$S^3$: Improving Agent Safety through Multi-Stage Defense

2026-08-02

AI Summary

This work addresses the security risks propagated across stages in multi-stage workflows involving large language model (LLM) agents, a challenge inadequately handled by existing approaches that focus on isolated stages without holistic coordination. To bridge this gap, the authors introduce the abstraction of Stage-Specific Safety Skills, which modularizes heterogeneous safety mechanisms into reusable and composable components. They further develop an automated transformation pipeline and a community-driven safety skill repository. Building upon this foundation, they propose the $S^3$ (Stage-Specific Safety Skills) multi-stage defense framework, wherein guardian agents orchestrate stage-specific skills to enable end-to-end risk detection and mitigation. Experimental results demonstrate that $S^3$ significantly outperforms current methods in both safety effectiveness and task utility, highlighting its potential for constructing trustworthy LLM agent systems.

Abstract

Large Language Model (LLM) agents rely on multi-stage agentic workflows, with stages such as memory, planning, and tool execution, to accomplish complex tasks. However, risks may emerge at different stages, propagate across steps, and become difficult to detect and mitigate. Existing safety methods protect only isolated stages and are difficult to integrate, leaving agents without comprehensive protection throughout the workflow. To address these limitations, we introduce Stage-Specific Safety Skills, a unified abstraction that represents heterogeneous safety designs as reusable and composable components with explicit stage semantics. We further develop an automated transformation pipeline that converts existing safety designs into reusable safety skills and establish a community-driven safety skill library. Building on this abstraction, we propose $S^3$, a multi-stage defense framework in which a guard agent orchestrates stage-specific safety skills for risk detection and mitigation throughout the agentic workflow. We also construct the Multi-Stage Risk Benchmark (MSRB) to evaluate representative risks across workflow stages. Experimental results show that $S^3$ consistently outperforms representative state-of-the-art baselines in both safety effectiveness and utility preservation. These results demonstrate the potential of stage-specific safety skills as a scalable and composable foundation for building resilient and trustworthy agent systems.

Problem

• LLM agents
• multi-stage workflows
• safety risks
• risk propagation
• comprehensive protection

Innovation

• Stage-Specific Safety Skills
• Multi-Stage Defense
• Guard Agent
• Safety Skill Library
• Multi-Stage Risk Benchmark