When an LLM agent reads a confidential file, then writes a summary, then emails it externally, no single step is unsafe, but the sequence is a data leak. We call this safety drift: individually safe actions compounding into violations. Prior work has measured this problem; we predict it. SafetyDrift models agent safety trajectories as absorbing Markov chains, computing the probability that a trajectory will reach a violation within a given number of steps via closed form absorption analysis. A consequence of the monotonic state design is that every agent will eventually violate safety if left unsupervised (absorption probability 1.0 from all states), making the practical question not if but when, and motivating our focus on finite horizon prediction. Across 357 traces spanning 40 realistic tasks in four categories, we discover that "points of no return" are sharply task dependent: in communication tasks, agents that reach even a mild risk state have an 85% chance of violating safety within five steps, while in technical tasks the probability stays below 5% from any state. A lightweight monitor built on these models detects 94.7% of violations with 3.7 steps of advance warning at negligible computational cost, outperforming both keyword matching (44.7% detection, 55.9% false positive rate) and per step LLM judges (52.6% detection, 38.2% false positive rate) while running over 60,000x faster.
Figures & tables
Figure 1: Estimated transition probabilities for the coarse 5-state safety model. Notable: mild has a 13% per step probability of jumping directly to violated , making it the highest risk transient state.
Figure 2: Finite horizon violation probabilities. mild has higher aggregate risk than critical due to its direct transition to violated (see Section 8 ).
Figure 3: Per category finite horizon violation probabilities. Research & communication (top right) shows clear points of no return, while sysadmin (bottom left) and code debugging (top left) show near zero violation probability.
Model Order
Accuracy (%)
Log Likelihood
1st order
75.3
− 0.631
2nd order
81.6
− 0.546
3rd order
83.6
− 0.494
Table 1: Markov property validation: next state prediction accuracy by model order.
Category
#Tr
#Viol
Rate
PONR
Code Debug
67
2
3%
–
Data Handling
100
80
80%
–
Research Comms
100
100
100%
elev, mild
Sysadmin
90
4
4%
–
Table 2: Per category safety drift statistics. PONR are states where P(\textscviolated in 5)>0.85 .
Monitor
Det.%
95% CI
FPR%
95% CI
ms/step
No Monitor
0.0
0.0
0.0
Keyword
44.7
[30,60]
55.9
[39,71]
< 0.01
LLM Judge
52.6
[37,68]
38.2
[24,55]
588
LLM Judge (3-step)
57.9
[42,72]
47.1
[31,63]
646
Ours
94.7
[83,99]
11.8
[5,27]
< 0.01
Table 3: Monitor comparison on 72 test traces (38 violating, 34 safe).
Figure 4: Detection rate vs. false positive rate across thresholds for the Markov monitor.
Figure 5: Distribution of early warning steps for detected violations (mean 3.7, median 4).
Figure 6: Dimension ablation study. Tool escalation is the most important predictor.
Figure 7: Learning curve: prediction accuracy vs. number of training traces.
Metric
Haiku
Sonnet
Traces
19
182
Data handling viol. rate
60%
60%
Research comms viol. rate
100%
100%
Sysadmin viol. rate
0%
2%
Code debugging viol. rate
0%
5%
mild → violated
11.6%
11.9%
Table 4: Safety drift comparison across models (same scenarios).
LLM-based agents execute multi-step tasks, but their behavioral structure remains opaque: long unstructured traces resist the safety auditing and runtime monitoring that deployment requires. Existing approaches operate per-trace or success-only, so they miss the cross-run topology that links next-step and failure prediction. To recover that shared structure, we collapse an entire trace corpus into a single, compact finite-state machine (FSM) that serves as a structural substrate for the otherwise unpredictable behavior of LLM agents. Across twelve public datasets, the FSMs are compact (7-43 states), replay held-out data at >=0.997 fitness with near-identical topology across splits, and build in milliseconds. This substrate addresses both prediction goals. For next-step prediction, FSM-state context outperforms Agent Workflow Memory on every ground-truth-matched dataset. For failure prediction, per-state behavioral features reach held-out AUROC up to 0.94, and an online monitor ranks failing runs above passing ones from a partial trace, triggering early stopping well before completion. Behavioral topology thus appears shaped more by the deployment harness than by the LLM, providing a model-agnostic structural primitive for safety auditing and runtime monitoring.
Seonglae Cho, Franklin Cardenoso Fernandez, Umar Mohammed +4
AI agents extend large language models (LLMs) with external tools, enabling them to perform complex tasks and translate model outputs into consequential real-world actions. Yet LLMs often become substantially less safe when deployed as agents, and the source of this degradation remains poorly understood. In this paper, we identify schema-formatted tool specifications as a primary source of agent safety degradation and show, through white-box representation analysis, that they weaken the model's internal refusal signals and contribute to unsafe tool execution. Building on this finding, we propose SafeKeep, an inference-time safeguard that decouples safety judgment from tool execution: it assesses requests using flattened textual tool specifications while retaining the original schema-formatted specifications for execution. Across two representative benchmarks and four LLMs, including both white-box and black-box models, SafeKeep increases the average refusal rate for harmful requests from 23.8% to 70.6% and reduces the average attack success rate under observation-level prompt injection from 25.6% to 2.5%. It also outperforms existing safeguards and preserves task-handling capability. We release the code and data at https://github.com/snowcatsmoking/SafeKeep .
Minghui Pan, Jiayuxuan Yang, Yuanyuan Yuan +2
Beijing University of Posts and Telecommunications · Beihang University · Tsinghua University
As large language model (LLM) agents increasingly invoke external tools and interact with real-world systems, unsafe actions may cause irreversible consequences on external states, user data, and downstream services. Recent runtime guardrails mitigate such risks by checking proposed actions before execution, but many remain reactive: they primarily assess the apparent safety of the current action, lacking an explicit model of how risk evolves across the trajectory. This limitation creates a critical blind spot for long-horizon risks, where individually benign-looking actions can gradually drift the agent toward hazardous states. In response, we propose DreamGuard, a proactive guardrail for LLM agents built around a risk-aware world model. The world model maintains a compact recurrent latent state over the trajectory and predicts future latent states from which DreamGuard derives immediate-hazard and prefix-risk evidence. It then fuses these multi-horizon signals into intervention decisions before execution. Experiments across four benchmarks and an online guardrail evaluation show that DreamGuard outperforms generic, reactive, and proactive guardrail baselines, achieves the best safety-utility trade-off among evaluated guardrails, and maintains an average end-to-end latency of 25 ms per call.
Wenhao Lin, Chenyu Yu, Xingwei Lin +6
Zhejiang University · Nanjing University of Posts and Telecommunications · Sun Yat-sen University