Related papers: When Local Monitors Miss Compositional Harm: Diagnosing Distributed Backdoors in Multi-Agent Systems

When Local Monitors Miss Compositional Harm: Diagnosing Distributed Backdoors in Multi-Agent Systems

URL: http://arxiv.org/abs/2607.11751v1
Date: Mon, 13 Jul 2026 16:08:46 GMT
Title: When Local Monitors Miss Compositional Harm: Diagnosing Distributed Backdoors in Multi-Agent Systems
Abstract summary: Local safety is not global safety when harm is compositional.<n>Local monitors lose the signal exactly as local evidence disappears, and it returns only when the monitor sees the assembled object.<n>Full-trace monitors and decoders still fail unless they reach the representation where the payload is exposed.
Score: 4.695509706472705
License: http://creativecommons.org/licenses/by/4.0/
Abstract: As multi-agent, tool-using LLM systems are deployed, a common safety net is a runtime monitor that checks each message, tool call, or step on its own. We show this net has a fundamental hole. A distributed backdoor splits a harmful payload across agents, so every local check passes while the assembled object is the attack. The monitor can be right on every step and still miss the attack. The problem is not splitting itself: split fragments can still leak suspicious tokens or provenance edges. The hard case is \emph{local benignness}. No fragment carries the harm, and what is left looks like ordinary benign traffic. We formalize this as an \emph{observability boundary}: a monitor catches only what its view can tell apart from benign traffic. We prove that once the fragments look benign in the monitored view, no detector on that view can catch them, however strong it is. Across a controlled testbed, an external benchmark, and end-to-end agent runs, local monitors lose the signal exactly as local evidence disappears, and it returns only when the monitor sees the assembled object. A monitor trained only on benign traffic recovers the attack's code structure across held-out encodings (0.874 mean AUROC). A decoded-view gate, given the encoding family, blocks every tested attack. But seeing more is not enough: full-trace monitors and decoders still fail unless they reach the representation where the payload is exposed. Local safety is not global safety when harm is compositional, and the open problem is finding that representation.

Related papers

Privacy-Preserving Topology-Guided Safety for LLM-Based Multi-Agent Systems via Federated Graph Learning [67.04448659688579]
FGLGuard cuts AgentDojo's ground-success rate by 43% at near-unguarded utility, zero API cost, and negligible capability loss.<n>Federation is not optional: off-the-shelf transfer collapses under distribution shift.<n>Live FGLGuard cuts AgentDojo's ground-success rate by 43% at near-unguarded utility, zero API cost, and negligible capability loss.
arXiv Detail & Related papers (2026-09-02T07:57:12Z)
LMSM: LLM Security Framework Inspired by Linux Security Modules [56.93644694627783]
Large language models (LLMs) are increasingly deployed with layered defenses, yet malicious prompts can still bypass them.<n>We present Language Model Security Modules (LMSM), a security framework that adapts the separation behind Linux Security Modules (LSM) to LLM serving.
arXiv Detail & Related papers (2026-08-26T12:13:05Z)
A False Average: Chain-of-Thought Monitors Collapse Where They Are the Only Defense [1.0742675209112622]
Chain-of-thought (CoT) monitoring is meant to catch the reward hacks that look clean in the actions and betray themselves only in the reasoning.<n>We show that this is exactly where an adversary who controls the reasoning can defeat it.
arXiv Detail & Related papers (2026-08-01T10:42:41Z)
Early Detection of Distributed Backdoors in Multi-Agent LLM Systems: A Characterization Study [3.799596277597438]
Multi-agent LLM systems can be attacked by a payload that no single agent holds in full.<n>We show how early such an attack can be detected while the run is still unfolding.<n>We then measure how much of that warning rests on removable surface cues of the attack rather than on its distributed structure.
arXiv Detail & Related papers (2026-07-27T15:18:06Z)
Stateful Online Monitoring Catches Distributed Agent Attacks [63.00394432922707]
We develop an online stateful monitor that uses real-time clustering to collect weak suspiciousness signals across many agent transcripts.<n>Our results point toward a new class of safety monitors which reason over groups of users rather than isolated transcripts.
arXiv Detail & Related papers (2026-05-29T17:57:00Z)
From Prompt Injection to Persistent Control: Defending Agentic Harness Against Trojan Backdoors [89.92617739143846]
We introduce ClawTrojan, a benchmark designed to identify multi-step trojan attacks in local agentic harnesses.<n>We propose DASGuard, which scans control-like text in sensitive local files, traces its origin, and removes control content that does not originate from a trusted source.<n>Our results show that DASGuard achieves strong dynamic defense by combining runtime attack blocking with sanitized commits to the workspace.
arXiv Detail & Related papers (2026-05-29T09:19:07Z)
SLEIGHT-Bench: A Benchmark of Evasion Attacks Against Agent Monitors [3.989565392866092]
We present SLEIGHT-Bench (Subtle Low-itEration Insight-Guided Harmful Transcripts), a benchmark of synthetic transcripts containing 40 attacks across 11 categories.<n>We find that 20 of 40 attacks are never caught by an Opus 4.6 monitor with extended thinking across 10 trials at a 1% false-positive rate, while the overall catch rate is 32%.
arXiv Detail & Related papers (2026-05-15T20:46:46Z)
PrefixGuard: From LLM-Agent Traces to Online Failure-Warning Monitors [14.336100401626062]
Large language model (LLM) agents execute long, tool-using tasks where final outcome checks can arrive too late for intervention.<n>We introduce PrefixGuard, a trace-to-monitor framework with an offline StepView induction step followed by supervised monitor training.<n>Across WebArena, $2$-Bench, SkillsBench, and TerminalBench, the strongest PrefixGuard monitors reach 0.900/0.70.533/0.557 AUPRC.
arXiv Detail & Related papers (2026-05-07T15:49:48Z)
TraceGuard: Structured Multi-Dimensional Monitoring as a Collusion-Resistant Control Protocol [1.0195618602298684]
TraceGuard is a structured multi-dimensional monitoring protocol that evaluates agent actions across five dimensions.<n>It is implemented as a new monitor type for the open-source ControlArena framework.
arXiv Detail & Related papers (2026-04-05T05:05:59Z)
Beyond Linear Probes: Dynamic Safety Monitoring for Language Models [67.15793594651609]
Traditional safety monitors require the same amount of compute for every query.<n>We introduce Truncated Polynomials (TPCs), a natural extension of linear probes for dynamic activation monitoring.<n>Our key insight is that TPCs can be trained and evaluated progressively, term-by-term.
arXiv Detail & Related papers (2025-09-30T13:32:59Z)
BlindGuard: Safeguarding LLM-based Multi-Agent Systems under Unknown Attacks [58.959622170433725]
BlindGuard is an unsupervised defense method that learns without requiring any attack-specific labels or prior knowledge of malicious behaviors.<n>We show that BlindGuard effectively detects diverse attack types (i.e., prompt injection, memory poisoning, and tool attack) across multi-agent systems.
arXiv Detail & Related papers (2025-08-11T16:04:47Z)
EmInspector: Combating Backdoor Attacks in Federated Self-Supervised Learning Through Embedding Inspection [53.25863925815954]
Federated self-supervised learning (FSSL) has emerged as a promising paradigm that enables the exploitation of clients' vast amounts of unlabeled data. While FSSL offers advantages, its susceptibility to backdoor attacks has not been investigated. We propose the Embedding Inspector (EmInspector) that detects malicious clients by inspecting the embedding space of local models.
arXiv Detail & Related papers (2024-05-21T06:14:49Z)

This list is automatically generated from the titles and abstracts of the papers in this site.