Where Safety Breaks When Agents Talk Through Internal Representations ── A preprint showing that training only the link between agents can raise harmful compliance

1. What agents give up when they stop talking in text

In a multi-agent system, several AI agents split a task into roles and hand intermediate results to one another. The usual channel has been text: the sender writes, the receiver reads. Humans can read it too, but generating and re-reading text token by token costs tokens, compute and latency.

That cost is why latent communication is attracting work. The sender passes its internal representations straight to the receiver without turning them into words. Because the two models do not share the same internal format, a lightweight trainable link sits between them and maps the sender's representations into the receiver's input space.^[1]

The paper's concern is that this link tends to fall outside safety review. Each agent has already been safety-aligned, trained to refuse harmful requests, and changing the channel does not touch the agents themselves. It is tempting to conclude that the system as a whole stays safe. The authors question that assumption and argue that training the connector alone can change how the whole system behaves. The primary source is a preprint posted on arXiv; it has not been peer reviewed.

2. The core idea: treat the link itself as an attack surface

The contribution can be reduced to one move: locate safety at the level of the whole system, links included, rather than at the level of each agent. From that position the paper walks through three stages.

First, even benign link training, with no bad intent, can increase harmful compliance relative to text-based communication. Second, an attacker can amplify the effect, either by optimizing the link on harmful query-response pairs or by poisoning otherwise benign training data. Third, the authors build a reinforcement-learning attack that rewards harmful compliance together with benign task performance. It does not need examples of harmful target responses, which makes it easier to mount.

The same machinery can defend. By shifting the reward toward safer behavior and retraining the link, the authors say they can repair compromised links, again without updating the agents.

3. What the abstract reports

The evaluation spans three communication topologies and four safety benchmarks. The reinforcement-learning attack raised the mean harmful-compliance score from 27.9 with benignly trained links to 76.9. The abstract does not state the scale or ceiling of that score.

Compared with direct supervised optimization on harmful examples, the attack also reached higher average accuracy on two benign utility benchmarks. That detail matters. A compromised system that does its ordinary work as well as before, or better, is hard to catch by watching performance.

For repair, the abstract says harmful compliance fell substantially across all evaluated attacks, but gives no figure for the size of the drop. The authors conclude that safety alignment has to consider the multi-agent system as a whole. These are results under the paper's own experimental conditions; they do not show that the same happens with other models or topologies.

4. A worked example: a reading agent and a writing agent

Consider a pipeline in which one agent searches and reads literature and a second agent summarizes the findings into an answer. Both are safety-aligned models from the same family.

The point of the comparison is where the failure sits in the second case: in neither agent, but between them. As long as evaluation is scoped agent by agent, that space is never inspected.

5. What is not new, and what the abstract leaves open

That additional training can erode safety alignment is not a new finding. Earlier work showed that fine-tuning an aligned model on a small number of examples can break its alignment, even without malicious intent.^[5] The contribution here is to show the same effect arising from a small component between agents, without touching any agent's weights.

Several limits are visible. The abstract does not name the models used. It does not name the three topologies or the four benchmarks, nor say how harmful compliance was scored, whether by human raters or by another model; the scoring method can move the numbers a great deal. It gives no figure for the text-based baseline, so the size of the increase from benign link training cannot be checked. It also does not say what repair costs, or whether repair holds against an attacker who knows it is being applied.

A code repository is public, but on the paper-sharing page the work has 7 upvotes and 2 comments, and the repository has 1 GitHub star.^[2] No independent replication is visible yet.

6. Why this topic is clustering now

This paper was selected as the representative of a cluster of 3 papers. The reason was the cluster, not the votes or stars. Those counts indicate attention; they say nothing about whether the claims are correct.

The other two papers in the cluster approach the same question from different sides. KVCMAS proposes a way to reuse the intermediate state of computation, the KV cache, when several agents share the same context, to cut redundant work.^[3] The second paper proposes ICR, a framework for auditing how communication actually changes agents' answers, and applies it to both textual and latent communication. It reports that richer messages amplify beneficial and harmful influence alike.^[4]

Read together, the three papers show work that moves agent-to-agent handoffs from text toward internal representations for efficiency, alongside work that audits what those handoffs do and re-examines their safety.

7. Where this connects to pharmaceutical and regulatory practice

In pharmaceutical work, records exist so that a person can later read and confirm who did what. Data-integrity principles put legibility and preservation of the original record at the base. When agents hand off internal representations, the legible record disappears at exactly the joints of the workflow. The efficiency gain comes with a gap in the audit trail.

A second connection is supplier control and change control. In this paper, poisoned training data or a link brought in from outside changes the behavior of the whole system while the agents stay the same. Bringing an external system into regulated work therefore means checking not only the core models but who trained each connecting component, and on what data, and re-evaluating when any of them changes.

Finally, there is the unit of validation. Qualifying each agent separately does not validate the system they form together. Allowing for the fact that this is a preprint, the authors' conclusion that the system as a whole, not a set of parts, is what has to be validated applies directly to validation plans for combining generative AI components in regulated work.