SafeFlow Framework Blocks Malicious Propagation in Multi-Agent Systems

Multi-agent systems decompose complex tasks into subtasks assigned to specialized agents, boosting capability but also creating a critical safety blind spot: harmful objectives can be fragmented into locally plausible subtasks, evading detection by any single agent. This allows routine delegation to turn into unauthorized disclosure or unsafe actions. SafeFlow reframes this failure mode as a semantic information-flow problem rather than a single-turn prompt classification task.

To address it, SafeFlow attaches structured semantic taints to root requests, tracks them through a dynamic collaboration graph, and performs workflow-level validation before irreversible actions are executed. In evaluations across four diverse benchmarks—prompt injection, jailbreak-based unsafe tool use, risky code execution, and harmful web-agent behavior—SafeFlow significantly reduces attack success rates compared to undefended baselines and existing external defenses, while preserving high benign task completion and a strong paired safe-harm success rate. The framework ensures risk semantics remain visible throughout the entire workflow, preventing privacy harms and unsafe actions that could affect people and organizations.