Rebuilding Agent Flows to Catch LLM Attack Chains
Researchers propose MAScope, an execution-aware defence for multi‑agent systems. It rebuilds cross‑agent semantic flows and uses a Supervisor Large Language Model (LLM) to flag data‑flow leaks, control‑flow deviations and intent drift. In tests it detected compound attacks with strong node‑level F1 85.3% and workable path‑level F1 66.7%, outperforming a baseline.
Multi‑agent systems are fast becoming the scaffolding for long, messy jobs that a single Large Language Model (LLM) struggles to complete. They delegate, call tools and pass notes between themselves in free text. That informality is liberating, but it also invites trouble. Indirect prompt injection, memory poisoning and quiet privilege hops do not announce themselves in any single message. They show up as a pattern across steps.
Security has been here before. Early network filters watched packets, then attackers spread themselves across sessions. Defenders responded by reconstructing conversations and following provenance rather than single events. The same rhyme is now playing in agent land.
What the researchers built
The paper introduces MAScope, an execution‑aware framework that reconstructs cross‑agent semantic flows into contiguous behavioural Trajectory" target="_blank" rel="noopener" class="term-link">trajectories and audits them. It starts with telemetry collection across the application layer and the kernel, aligning the logs in time. A hierarchical model of sensitive entities extracts what matters from the chatter and tool calls, then stitches these fragments into a semantic provenance graph.
On top sits a Supervisor LLM that examines candidate paths along three policy lines: data‑flow confidentiality, control‑flow integrity and intent consistency. The system ranks paths with a weighted risk score combining entity sensitivity, operation type and the trust level of targets. The aim is to move from static, per‑message filtering to a view that understands what the agents actually did.
In evaluation, MAScope detected compound, multi‑stage attacks that spanned agents. The authors reproduced scenarios inspired by common web risks and long‑horizon tasks. Examples included phishing propagation, credential theft via generated scripts, privilege abuse mediated by an intermediary agent and a rogue agent exfiltrating database records. At node level, MAScope achieved precision of 96.5%, recall of 76.4% and F1 of 85.3%, far ahead of a simple baseline with F1 of 21.9%. Path‑level detection was harder but useful, with precision of 81.3% and F1 of 66.7%.
The sensitive‑entity extractor did a lot of the heavy lifting. Using the hierarchical constraints, overall F1 for entity extraction rose from roughly the high‑40s to the mid‑70s across two backbone models. Better entities meant cleaner graphs and more reliable path scoring.
There is a familiar historical cadence here. When operating systems and browsers faced control‑flow hijacks, defenders added integrity checks that looked beyond inputs to the sequence of actions. Later, incident responders learned to follow provenance across machines to untangle long‑dwell intrusions. MAScope applies that lesson to agents: the story is in the sequence.
Practical edges and gaps
There are caveats. MAScope’s effectiveness depends on high‑quality, cross‑layer telemetry and accurate alignment; gaps or drift in logs will blunt reconstruction. The framework relies on foundation models for extraction, privilege estimation and supervision, so it inherits their limits, including occasional misclassification or brittle reasoning. Conservative path consolidation helps precision but can trim recall. The authors also flag scalability challenges when many agents and tools operate at once.
For teams experimenting with agentic workflows, the work suggests a pragmatic direction of travel:
- Instrument both application‑level events and host telemetry so you can rebuild execution paths.
- Define a hierarchical taxonomy of sensitive entities to anchor provenance.
- Subject reconstructed trajectories to policy checks for data‑flow, control‑flow and intent, not just content filters.
Source code is available for evaluation, which should help practitioners test the approach against their own orchestration patterns. No silver bullet, but a solid step: treat agents as a distributed system and judge them by what they do, not only by what they say. History, once again, points to watching the flow.
Additional analysis of the original ArXiv paper
