An attack with no malicious message in it
Enterprises are handing consequential work to systems of language-model agents that pass state and messages between each other. A benchmark posted to arXiv on 8 November targets a failure mode those systems create and single-agent testing cannot see: a benign-looking request that escalates into an unsafe action as it propagates across sessions, through poisoned shared state, long-context documents and trusted peer messages. No single message is malicious; the tool call that eventually fires is.
The authors call this alignment decay and built ErosionBench to measure it. Each scenario is authored as a deterministic state graph before any prose is rendered, so every change of state traces to a known cause — a design choice that matters, because the alternative is a benchmark whose own narrative text is doing work the evaluator cannot audit. The set spans four enterprise domains and four decay mechanisms across 1,728 scenarios with matched benign controls, labelled against the OWASP Top 10 for LLM Applications, plus 198 image-based attacks, each paired with a text equivalent.
Scoring the tool call, not the text
The benchmark does not grade the model’s answer. It executes the attack and checks the realised tool call against authorised intent and provenance using deterministic contracts. That distinction is the point: prior multi-agent evaluations score the final output, which rewards a system that says the right thing while doing the wrong one.
The headline result is about defences rather than attacks. Perimeter defences, the authors report, suppress attacks only by over-refusing 54% to 92% of legitimate work. A low attack-success rate, in other words, can conceal severe over-refusal — which is why the matched benign controls are in the design at all. Quoted without its refusal rate, a defence’s attack-success number says almost nothing about whether the system remains usable.
A monitor that watches the trajectory
As a reference defence the paper proposes a calibrated Meta-Auditor that pairs synchronous state checks with asynchronous trajectory monitoring. On a family-disjoint held-out split of 906 scenarios — attacks from families it was not calibrated on — it reaches 98.5% recall at a 2.9% false-positive rate.
Because it monitors the trajectory rather than surface content, its detection is channel-invariant: the strongest auditor flags image-delivered attacks about as reliably as their text equivalents, with a recall gap of two points or less per model. That is a useful finding on its own. Defences that read text tend to collapse when the same instruction arrives as a picture, and pairing each image attack with a text twin is what makes the claim checkable.
Where the auditors differ
The paper evaluated GPT, Gemini and Claude models as auditors. Calibration keeps false positives low across all of them, while recall tracks model capability and is strongest for Claude. That is a reminder that a monitoring layer is itself a model with its own ceiling: the defence is only as good as the model watching, and swapping in a cheaper auditor moves recall, not just cost.
The numbers are the authors’ own and have not been independently reproduced. What to watch is whether the over-refusal finding survives contact with vendors’ own published defences, which are usually reported with an attack-success rate and no accompanying figure for the legitimate work they block.
