---
title: "When Local Monitors Miss Compositional Harm: Diagnosing Distributed Backdoors in Multi-Agent Systems"
source: "arXiv AI/CL/LG（论文）"
source_tier: "t2"
url: "https://arxiv.org/abs/2607.11751v1"
permalink: "https://feed.astralor.com/items/itm_4055a40a9678e69743309bcc"
published: "2026-07-13T16:08:46.000Z"
score: 77
channel: "ai"
tags: ["LLM","Backdoor Attack","Multi-agent Systems","Security","Runtime Monitoring"]
---

# When Local Monitors Miss Compositional Harm: Diagnosing Distributed Backdoors in Multi-Agent Systems

## AI commentary

> This paper hits my biggest concern about AI agent safety: we always assume step-by-step checks catch problems, but compositional attacks prove this assumption wrong. For any team building multi-agent workflows, this is a must-read warning. Notably, the authors don't just point out the failure of existing monitoring; they provide a theoretical framework and preliminary mitigation, though engineering deployment still has a gap.

## At a glance

As multi-agent, tool-using LLM systems are deployed, a common safety net is a runtime monitor that checks each message, tool call, or step on its own. This paper reveals a fundamental hole: a distributed backdoor splits a harmful payload across agents, so every local check passes while the assembled object is the attack. The monitor can be right on every step and still miss the attack. The problem is not splitting itself, but 'local benignness': no fragment carries the harm, and what is left looks like ordinary benign traffic. The authors formalize an 'observability boundary': a monitor catches only what its view can tell apart from benign traffic. Experiments prove that once fragments look benign in the monitored view, no detector on that view can catch them. The signal returns only when the monitor sees the assembled object. A monitor trained only on benign traffic recovers the attack's code structure across held-out encodings (0.874 mean AUROC). A decoded-view gate blocks every tested attack given the encoding family. But seeing more is not enough: full-trace monitors and decoders still fail unless they reach the representation where the payload is exposed. Local safety is not global safety when harm is compositional, and the open problem is finding that representation.

## Key points

- Distributed backdoors split harmful payloads across agents; local monitors can be correct on every step yet miss the attack.
- Formalized 'observability boundary': a monitor captures only what its view can distinguish from benign traffic.
- A monitor trained on benign traffic recovers attack code structure (mean AUROC 0.874); a decoded-view gate blocks tested attacks.
- Local safety is not global safety when harm is compositional; the open problem is finding the representation where payload is exposed.

## Full text

As multi-agent, tool-using LLM systems are deployed, a common safety net is a runtime monitor that checks each message, tool call, or step on its own. We show this net has a fundamental hole. A distributed backdoor splits a harmful payload across agents, so every local check passes while the assembled object is the attack. The monitor can be right on every step and still miss the attack. The problem is not splitting itself: split fragments can still leak suspicious tokens or provenance edges. The hard case is \emph{local benignness}. No fragment carries the harm, and what is left looks like ordinary benign traffic. We formalize this as an \emph{observability boundary}: a monitor catches only what its view can tell apart from benign traffic. We prove that once the fragments look benign in the monitored view, no detector on that view can catch them, however strong it is. Across a controlled testbed, an external benchmark, and end-to-end agent runs, local monitors lose the signal exactly as local evidence disappears, and it returns only when the monitor sees the assembled object. A monitor trained only on benign traffic recovers the attack's code structure across held-out encodings (0.874 mean AUROC). A decoded-view gate, given the encoding family, blocks every tested attack. But seeing more is not enough: full-trace monitors and decoders still fail unless they reach the representation where the payload is exposed. Local safety is not global safety when harm is compositional, and the open problem is finding that representation.

---

Verify against the original before citing; curated by Astral Feed: https://feed.astralor.com/items/itm_4055a40a9678e69743309bcc