SafeFlow blocks multi-agent attacks by propagating semantic taints across delegation boundaries

arXiv·medium signalXBlueskyLinkedInCopy link

A July 28 arXiv paper argues that multi-agent systems fail at safety because a harmful objective can be fragmented into locally plausible subtasks, so no single agent ever sees enough to refuse. SafeFlow treats this as an information-flow control problem: it attaches structured semantic taints to root requests, propagates them through a dynamic collaboration graph, and runs workflow-level validation before any irreversible action. Across four benchmarks covering prompt injection, jailbreak-driven unsafe tool use, risky code execution, and harmful web-agent behavior, it cuts attack success rates below both undefended baselines and external defenses while keeping benign task completion high.