Journal

Signing an agent handoff does not protect it if the requirements were tampered with before signing

A paper on multi-agent handoffs shows the risky step is the requirements summary itself: tamper before signing and the signature certifies the altered version.

Published 3 min read

Findings

When one agent hands work to another, the receiving agent usually works from a summary of what the user asked for. The risky step is the summary itself. If an extra line gets into the requirements before anyone signs them, the signature then certifies the altered version, and the agents downstream follow it.

The paper is "Signed but Not Safe: Requirement Integrity in Multi-Agent LLM Handoffs" ¹. The authors ran 1,440 trajectories with Qwen3-8B on synthetic tasks that could be scored exactly, across five threat types. Under attack, the share of unsafe commits fell from 69.4% to 9.0% when requirements were extracted only from authenticated user input, confirmed before signing, and checked at the end in deterministic code. In a separate test, one adversarial line inserted before signing pushed violations to 75.0% on a frontier model.

Bar chart: unsafe commits under attack were 69.4 percent with no integrity pipeline and 9.0 percent with the full pipeline

The final check mattered as much as the signing. A deterministic verifier caught 78.7% of violations, compared with 59.0% for a checker that used a language model. The deterministic verifier also raised far fewer false alarms: 7%, compared with 50% for the model-based checker.

Table: a deterministic final check caught 78.7 percent of violations with 7 percent false alarms, against 59.0 percent and 50 percent for a language-model checker

The same figures as a list:

  • Deterministic code as the final check: 78.7% of violations caught, 7% false alarms.
  • Language-model checker as the final check: 59.0% of violations caught, 50% false alarms.

What we would test on our own systems

Whether the same split holds when agents hand work to each other in our tools. We would build test cases with a real user request, a requirements summary extracted from it, work from a second agent, and a final decision to accept or reject the combined result. We would run three versions: free-text handoffs, signed summaries, and signed summaries that are confirmed against the original request before signing, with a planted extra line in some cases. We would score unsafe acceptances and correct acceptances in each version, and compare a deterministic check against a model-based check on the same cases. If signing alone does as well as signing with confirmation, we will say so. If the planted line survives signing in our cases as it did in the paper, the fix belongs at extraction and confirmation, before any signature is applied.

References

  1. "Signed but Not Safe: Requirement Integrity in Multi-Agent LLM Handoffs," arXiv 2611.07483. https://arxiv.org/abs/2611.07483