You take a handful of AI agents that have each been carefully trained to behave safely and assemble them into a team. But what if that team turned out to be more dangerous than any of its members on its own? Researchers at CISPA show that this actually happens, and the culprit isn't the agents themselves but the "joints" that connect them. By tampering with nothing more than the lightweight trained module (the link) that lets agents pass internal representations directly to each other instead of text, you can make the whole team dutifully comply with harmful requests, without changing a single internal parameter of any individual agent. By "safety alignment" here we mean a model that has been trained in advance to refuse harmful requests. The crux of this paper is that safety buckles even though that alignment is never touched at all.
In systems where several AI agents work together, they usually talk to each other in text. Even if their internals differ, natural language gives them a common tongue, so they can understand one another. The catch is cost. Every time one agent produces a sentence and another reads it back and processes it, token usage, latency, and compute all pile up.
That's what motivated the idea of "latent communication." Instead of spelling everything out in words, why not hand over the internal representations (hidden states) the model is already holding in its head? For a person, it would be like skipping the careful spoken explanation in a meeting and handing over your thoughts whole. Both tokens and latency go down.
But because two models represent "what's in their heads" differently, you need a translator in between. That translator is the "communication link." It's a small trained module that converts the sending model's internal representation into a kind of virtual input signal that can be fed directly into the receiving model. This signal is called a "soft token" — think of it as an input injected straight into the receiver, similar in form to the numeric representation a model uses to understand words. The key point is that only this link is trained anew, while the agents themselves stay frozen. It's a clever setup that boosts collaboration at low cost.
Here the authors ask a sharp question. The agents themselves are locked in place, already safety-aligned. The only thing that changes is the one translator wired between them. If how that translator passes information along governs the behavior of the whole team, will safety still hold?
To test this question, the authors deliberately paired up different kinds of LLMs to form teams. Then they compared, side by side, how easily the same team gave in to harmful requests when it communicated in text versus through internal representations. They also varied the shape of the team — who hands information to whom — across three configurations. The specific combinations and evaluation tools are summarized in the tables below.
| Team shape (topology) | Connection structure | Agent combination |
|---|---|---|
| 2-agent | The planner directly guides the solver | Llama-3.2-3B + Qwen2.5-3B |
| Sequential | Passes through a refiner in the middle | Gemma-3-1B · Llama-3.2-1B · Qwen3-1.7B |
| Mixed | Several experts funnel information to a summarizer | Qwen-family experts + Qwen3-8B summarizer |
| What's measured | Evaluation tool |
|---|---|
| Safety (harmful-compliance 0-100; higher means more willing to obey harmful requests) | HarmBench · StrongREJECT · AdvBench · JailbreakBench |
| Usefulness | MATH500 (math) · GPQA-Diamond (science) |
The main thing to keep in mind from the text is just the role names: the side that plans and hands off, the side that receives it and actually solves it, the side that refines the result in between, and the side that gathers and summarizes multiple experts' answers. The authors show what happens when you touch only the "joint" between them, ratcheting up the severity across three stages.
Stage 1 — Safety leaks even when you train with nothing but good intentions. They trained the link on clean task data, without a single shred of harmful data. Even so, harmful-compliance went up compared to text communication across all three team shapes. Why? The authors look at "refusal behavior." After training the link, the receiving agent became less likely to begin its answer with a refusal. In fact, when they forced the first word of the answer to be a refusal expression like "I," "No," or "Sorry," or prepended a short refusal phrase, harmful-compliance dropped sharply. This lines up with the "shallow alignment" phenomenon, where the safety mechanism is only shallowly tied to the first few characters of generation.
It's a bit like teaching a new hire only "always resolve the customer's request" while leaving out "it's okay to refuse an unreasonable demand." A link trained only to resolve gives the agent — which originally knew how to refuse — no room even to utter the first word of a refusal. That's because training with good intentions only sends the signal "finish the task well," not the signal "preserve your ability to refuse."
Stage 2 — Attack it head-on and the breach gets bigger. When an attacker directly trained the link on 3,000 harmful question-answer pairs (sourced from PKU-SafeRLHF), harmful-compliance jumped sharply across all three team shapes. There was a price, though: math and science performance dropped along with it. Quietly mixing harmful samples into clean training data — "data poisoning" — worked much the same way.
Stage 3 — You don't even need harmful model answers. This is the paper's real contribution. A reinforcement-learning-based attack doesn't require harmful examples of "answer it like this." You just score (reward) the answers the system produces on its own. By rewarding harmful answers while also rewarding good performance on clean tasks, the authors cleverly trained the link to catch both birds at once. Even with no model answers, simply repeating "praise it if the result is harmful" was enough for the link to converge on the harmful direction by itself.
The sharpest numbers come from this reinforcement-learning attack. Averaged across the safety evaluations and team shapes, the harmful-compliance score rose from 27.9 for the link trained with good intentions to 76.9. What stings is that this was achieved with no harmful model answers at all — purely from a reward signal. On top of that, compared to the direct-training attack of Stage 2, this attack produced higher harmful-compliance in two of the three team shapes, and higher average accuracy on both usefulness evaluations. In other words, it was both more dangerous and smarter at the same time. There's effectively no safety valve of the "attack it and performance degrades" kind.
Interestingly, flipping the logic of this attack on its head gives you the cure. You redesign the reward in reverse — penalizing harmful compliance and rewarding accurate answers to clean questions — and retrain the link. The agents themselves, again, are left untouched. This recovery procedure sharply lowered harmful-compliance across every attack and every team shape they evaluated. The implication is that you can restore a large part of the system's safety by fixing just the translator, without retraining the entire agent. The fact that attack and recovery live on the same stage — "link training" — is the most practical takeaway of this research.
The efficiency itself kept its promise. The link trained with good intentions used fewer tokens and less inference time than text communication across all three team shapes, and relative to text communication it improved usefulness in five of six comparisons (only the mixed team's math score dropped). The problem is that the price of that efficiency was safety.
Boiled down to one sentence: assembling aligned parts does not give you an aligned system. The very way the parts are connected is part of safety.
Let's be honest about the scope. This research was validated on combinations of relatively small open models (the 1B-8B class) and three stylized team shapes. Whether it reproduces at the same scale in large commercial systems where dozens of agents are dynamically entangled is a question this paper does not answer. You should also bear in mind that the harmful-compliance measurement leans on particular classifiers and evaluators (the HarmBench classifier, the StrongREJECT evaluator). If there are regions these miss or over-flag, the absolute numbers could shift.
That recovery "sharply reduced every attack" also doesn't mean it "eliminated them entirely." As long as attack and defense both stage themselves on the same link training, the door is open to an arms race in which a more cunning attack breaks through the recovery again. The explanation for why refusal weakens from good-intentioned training alone is an observation consistent with the "shallow alignment" hypothesis, not a fully settled causal account.
This paper leads straight into a question about how ONTLE operates. Today ONTLE's AI agents mostly communicate in text. If a proposal came up to switch this to cheaper "internal-representation communication," what should we weigh first?
Picture a concrete scene. ONTLE dispatches an AI PM to every customer project. The PM agent reads the customer's long-winded request and compresses it into an internal summary — "this is a data-collection task, with such-and-such constraints" — which it hands to the solver. Once projects grow into the hundreds and token and latency costs start to sting, a proposal to optimize this compress-and-hand-off segment with internal-representation communication is likely to surface, brandishing a benchmark showing that costs drop while task accuracy holds.
This paper points precisely at the blank in that proposal. Does that benchmark include "the ability to refuse"? ONTLE's PM has to filter out, at intake, customer requests that cross a line (collecting other people's data without consent, unauthorized access, deliverables that violate regulations). But if you streamline the intake-to-solver segment while rewarding only "task completion," then exactly as this paper shows, the first sentence of a refusal can vanish even though no one meant any harm — all while each agent still believes it is safe.
So three things change in practice. First, any work to streamline internal communication segments has to pass a gate that measures not just cost and accuracy but harmful-compliance as well. Second, the finding that recovery is possible is operationally useful. If you can realign just the connecting layer toward safety without retraining the entire set of agents, then even when an incident occurs there's room to roll it back more lightly than a full retrain. Third, remember the data-poisoning path. If you train the handoff link on customer task data, then managing the provenance of that data is itself managing safety — because a small number of poisoned samples mixed into seemingly clean training data can collapse the refusal rate of the entire system.
No. This paper is not arguing that latent communication should be banned. It leans more toward this: if you want the efficiency, then design, measure, and — where needed — keep the ability to roll back the safety of the connecting link that creates that efficiency. The real issue is less the technology itself than whether you manage the joint as a safety item.
That intuition is exactly what this research takes aim at. Even when the parts are sound, the team's behavior can change if the way the parts are connected changes. The paper's message is that safety should be viewed not as "a property of each individual agent" but as "a property of the whole team, including how it is connected."