When Local Monitors Miss Compositional Harm: Diagnosing Distributed Backdoors in Multi-Agent Systems
It is proved that once the fragments look benign in the monitored view, no detector on that view can catch them, however strong it is, and that local safety is not global safety when harm is compositional, and the open problem is finding that representation.