Search papers, labs, and topics across Lattice.
This paper identifies a critical vulnerability in local runtime monitors used in multi-agent systems, revealing that distributed backdoors can evade detection by splitting harmful payloads across agents, resulting in each local check passing while the overall attack remains undetected. The authors formalize this issue as an "observability boundary," demonstrating that once fragments appear benign, no local detector can catch the attack, regardless of its strength. Through empirical evaluations, they show that while monitors trained on benign traffic can recover attack structures, they fail to detect attacks unless they access the representation where the payload is fully exposed.
Local monitors can be fooled by distributed backdoors that split harmful payloads, exposing a fundamental flaw in multi-agent safety systems.
As multi-agent, tool-using LLM systems are deployed, a common safety net is a runtime monitor that checks each message, tool call, or step on its own. We show this net has a fundamental hole. A distributed backdoor splits a harmful payload across agents, so every local check passes while the assembled object is the attack. The monitor can be right on every step and still miss the attack. The problem is not splitting itself: split fragments can still leak suspicious tokens or provenance edges. The hard case is \emph{local benignness}. No fragment carries the harm, and what is left looks like ordinary benign traffic. We formalize this as an \emph{observability boundary}: a monitor catches only what its view can tell apart from benign traffic. We prove that once the fragments look benign in the monitored view, no detector on that view can catch them, however strong it is. Across a controlled testbed, an external benchmark, and end-to-end agent runs, local monitors lose the signal exactly as local evidence disappears, and it returns only when the monitor sees the assembled object. A monitor trained only on benign traffic recovers the attack's code structure across held-out encodings (0.874 mean AUROC). A decoded-view gate, given the encoding family, blocks every tested attack. But seeing more is not enough: full-trace monitors and decoders still fail unless they reach the representation where the payload is exposed. Local safety is not global safety when harm is compositional, and the open problem is finding that representation.
