@inproceedings{zhou-etal-2026-trust,
title = "Trust Cascade through Provenance Erasure: How Multi-Agent Delegation Breaks Single-Agent Safety",
author = "Zhou, Yuxin and
Ding, Xiao and
Chang, Tianle and
He, Ye and
Zhang, Wenbin and
Li, ShangZhan and
Meng, Yijia and
Zang, Wenyu and
Cai, Bibo and
Shi, Qi",
editor = "Lee, Hung-Yi and
Dev, Sunipa and
Li, Jessy and
Elliott, Desmond",
booktitle = "Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing",
month = oct,
year = "2026",
address = "Budapest, Hungary",
publisher = "Association for Computational Linguistics",
url = "https://aclanthology.org/2026.emnlp-main.1005/",
pages = "23130--23148",
ISBN = "979-8-89176-459-0",
abstract = "Multi-agent LLM systems delegate through natural language, creating trust boundaries that single-agent safety hierarchies were not designed to preserve. We identify provenance erasure as a multi-agent safety failure mechanism: even in the minimal two-agent case, delegation strips trust metadata{---}98{\%} of format markers, 100{\%} of authority entities, and 44{\%} of source attribution across 460 pairs{---}while often preserving the actionable payload. This lossy transform enables Trust Cascade, amplifying system-channel attacks from 0{\%} to 33{--}63{\%} cascade ASR across eight open-weight models; a delegation-as-user control isolates channel trust escalation rather than content reformulation. Because the failure occurs at the delegation boundary, we propose the Trust Boundary Auditor (TBA), a zero-inference provenance diagnostic achieving 86{--}100{\%} conditional detection with 0{\%} false positives across four domains. Training, scale, and closed-source evaluations show that stronger models can interrupt different cascade stages but do not remove the boundary problem, suggesting that multi-agent safety requires delegation gating plus provenance auditing."
}<?xml version="1.0" encoding="UTF-8"?>
<modsCollection xmlns="http://www.loc.gov/mods/v3">
<mods ID="zhou-etal-2026-trust">
<titleInfo>
<title>Trust Cascade through Provenance Erasure: How Multi-Agent Delegation Breaks Single-Agent Safety</title>
</titleInfo>
<name type="personal">
<namePart type="given">Yuxin</namePart>
<namePart type="family">Zhou</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Xiao</namePart>
<namePart type="family">Ding</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Tianle</namePart>
<namePart type="family">Chang</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Ye</namePart>
<namePart type="family">He</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Wenbin</namePart>
<namePart type="family">Zhang</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">ShangZhan</namePart>
<namePart type="family">Li</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Yijia</namePart>
<namePart type="family">Meng</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Wenyu</namePart>
<namePart type="family">Zang</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Bibo</namePart>
<namePart type="family">Cai</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Qi</namePart>
<namePart type="family">Shi</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<originInfo>
<dateIssued>2026-10</dateIssued>
</originInfo>
<typeOfResource>text</typeOfResource>
<relatedItem type="host">
<titleInfo>
<title>Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing</title>
</titleInfo>
<name type="personal">
<namePart type="given">Hung-Yi</namePart>
<namePart type="family">Lee</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Sunipa</namePart>
<namePart type="family">Dev</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Jessy</namePart>
<namePart type="family">Li</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Desmond</namePart>
<namePart type="family">Elliott</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<originInfo>
<publisher>Association for Computational Linguistics</publisher>
<place>
<placeTerm type="text">Budapest, Hungary</placeTerm>
</place>
</originInfo>
<genre authority="marcgt">conference publication</genre>
<identifier type="isbn">979-8-89176-459-0</identifier>
</relatedItem>
<abstract>Multi-agent LLM systems delegate through natural language, creating trust boundaries that single-agent safety hierarchies were not designed to preserve. We identify provenance erasure as a multi-agent safety failure mechanism: even in the minimal two-agent case, delegation strips trust metadata—98% of format markers, 100% of authority entities, and 44% of source attribution across 460 pairs—while often preserving the actionable payload. This lossy transform enables Trust Cascade, amplifying system-channel attacks from 0% to 33–63% cascade ASR across eight open-weight models; a delegation-as-user control isolates channel trust escalation rather than content reformulation. Because the failure occurs at the delegation boundary, we propose the Trust Boundary Auditor (TBA), a zero-inference provenance diagnostic achieving 86–100% conditional detection with 0% false positives across four domains. Training, scale, and closed-source evaluations show that stronger models can interrupt different cascade stages but do not remove the boundary problem, suggesting that multi-agent safety requires delegation gating plus provenance auditing.</abstract>
<identifier type="citekey">zhou-etal-2026-trust</identifier>
<location>
<url>https://aclanthology.org/2026.emnlp-main.1005/</url>
</location>
<part>
<date>2026-10</date>
<extent unit="page">
<start>23130</start>
<end>23148</end>
</extent>
</part>
</mods>
</modsCollection>
%0 Conference Proceedings
%T Trust Cascade through Provenance Erasure: How Multi-Agent Delegation Breaks Single-Agent Safety
%A Zhou, Yuxin
%A Ding, Xiao
%A Chang, Tianle
%A He, Ye
%A Zhang, Wenbin
%A Li, ShangZhan
%A Meng, Yijia
%A Zang, Wenyu
%A Cai, Bibo
%A Shi, Qi
%Y Lee, Hung-Yi
%Y Dev, Sunipa
%Y Li, Jessy
%Y Elliott, Desmond
%S Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing
%D 2026
%8 October
%I Association for Computational Linguistics
%C Budapest, Hungary
%@ 979-8-89176-459-0
%F zhou-etal-2026-trust
%X Multi-agent LLM systems delegate through natural language, creating trust boundaries that single-agent safety hierarchies were not designed to preserve. We identify provenance erasure as a multi-agent safety failure mechanism: even in the minimal two-agent case, delegation strips trust metadata—98% of format markers, 100% of authority entities, and 44% of source attribution across 460 pairs—while often preserving the actionable payload. This lossy transform enables Trust Cascade, amplifying system-channel attacks from 0% to 33–63% cascade ASR across eight open-weight models; a delegation-as-user control isolates channel trust escalation rather than content reformulation. Because the failure occurs at the delegation boundary, we propose the Trust Boundary Auditor (TBA), a zero-inference provenance diagnostic achieving 86–100% conditional detection with 0% false positives across four domains. Training, scale, and closed-source evaluations show that stronger models can interrupt different cascade stages but do not remove the boundary problem, suggesting that multi-agent safety requires delegation gating plus provenance auditing.
%U https://aclanthology.org/2026.emnlp-main.1005/
%P 23130-23148
Markdown (Informal)
[Trust Cascade through Provenance Erasure: How Multi-Agent Delegation Breaks Single-Agent Safety](https://aclanthology.org/2026.emnlp-main.1005/) (Zhou et al., EMNLP 2026)
ACL
- Yuxin Zhou, Xiao Ding, Tianle Chang, Ye He, Wenbin Zhang, ShangZhan Li, Yijia Meng, Wenyu Zang, Bibo Cai, and Qi Shi. 2026. Trust Cascade through Provenance Erasure: How Multi-Agent Delegation Breaks Single-Agent Safety. In Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing, pages 23130–23148, Budapest, Hungary. Association for Computational Linguistics.