{"record_type":"pith_number_record","schema_url":"https://pith.science/schemas/pith-number/v1.json","pith_number":"pith:2026:YCKJKCD4X2QXM2QIFUR3WAYQD2","short_pith_number":"pith:YCKJKCD4","schema_version":"1.0","canonical_sha256":"c09495087cbea1766a082d23bb03101e98561539cffea6bcc0f18081dc25314b","source":{"kind":"arxiv","id":"2607.11751","version":1},"attestation_state":"computed","paper":{"title":"When Local Monitors Miss Compositional Harm: Diagnosing Distributed Backdoors in Multi-Agent Systems","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":["cs.LG","cs.MA"],"primary_cat":"cs.CR","authors_text":"Ren Wang, Yibo Hu","submitted_at":"2026-07-13T16:08:46Z","abstract_excerpt":"As multi-agent, tool-using LLM systems are deployed, a common safety net is a runtime monitor that checks each message, tool call, or step on its own. We show this net has a fundamental hole. A distributed backdoor splits a harmful payload across agents, so every local check passes while the assembled object is the attack. The monitor can be right on every step and still miss the attack. The problem is not splitting itself: split fragments can still leak suspicious tokens or provenance edges. The hard case is \\emph{local benignness}. No fragment carries the harm, and what is left looks like or"},"verification_status":{"content_addressed":true,"pith_receipt":true,"author_attested":false,"weak_author_claims":0,"strong_author_claims":0,"externally_anchored":false,"storage_verified":false,"citation_signatures":0,"replication_records":0,"graph_snapshot":true,"references_resolved":false,"formal_links_present":false},"canonical_record":{"source":{"id":"2607.11751","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-07-13T16:08:46Z","cross_cats_sorted":["cs.LG","cs.MA"],"title_canon_sha256":"8704564b9ab95e28df7d18cd67383b2240754ae46e8bd10b5ff76db701ad02f6","abstract_canon_sha256":"26b2202e0d663a46ae1693c5fd81a0fa6c48a83d9a8b4675b5980ab15365b8da"},"schema_version":"1.0"},"receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-14T02:22:22.842188Z","signature_b64":"R4pcsC4JO9G2ZccLra+HORwvTUdTg8TDC4I1xYl7uAANWIDTPROvKuTgVxMD00knCbCJPGPt2XbOCWYJj80JCg==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"c09495087cbea1766a082d23bb03101e98561539cffea6bcc0f18081dc25314b","last_reissued_at":"2026-07-14T02:22:22.841385Z","signature_status":"signed_v1","first_computed_at":"2026-07-14T02:22:22.841385Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"graph_snapshot":{"paper":{"title":"When Local Monitors Miss Compositional Harm: Diagnosing Distributed Backdoors in Multi-Agent Systems","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":["cs.LG","cs.MA"],"primary_cat":"cs.CR","authors_text":"Ren Wang, Yibo Hu","submitted_at":"2026-07-13T16:08:46Z","abstract_excerpt":"As multi-agent, tool-using LLM systems are deployed, a common safety net is a runtime monitor that checks each message, tool call, or step on its own. We show this net has a fundamental hole. A distributed backdoor splits a harmful payload across agents, so every local check passes while the assembled object is the attack. The monitor can be right on every step and still miss the attack. The problem is not splitting itself: split fragments can still leak suspicious tokens or provenance edges. The hard case is \\emph{local benignness}. No fragment carries the harm, and what is left looks like or"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2607.11751","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2607.11751/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"aliases":[{"alias_kind":"arxiv","alias_value":"2607.11751","created_at":"2026-07-14T02:22:22.841802+00:00"},{"alias_kind":"arxiv_version","alias_value":"2607.11751v1","created_at":"2026-07-14T02:22:22.841802+00:00"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2607.11751","created_at":"2026-07-14T02:22:22.841802+00:00"},{"alias_kind":"pith_short_12","alias_value":"YCKJKCD4X2QX","created_at":"2026-07-14T02:22:22.841802+00:00"},{"alias_kind":"pith_short_16","alias_value":"YCKJKCD4X2QXM2QI","created_at":"2026-07-14T02:22:22.841802+00:00"},{"alias_kind":"pith_short_8","alias_value":"YCKJKCD4","created_at":"2026-07-14T02:22:22.841802+00:00"}],"events":[],"event_summary":{},"paper_claims":[],"inbound_citations":{"count":0,"internal_anchor_count":0,"sample":[]},"formal_canon":{"evidence_count":0,"sample":[],"anchors":[]},"links":{"html":"https://pith.science/pith/YCKJKCD4X2QXM2QIFUR3WAYQD2","json":"https://pith.science/pith/YCKJKCD4X2QXM2QIFUR3WAYQD2.json","graph_json":"https://pith.science/api/pith-number/YCKJKCD4X2QXM2QIFUR3WAYQD2/graph.json","events_json":"https://pith.science/api/pith-number/YCKJKCD4X2QXM2QIFUR3WAYQD2/events.json","paper":"https://pith.science/paper/YCKJKCD4"},"agent_actions":{"view_html":"https://pith.science/pith/YCKJKCD4X2QXM2QIFUR3WAYQD2","download_json":"https://pith.science/pith/YCKJKCD4X2QXM2QIFUR3WAYQD2.json","view_paper":"https://pith.science/paper/YCKJKCD4","resolve_alias":"https://pith.science/api/pith-number/resolve?arxiv=2607.11751&json=true","fetch_graph":"https://pith.science/api/pith-number/YCKJKCD4X2QXM2QIFUR3WAYQD2/graph.json","fetch_events":"https://pith.science/api/pith-number/YCKJKCD4X2QXM2QIFUR3WAYQD2/events.json","actions":{"anchor_timestamp":"https://pith.science/pith/YCKJKCD4X2QXM2QIFUR3WAYQD2/action/timestamp_anchor","attest_storage":"https://pith.science/pith/YCKJKCD4X2QXM2QIFUR3WAYQD2/action/storage_attestation","attest_author":"https://pith.science/pith/YCKJKCD4X2QXM2QIFUR3WAYQD2/action/author_attestation","sign_citation":"https://pith.science/pith/YCKJKCD4X2QXM2QIFUR3WAYQD2/action/citation_signature","submit_replication":"https://pith.science/pith/YCKJKCD4X2QXM2QIFUR3WAYQD2/action/replication_record"}},"created_at":"2026-07-14T02:22:22.841802+00:00","updated_at":"2026-07-14T02:22:22.841802+00:00"}