SafeFlow is proposed, a defense framework for multi-agent systems that formalizes malicious cross-agent propagation as a semantic information-flow problem and reduces attack success rates compared to undefended baselines and external defenses while retaining high benign task completion and a high paired safe--harm success rate.
Abstract
Multi-agent systems improve capability through task decomposition and role specialization, but these same mechanisms introduce an important safety blind spot: a harmful objective can be fragmented into locally plausible subtasks, allowing malicious intent to evade detection by any single agent. This is a growing social-impact challenge: systems handling sensitive information or consequential tools can turn routine delegation into unauthorized disclosure or unsafe action. We argue that this failure mode is better understood as a semantic information-flow problem than as a single-turn prompt classification task. To address this, we propose SafeFlow, a defense framework for multi-agent systems that formalizes malicious cross-agent propagation as a semantic information-flow problem. SafeFlow attaches structured semantic taints to root requests, propagates them through a dynamic collaboration graph, and performs workflow-level validation to reconstruct the global risk context before irreversible actions are committed. Evaluated on four benchmarks spanning prompt injection, jailbreak-based unsafe tool use, risky code execution, and harmful web-agent behavior, SafeFlow reduces attack success rates compared to undefended baselines and external defenses while retaining high benign task completion and a high paired safe--harm success rate. Our findings show that multi-agent systems still lack mechanisms for preserving risk semantics across delegation boundaries. This gap can turn routine delegation into privacy harms or unsafe actions that affect people and organizations. SafeFlow keeps this risk visible throughout the workflow, before it results in harm.
AgentFlow, a flow-centric policy language and runtime enforcement model for specifying where data may travel in agent systems, is presented and results are preliminary and scoped to the modeled policy-visible agent behaviors and evaluated benchmarks.
The rapid integration of Large Language Models into autonomous agentic systems has introduced unprecedented capabilities for task automation, reasoning, and tool utilization. However, equipping these agents with the ability to access external APIs, internal databases, and arbitrary web resources significantly broadens the attack surface for data exfiltration. Malicious actors can leverage prompt injection and indirect prompt injection techniques to hijack the agent control flow, forcing it to retrieve sensitive information and transmit it to attacker-controlled destinations. Existing security mechanisms, which predominantly rely on static prompt filtering or heuristic anomaly detection, fail to maintain context across complex, multi-step tool invocations. This paper introduces a comprehensive framework based on Tool-Flow Taint Analysis designed to mitigate data exfiltration in Large Language Model agents. By adapting classical dynamic taint analysis principles to the semantic and operational workflows of agent toolchains, the proposed architecture tracks sensitive data from predefined sources through intermediate natural language reasoning steps to potential external sinks. We establish robust semantic taint propagation rules capable of operating within the non-deterministic environment of Large Language Models. Extensive experimental evaluations demonstrate that the proposed system achieves high efficacy in intercepting exfiltration attempts while maintaining a low false-positive rate and negligible latency overhead. The findings provide a critical foundation for securing next-generation autonomous agents against sophisticated data-stealing attacks in enterprise environments.
Chun Tian, Hiu-Tung Li, Michelle Yu· Journal of innovative resear...· 0 citations
TokenWall is proposed, a runtime defense framework that acts as a semantic firewall over agent token flows, demonstrating that semantic runtime containment can achieve a practical security-utility trade-off for persistent AI agents.
Puji Wang, Yingchen Zhang, Ruqing Zhang et al.· 1 citation
Open source software is vulnerable to supply-chain attacks through transitive dependencies, especially malicious code injected into NPM packages. Existing detectors often inadequately model obfuscated behavior, overlook JavaScript's object-centric features, poorly coordinate static and dynamic analysis, and lose semantic information during behavior abstraction. We propose ProfMalPlus, a malicious NPM package detector combining object-sensitive behavior graphs with coordinated LLM reasoning over annotated code slices. It identifies installation commands and entry files, then constructs graphs capturing sensitive APIs, third-party calls, and unresolved calls. From these graphs, ProfMalPlus extracts security-relevant slices and adds inline static analysis evidence. Local judge agents independently assess each slice. Self-consistency consolidates repeated judgements to reduce LLM variance, while a global judge synthesizes their reports into an entry-level verdict. For undetermined cases, a router selects either third-party enrichment, which adds registry derived module and method semantics, or dynamic augmentation, which executes the package in a sandbox to resolve runtime dependent behavior. The enriched evidence is fed back for reassessment. Finally, a localization agent reports malicious code snippets with explanations. ProfMalPlus achieves a 98.1% F1-score, outperforming state-of-the-art detectors by 3.5% to 52.6%. It also identified 597 previously unknown malicious packages, all confirmed and removed from NPM.
Yiheng Huang, Zhijia Zhao, Bihuan Chen et al.· 1 citation
MAP-Graph is introduced, a provenance-aware memory layer that represents agents, sources, memories, claims, and actions in a typed execution graph and supports provenance as an operational control signal, rather than only post-hoc audit metadata, within the evaluated setting.
Yiqi Wang, Zihao Yan, Jiaqi Zhang et al.· 4 citations
This work presents FAVA (Formal Authorization for Verified Agents), a permission-carrying authorization framework for agent execution that utilizes an LLM-guided Permission Intermediate Representation to translate ambiguous natural-language tasks into structured constraints.
Yifan Zhang, Xinkui Zhao, Sai-Da Liu et al.· 3 citations