{"id":"https://openalex.org/W7168248142","doi":"https://doi.org/10.48550/arxiv.2607.11751","title":"When Local Monitors Miss Compositional Harm: Diagnosing Distributed Backdoors in Multi-Agent Systems","display_name":"When Local Monitors Miss Compositional Harm: Diagnosing Distributed Backdoors in Multi-Agent Systems","publication_year":2026,"publication_date":"2026-07-13","ids":{"openalex":"https://openalex.org/W7168248142","doi":"https://doi.org/10.48550/arxiv.2607.11751"},"language":"en","primary_location":{"id":"pmh:oai:arXiv.org:2607.11751","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2607.11751","pdf_url":"https://arxiv.org/pdf/2607.11751","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"volume":null,"type":"preprint","indexed_in":["arxiv","datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://arxiv.org/pdf/2607.11751","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5137882511","display_name":"Yibo Hu","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I180949307","display_name":"Illinois Institute of Technology","ror":"https://ror.org/037t3ry66","country_code":"US","type":"education","lineage":["https://openalex.org/I180949307"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Hu, Yibo","raw_affiliation_strings":["Illinois Institute of Technology"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Illinois Institute of Technology","institution_ids":["https://openalex.org/I180949307"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5136724230","display_name":"Ren Wang","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I180949307","display_name":"Illinois Institute of Technology","ror":"https://ror.org/037t3ry66","country_code":"US","type":"education","lineage":["https://openalex.org/I180949307"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Wang, Ren","raw_affiliation_strings":["Illinois Institute of Technology"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Illinois Institute of Technology","institution_ids":["https://openalex.org/I180949307"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I180949307"],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9945999979972839,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9945999979972839,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.0019000000320374966,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.000699999975040555,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/multi-agent-systems","display_name":"multi-agent systems","score":0.7360000014305115},{"id":"https://openalex.org/keywords/llm-based-agents","display_name":"LLM agents","score":0.5519999861717224},{"id":"https://openalex.org/keywords/runtime-monitoring","display_name":"runtime monitoring","score":0.8149999976158142},{"id":"https://openalex.org/keywords/tool-use","display_name":"tool use","score":0.33799999952316284},{"id":"https://openalex.org/keywords/attack-detection","display_name":"attack detection","score":0.5199999809265137}],"concepts":[{"id":"https://openalex.org/C2781045450","wikidata":"https://www.wikidata.org/wiki/Q254569","display_name":"Backdoor","level":2,"score":0.7854999899864197},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7307000160217285},{"id":"https://openalex.org/C134066672","wikidata":"https://www.wikidata.org/wiki/Q1424639","display_name":"Payload (computing)","level":3,"score":0.6747000217437744},{"id":"https://openalex.org/C2781238097","wikidata":"https://www.wikidata.org/wiki/Q175026","display_name":"Object (grammar)","level":2,"score":0.5156999826431274},{"id":"https://openalex.org/C2776359362","wikidata":"https://www.wikidata.org/wiki/Q2145286","display_name":"Representation (politics)","level":3,"score":0.4564000070095062},{"id":"https://openalex.org/C2779662365","wikidata":"https://www.wikidata.org/wiki/Q5416694","display_name":"Event (particle physics)","level":2,"score":0.42829999327659607},{"id":"https://openalex.org/C125411270","wikidata":"https://www.wikidata.org/wiki/Q18653","display_name":"Encoding (memory)","level":2,"score":0.39259999990463257},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.39259999990463257},{"id":"https://openalex.org/C101468663","wikidata":"https://www.wikidata.org/wiki/Q1620158","display_name":"Modular design","level":2,"score":0.37689998745918274},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.3741999864578247},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.35499998927116394},{"id":"https://openalex.org/C2776235265","wikidata":"https://www.wikidata.org/wiki/Q18392052","display_name":"Fragment (logic)","level":2,"score":0.35440000891685486},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.3504999876022339},{"id":"https://openalex.org/C168167062","wikidata":"https://www.wikidata.org/wiki/Q1117970","display_name":"Component (thermodynamics)","level":2,"score":0.32710000872612},{"id":"https://openalex.org/C2779089604","wikidata":"https://www.wikidata.org/wiki/Q7169333","display_name":"Permission","level":2,"score":0.32330000400543213},{"id":"https://openalex.org/C11413529","wikidata":"https://www.wikidata.org/wiki/Q8366","display_name":"Algorithm","level":1,"score":0.3061999976634979},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.2851000130176544},{"id":"https://openalex.org/C94915269","wikidata":"https://www.wikidata.org/wiki/Q1834857","display_name":"Detector","level":2,"score":0.28200000524520874},{"id":"https://openalex.org/C137471899","wikidata":"https://www.wikidata.org/wiki/Q11381","display_name":"Local area network","level":2,"score":0.2648000121116638},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.2563999891281128},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.25440001487731934}],"mesh":[],"locations_count":2,"locations":[{"id":"pmh:oai:arXiv.org:2607.11751","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2607.11751","pdf_url":"https://arxiv.org/pdf/2607.11751","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"doi:10.48550/arxiv.2607.11751","doi":"https://doi.org/10.48550/arxiv.2607.11751","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2607.11751","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"pmh:oai:arXiv.org:2607.11751","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2607.11751","pdf_url":"https://arxiv.org/pdf/2607.11751","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"sustainable_development_goals":[],"study_designs":[],"awards":[{"id":"https://openalex.org/G1453181110","display_name":null,"funder_award_id":"#2138286","funder_id":"https://openalex.org/F4320337377","funder_display_name":"Office of Advanced Cyberinfrastructure"},{"id":"https://openalex.org/G1912064254","display_name":"Track 4:  Advanced CI Coordination Ecosystem: Monitoring and Measurement Services","funder_award_id":"2137603","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G3251540411","display_name":null,"funder_award_id":"Jetstream2","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G3562386289","display_name":null,"funder_award_id":"#2138296","funder_id":"https://openalex.org/F4320337377","funder_display_name":"Office of Advanced Cyberinfrastructure"},{"id":"https://openalex.org/G4006316252","display_name":"Track 1: ACCESS Resource Allocations Marketplace and Platform Services (RAMPS)","funder_award_id":"2138259","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G4010157413","display_name":null,"funder_award_id":"2138259","funder_id":"https://openalex.org/F4320337377","funder_display_name":"Office of Advanced Cyberinfrastructure"},{"id":"https://openalex.org/G4676224565","display_name":"ACO: An Open CI Ecosystem to Advance Scientific Discovery (OpenCI)","funder_award_id":"2138296","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G509285653","display_name":"Track 3: COre National Ecosystem for CyberinfrasTructure (CONECT)","funder_award_id":"2138307","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G5367127336","display_name":null,"funder_award_id":"#2138307","funder_id":"https://openalex.org/F4320337377","funder_display_name":"Office of Advanced Cyberinfrastructure"},{"id":"https://openalex.org/G5464919783","display_name":null,"funder_award_id":"2137603","funder_id":"https://openalex.org/F4320337377","funder_display_name":"Office of Advanced Cyberinfrastructure"},{"id":"https://openalex.org/G8300691027","display_name":"Track 2: Customized Multi-tier Assistance, Training, and Computational Help (MATCH) for End User ACCESS to CI","funder_award_id":"2138286","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"}],"funders":[{"id":"https://openalex.org/F4320306076","display_name":"National Science Foundation","ror":"https://ror.org/021nxhr62"},{"id":"https://openalex.org/F4320337377","display_name":"Office of Advanced Cyberinfrastructure","ror":"https://ror.org/04nh1dc89"}],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7168248142.pdf","grobid_xml":"https://content.openalex.org/works/W7168248142.grobid-xml"},"referenced_works_count":0,"referenced_works":[],"related_works":["https://openalex.org/W7171662933","https://openalex.org/W7163021551","https://openalex.org/W7162652773","https://openalex.org/W7172454938","https://openalex.org/W7078346967","https://openalex.org/W7143459916","https://openalex.org/W7220939908","https://openalex.org/W7223081624","https://openalex.org/W7165859076","https://openalex.org/W7090867030"],"abstract_inverted_index":{"As":[0],"multi-agent,":[1],"tool-using":[2],"LLM":[3],"systems":[4],"are":[5],"deployed,":[6],"a":[7,12,31,38,111,149],"common":[8],"safety":[9,232,236],"net":[10,29],"is":[11,52,70,87,97,212,229,233,239,245],"runtime":[13],"monitor":[14,56,112,175,181],"that":[15,126,139,247],"checks":[16],"each":[17],"message,":[18],"tool":[19],"call,":[20],"or":[21,81],"step":[22,62],"on":[23,60,138,184],"its":[24,116],"own.":[25],"We":[26,104,124],"show":[27],"this":[28,106],"has":[30],"fundamental":[32],"hole.":[33],"A":[34,180,198],"distributed":[35],"backdoor":[36],"splits":[37],"harmful":[39],"payload":[40,228],"across":[41,192],"agents,":[42],"so":[43],"every":[44,61,206],"local":[45,159,166],"check":[46],"passes":[47],"while":[48],"the":[49,53,66,93,128,133,162,174,177,188,202,224,227,242],"assembled":[50,178],"object":[51],"attack.":[54,67,208],"The":[55,68,84],"can":[57,76,118,141],"be":[58],"right":[59],"and":[63,95,155,169,217,241],"still":[64,77,219],"miss":[65],"problem":[69,244],"not":[71,213,234],"splitting":[72],"itself:":[73],"split":[74],"fragments":[75,129],"leak":[78],"suspicious":[79],"tokens":[80],"provenance":[82],"edges.":[83],"hard":[85],"case":[86],"\\emph{local":[88],"benignness}.":[89],"No":[90],"fragment":[91],"carries":[92],"harm,":[94],"what":[96,115],"left":[98],"looks":[99],"like":[100],"ordinary":[101],"benign":[102,122,131,185],"traffic.":[103,123],"formalize":[105],"as":[107,165],"an":[108,152],"\\emph{observability":[109],"boundary}:":[110],"catches":[113],"only":[114,172,183],"view":[117,140],"tell":[119],"apart":[120],"from":[121],"prove":[125],"once":[127],"look":[130],"in":[132],"monitored":[134],"view,":[135],"no":[136],"detector":[137],"catch":[142],"them,":[143],"however":[144],"strong":[145],"it":[146,170],"is.":[147],"Across":[148],"controlled":[150],"testbed,":[151],"external":[153],"benchmark,":[154],"end-to-end":[156],"agent":[157],"runs,":[158],"monitors":[160,216],"lose":[161],"signal":[163],"exactly":[164],"evidence":[167],"disappears,":[168],"returns":[171],"when":[173,237],"sees":[176],"object.":[179],"trained":[182],"traffic":[186],"recovers":[187],"attack's":[189],"code":[190],"structure":[191],"held-out":[193],"encodings":[194],"(0.874":[195],"mean":[196],"AUROC).":[197],"decoded-view":[199],"gate,":[200],"given":[201],"encoding":[203],"family,":[204],"blocks":[205],"tested":[207],"But":[209],"seeing":[210],"more":[211],"enough:":[214],"full-trace":[215],"decoders":[218],"fail":[220],"unless":[221],"they":[222],"reach":[223],"representation":[225],"where":[226],"exposed.":[230],"Local":[231],"global":[235],"harm":[238],"compositional,":[240],"open":[243],"finding":[246],"representation.":[248]},"counts_by_year":[],"updated_date":"2026-10-28T10:33:24.094632","created_date":"2026-07-15T00:00:00"}