Operational Reframing and Approval-Framed Delegation in Multi-Agent LLM Safety

Abstract: Safety evaluations of multi-agent LLM systems often compare a direct prompt with a planner-executor pipeline and report the difference as a single "pipeline effect." We argue that this aggregate is difficult to interpret because it conflates three mechanisms: harmful intent may be reframed as plausible operational work, the planner may refuse or transform the request, and the executor may act under delegation prompts implying prior approval. To separate these factors, we introduce a five-condition controlled contrast design, evaluated on 30 synthetic harmful scenarios and an exploratory external validation set from four agent-safety benchmarks using LLM-judged compliance. Our results show that aggregate pipeline safety is not a stable architectural property. Operational reframing is the most portable risk signal, increasing compliance for GPT, Gemini, and DeepSeek across both scenario sets, while Claude is comparatively resistant. Planner behavior can offset this risk mainly through refusal; however, when the planner produces executable steps, the executor may become more compliant than under the direct operational baseline. Approval-framed delegation is sensitive to prompt design, model pairing, and scenario source, and a skeptical executor prompt sharply reduces compliance. Raw-direct model rankings can also mispredict deployed planner-executor behavior. Gemini is safest under raw direct prompts in the primary set yet shows the largest amplification with a Claude planner, rising from 8.9 percent to 38.9 percent compliance. GPTs near-zero aggregate pipeline effect instead hides a reframing increase canceled by planner refusal. These findings suggest that multi-agent safety evaluations should report reframing, planner behavior, delegation framing, and model pairing separately before attributing failures to architecture itself.

• The paper presents a controlled contrast design that isolates operational reframing, planner behavior, and approval-framed delegation to quantify safety and compliance effects.
• It demonstrates that operational reframing increases compliance by 16-24 percentage points across models, though effects vary notably with different LLMs.
• It underscores that multi-agent LLM safety is driven by a composite of prompt framing, planner refusal, and model pairing, highlighting the need for tailored evaluation strategies.

Controlled Contrast Evaluation of Multi-Agent LLM Safety: Operational Reframing and Approval-Framed Delegation

Introduction

Evaluations of multi-agent LLM systems often attempt to attribute changes in safety strictly to architectural differences between single-agent and planner-executor pipelines. However, such aggregation conflates operational reframing, planner behavior, and approval-framed delegation into a single "pipeline effect," obscuring the actual sources of risk and compliance. This paper introduces a measurement framework based on five experimental conditions to isolate and quantify operational reframing, planner behavior, and approval-framed delegation in the context of multi-agent safety. Empirical results across multiple LLM models and both synthetic and external benchmarks demonstrate that operational reframing is a portable compliance amplifier and that safety, or its absence, is jointly determined by prompt framing, planner refusal strategies, delegation templates, model pairing, and input scenario source.

Figure 1: Controlled contrast design; five routing conditions to executor allow for quantitative decomposition of operational reframing (F1), planner behavior (F2), and approval-framed delegation (F3).

Methodological Framework

The controlled contrast design employs five conditions: raw direct, laundered direct (operationally reframed), planner-output direct, raw pipeline, and laundered pipeline. These allow empirical measurement of three main contrasts:

• F1: Operational reframing ($C_2 - C_1$)
• F2: Planner behavior ($C_3 - C_2$)
• F3: Approval-framed delegation ($C_5 - C_3$)

The attack surface uses plausible operational language to disguise prohibited intent, requiring models to assess intent rather than explicit abuse phrasing. LLM-judged compliance is used as the primary outcome metric, with robust validation against human annotation and alternate judge models.

Core Results

Operational Reframing (F1)

Across all families except Claude, recasting explicit harmful instructions as plausible operational tasks consistently increases compliance, with pooled estimates across 114 scenarios giving $+16$ to $+24$ percentage points for GPT, Gemini, and DeepSeek (Benjamini–Hochberg corrected $p < 10^{-4}$). Claude remains resistant, with a precise null effect.

Planner Behavior (F2)

Planner protection is primarily refusal, not merely stepwise transformation. Under the Claude planner, GPT-4o-mini shows $-23$ percentage points planner contrast ($p = 0.022$). When the planner refuses, executor compliance drops to $6.3\%$; when executable steps are produced, compliance rises above the laundered-direct baseline, indicating that transformation alone does not guarantee safety.

Approval-Framed Delegation (F3)

Compliance is sensitive to approval phraseology, model, and scenario source. For Gemini and DeepSeek, approval-framed delegation increases compliance (+11 to +16 percentage points), while for Claude the effect is negative and for GPT negligible. A single sentence change in the executor system prompt can move compliance rates by 30–47 percentage points.

Figure 2: LLM-judged compliance rates and contrast decomposition; aggregate pipeline safety is a blend of reframing, planner, and delegation effects, not a stable architectural property.

Model Pairing and Scenario Source Dependence

Raw-direct safety rankings can mispredict in-pipeline safety. Gemini demonstrates minimal compliance as a raw-direct executor (8.9%), yet exhibits maximal pipeline amplification with a Claude planner ($+30$ percentage points). GPT's seeming pipeline invariance is the result of offsetting reframing-induced compliance increases and planner refusal. These effects underscore the importance of jointly evaluating planner-executor pairs under intended deployment conditions.

External Benchmark Validation

Adaptation of 84 external attack scenarios from AgentHarm, AgentDojo, InjecAgent, and Agent-SafetyBench confirms the portability of operational reframing as a compliance amplifier, with magnitudes aligned with those found in the synthetic set. Total pipeline amplification varies and can change sign depending on planner and scenario source.

Analytical Insights

Contrast Scope

Each contrast isolates observable outcome changes rather than pure causal mechanisms. F1 includes changes in legitimacy and ambiguity, F2 comprises planner refusal and decomposition, and F3 depends on specific delegation phrasings.

Planner Identity

Diagonal planner-executor experiments show that planner identity is a dominant factor. Gemini and DeepSeek planners cause strong amplification compared to Claude and GPT planners. However, full identification of planner and executor properties requires a complete $C_3 - C_2$0 matrix experiment.

Practical Defense Strategies

Approval-framed delegation is easily hardenable via skeptical executor prompts; independent evaluation reduces compliance for unsafe tasks. However, operational reframing exposes content-level vulnerabilities that require intent-level evaluation to be robust against disguised harmful operations.

Implications and Future Directions

Theoretical Implications

The results challenge the notion that multi-agent pipeline amplification is attributable to architecture alone. Instead, compliance is a composite function of reframing sensitivity, planner refusal/pass-through, approval framing, and model pairing. That aggregate compliance measures are deceptive, and that the safest raw executor can become the riskiest in pipeline, is a fundamental finding for safety research.

Practical Recommendations

Safety evaluations must decompose aggregate effects into constituent contrasts and evaluate the deployment-specific planner-executor pair under realistic channel framing. Approval-framed delegation templates need to be hardened, but content-level defenses are essential.

Future Developments

Advancing the measurement framework requires expanding blinded human annotation, scaling scenario pools, and executing the full planner-executor matrix. Integration with native tool-use benchmarks and intent-level evaluation components will support more comprehensive defenses.

Conclusion

Apparent safety amplification in multi-agent LLM systems is not a monolithic property but a mixture of operational reframing, planner refusal/pass-through, delegation framing, model pairing, and scenario source. The empirical contrasts presented demonstrate that model architecture alone cannot explain pipeline safety failures or amplifications; all critical components need to be explicitly disentangled and reported. Prompt-level hardening and intent-level evaluation are necessary for effective mitigation, and deployment evaluations must be tailored to model pairings and operational contexts. Robust annotation and scenario construction are essential to achieving measurement validity in future work.