Every paper below defends a different layer of the LLM agent stack. Rather than describe the mechanisms, each one runs here as a short loop: the attack arrives, the defense reacts, and you can see what it catches.
Each animation is a faithful illustration of the mechanism, not a live instance of the system. Numbers shown are from the papers.
Two plans arrive. The benign read clears the rules and passes. The irreversible write to a sensitive path trips two rules, drives the risk score up, and is stopped before any tool runs. In the paper this reaches 0.949 F₁ at 0.205 ms median latency.
A tool result carries an injected instruction to the next agent. The gate keeps what the task needs and drops the rest, so the payload never reaches agent B. Tool-output poisoning is blocked outright and prompt-injection success is halved, with task accuracy held at 0.867.
Both paths land on the correct diagnosis, so answer-level scoring calls them equal. CareBench scores the trajectory, and only path A earns credit. Across 1,000 trajectories from five frontier models, nearly four in five correct diagnoses came from a pathway like B, with no safety check invoked.
A judge bank votes on a preference pair and four of five agree to keep it. The agreement looks like independent confirmation, but three of those judges share the same blind spot, so the vote counts one opinion more than once. Consensus certifies the corrupted sample straight into the training set.