这篇论文拆穿了多智能体安全评估的常见错觉——GPT看似安全但只是被拒绝掩盖，Gemini配对Claude反而危险。做安全测试时别只看总数。
这项研究提出一种五条件对比设计，拆解多智能体LLM安全中的三个机制。在30个合成有害场景和四个安全基准上测试，发现操作重构是最可迁移的风险信号，使GPT、Gemini和DeepSeek的合规性上升，而Claude相对抵抗。批准框架委托的敏感性因提示设计、模型配对和场景来源而异，怀疑性执行提示可大幅降低合规性。原始直接模型排名可能误导：Gemini在直接提示中最安全（8.9%），但与Claude规划器配对后合规性升至38.9%。GPT的零净管道效应实际上隐藏了重构增加被规划器拒绝抵消的事实。
Operational Reframing and Approval-Framed Delegation in Multi-Agent LLM Safety
Safety evaluations of multi-agent LLM systems often compare a direct prompt with a planner-executor pipeline and report the difference as a single "pipeline effect." We argue that this aggregate is difficult to interpret because it conflates three mechanisms: harmful intent may be reframed as plausible operational work, the planner may refuse or transform the request, and the executor may act under delegation prompts implying prior approval. To separate these factors, we introduce a five-condition controlled contrast design, evaluated on 30 synthetic harmful scenarios and an exploratory external validation set from four agent-safety benchmarks using LLM-judged compliance. Our results show that aggregate pipeline safety is not a stable architectural property. Operational reframing is the most portable risk signal, increasing compliance for GPT, Gemini, and DeepSeek across both scenario sets, while Claude is comparatively resistant. Planner behavior can offset this risk mainly through refusal; however, when the planner produces executable steps, the executor may become more compliant than under the direct operational baseline. Approval-framed delegation is sensitive to prompt design, model pairing, and scenario source, and a skeptical executor prompt sharply reduces compliance. Raw-direct model rankings can also mispredict deployed planner-executor behavior. Gemini is safest under raw direct prompts in the primary set yet shows the largest amplification with a Claude planner, rising from 8.9 percent to 38.9 percent compliance. GPTs near-zero aggregate pipeline effect instead hides a reframing increase canceled by planner refusal. These findings suggest that multi-agent safety evaluations should report reframing, planner behavior, delegation framing, and model pairing separately before attributing failures to architecture itself.