Containment Does Not Compose: Provenance Graphs for Tracing Collective Escape in Multi-Agent Systems

I thought this was carefully scoped and very honest about what the experiments do and do not show. The claim-status table is particularly useful, and the negative control, oracle check, and direct comparison with a simple sender baseline all make the results easier to trust.

The cross-episode contamination was probably the most interesting finding for me. It is close to the message-board failure that motivated the project. Supposedly separate runs were able to leave state for later agents. Adding a unique canary to each episode seems like a cheap check that could be useful for any evaluation that reuses a sandbox.

The main limitation is that the central result is partly built into the setup. The agents are explicitly told to pool their fragments, while the audit never checks the shared channel. The graph also cannot really demonstrate an advantage over the sender baseline when every message is broadcast.

This is a great takeaway from the HF incident and multi-agent evaluation is an important area to study moving forward. Containment auditing is still almost entirely per-agent, and this paper targets that gap.

This paper is also extremely impressive methodologically. The pilot was discarded and re-run after the authors found their own parts guessable, and the N=3 negative control rules out harness leakage rather than just reporting a zero. Eval hygiene throughout is particularly excellent.

The logging requirement in §6 is the most immediately actionable thing here as it requires just one extra field in an agent log, and without it you can't trace information back to its origin, only to which agent last passed it on.

As the author notes, the graph's attribution doesn't yet beat simply listing who messaged the agent that validated the credential. Testing it with addressed messages is what would measure this, and this is already clearly addressed in the "What a month would add" section.

I like this project's attempt to trace how information passes between agents instead of assessing each agent’s sandbox alone. These exchanges are represented as a provenance graph, which shows a record of which information reached whom, and could help investigators reconstruct incidents. The report is refreshingly honest about its results. A simpler sender list recovered the same origins, legitimate cases triggered false positives, and the reset procedure leaked state between episodes.

The current findings leave me unconvinced that the graph currently adds enough over a transcript or sender list. I would first fix the reset procedure so that earlier exchanges cannot affect later ones. Then I would test whether the graph helps investigators trace information through longer chains of agents, either more accurately or more quickly than the simpler alternatives. I would also narrow the claim on containment: showing where information traveled does not establish that blocking that route would have prevented the incident. The report’s clear account of what failed is a strength. Demonstrating one practical advantage of this method for investigators would make a stronger contribution than a claim of broader protection.