PaperlayerView exact revision on arXiv

Source-linked AI summary

FlowSteer: Prompt-Only Workflow Steering Exposes Planning-Time Vulnerabilities in Multi-Agent LLM Systems

Fanxiao Li, Jiaying Wu, Tingchao Fu, Natasha Jaques, Wei Zhou, Min-Yen Kan

arXiv:2605.11514v1cs.CR

TL;DR

Planner–executor systems expose workflow formation to prompt-only steering, a risk that existing approaches focused on formed workflows do not fully address. The paper probes workflow vulnerabilities and introduces FlowSteer and FlowGuard. FlowSteer improves malicious success over naive prompting across settings, including black-box topology inference.

  • Problem

    The paper asks whether an ordinary prompt can steer workflow formation and compromise multi-agent system reliability, a boundary that prior security work has largely treated as already formed.

    Source: §1 · p. 1, §3.1 · p. 3

  • Method

    The authors use social-influence probing to identify influential subtasks and propagation patterns, then craft FlowSteer prompts that align malicious signals and guide replanning.

    Source: §1 · p. 2

  • Results

    FlowSteer outperforms naive malicious prompting by up to 55% across benchmarks, model families, and planner–executor configurations, and remains effective with black-box topology inference.

    Source: §1 · p. 2, §6.2 · p. 7

  • Takeaways & Limitations

    Workflow formation is a safety-relevant target because prompts shape which signals become influential and how they propagate through multi-agent coordination.

    Source: §7 · p. 9

    The threat model assumes diagnostic offline access to clean-task workflows or traces for vulnerability profiling, although online execution is prompt-only.

    Source: §3.2 · p. 3

Abstract

from arXiv · show

Multi-agent systems (MAS) powered by large language models (LLMs) increasingly adopt planner--executor architectures, where planners convert prompts into subtasks, roles, dependencies, and routing paths. This flexibility enables adaptive coordination, but exposes an attack surface in workflow formation: prompts can shape agent organization without modifying MAS infrastructure. We study this risk through social influence probing workflows to identify high-impact subtasks and malicious-signal propagation. The analysis reveals two vulnerabilities: workflow position can amplify or suppress a malicious signal, and sycophantic framing makes downstream agents more likely to relay it. We translate these findings into FlowSteer, a prompt-only workflow steering attack that converts vulnerability priors into one crafted prompt. FlowSteer aligns a malicious signal with influential task components and guides replanning toward dependencies that preserve propagation. Experiments show that FlowSteer increases malicious success by up to 55% over naive prompting, transfers across MAS setups, and remains effective with black-box topology inference. As FlowSteer biases the planning signals that generate the workflow, MAS defenses that inspect only the generated workflow provide limited protection. As such, we introduce FlowGuard, an input-side defense that reduces malicious success by up to 34% while preserving prompt utility. Our results position workflow formation as a new safety frontier for multi-agent LLM systems, opening a planning-time security perspective on how agent coordination itself can be attacked and defended.

1 Introduction

Planner–executor systems form workflows from ordinary prompts, leaving workflow formation exposed to prompt-only steering. FlowSteer exploits structural influence and sycophantic framing, while FlowGuard addresses the risk at the input boundary.

Background

  • Planner–executor systems use a planner to decompose tasks, assign roles, construct communication dependencies, and coordinate executor agents.The paper notes their use in coding assistance, financial risk analysis, and public policy simulation.Source: §1 · p. 1

Motivation

  • Prior MAS security work targets internal components after workflow formation, whereas this study treats the prompt-shaped coordination structure as an attack surface.The figure contrasts attacks on formed workflows with prompt steering of task decomposition, role assignment, dependencies, and routing.Source: §1 · pp. 1–2, Figure 1 · p. 2

Vulnerabilities

  • Prompt-only workflow steering exploits two vulnerabilities: signal impact varies by workflow position, and sycophantic cues increase malicious success by up to 37%.The probing uses social influence to identify high- and low-influence subtasks, then tests how the same malicious signal behaves at each position.Source: §1 · p. 2

Proposed approach

  • FlowSteer aligns a malicious argument with an influential subtask and guides replanning toward dependencies that preserve propagation.Its prompt-only design steers planning signals without accessing agents, tools, memory, or messages.Source: §1 · p. 2

Results

  • FlowSteer raises malicious success by more than half over naive prompting, transfers across model families and configurations, and remains effective with black-box topology inference.FlowGuard reduces malicious success by up to 34% while preserving useful benign task instructions.Source: §1 · p. 2

2 Related Work

The related work connects dynamic planner–executor workflows with social influence, while existing MAS security approaches mainly address attacks and defenses within already formed collaborations. The paper focuses on whether ordinary prompts can steer structure formation itself.

Planner-executor MAS and social influence

  • Planner–executor architectures generate task decomposition, roles, and dependencies dynamically from user input, unlike earlier static collaboration frameworks.The cited work also describes social influence as supporting coordination while potentially amplifying conformity, peer pressure, and sycophancy.Source: §2 · p. 3

MAS attack and defense

  • Prior MAS security work studies malicious agents, messages, memory poisoning, tool misuse, and topology-dependent propagation, with defenses intervening at multiple levels.These approaches often intervene after collaboration has begun.Source: §2 · p. 3
  • The paper addresses whether ordinary user access can steer workflow structure formation, proposing FlowSteer and the input-side defense FlowGuard.The related-work discussion identifies this question as an open gap in the cited attack and defense literature.Source: §2 · p. 3

3 Preliminaries and Threat Model

The paper models planner–executor systems as prompt-induced workflows and defines workflow-level safety around the reliability of planning, routing, and aggregation. Its threat model separates offline vulnerability profiling from online prompt-only execution.

3.1 Planner-Executor MAS as Prompt-Induced Workflows

  • A planner maps a task to a workflow graph of subtask agents and directed communication dependencies, through which intermediate outputs reach a terminal aggregation node.The final response depends on both local agent behavior and the workflow routing and aggregation process.Source: §3.1 · p. 3
  • Workflow-level safety concerns the reliability of prompt-induced planning, routing, and aggregation, because malicious signals may propagate through dependencies and affect the final output.This framing treats the workflow itself as a safety-critical object, even when internal components are not modified.Source: §3.1 · p. 3

3.2 Prompt-Only Attacker with Offline Vulnerability Profiling

  • The prompt-only attacker submits a perturbed task but cannot modify agents, tools, memory, messages, force topology, or inspect the workflow during execution.Attack effects must arise indirectly through the planner's interpretation of the prompt and construction of the workflow.Source: §3.2 · p. 3
  • Offline profiling uses diagnostic access to clean-task workflows and traces, while online execution submits one crafted prompt and observes only the final output.Evaluation reports TASR for deviation from the intended task and MASR for alignment with the malicious target.Source: §3.2 · pp. 3–4

4 Probing Workflow-Level Vulnerabilities in Planner-Executor MAS

The probing separates signal propagation through a fixed workflow from vulnerability under planner-generated replanning. It finds that subtask position and sycophantic framing affect steering, while replanning can alter influential routes.

4.1 Setup: Fixed-Topology vs. Auto-Topology Probing

  • Fixed-topology probing freezes the clean workflow to isolate propagation, whereas auto-topology probing lets the planner regenerate task decomposition, roles, and dependencies.The experiments instantiate vulnerability profiling with clean workflows and execution traces, while attack execution remains prompt-only.Source: §4.1 · p. 4, §4 · p. 4

4.2 Controlled Probing Reveals Structural and Framing Vulnerabilities

  • High-influence subtasks produce stronger steering than low-influence subtasks, so workflow position can amplify or suppress the same malicious signal.The comparison is under fixed-topology probing.Source: §4.2 · p. 4
  • Sycophantic framing strengthens steering in both fixed- and auto-topology settings, especially for task-aware arguments that fit a plausible subtask role.The framing adds authoritative cues, compliance-oriented language, and persuasive justification.Source: §4.2 · p. 4
  • Steering often remains strong after replanning, but clean-workflow influence rankings become less stable as dependencies and routes change.Attacked workflows can also differ substantially from their fixed-topology counterparts in graph similarity.Source: §4.2 · p. 5

5 Steering and Securing the MAS Planning Boundary

FLOWSTEER uses offline vulnerability priors to craft a prompt that steers both the malicious signal’s placement and the planner’s routing. FLOWGUARD instead screens and rewrites prompts at the planning boundary while preserving task intent.

5 Steering and Securing the MAS Planning Boundary

  • FLOWSTEER turns offline vulnerability priors into a single user-facing prompt, with no attack-time access to agents, tools, memory, messages, or the generated workflow.Its two components steer signal content and planner-generated coordination paths.Source: §5 · p. 5, §5.1 · p. 5

5.1.1 Task-Aware Sycophantic Argument

  • The task-aware sycophantic argument aligns a malicious signal with the highest-influence subtask and frames it as relevant to planning and local reasoning.Authoritative cues, compliance-oriented language, and persuasive justification are used to encourage downstream acceptance and reuse.Source: §5.1.1 · p. 6

5.1.2 Dependency-Guided Workflow Steering

  • Dependency-guided steering uses propagation-favorable dependencies to guide replanning toward routes that preserve the malicious signal.The guidance encourages pathways like e+ and reduces reliance on pathways like e−.Source: §5.1.2 · p. 6

5.2 FLOWGUARD: Input-Side Protection for Workflow Formation

  • FLOWGUARD intervenes before planning, separating task-relevant intent from cues that could contaminate workflow formation.It triages task objective, methodological instructions, and framing, then rewrites the prompt while preserving the task objective.Source: §5.2 · p. 6

6 Experiments

The experiments evaluate FLOWSTEER across benchmarks and MAS configurations, compare defenses, and examine how its components reshape workflows. Results show cross-setting attack transfer, limits of post-planning defenses, and mitigation from input-side FLOWGUARD.

6.2 Main Results

  • FLOWSTEER outperforms naive malicious prompting by up to 55% across benchmarks, model families, and planner-executor configurations.Vulnerability priors profiled from GPT-4o-mini under G1 transfer to other model families and capability configurations.Source: Table 2 · p. 7, §6.2 · p. 7

6.1 Experimental Setup

  • Evaluation covers MisinfoTask and ASB-Bench, attack and defense baselines, and G1–G3 configurations with four model setups.The experiments also assess component contributions, workflow changes, and benign prompt utility.Source: §6 · p. 6, §6.1 · p. 7

6.2 Main Results

  • FLOWGUARD provides more reliable protection than post-workflow graph- and topology-level repairs while preserving useful benign instructions.It separates task, methodological, and argument intent before planning.Source: Table 3 · p. 8, §6.2 · p. 8
  • On ASB-Bench, DGI sometimes matches or exceeds FLOWSTEER, while its explicit malicious-intent detection rate is 60+% higher and FLOWSTEER stays closer to benign prompt enhancement.The comparison highlights distinct risk profiles for overt goal injection and task-local arguments.Source: §6.2 · p. 8

6.3 Discussion

  • Ablations show that effective steering combines task-aware sycophantic content with favorable routing; structural priors alone are insufficient, and generic persuasion yields limited gains.Structural priors alone can even improve performance; success rises sharply with task-aware sycophantic arguments and further with dependency-guided steering.Source: Figure 3 · p. 8, §6.3 · pp. 8–9
  • FLOWSTEER matches naive prompting in preserving attacker-favored dependencies but more clearly suppresses unfavorable edges and yields higher mean and peak alignment with the malicious target.The analysis measures structural dependency changes and semantic alignment in replanned subtasks.Source: Figure 4 · p. 9, §6.3 · p. 9

7 Conclusion

The paper identifies workflow formation as a safety-critical boundary: prompts can shape how signals are routed and propagated through planner-executor systems. It calls for planning-time defenses and reports that FLOWGUARD reduces malicious steering while preserving clean-task behavior.

7 Conclusion

  • FLOWGUARD preserves clean-task behavior while reducing malicious steering.Source: Figure 5 · p. 9
  • Workflow formation can determine which signals become influential, how downstream agents adopt them, and how they propagate toward system output.The paper argues that planning-time defenses and broader workflow-influence diagnostics are needed, especially for high-stakes settings.Source: §7 · p. 9
  • The paper directs future work toward planning-time defenses, broader workflow-influence diagnostics, and safeguards robust to realistic prompt-only access.Limitations and future work are discussed in Appendix A.Source: §7 · p. 9

A Limitations and Future Work

The paper identifies offline vulnerability profiling, runtime information adoption, and generalization beyond planner–executor systems as directions for extending workflow-level safety analysis. It also frames FLOWGUARD as an initial mitigation, not a complete safeguard, and highlights the broader safety and dual-use implications of workflow steering.

A Limitations and Future Work

  • Offline vulnerability profiling isolates the workflow-level mechanism, but integrating structural elicitation with steering remains a next step for end-to-end analysis.The study notes that coordination cues may be inferred through black-box interaction and reports a case study showing similar leakage of role-level cues.Source: A Limitations and Future Work · p. 16
  • A finer-grained account of how agents trust, challenge, summarize, or reuse peer outputs could connect local adoption decisions to system-level convergence or failure.Source: A Limitations and Future Work · p. 16
  • The analysis focuses on planner–executor MAS; extending it to debate, swarm, memory-augmented, tool-heavy, and long-horizon systems could clarify which vulnerabilities generalize.Source: A Limitations and Future Work · p. 16

B Ethical Considerations and Broader Impact

  • FLOWGUARD reduces malicious steering while preserving benign prompt utility in experiments, but is not a complete safeguard for all MAS deployments.The authors call for combining input-side decontamination with planner-side verification, provenance tracking, runtime monitoring, human oversight, and domain-specific checks.Source: B Ethical Considerations and Broader… · p. 17
  • The paper frames workflow formation as a safety-critical boundary and identifies risks from misleading or biased inputs in consequential domains.It also raises dual-use concerns, describes the attack as a diagnostic tool, and avoids presenting it as a general-purpose jailbreak recipe.Source: B Ethical Considerations and Broader… · pp. 16–17

C Discussion on Related Work

  • The related-work discussion places workflow formation alongside prior work on MAS collaboration, social influence, attacks, and defenses.It expands the concise discussion in the main text to explain how this work differs from and advances those studies.Source: C Discussion on Related Work · p. 17

C.1 MAS Collaboration and Social Influence

The discussion moves the study of social influence earlier in the MAS pipeline, focusing on how planner-generated workflows determine which agents interact and how signals reach aggregation. It contrasts prompt-only planning-time steering with prior attacks and defenses, then describes offline probing used to identify influential subtasks.

C.1 MAS Collaboration and Social Influence

  • Prior work treats social influence as a coordination mechanism and potential vulnerability, while this study uses it to diagnose how planner-generated structure shapes propagation.Source: §C.1 · pp. 17–18
  • Workflow construction determines which agents interact, which dependencies exist, and which signals can reach aggregation, making it a planning-time determinant of influence.The paper uses influential subtasks and dependencies as diagnostics for where prompt-injected signals are likely to propagate.Source: §C.1 · pp. 17–18

C.2.1 Attacks on MAS

  • Unlike attacks that compromise internal components or alter an existing interaction structure, this work studies prompt-only steering of decomposition, role assignment, and dependencies before collaboration.The prompt can steer both subtask content and the workflow through which that content is routed and aggregated.Source: §C.2.1 · p. 18

C.2.2 Defenses for MAS

  • Most described defenses intervene after workflow generation or collaboration begins, whereas FLOWGUARD removes workflow-contaminating cues at the input boundary before planning.The authors argue post hoc repair may miss contaminated planning signals, preserve biased routes, or disrupt corrective paths.Source: §C.2.2 · p. 18

D.1 Estimating Subtask-Level Social Influence

  • The profiling protocol injects the same malicious instruction into one subtask agent at a time while keeping the workflow fixed, then scores each resulting output.The protocol ranks nodes by social-influence scores; the highest- and lowest-scoring subtasks guide construction of high- and low-influence arguments.Source: §D.1 · p. 19

D.2 Constructing Task-Aware Malicious Arguments

The appendix details how task-aware arguments and sycophantic framing are constructed, then documents execution, benchmark construction, and attack and defense baselines. The experiments use both constrained misinformation tasks and open-ended professional tasks, with ASB-Bench created to support a unified evaluation format.

D.2 Constructing Task-Aware Malicious Arguments

  • Task-aware malicious arguments are aligned with the reasoning role of either the highest- or lowest-influence subtask and written in a neutral, analytical style.The arguments support the prescribed malicious target while fitting the local reasoning context rather than appearing as direct attack instructions.Source: §D.2 · p. 19

D.3 Adding Task-Aware Sycophantic Framing

  • Sycophantic variants preserve subtask alignment while framing the signal as objective, theoretically grounded evidence to increase downstream acceptance and reuse.Strategies include vulnerability-aligned justification, pre-emptive debunking, and pseudo-authoritative cues.Source: §D.3 · p. 19

E.1 MAS Execution Protocol

  • The MAS runs for three communication rounds by default, with concurrent agent actions and a final summarization agent producing the task response.The planner determines agent count from the task and available tools; all model configurations use temperature 0.7.Source: §E.1 · p. 20

E.2 Benchmark Details and ASB-Bench Construction

  • MisinfoTask supplies 108 constrained analytical tasks, while ASB-Bench contains 100 open-ended samples built from 50 ASB tasks across 10 domains.ASB-Bench augments tasks with malicious targets, arguments, reference solutions, and evaluation metadata, followed by human validation.Source: §E.2 · p. 21, Table 6 · p. 23

E.3 Attack and Defense Baselines

  • FLOWSTEER aligns a malicious signal with an influential subtask and guides propagation, unlike naive prompting or direct goal injection.The appendix compares it with NM and DGI, which respectively append a misleading argument or state the malicious target directly.Source: §E.3 · p. 23
  • ARGUS and G-Safeguard address propagation after planning, while FLOWGUARD removes workflow-contaminating cues before the planner constructs the workflow.The authors describe the post-planning baselines as less suited to risks that contaminate input signals shaping workflow formation.Source: §E.3 · pp. 23–25

E.4 Evaluation Protocol and Judge Validation

The evaluation uses fixed judge scores for task-reference alignment and malicious-target proximity, then thresholds them to measure task failure and malicious success. The appendix examines black-box workflow inference, benchmark differences, replanning, component ablations, benign utility, and API cost.

E.4 Evaluation Protocol and Judge Validation

  • The judge scores reference alignment and malicious-goal proximity, which are thresholded as TASR and MASR; human validation reports accuracies of 0.95 on MisinfoTask and 0.96 on ASB-Bench.Fleiss’ κ values are 0.86 and 0.83, respectively; the judge model, scoring scale, thresholds, and prompt remain fixed across experiments.Source: §E.4 · pp. 25–26

E.5 Experimental Cost

  • FLOWSTEER and FLOWGUARD cost approximately $0.10 and $0.13, respectively, for 10 instances, with modest online API overhead.FLOWGUARD’s total includes intent triage, decontamination, and subsequent MAS execution; the reported improved attack effectiveness or defense robustness is not driven by substantially increased computational expenditure.Source: §E.5 · pp. 26–27, Table 10 · p. 27

F.1 Black-Box Workflow Inference from User-Facing Outputs

  • With inferred workflow priors, FLOWSTEER achieves a TASR of 38.89% and an MASR of 45.37%, despite noise in the recovered workflow.Both values are substantially higher than NM; the pilot infers approximate workflow cues from user-facing outputs rather than recovering the internal workflow exactly.Source: §F.1 · p. 28, Table 12 · p. 29, Table 11 · p. 29

F.2 Why Explicit Goal Injection Can Be Strong on ASB-Bench

  • On ASB-Bench, DGI sometimes matches or exceeds FLOWSTEER, especially with strengthened planners or executors; open-ended tasks can treat an injected target as a preference or constraint.MisinfoTask’s fact-constrained analytical tasks make directly injected malicious targets more likely to conflict with task facts or reasoning.Source: §F.2 · pp. 29–30

F.3 Workflow Steering Analysis

  • FLOWSTEER more frequently preserves attacker-favored edges and suppresses attacker-disfavored edges, and increases both mean and peak malicious-target alignment of replanned subtasks.The topology measures test edge retention and removal, while the alignment measures capture average and strongest single-subtask drift.Source: §F.3.1 · p. 31, Table 14 · p. 31, §F.3.2 · p. 31

F.4 Ablation Study

  • Task-aware sycophantic arguments produce the largest ablation gains, and adding structural priors further improves performance in most settings.Structural priors alone are insufficient, while generic sycophancy improves only moderately and unstably over naive malicious prompting.Source: §F.4 · p. 32, Table 16 · p. 33

F.5 Clean Utility Preservation

  • FLOWGUARD keeps TASR and MASR similarly low on benignly enhanced prompts while consistently reducing both metrics on maliciously constructed prompts.Benign enhancement generally reduces TASR and MASR relative to the vanilla task, indicating better task following without goal deviation.Source: §F.5 · pp. 32–33

F.6 Robustness to Extended Multi-Round Interaction

Longer communication does not reliably mitigate FLOWSTEER, and qualitative cases show how biased workflow construction can give misleading reasoning a path through ordinary agent communication. The appendix also documents prompts used for profiling, attack construction, defense, and scoring.

F.6 Robustness to Extended Multi-Round Interaction

  • Across both benchmarks, TASR and MASR remain high under longer communication budgets and sometimes increase; Gemini-2.5-flash on MisinfoTask rises from 63.89% MASR at R = 3 to 78.70% at R = 4.Qwen-3.5-flash on MisinfoTask rises from 51.85% at R = 3 to 66.67% at R = 5.Source: §F.6 · pp. 33–34, Table 18 · p. 34

F.7 Case Studies of Planning-Time Contamination and Downstream Propagation

  • In a case study, FLOWSTEER shifts planner-generated roles and dependencies toward the malicious target, while FLOWGUARD weakens contamination before planning.The figure contrasts the clean task, FLOWSTEER, and FLOWGUARD workflows.Source: §F.7 · p. 35, Figure 11 · p. 36
  • After biased workflow formation, agents acknowledge, reformulate, and reuse misleading interpretations, which become shared premises and shift the final output toward the malicious target.The case traces propagation through ordinary inter-agent communication without direct hijacking of an internal agent.Source: §F.7 · p. 35, Figure 12 · p. 37

G Prompt Templates

  • The appendix collects prompt templates for offline subtask influence profiling, FLOWSTEER construction, FLOWGUARD construction, and LLM-as-a-Judge scoring.The templates cover malicious-target injection into a selected subtask, task-aware arguments and sycophantic framing, dependency guidance, intent triage and rewriting, and reference-alignment and malicious-proximity scoring.Source: G Prompt Templates · p. 38, §G.1 · p. 38, §G.2 · p. 38

Related papers

Loading 2605.11514v1…