collection 8
Papers most semantically related to this note, ranked by cosine similarity in the embedding space.
- ColluSkill: Adversarial Cross-Skill Composition for Evading Agent Skill Scanners
- Cyber-Capable AI Agents: Vulnerabilities, Evaluation Containment, and Defensive Response
- PACT: Can Enterprise AI Assistants Be Trusted Under Pressure?
- Large Language Models Meet Knowledge Graphs for Question Answering: Synthesis and Opportunities
- ChannelGuard: Safe Models Do Not Compose into Safe Multi-Agent Systems
- LLMs Can Covertly Sandbag on Capability Evaluations Against Chain-of-Thought Monitoring
- Trust propagation and structural containment in Multi-agent LLM pipelines
- The Troy Moment of AI: Why Some Will Cheat and Some Will Follow?
Original note title
a chain-level defense narrows the cross-skill blind spot but does not close it — ChainGuard passes almost every benign workflow and attack success remains above one in five