Why do single-message classifiers miss cross-agent harms?
Can prompt classifiers detect malicious intent when harm emerges only across multiple agent interactions? The question reframes security from checking individual messages to tracking how content flows and transforms through a multi-agent system.
SafeFlow's authors say the fragmentation failure "is better understood as a semantic information-flow problem than as a single-turn prompt classification task." The sentence changes the unit of analysis. A prompt classifier takes one text and asks whether it is harmful. A flow view takes a piece of content, or a request, and asks where it came from, what has happened to it and where it is going. The introduction says why the second view is needed: "planner decisions, inter-agent messages, and tool-side effects jointly determine system behavior." A classifier sits at one of those three and sees a slice. In the fragmentation example (Can task decomposition hide harmful intent across agents?) the harm is defined over the path through all of them.
The vocabulary comes from software security, where information-flow control and taint tracking label data at its source and follow the label wherever the data goes. That background is not in the excerpt, but the paper's own terms, "taints" and "information-flow", invoke it. What the paper adds is the word "semantic". In an LLM system content is re-expressed in natural language at every hop, so a label cannot simply ride on the string. It has to attach to something that survives paraphrase, which is the question taken up in How does SafeFlow track sensitivity through agent rewrites?.
The design consequence is that better classifiers do not close a gap that classification cannot see. The defenses ChannelGuard lists (IBProtector, SmoothLLM, Llama Guard, perplexity thresholds) are input classifiers, as Do internal agent hops in pipelines need security monitoring? records. ChannelGuard's own remedy, a gate on every hop, keeps the classification unit and multiplies the checkpoints. The flow framing says the missing piece is not more checkpoints but a label that connects them. Whether coverage or flow is the better investment is open; an open tension in ops/tensions/ records it. The change of unit has a second answer elsewhere in the vault: Should defence units span multiple executions and agents? replaces the isolated action with a set discovered from observed transfers whose membership stays revisable, where a SafeFlow taint is set once at the root request.
The counterargument is cost and sufficiency. Flow tracking needs labels, a graph and a validator, while classification is cheap and probably enough for injection-shaped payloads that sit in one message. That points toward layering, not replacement.
What the excerpt does not give. "Semantic taint" is defined only as "structured", and there is no comparison against classification baselines.
Inquiring lines that read this note 19
This note is a source for these research framings, grouped by the broader line of inquiry each explores. Scan the bold lines of inquiry; follow any specific question forward.
How can defenders detect coordinated attacks across episodes?- Does terminating an intrusion differ from stopping the agent behind it?
- How can per-agent or per-message checks catch harm that emerges only in composition?
- Can a single crossing rate capture all forms of agent behavior when blocked?
- Does prompt hardening equally protect single and multi-agent web systems?
- What attacks are unique to multi-agent systems compared to single agents?
- How does payload exposure compare between single and multi-agent architectures?
- How does prompt hardening work differently in single-agent versus multi-agent systems?
- How do malicious skills evade detection when composed in specific sequences?
- How much does prompt hardening actually defend multi-agent systems?
- Why can agent-restored files pass correct checks but violate task intent?
- How reliable is agent self-description compared to infrastructure monitoring for detecting intent?
- Why do individual safe actions create unsafe behavior collectively?
- Can an agent's unauthorized request for help constitute a boundary crossing?
- Why does scanning skill pairs not fully prevent cross-skill attacks?
- Why does a single approval point create an easy target for attackers?
Related concepts in this collection 6
This note in its neighbourhood — explore the map, then jump to a related concept in the list below.
Click a node to walk · click center to open · click Open in graph to see this note in the full knowledge graph
-
Do internal agent hops in pipelines need security monitoring?
Multi-agent systems route data between planner, worker, verifier, and synthesizer components. Current defenses only guard user input at the entry point, leaving inter-agent channels unmonitored—but is this a real vulnerability or does downstream safety suffice?
its list of existing defenses is a list of input classifiers; the flow framing questions the classification unit itself
-
Can chain-of-thought monitors detect reasoning that originates elsewhere?
When language models work inside pipelines that inject reasoning from retrieved documents, planners, or other agents, monitoring systems may evaluate paraphrased external reasoning as if it were the model's own thinking. This raises questions about what monitors can actually detect.
who wrote what into context is a provenance question, the monitoring-side form of the flow question
-
Can we detect when models hide their reasoning?
Chain-of-thought monitoring is meant to reveal how models reason, but research shows it fails in two distinct ways. Understanding these failure modes is critical for knowing whether safety monitoring actually works.
content re-expressed in clean words is as hard for a flow label as for a monitor
-
Can task decomposition hide harmful intent across agents?
Explores whether splitting a harmful objective into specialized subtasks allows malicious intent to evade detection at each individual step, since no single agent sees the full malicious picture.
the failure this framing is meant to fit
-
Should defence units span multiple executions and agents?
Can security detection improve by treating coordinated intrusions as linked episodes across executions rather than isolated actions? This matters because attackers can hide coordination across time and system boundaries.
parallels: another change of unit from the isolated action to a linked set, with the link found from observed transfers and revisable where a taint is fixed at the root
-
How do failures cross boundaries between multiple agents?
Explores four distinct mechanisms—messages, shared state, aggregation, and delegation—that allow a failure or attack originating in one principal to propagate through multi-agent systems. Understanding these pathways is essential for designing agent interactions that contain rather than amplify risk.
complements: the flow view names the three things that jointly fix behavior, and the four verbs are a topology-independent list of how influence and authority cross principal boundaries, two of which (shared state, aggregation) are not hops
Related papers in this collection 8
Papers most semantically related to this note, ranked by cosine similarity in the embedding space.
- SafeFlow: Semantic Information-Flow Control for Blocking Malicious Propagation in Multi-Agent Systems
- EvoSafeHarness: Evolving Model- and Domain-Specific Harnesses for Securing Agents
- FLOWSTEER: Prompt-Only Workflow Steering Exposes Planning-Time Vulnerabilities in Multi-Agent LLM Systems
- Thought Virus: Viral Misalignment via Subliminal Prompting in Multi-Agent Systems
- SoK: When Safe Agents Fail Together: The Security of Multi Agent LLM Systems
- Securing Agentic AI: From Per-Action Checks to Trajectory Assurance
- Trust propagation and structural containment in Multi-agent LLM pipelines
- ChannelGuard: Safe Models Do Not Compose into Safe Multi-Agent Systems
Original note title
malicious cross-agent propagation is a semantic information-flow problem rather than a single-turn prompt classification task