REVIEW
Signed but Not Safe: Requirement Integrity in Multi-Agent LLM Handoffs
Cryptography and Security · Submitted 5 Nov 2026 · 72 references
Pith's verdict: Solid, preregistered empirical work that cleanly separates benign loss from tampering in multi-agent handoffs, with an honest identification of the extraction trust boundary.
T0 · AI review
Why Pith says this
Highlight any text to comment on it.
Referee report
The paper
The paper claims
Signing blocks in-transit tampering in LLM handoffs, not extraction flaws
The reading
What carries the argument
The signed requirement manifest (the central object) is a canonical JSON structure containing, for each mandatory requirement, a verbatim source quote from the request and a predicate from a finite-domain grammar (true, eq, le, sum_le, not, and, or, implies) over public integer-valued settings. Trusted harness code performs provenance filtering (drops items whose quote is not a substring of the request), predicate validation, canonicalization (RFC 8785 subset for compact serialization), HMAC-SHA256 signing, and deterministic verification of both the received manifest (receipt check) and the final decision against every predicate (decision check). The machinery is designed so that the harness code is the only signer and verifier; models never see the key, and the signature provides integrity in transit but no guarantee about the fidelity of the extraction step that precedes signing.
Extended reading notes
Core claim
The paper establishes that a signed requirement manifest—a canonical JSON object built by trusted harness code from the orchestrator's output, containing a verbatim source quote and an executable predicate for each mandatory requirement, keyed with HMAC-SHA256—is the intervention that defeats in-transit tampering in multi-agent LLM handoffs. Under an agent-in-the-middle threat (T2a), the signed manifest produced 0% unsafe commits in every model family tested, while an unsigned manifest committed violations in 79% of mutated runs. The deterministic verifier, which checks the received manifest and the final decision against every predicate in microseconds, caught 78.7% of violating first decisions versus 59.0% for a same-information LLM checker, with far fewer false alarms (7% vs 50%). However, an oracle manifest—built from gold requirements—removed all remaining unsafe commits (0% for Qwen3-8B), proving that every residual violation came from extraction errors made before signing. A preregistered pre-signing injection attack (T5) made this explicit: one adversarial line in the request context raised signed-manifest violations from 14.6% to 37.5% (Qwen3-8B), and every such violation traced to a manifest corrupted before signing, whose signature then authenticated the attacker's version. Signing protects requirements in transit, not at extraction; the extraction step is the trust boundary.
Load-bearing premise
The load-bearing premise is that user requirements can be expressed as executable predicates in a small finite-domain grammar (eq, le, sum_le, not, and, or, implies) over integer-valued settings—the same grammar in which gold requirements are written and the verifier operates, and the study uses only synthetic tasks with three settings and two requirements, so the claim may not hold for real-world requirements that resist formalization or for larger, more complex task topologies.
Editorial extensions
If this is right
- Deployments that adopt signed requirement manifests can guarantee detection of in-transit tampering (agent-in-the-middle, relay rewriting) at the cost of abstaining on tampered runs (97.9% abstention under T2a for Qwen3-8B) rather than committing a violation.
- Deterministic verification provides higher detection and lower false-alarm rates than an LLM checker on the same trajectories (19.7pp detection advantage, 42.9pp fewer false alarms), with negligible compute cost, making it preferable as the deciding check for requirement compliance.
- The approach can be layered onto existing agent protocols (e.g., A2A's agent cards) by adding a canonical JSON manifest with a signature and a deterministic verifier at every hop, without requiring changes to the model prompts or the protocol transport.
- Pre-signing injection attacks represent a practical risk because injected text becomes verbatim in the request and passes the provenance filter; deployments must treat the extraction step as a trust boundary, verifying the manifest—by user confirmation or a second extraction—before signing.
- For weaker models (e.g., Qwen3-8B), the manifest arms produce safety gains even without an adversary (14.6% vs 56.2% unsafe commits for structured handoffs under T0), whereas for stronger models (gpt-oss-20b, GPT-5.6-luna) the benign-condition benefit disappears and the case for signing rests solely on tampering resistance.
Reading between the lines
- The finding that extraction is the trust boundary implies that an interactive step—showing the user a summary of the extracted requirements and asking for confirmation before signing—could close the residual risk in high-stakes deployments, at the cost of adding a human-in-the-loop latency.
- The paper's predicate grammar (finite-domain integer constraints) is a limitation for real-world enterprise requirements that involve free-text policies, fuzzy thresholds, or qualitative conditions; a hybrid defense might use provenance and coverage checks (present for every requirement) without full executability, and defer to manual or LLM-based verification for predicates that cannot be formali
- Brittleness—signed manifests cannot be summarized or re-encoded without triggering fail-closed behavior—is a feature for safety-critical access control or payment decisions, but a cost for high-throughput scenarios where benign format changes are common; deployments must choose a compression policy (e.g., allow re-encoding that preserves canonical equivalence) or accept the abstention rate.
- The pre-signing injection attack exploited a small number of fixed, non-optimized templates; adaptive or concealed injections would likely increase the success rate, meaning the reported residual risk is a lower bound, and the extraction step merits formal guarantees (e.g., using an isolated, non-LLM module to parse requirement sentences from authenticated input).
Original abstract
Enterprise AI agents increasingly split a user's request across subagents and merge their results, and each handoff can summarize away, alter or ignore a requirement. We report a preregistered study with synthetic, exactly scorable tasks comparing free-text, structured JSON and signed requirement-manifest handoffs: the orchestrator extracts each requirement as a verbatim quote plus a checkable predicate, code signs the manifest with HMAC-SHA256, and deterministic code verifies the merger's decision. With Qwen3-8B (1,440 trajectories, five threats), signed manifests cut unsafe commits under attack from 69.4% to 9.0% (60.4 pp, 95% CI [51.4, 69.4]) with no net loss of conformant commits relative to structured handoffs. Signing is what defeats in-transit tampering: an unsigned manifest committed violations in 79% of mutated runs, the signed one in none. On identical trajectories the deterministic verifier caught 78.7% of violating decisions versus 59.0% for an LLM checker, with 7% versus 50% false alarms. An oracle manifest removed all remaining unsafe commits: the residual risk comes from extraction errors made before signing. A preregistered pre-signing injection attack confirmed this boundary: one adversarial line raised signed-manifest violations from 14.6% to 37.5% (Qwen3-8B), 11.1% to 63.9% (gpt-oss-20b) and 8.3% to 75.0% (GPT-5.6-luna), and the signature then authenticated the corrupted manifest. Signing protects requirements in transit, not at extraction; the extraction step is the trust boundary.
The compiled record
The paper's own sentences, arranged, kept beside the review and separate from it. Each label is drawn from a closed vocabulary; the number beside it is the probability the classifier gave that label. Numbers in the tables are the authors', checked by code. No sentence in this record was written by a model.
The abstract, sentence by sentence
Enterprise AI agents increasingly split a user's request across subagents and merge their results, and each handoff can summarize away, alter or ignore a requirement. We report a preregistered study with synthetic, exactly scorable tasks comparing free-text, structured JSON and signed requirement-manifest handoffs: the orchestrator extracts each requirement as a verbatim quote plus a checkable predicate, code signs the manifest with HMAC-SHA256, and deterministic code verifies the merger's decision. With Qwen3-8B (1,440 trajectories, five threats), signed manifests cut unsafe commits under attack from 69.4% to 9.0% (60.4 pp, 95% CI [51.4, 69.4]) with no net loss of conformant commits relative to structured handoffs. Signing is what defeats in-transit tampering: an unsigned manifest committed violations in 79% of mutated runs, the signed one in none. On identical trajectories the deterministic verifier caught 78.7% of violating decisions versus 59.0% for an LLM checker, with 7% versus 50% false alarms. An oracle manifest removed all remaining unsafe commits: the residual risk comes from extraction errors made before signing. A preregistered pre-signing injection attack confirmed this boundary: one adversarial line raised signed-manifest violations from 14.6% to 37.5% (Qwen3-8B), 11.1% to 63.9% (gpt-oss-20b) and 8.3% to 75.0% (GPT-5.6-luna), and the signature then authenticated the corrupted manifest. Signing protects requirements in transit, not at extraction; the extraction step is the trust boundary.
background contribution method result interpretation main claim
| # | sentence | role | the authors' own work | states the main conclusion | strength |
|---|---|---|---|---|---|
| s0 | Enterprise AI agents increasingly split a user's request across subagents and merge their results, and each handoff can summarize away, alter or ignore a requirement. | background 1.00 | 0.05 | 0.03 | asserted 0.80 |
| s1 | We report a preregistered study with synthetic, exactly scorable tasks comparing free-text, structured JSON and signed requirement-manifest handoffs: the orchestrator extracts each requirement as a verbatim quote plus a checkable predicate, code signs the manifest with HMAC-SHA256, and deterministic code verifies the merger's decision. | method 0.69 | 0.95 | 0.06 | asserted 0.97 |
| s2 | With Qwen3-8B (1,440 trajectories, five threats), signed manifests cut unsafe commits under attack from 69.4% to 9.0% (60.4 pp, 95% CI [51.4, 69.4]) with no net loss of conformant commits relative to structured handoffs. | result 1.00 | 0.96 | 0.45 | asserted 1.00 |
| s3 | Signing is what defeats in-transit tampering: an unsigned manifest committed violations in 79% of mutated runs, the signed one in none. | result 0.75 | 0.92 | 0.20 | asserted 1.00 |
| s4 | On identical trajectories the deterministic verifier caught 78.7% of violating decisions versus 59.0% for an LLM checker, with 7% versus 50% false alarms. | result 1.00 | 0.91 | 0.07 | asserted 1.00 |
| s5 | An oracle manifest removed all remaining unsafe commits: the residual risk comes from extraction errors made before signing. | result 0.56 | 0.84 | 0.19 | asserted 1.00 |
| s6 | A preregistered pre-signing injection attack confirmed this boundary: one adversarial line raised signed-manifest violations from 14.6% to 37.5% (Qwen3-8B), 11.1% to 63.9% (gpt-oss-20b) and 8.3% to 75.0% (GPT-5.6-luna), and the signature then authenticated the corrupted manifest. | result 0.93 | 0.92 | 0.16 | asserted 1.00 |
| s7 | Signing protects requirements in transit, not at extraction; the extraction step is the trust boundary. | interpretation 0.97 | 0.82 | 0.79 | asserted 1.00 |
What was examined, and what was not
- arXiv listing abstract v1
- full text
- figures and tables
- references and citing sentences
- relations to other papers
- P abstract
- S sections
- T body sentences
- C citations
- R cross-paper relations
Figures
Figures reproduced from arXiv:2611.07483 by the authors.
References
Discussion
Disagree with the review, or know something it missed? Leave a comment, highlight any passage above to comment on it, or challenge this review formally.