Check the assembled artifact, not each message — distributed backdoors pass every local check

arXiv 2607.11751·high signal

arXiv 2607.11751 diagnoses distributed backdoors in multi-agent tool-using systems: a harmful payload is split across agents so that every per-message, per-tool-call, per-step check passes individually while the assembled object is the attack. The practical rule is to add a composition-level verification stage that inspects the final artifact (the written file, the merged diff, the outbound request) rather than trusting the sum of green step-level checks.