Search papers, labs, and topics across Lattice.
This paper introduces SafeFlow, a defense framework designed to mitigate the risks of malicious intent in multi-agent systems by treating the problem as a semantic information-flow issue rather than a simple prompt classification task. By attaching structured semantic taints to requests and validating workflows through a dynamic collaboration graph, SafeFlow effectively reduces the success rates of various attack vectors while maintaining high performance on benign tasks. The evaluation across multiple benchmarks demonstrates that SafeFlow significantly enhances safety in multi-agent systems by preserving risk semantics throughout the delegation process, addressing a critical gap in current methodologies.
SafeFlow reveals that multi-agent systems can obscure malicious intent through task decomposition, but a semantic information-flow approach can effectively counteract this vulnerability.
Multi-agent systems improve capability through task decomposition and role specialization, but these same mechanisms introduce an important safety blind spot: a harmful objective can be fragmented into locally plausible subtasks, allowing malicious intent to evade detection by any single agent. This is a growing social-impact challenge: systems handling sensitive information or consequential tools can turn routine delegation into unauthorized disclosure or unsafe action. We argue that this failure mode is better understood as a semantic information-flow problem than as a single-turn prompt classification task. To address this, we propose SafeFlow, a defense framework for multi-agent systems that formalizes malicious cross-agent propagation as a semantic information-flow problem. SafeFlow attaches structured semantic taints to root requests, propagates them through a dynamic collaboration graph, and performs workflow-level validation to reconstruct the global risk context before irreversible actions are committed. Evaluated on four benchmarks spanning prompt injection, jailbreak-based unsafe tool use, risky code execution, and harmful web-agent behavior, SafeFlow reduces attack success rates compared to undefended baselines and external defenses while retaining high benign task completion and a high paired safe--harm success rate. Our findings show that multi-agent systems still lack mechanisms for preserving risk semantics across delegation boundaries. This gap can turn routine delegation into privacy harms or unsafe actions that affect people and organizations. SafeFlow keeps this risk visible throughout the workflow, before it results in harm.
