Beyond Input Guardrails: Reconstructing Cross-Agent Semantic Flows for Execution-Aware Attack Detection

Abstract: Multi-Agent System is emerging as the \textit{de facto} standard for complex task orchestration. However, its reliance on autonomous execution and unstructured inter-agent communication introduces severe risks, such as indirect prompt injection, that easily circumvent conventional input guardrails. To address this, we propose \SysName, a framework that shifts the defensive paradigm from static input filtering to execution-aware analysis. By extracting and reconstructing Cross-Agent Semantic Flows, \SysName synthesizes fragmented operational primitives into contiguous behavioral trajectories, enabling a holistic view of system activity. We leverage a Supervisor LLM to scrutinize these trajectories, identifying anomalies across data flow violations, control flow deviations, and intent inconsistencies. Empirical evaluations demonstrate that \SysName effectively detects over ten distinct compound attack vectors, achieving F1-scores of 85.3\% and 66.7\% for node-level and path-level end-to-end attack detection, respectively. The source code is available at https://anonymous.4open.science/r/MAScope-71DC.

• The paper introduces MAScope, a framework that combines kernel and application telemetry, hierarchical sensitive-entity extraction, semantic-flow reconstruction, and policy-based trajectory scrutiny to detect attacks spanning multiple agents and execution steps.
• HSEC raises entity-extraction F1 from 48.2% to 75.7% for Gemini-3 and from 49.4% to 76.8% for GPT-5.2, while MAScope reaches 96.5% precision, 76.4% recall, and 85.3% node-level F1 across 14,927 simulated records.
• The results show that execution-aware flow analysis substantially outperforms isolated input guardrails, but simulation-only evaluation, an LLM-based supervisor, configurable risk parameters, and lower path-level F1 of 66.7% limit immediate production generalization.

Motivation and threat model

Multi-Agent Systems (MAS) built on LLMs, exemplified by frameworks such as AutoGen and LangGraph, have become the dominant architecture for orchestrating complex workflows. The authors argue that this architectural shift expands the attack surface not merely quantitatively but qualitatively: vulnerabilities arise from interaction dynamics, coordination logic, and transitive trust dependencies rather than from individual agent defects alone. Drawing on the OWASP Top 10 for agentic applications, they organize threats across three lifecycle stages — input (indirect prompt injection, privilege escalation), interaction (memory poisoning, channel interception), and output (tool misuse) — where dynamic delegation amplifies the cascading impact of unauthorized modifications.

The central technical obstacle the paper identifies is semantic ambiguity combined with execution fragmentation. Attackers can chain individually innocuous micro-operations across different agents and time steps; each event appears benign in isolation, and only the complete sequence manifests as malicious. Conventional input guardrails fail here because they cannot perform fine-grained extraction of security-relevant fields from unstructured natural-language interactions, nor do they possess the situational awareness to distinguish complex legitimate behavior from malicious intent.

The MAScope framework

MAScope shifts defense from static input filtering to execution-aware analysis through three modules: data collection, semantic extraction with flow reconstruction, and trajectory scrutiny. The design is inspired by provenance-based threat detection at the system level, adapted to the semantic richness of agent interactions.

Dual-layer data collection. Kernel-level collectors (ETW, eBPF) monitor process behavior, while application-layer structured logging captures high-level agent semantics — intent, context, reasoning chains — that kernel instrumentation misses. Records are temporally aligned and entity identifiers normalized into a Cross-Agent Semantic Graph, where each event is a quintuple $(l, s, r, o, t)$ denoting layer, subject, relationship, object, and timestamp, with dependency relations spanning agent-to-agent invocations and process-level file/network operations.

Semantic extraction via HSEC. Direct application of general-purpose foundation models to sensitive-information extraction yields irrelevant entities and coarse labels. The Hierarchical Sensitive Entity Constraint (HSEC) mechanism addresses this by mapping extracted entities to a two-level taxonomy (e.g., "Contact Information" under "Identity & Privacy") rather than generic categories, forcing evaluation within an explicit risk context. Each entity receives a continuous sensitivity score composed of a category-prior base weight plus deterministic context adjustments for secret-like patterns, high-entropy strings, sensitive paths, and egress destinations. Event risk scores combine entity sensitivity, relation-dependent operation weights, and a penalty for untrusted destination domains; candidate provenance paths are ranked by aggregated scores with temporal decay $\gamma^{(t_m - t_i)}$, prioritizing which trajectories reach deep scrutiny.

Trajectory scrutiny. A Supervisor LLM audits reconstructed paths against three policies derived from the observation that successful exploits distort one of three dimensions:

Policy	Violation condition
Intent consistency	Path actions deviate from a structured intent specification derived from the initial user request
Data flow confidentiality	Sensitive entities flow to untrusted external destinations
Control flow integrity	Privilege level of source node is below that of target node

Intent specifications are generated once per session and may be overridden by user-defined policy templates. Privilege levels are estimated by an LLM conditioned on process identity, execution context, and object metadata. The supervisor outputs a binary decision plus an evidence string citing concrete attributes (destinations, tool names, file paths), making alerts explainable.

Empirical results

The evaluation uses ten LangGraph-based simulation scenarios spanning recruitment platforms, email orchestration, programming copilots, knowledge assistants, and database infrastructure, yielding 14,927 records with manually labeled ground truth for entities, attack paths, and malicious nodes. Adversarial cases reproduce the OWASP Top 10 attack techniques in compound combinations.

Extraction performance. HSEC improves overall extraction F1 substantially on both backbones: Gemini-3 rises from 48.2% to 75.7% (+27.5 points) and GPT-5.2 from 49.4% to 76.8% (+27.4 points). Gains are largest where baselines collapse — for instance, one attack category improves from an F1 of 13.3% to 83.3% under Gemini-3. The authors attribute this to HSEC treating source code as semantically complete logical blocks rather than fragmented snippets.

Detection performance. Against a VanillaGPT baseline given identical detection rules but no semantic flow reconstruction, MAScope achieves markedly better results:

Metric	MAScope (node-level)	VanillaGPT (node-level)	MAScope (path-level)
Precision	96.5%	23.1%	81.3%
Recall	76.4%	20.8%	56.5%
F1-score	85.3%	21.9%	66.7%

The roughly fourfold F1 gap over the baseline isolates the contribution of cross-agent semantic reconstruction itself, rather than the underlying model's reasoning ability. Case studies illustrate the mechanism: in a phishing-propagation scenario, VanillaGPT classifies both internal Gmail usage and routine database queries as benign because it evaluates actions in isolation, whereas MAScope traces the full path from injected email through SQL extraction to outbound exfiltration. Similar analyses cover credential exfiltration via unexpected shell invocation (flagged as control-flow anomaly) and rogue-agent database theft (flagged as intent inconsistency plus data leakage).

Notably, MAScope's node-level precision (96.5%) exceeds its recall (76.4%), reflecting a deliberately conservative design: when multiple attack paths converge at a common node, trajectories are consolidated, which the authors acknowledge marginally reduces recall but filters background noise. The lower path-level F1 (66.7%) indicates that reconstructing exact end-to-end causal chains remains harder than flagging individual malicious nodes.

Limitations and open questions

Several constraints qualify these results. First, all evaluation occurs in self-constructed simulation scenarios on LangGraph; generalization to production deployments, other orchestration frameworks, and adversarially adaptive attackers is untested. Second, ground truth derives from manual labeling of a single dataset of 14,927 records, so reported metrics carry the uncertainties inherent to small-scale, hand-labeled benchmarks. Third, the framework depends on an LLM-based supervisor whose own susceptibility to prompt injection — the very attack class being detected — is not analyzed; a compromised or manipulated supervisor could undermine the entire pipeline. Fourth, the trusted-domain set $\mathcal{T}$, sensitivity base weights, cue contributions $\delta_k$, and decision threshold $\delta$ are configurable parameters whose sensitivity is not ablated. Fifth, the intent specification is generated once per session, leaving open how drift in legitimate multi-turn objectives affects false-positive rates over long horizons. Finally, the gap between node-level and path-level F1 raises an unresolved question about whether current flow-reconstruction granularity suffices for attacks whose fragmentation spans longer temporal windows.

Conclusion

MAScope demonstrates that shifting multi-agent defense from static input filtering to execution-aware analysis of reconstructed cross-agent semantic flows yields substantial detection gains, with an 85.3% node-level F1 against compound OWASP-derived attacks versus 21.9% for an identically prompted baseline lacking flow reconstruction. The HSEC constraint mechanism independently delivers large extraction improvements across backbone models. The evidence supports trajectory-level scrutiny as a complement to guardrails, while the simulation-only evaluation, reliance on an LLM supervisor, and the node-versus-path performance gap delineate the boundaries within which these conclusions hold.