Semantic Intent Fragmentation: A Single-Shot Compositional Attack on Multi-Agent AI Pipelines
For developers and deployers of multi-agent AI pipelines, this work identifies and demonstrates a critical compositional safety vulnerability that current subtask-level defenses miss, and shows it is closable with plan-level monitoring.
Semantic Intent Fragmentation (SIF) attacks exploit compositional safety gaps in LLM orchestration systems, where a single benign request leads to a policy-violating plan. Across 14 enterprise scenarios, a GPT-20B orchestrator produced violating plans in 71% of cases, with all subtasks appearing benign; plan-level information-flow tracking and compliance evaluation detected all attacks with 0% false positives.
We introduce Semantic Intent Fragmentation (SIF), an attack class against LLM orchestration systems where a single, legitimately phrased request causes an orchestrator to decompose a task into subtasks that are individually benign but jointly violate security policy. Current safety mechanisms operate at the subtask level, so each step clears existing classifiers -- the violation only emerges at the composed plan. SIF exploits OWASP LLM06:2025 through four mechanisms: bulk scope escalation, silent data exfiltration, embedded trigger deployment, and quasi-identifier aggregation, requiring no injected content, no system modification, and no attacker interaction after the initial request. We construct a three-stage red-teaming pipeline grounded in OWASP, MITRE ATLAS, and NIST frameworks to generate realistic enterprise scenarios. Across 14 scenarios spanning financial reporting, information security, and HR analytics, a GPT-20B orchestrator produces policy-violating plans in 71% of cases (10/14) while every subtask appears benign. Three independent signals validate this: deterministic taint analysis, chain-of-thought evaluation, and a cross-model compliance judge with 0% false positives. Stronger orchestrators increase SIF success rates. Plan-level information-flow tracking combined with compliance evaluation detects all attacks before execution, showing the compositional safety gap is closable.