SafeFlow blocks multi-agent attacks by propagating taints across delegation boundaries.

arXiv 2607.25255 names the real multi-agent failure: a harmful objective gets fragmented into locally plausible subtasks, so no single agent ever sees enough to refuse. SafeFlow attaches structured semantic taints to root requests, propagates them through a dynamic collaboration graph, and validates at the workflow level before any irreversible action. Across four benchmarks it cuts attack success below both undefended baselines and external defenses while keeping benign completion high.