SafeFlow: Attribution-Driven Adaptive Security Defense for Large Language Model Agents

Abstract

As large language model (LLM) agents are increasingly deployed in healthcare, finance, education, and other high-risk domains, their multi-turn interactions become more complex. When facing emerging threats such as context poisoning, memory injection, and tool manipulation, conventional binary filtering models struggle to provide effective protection. Although existing security frameworks establish layered defense architectures, they still rely on static thresholds and opaque binary decisions, making it difficult to trace attack sources or dynamically adjust defensive responses. This paper presents SafeFlow, a full-chain protection architecture that integrates three-dimensional security signals, namely risk category, confidence score, and attribution source, to enable end-to-end risk tracing and adaptive defense along the agent execution path. SafeFlow dynamically adjusts interception strength through a confidence-aware response mechanism and constructs collaborative cross-layer feedback based on aggregated attribution sources. While preserving task completion, SafeFlow effectively suppresses unsafe and adversarial behaviors. Experiments on Agent-SafetyBench show that SafeFlow reduces the unsafe behavior rate to 18.56%, lowers the attack success rate to 16.20%, and achieves an attribution accuracy of 86.4% under the ReAct execution paradigm. The results indicate that coordinated three-dimensional security signals improve safety judgment accuracy, and that attribution-driven defense can precisely identify memory pollution attacks in multi-agent scenarios, providing a new paradigm for interpretable and trustworthy LLM agent security.