Delegated Misalignment: How Multi-Agent Structures Amplify LLM Safety Risks

arXiv:2609.27900 · cs.CL · Submitted 2026-08-26 · Read on arXiv

cs.CL

Submitted: 2026-08-26

Updated: 2026-08-26

Comments: EMNLP 2026

License: http://creativecommons.org/licenses/by/4.0/

The gist: Large language models (LLMs) are increasingly deployed in multi-agent systems where a principal agent decomposes tasks and delegates them to subordinate agents that may invoke external tools.

Terminology

Abstract

Large language models (LLMs) are increasingly deployed in multi-agent systems where a principal agent decomposes tasks and delegates them to subordinate agents that may invoke external tools. Safety alignment, however, is still evaluated almost exclusively under a single-agent threat model, treating safety as a property of the individual LLM. We show that this assumption breaks down: individual safety alignment fails to transfer to multi-agent settings. Two failure mechanisms emerge under delegation: responsibility diffusion on the principal side and role-bias compliance on the subordinate side, jointly converting language-level refusal into actionable harm. We refer to this phenomenon as delegated misalignment and study it through a three-condition protocol across 6 frontier LLMs on 49 hazardous tasks. Delegation amplifies end-to-end harm substantially: DeepSeek-V3.2's full-execution rate rises from 30.6% to 77.6% once delegation is introduced, and the same model behaves very differently across roles (GPT-5: 22.5% as a single agent vs. 61.2% as a subordinate). Ablations further show that standard single-layer defenses each fail on their own and can even backfire. We call on the community to move beyond per-model alignment and toward composite safety mechanisms before multi-agent LLM systems are deployed at scale.

Sources

Related papers