Generalizing information-flow control to orchestrations of black-box, proprietary LLM-based agents

Develop information-flow control techniques that generalize from single-agent settings to multi-agent systems composed of black-box agents implemented with proprietary commercial LLMs, where only inter-agent messaging at the orchestration layer is observable.

Background

The authors survey information-flow control (IFC) approaches that separate trusted and untrusted data flows, noting these methods typically rely on full visibility into an agent’s internal state and execution. Such visibility is unavailable when agents are implemented with proprietary commercial LLMs and orchestrated as opaque components.

They explicitly state that generalizing IFC to these multi-agent contexts is unclear, highlighting a gap between theory and practice for securing real-world orchestrations with limited introspection.

References

These are full-visibility defenses for single agents and it is unclear how to generalize them to orchestrations of black-box agents based on proprietary commercial LLMs.

— Breaking and Fixing Defenses Against Control-Flow Hijacking in Multi-Agent Systems  (2510.17276 - Jha et al., 20 Oct 2025) in Section 7 (Related work), subsection Information flow control

We state these as conjectured sufficient conditions. Proving them, and finding the weakest set that suffices, is open; the deployment in Table~\ref{tab:register} violates (ii).

— Privacy Foundations for Multi-Institutional Scientific Artificial Intelligence  (2609.39787 - Kotevska et al., 30 Sep 2026) in Section 4, subsection “Where individually sound claims fail to compose”

Tracking individual values through the inference of a LLM remains an open problem, and approaches that avoid this assumption propagate labels coarsely through the agent's context instead, which requires modifying the agent and taints much of what it emits (\cref{sec:discussion}).

— Kairos: Transactional Security Enforcement at the System Boundary for LLM Agents  (2610.18457 - Hempel et al., 13 Oct 2026) in Section 3, subsection “Authorization: Labels, Policy, and Oracle,” subsection “Provenance” (Section 3.3.2)