AgentVax: From Downstream Harm to Local Safety in Multi-Agent Workflows

Safety in language-model multi-agent workflows is fragmented across both evidence and control, while harmful incidents may only be confirmed after earlier decisions. This creates two coupled problems: learning future risk from what each agent actually observed, and choosing an authorized action that can still change the outcome. We find that local views provide strongly complementary safety signals: at matched inference budgets and 5% validation false-positive rate, combining views raises attack-detection TPR from 55.9% for the best single view to 73.6%, a 17.7-point improvement. We also find that the position best able to recognize risk need not be the one best able to prevent harm. Motivated by these observations, we propose AgentVax, which turns verified downstream incidents into supervision for earlier local decisions. AgentVax pairs events with versioned historical inputs, uses discrete-time survival analysis to predict whether and when a violating proposal will occur, and applies counterfactual replay from restored workflow states to estimate how authorized actions change harm, legitimate-task utility, and cost. These estimates train local policies under a workflow-level false-blocking constraint, while deployment uses only each agent's current authorized view. Across controlled workflow studies spanning 24 attack families, we observe directed transfer across attacks sharing safety-relevant patterns. In a separate controlled action-value study, replay-based action selection reduces decision regret from 0.150 to 0.043, a 71.3% reduction relative to risk ranking. Together, these results show how delayed downstream feedback can become earlier, locally actionable protection by learning risk from what an agent can observe and intervention from what it can still change.