Semantic Taint Propagation: Embedding-Based Semantic Flow Monitoring for Multi-Agent Large Language Model Systems

Multi-agent large language model deployments introduce a structural vulnerability: adversarially crafted text injected through retrieved documents or inter-agent messages can cause data-access agents to disclose sensitive records via semantic pathways that surfacevocabulary defences cannot reliably detect.This work presents Semantic Taint Propagation (STP), a zero-shot semantic flow monitoring mechanism that evaluates agent outputs against pre-defined sensitive and authorised concept anchors in embedding space. A signed semantic margin — the difference between an output sentence’s cosine proximity to the sensitive anchor region and its proximity to the authorised anchor region — serves as the core detection primitive, providing resistance to vocabulary substitution without requiring labelled training data or secondary model inference.Evaluated on a unified 1 122-scenario corpus spanning synthetic adversarial prompts, the Microsoft BIPIA indirect injection benchmark, and domain-specific scope tests, the combined method achieves 97% detection at a 2% false positive rate (F1=0.976, ROC-AUC=0.982). On keyword-free adversarial scenarios where pattern matching detects nothing, STP achieves 92% detection. Per-sentence taint scoring outperforms whole-document scoring by 9.4 F1 points, establishing segmentation granularity as a consequential architectural choice. A five-model portability study confirms combined F1 of 0.958–0.983 across freely available open-weight alternatives at throughputs exceeding 42 000 semantic evaluations per second — approximately four orders of magnitude faster than secondary-model detection pipelines.The approach reframes prompt injection detection as a semantic flow monitoring problem, complementing existing tool-level and trust-propagation defences in layered security architectures