Beyond Input Guardrails: Reconstructing Cross-Agent Semantic Flows for Execution-Aware Attack Detection

2026-03-04

arXiv.org

AI Summary

Existing input sanitization mechanisms struggle to detect stealthy malicious behaviors in agent systems that span both application and operating system layers, as their malicious intent often only manifests in downstream execution effects. This work proposes AScope, a novel framework that achieves cross-layer semantic alignment and behavior reconstruction for the first time. By correlating high-level agent semantics with kernel-level audit logs, AScope reconstructs causal behavior traces and leverages a supervised large language model to perform multi-dimensional anomaly detection, identifying violations in data flow, deviations in control flow, and inconsistencies in intent. Experimental results demonstrate that AScope achieves strong performance across AgentDojo and ten multi-agent scenarios, attaining node-level and path-level F1 scores of 85.3% and 66.7%, respectively, effectively uncovering stealthy attack paths in both single- and multi-agent environments.

Abstract

Multi-Agent System is emerging as the \textit{de facto} standard for complex task orchestration. However, its reliance on autonomous execution and unstructured inter-agent communication introduces severe risks, such as indirect prompt injection, that easily circumvent conventional input guardrails. To address this, we propose \SysName, a framework that shifts the defensive paradigm from static input filtering to execution-aware analysis. By extracting and reconstructing Cross-Agent Semantic Flows, \SysName synthesizes fragmented operational primitives into contiguous behavioral trajectories, enabling a holistic view of system activity. We leverage a Supervisor LLM to scrutinize these trajectories, identifying anomalies across data flow violations, control flow deviations, and intent inconsistencies. Empirical evaluations demonstrate that \SysName effectively detects over ten distinct compound attack vectors, achieving F1-scores of 85.3\% and 66.7\% for node-level and path-level end-to-end attack detection, respectively. The source code is available at https://anonymous.4open.science/r/MAScope-71DC.

Problem

• agentic systems
• cross-layer execution
• attack detection
• semantic flow
• security risks

Innovation

• cross-layer semantic flow
• agentic systems
• execution-aware detection
• supervisor LLM
• attack detection