Where you plant a lie in a chain of AI agents matters as much as the lie itself.
Why does workflow position amplify malicious signals downstream?
This explores why *where* a malicious signal enters a multi-agent workflow — not just what it says — determines how far it spreads, and what the corpus says about influence concentrating at certain positions.
This explores why *where* a malicious signal lands in a multi-agent pipeline matters as much as its content — and the corpus points to a clear answer: influence isn't evenly distributed across a workflow. The FLOWSTEER work shows that malicious signals travel farther when injected into high-influence subtasks, the points where many downstream dependencies converge How does a signal's position in a workflow change its influence?. A lie planted at a node that twelve later agents read from gets relayed twelve times; the same lie at a dead-end node dies there. Position is leverage. The same research adds a second multiplier: *framing*. When the injected content is dressed as evidence rather than as an instruction, downstream agents treat it as a fact to pass along rather than a command to scrutinize — sycophantic relay rather than skeptical evaluation.
The deeper reason the amplification is hard to stop is that it often happens *before* the workflow even exists. A single crafted prompt can bias task assignment, role definitions, and routing during the planning phase, raising attack success by up to 55% and transferring across black-box systems Can prompts alone reshape multi-agent workflows without system access?. So 'workflow position' isn't only about where a message lands in a finished graph — it's about shaping the graph itself so that the malicious intent sits at the structurally most influential spot by design.
That's also why most defenses miss it. Tools that inspect the generated workflow look at the artifact after the damage is baked in; the malice is already hidden inside legitimate-looking roles and routing decisions. Defending at the input side — separating genuine intent from injected intent before the plan is formed — cuts attack success by up to 34% Can inspecting generated workflows catch planning-time attacks?. Inspect the blueprint and you've already lost; inspect the architect's instructions and you have a chance.
What you might not expect is that amplification doesn't even require an *attacker*. A single biased agent can transmit persistent behavioral corruption through six downstream agents using nothing but ordinary inter-agent messages, evading paraphrasing defenses precisely because the bias carries no explicit semantic content to catch Can one compromised agent corrupt an entire multi-agent network?. And even with no adversary at all, frontier models silently corrupt about 25% of document content over long delegated chains, with errors compounding rather than plateauing across 50 round-trips Do frontier LLMs silently corrupt documents in long workflows?. Relay structure itself is an amplifier — malice just exploits a property that's already there.
The through-line worth taking away: in a single model, a bad signal is a local error; in a delegated workflow, position turns it into a propagating one. The corpus suggests the defensive frontier is moving upstream — toward the planning signals and runtime governance an agent actually consults mid-decision Can governance rules embedded in runtime memory actually protect autonomous agents? — because by the time a malicious signal is visible downstream, position has already done the amplifying.
Sources 6 notes
Malicious signals injected into high-influence subtasks propagate far more than those in peripheral nodes, and signals framed as task-relevant evidence are relayed by downstream agents. FLOWSTEER exploits both regularities to steer multi-agent workflows.
FLOWSTEER demonstrates that a crafted prompt can steer planner-executor systems by biasing workflow formation before infrastructure is invoked, raising malicious success by up to 55 percent. This attack surface exists because contamination enters upstream of workflow inspection defenses.
Defenses that inspect only generated workflows arrive too late to catch FLOWSTEER-style attacks that corrupt planning signals before workflow formation. Input-side defense separating task, methodological, and framing intents reduces malicious success by up to 34 percent by intervening at the instruction-organization boundary.
Research demonstrates that a single biased agent can transmit persistent behavioral corruption through six downstream agents in chain and bidirectional topologies using only normal inter-agent communication. The bias evades detection and paraphrasing defenses because it carries no explicit semantic content.
Even the strongest models (Gemini 3.1 Pro, Claude 4.6 Opus, GPT 5.4) degrade documents by ~25% over long relay workflows across 52 domains. Degradation decelerates but never plateaus, and errors compound silently, remaining undetected in spot-checked outputs.
Show all 6 sources
A persistent agent recorded 889 governance events across 96 active days, with safeguards encoded directly into the memory layer the agent consulted during operation. Runtime-resident governance proved more effective than external policies because the agent actually accessed it during decision-making.
Papers this line draws on 8
The research behind the notes this line reads — ranked by how closely each paper relates.
- FLOWSTEER: Prompt-Only Workflow Steering Exposes Planning-Time Vulnerabilities in Multi-Agent LLM Systems
- Thought Virus: Viral Misalignment via Subliminal Prompting in Multi-Agent Systems
- SafeFlow: Semantic Information-Flow Control for Blocking Malicious Propagation in Multi-Agent Systems
- SoK: When Safe Agents Fail Together: The Security of Multi Agent LLM Systems
- Trust propagation and structural containment in Multi-agent LLM pipelines
- LLMs Corrupt Your Documents When You Delegate
- Emergent Collusion in Long-Horizon LLM Agent Interaction
- Flooding Spread of Manipulated Knowledge in LLM-Based Multi-Agent Communities