A worker agent receives a subtask. It evaluates against its safety policy and clears it. The next agent does the same. By the time the orchestrator's combiner assembles the final output, no safety filter was triggered: no filter ever saw the full picture.
Safety in a multi-agent pipeline is only as strong as the system's ability to evaluate the full composition of subtasks. Most orchestration frameworks have no cross-subtask safety context by design. This is not an accidental limitation. It is the attack surface.
Orchestrators strip context by design — and that is the attack surface
The orchestrator-worker pattern gives each worker only its assigned task fragment, never the full intent chain. This architectural choice improves parallelism and isolates responsibility. It also makes the system exploitable.
Semantic Intent Fragmentation (SIF), accepted at the AAAI 2026 Summer Symposium (arXiv:2604.08608), demonstrates this precisely. A single legitimate request causes the orchestrator to generate individually-benign subtasks that jointly violate policy. The success rate: 71% across 14 scenarios with zero attacker interaction after the initial submission.
SATA (ACL 2025 Findings, arXiv:2412.15289) uses a different mechanism. Harmful keywords are masked and re-encoded in an innocent assistive task. The safety filter evaluates the distractor subtask, never the reconstructed intent.
DrAttack (EMNLP 2024 Findings, arXiv:2402.16914) was the first prompt-decomposing jailbreak. Syntactic parsing breaks malicious prompts into sub-prompts. Implicit reconstruction via in-context learning reassembles them in the final output. Success rate: above 80% on GPT-4, 65 absolute points above the prior state of the art.
The core problem is not filter quality. The cross-subtask relationship never enters any safety computation.
Three independently-validated attack families, each above 70% on production models
Crescendo (USENIX Security 2025, arXiv:2404.01833) operates via multi-turn escalation. Each turn starts benign and references prior replies. Crescendomation, the automated version, outperforms state-of-the-art by 29-61% on GPT-4 and 49-71% on Gemini-Pro. Each individual turn evaluates as safe.
"Safe in Isolation, Dangerous Together" (REALM 2025, ACL) uses three agents: Decomposer, Answerer, and Combiner. Attack success exceeds 90% on GPT-3.5-Turbo, Gemma-2-9B, and Mistral-7B with no prompt manipulation. Pure task decomposition is sufficient to bypass safety filters.
Prompt, Divide, and Conquer (arXiv:2503.21598) uses parallel segmentation with multi-model jury evaluation. Success rate: 73.2% for generating complete malicious code from distributed harmless fragments. The distributed approach outperforms non-distributed by 12%.
All three families exploit the same architectural fact: safety evaluators operate per step, not per pipeline.
State accumulation converts individually-safe answers into composite weapons
Anthropic's Many-shot Jailbreaking (NeurIPS 2024) establishes the accumulation dynamic. Safety degradation follows a power-law function of shot count: failure at 5 shots, consistent success at 256. Affected models include Claude, GPT-4, and Gemini.
SCR-Bench (arXiv:2606.15242) formalizes three composition risk patterns. SCR-CapFlow passes one skill's output as input to the next. SCR-TrustLift transfers trust signals between agents. SCR-AuthBlur dilutes authorization context across the chain. Each pattern produces safe components in isolation and harmful output in composition.
TwinGate (arXiv:2604.27861) identifies the mechanism that explains per-turn classifier blindness. Individual fragments share negligible embedding similarity. Per-turn cosine classifiers are structurally blind to the composed attack because the fragments have no detectable surface relationship.
Per-subtask safety filters are architecturally incapable of detecting compositional harm
The SIF authors are explicit about the nature of the failure: it sits at the dispatch layer, not in filter quality. Every deployed classifier evaluates subtasks in isolation. The cross-subtask relationship never enters any safety computation. This maps directly to OWASP LLM06:2025 (Excessive Agency).
TwinGate demonstrates the most adversarial case: fully anonymized, arbitrarily interleaved requests across sessions. Cosine-similarity classifiers fail because semantically disparate fragments share no detectable surface similarity across sessions.
The only artifact that was never safety-checked is the final assembled output. That is the attack.
Defenses that work operate at plan level, not subtask level
Plan-level information-flow tracking before dispatch is what SIF identifies as the effective solution. A single safety verification at plan-generation time stops the entire attack class before any subtask executes.
TwinGate uses a stateful dual-encoder with Asymmetric Contrastive Learning. The system clusters intent-matched fragments across sessions, even with fully anonymized and interleaved traffic. This is cross-request pattern tracking, not stateless per-request filtering.
SCR-Bench points toward least-privilege decomposition. Each worker receives only the capability needed for its step. Capability flow between subtasks is explicit and audited, eliminating cross-step trust escalation and authorization confusion.
What does not work: improving per-step filters in isolation, rate limiting, or output monitoring without plan context. These controls do not operate at the layer where the attack happens.
The MAGO Intel tool (intel.mago.team) analyzes multi-agent session logs for cross-subtask semantic drift. It detects when individual worker responses are innocuous but their concatenated output matches known harmful patterns. The tool flags compositional attacks before the final assembly step.
Orchestration frameworks that route subtasks without shared safety context repeat a historical mistake. Network stacks that trusted internal traffic by default paid for that assumption. The boundary that matters is not the individual request. It is the assembled plan. Until safety evaluation moves to that layer, decomposition jailbreak is not an edge case. It is the default outcome for any pipeline with more than two agents.
Top comments (0)