Signed handoffs reduce violations in agent chains
Signed but Not Safe: Requirement Integrity in Multi-Agent LLM Handoffs · arXiv:2611.07483
In plain words
When several language-model agents pass a request between them, a rule the user gave can be lost or changed before the final decision. This paper evaluates a handoff that records each rule as a quote and a checkable condition. Trusted code signs the record, checks it when passed along, and checks the final decision.
In tests with one model on synthetic tasks, signed records let fewer rule-breaking decisions through than structured handoffs under three scripted threats. But a signature cannot fix a rule that was already extracted incorrectly.
The research
A final decision can break a requirement even when each agent has received a handoff that looks orderly.
The results change the expectation that structured messages alone will preserve constraints: in these tests, checking signed, explicit requirements reduced violations under three scripted threats, while a signature still could not protect a requirement corrupted before it was recorded.
The paper evaluates a signed requirement manifest that lets trusted code check what agents pass along and whether the final decision follows it.
The study compared signed manifests with structured JSON handoffs on the same Qwen3-8B synthetic tasks under three scripted threats.
An independent scorer found fewer committed decisions that violated original requirements with signed manifests, across in-transit mutation, tool-output injection, and merger override.
Because the signed system also checks the handoff and final decision, the comparison supports the full procedure rather than signing alone. A separate test found that signing stopped the tested in-transit mutation; an extraction control showed why risk can remain before signing.
The tests used synthetic, finite-domain tasks, one two-branch agent setup, fixed threat scripts, and an honest orchestrator and harness. The extraction attack used only three fixed templates; these results do not establish how the system performs with other models, tasks, or attacks.
What the evidence shows
- Make requirements checkable
A signed requirement-manifest handoff is a system for carrying a user’s requirements through a multi-agent language-model pipeline. The orchestrator extracts each mandatory requirement as a quote and a checkable rule; trusted code signs and verifies that record and checks the final decision.
In the primary test, the key question was whether this combination let fewer violating decisions through than a structured handoff without checks.
- Fewer violations under attack
The comparison tests the full signed-manifest procedure, which combines explicit requirements with checks on the handoff and final decision, against structured handoffs without checks.
Because the procedures differ in more than signing, the lower rate of violating commits supports the combined approach under these three scripted threats, not signing alone.
- Signing blocks transit changes
The main comparison changes more than the signature: the signed-manifest system also checks the received record and proposed decision, permits one repair, and abstains if a violation remains. A separate test isolates signing under scripted in-transit mutation.
There, an unsigned manifest allowed violating decisions through in 79.2% of 48 task runs, while the signed version allowed none; modified records were rejected on receipt by construction. This shows what signing adds against that specific transit attack.
- Code flags more violations
This comparison asks whether deterministic code or an LLM checker flags more first decisions that violate requirements when both see the same inputs. Code flagged a larger share of violating decisions in Qwen3-8B trajectories under tool-output injection and merger override.
The LLM checker only observed the decisions, and this result does not establish how either checker performs on other inputs or prompts.
- Extraction sets the boundary
The signature cannot correct an extraction that is already corrupted. Replacing extracted requirements with gold requirements lowered unsafe commits by an average of 11.2 percentage points across five threats, which the authors interpret as evidence that extraction errors explain part of the remaining risk.
In a separate test that injected text before extraction, all 18 signed-manifest violations in Qwen3-8B runs involved corrupted manifests. The protection therefore begins after extraction.
Deep
- Original paper authors
- Xiaobo Chen, Genliang Zhu, Ziyuan Wang, Chu Wang
- Submitted to arXiv
- License
- Not specified by source