Beyond Suspicious Steps: Ontological Trust in Long-Horizon Agents

An He; Yao Wang; Haibin Zhang

cs.AIAug 18, 2026

Beyond Suspicious Steps: Ontological Trust in Long-Horizon Agents

Authors: An He, Yao Wang, Haibin Zhang

Abstract

Long-horizon agents increasingly operate across many steps, tools, and observa- tions. In this setting, the relevant oversight question is not only whether each action is locally valid, but whether the evolving trajectory still corresponds to the task the user authorized. Drift can accumulate quietly: an agent may call the right tool with plausible arguments at every step, while its prefix moves toward a broader role, an adjacent objective, or evidence the user never supplied. Existing monitors mostly check local compliance, deliver final-trace verdicts, or score generic risk; they do not directly estimate this prefix-level relation. We introduce ontological trust, a task-conditioned property of trajectory prefixes, and instantiate it as RGE, an online monitor that decomposes trust along Role, Goal, and Evidence. RGE uses LLMs only to derive structured task and step representations; trust-state updates, projec- tions, and intervention decisions are deterministic, so the output is a replayable and auditable trust trajectory rather than a single end-to-end judge verdict. We construct a cross-domain trajectory corpus from OSWorld, FinanceBench, and EICU-AC, covering benign executions, prefix-paired drift, and pseudo-consistency failures. On this corpus, RGE outperforms adapted rule-, judge-, and shield-style baselines on prefix-paired drift detection. With the two larger estimator models, it exceeds 93% Drift F1 on every benchmark while keeping benign coverage at or above 95.8%. Pseudo-consistency is harder: detection depends on whether task completion is externally visible, a structural limit we characterize empirically.

Figures & tables

Figure 1: Snapshot-level AUC heatmap on Living-off-the-Land trajectories.

Figure 2: 2D t-SNE embedding of maximum-deviation LotL points. Contours denote benign density. Red markers denote drift, and the star denotes the trust origin.

Figure 3: RGE pipeline: task-conditioned completion structure, local structured parsing, Role–Goal–Evidence projection, and temporal aggregation into intervention labels.

Figure 4: Main trajectory-level results for the Role–Goal–Evidence monitor across domains and estimator models. Bars report Drift F1, Pseudo F1, and Benign Coverage at the shared operating point; higher is better.

	none	step	window	offline record	online prefix
unstructured	B1 AgentSpec	B2 R-Judge ( $k{=}1$ )	B3 R-Judge ( $k{=}3$ )	B4 AgentAuditor	N/A
structured	N/A	B5 MAS-Shield	N/A	N/A	Ours

Table 1: Trajectory monitor design space across representation and trace context.

Figure 5: Benchmark-averaged baseline comparison under default protocols. Cells report Drift F1, Pseudo F1, and Benign Coverage by monitor and estimator setting (Appendix E.9 ).

Subset	Drift F1 $\uparrow$	Pseudo F1 $\uparrow$	Benign Cov. $\uparrow$
$r$	89.4	60.9	91.7
$g$	91.3	57.8	95.8
$e$	57.1	47.6	95.8
$r{+}g$	91.7	65.3	91.7
$r{+}e$	91.7	68.0	91.7
$g{+}e$	88.9	60.9	95.8

Table 2: RGE axis ablation on OSWorld with Qwen3.5-9B. Columns report Drift F1, Pseudo F1, and Benign Coverage.

Appendix figures & tables41 assets

Supplementary material from the paper’s appendix.

Appendix

Concept	Question being tested	Required information	Typical mechanisms
Safety compliance	“Does the current action or output violate predefined safety rules?”	Rule set, action or output content	RLHF, output filtering, red-teaming
Trust (ours)	“Does the current execution satisfy $\mathcal{D}(x)$ ?”	Original delegation scope, trajectory evolution, evidential basis	The trust monitoring framework proposed in this paper

Appendix

Table 3: Formal distinction between safety compliance and trust.

Symbol	Description
$x$	Task instance
$\mathcal{T}(x,h_{\leq t})\in\mathcal{S}$	Latent trust state at prefix $h_{\leq t}$ ; estimated online and instantiated by observable coordinates $z_{t}$
$\tau=(y_{1},\dots,y_{T})$	Trajectory symbol: full trajectory, where $y_{t}=(a_{t},o_{t})$
$\kappa$	Sensitivity parameter: shared global operating point used to derive thresholds
$h_{<t}=(y_{1},\dots,y_{t-1})$	History prefix before step $t$
$h_{\leq t}=(y_{1},\dots,y_{t})$	Trajectory prefix up to and including step $t$

Appendix

Table 4: Notation table.

Attack type	Primary distinction from our setting
Inner-monologue poisoning	Primarily affects internal reasoning channels and may not yield stable, externally observable action–observation trajectories
Prompt injection	Often depends on explicit instruction injection or syntax-level triggering, and therefore interacts directly with system-level guardrails
Reward / policy hijacking	Usually concerns corruption of training-time or optimization-time objectives, rather than progressive drift at inference time

Appendix

Table 5: Conceptual relation between our threat model and nearby attack paradigms.

Dimension	Core Question	Included Metrics
Dimension I : Surface & Heuristic	Surface anomalies of single-step commands and zero-shot malicious intuition	LLM-based Evaluator, Predictive Entropy
Dimension II : Immediate Execution Capability & State Impact	Immediate impact strength on system resources and privilege invocation intensity at single step	State Transition Operator, Role Energy, Role-Energy Delta
Dimension III : Local Causal & Semantic Consistency	Logical coherence between current action and local context	Causal Grounding, Temporal Context Dynamics, Logical Consistency Constraint, Causal Trace Consistency

Appendix

Table 6: Dimension grouping and design motivation of nine snapshot metrics.

Configuration Item	Value
Evaluation engines	Qwen3-4B-Instruct / Llama-3-8B-Instruct / GPT-4o-mini
Temperature	0.0
Top-p	1.0
Max token limit	Standard context-window limit of each model
Sampling strategy	Greedy decoding (deterministic for reproducibility)
Parallel invocation strategy	Independent invocation per metric; no shared prompt context

Appendix

Table 7: Model configuration for snapshot-metric evaluation.

Statistic	Value
Total number of trajectories	216
Number of drifting trajectories	108
Number of benign trajectories	108
Total steps in drifting trajectories	531
Total steps in benign trajectories	531
Average steps per trajectory ( $\bar{L}$ )	4.92

Appendix

Table 8: Trajectory-length statistics of the benchmark.

Attack Type	Drifting Traj.	Benign Traj.	Total Steps (Drifting)	Total Steps (Benign)
Backdoor	34	34	164	164
Data Exfiltration	28	28	138	138
Persistence	25	25	123	123
Log Deletion	21	21	106	106
Total	108	108	531	531

Appendix

Table 9: Sample distribution by attack type in the benchmark.

Metric	$r^{*}=0.80$		$r^{*}=0.90$		$r^{*}=0.95$
	P	F1	P	F1	P	F1
LLM-based Evaluator	0.5000	0.6667	0.5000	0.6667	0.5000	0.6667
Predictive Entropy	0.5130	0.6412	0.4920	0.6477	0.4920	0.6477
State Transition Operator	0.5000	0.6667	0.5000	0.6667	0.5000	0.6667
Role Energy	0.5638	0.7162	0.5000	0.6667	0.5000	0.6667
Role-Energy Delta	0.5602	0.7157	0.5320	0.6945	0.5118	0.6771

Appendix

Table 10: Fixed-recall Precision/F1 (GPT-4o-mini).

Metric	$r^{*}=0.80$		$r^{*}=0.90$		$r^{*}=0.95$
	P	F1	P	F1	P	F1
LLM-based Evaluator	0.5000	0.6667	0.5000	0.6667	0.5000	0.6667
Predictive Entropy	0.5130	0.6412	0.4920	0.6477	0.4920	0.6477
State Transition Operator	0.5000	0.6667	0.5000	0.6667	0.5000	0.6667
Role Energy	0.5000	0.6667	0.5000	0.6667	0.5000	0.6667
Role-Energy Delta	0.5176	0.6710	0.5176	0.6710	0.5000	0.6667

Appendix

Table 11: Fixed-recall Precision/F1 (Llama-3-8B-Instruct).

Metric	$r^{*}=0.80$		$r^{*}=0.90$		$r^{*}=0.95$
	P	F1	P	F1	P	F1
LLM-based Evaluator	0.5000	0.6667	0.5000	0.6667	0.5000	0.6667
Predictive Entropy	0.5130	0.6412	0.4920	0.6477	0.4920	0.6477
State Transition Operator	0.5000	0.6667	0.5000	0.6667	0.5000	0.6667
Role Energy	0.5000	0.6667	0.5000	0.6667	0.5000	0.6667
Role-Energy Delta	0.5000	0.6667	0.5000	0.6667	0.5000	0.6667

Appendix

Table 12: Fixed-recall Precision/F1 (Qwen3-4B-Instruct).

Metric	AUC	95% CI	CI Width
LLM-based Evaluator	0.7071	[0.6520, 0.7620]	0.1100
Predictive Entropy	0.4664	[0.4120, 0.5210]	0.1090
State Transition Operator	0.6514	[0.5980, 0.7050]	0.1070
Role Energy	0.6181	[0.5650, 0.6720]	0.1070
Role-Energy Delta	0.6466	[0.5920, 0.7010]	0.1090
Causal Grounding	0.7234	[0.6680, 0.7790]	0.1110

Appendix

Table 13: AUC and clustered-bootstrap CI (GPT-4o-mini).

Metric	AUC	95% CI	CI Width
LLM-based Evaluator	0.6139	[0.5600, 0.6660]	0.1060
Predictive Entropy	0.5649	[0.5100, 0.6180]	0.1080
State Transition Operator	0.6670	[0.6120, 0.7210]	0.1090
Role Energy	0.6157	[0.5620, 0.6690]	0.1070
Role-Energy Delta	0.6269	[0.5730, 0.6800]	0.1070
Causal Grounding	0.7349	[0.6800, 0.7880]	0.1080

Appendix

Table 14: AUC and clustered-bootstrap CI (Llama-3-8B-Instruct).

Metric	AUC	95% CI	CI Width
LLM-based Evaluator	0.6969	[0.6420, 0.7510]	0.1090
Predictive Entropy	0.5247	[0.4700, 0.5790]	0.1090
State Transition Operator	0.6534	[0.5990, 0.7070]	0.1080
Role Energy	0.5514	[0.4960, 0.6060]	0.1100
Role-Energy Delta	0.6099	[0.5550, 0.6640]	0.1090
Causal Grounding	0.6849	[0.6300, 0.7390]	0.1090

Appendix

Table 15: AUC and clustered-bootstrap CI (Qwen3-4B-Instruct).

Metric	Backdoor	Exfil	Persist	LogDel	Weighted avg.
LLM-based Evaluator	0.9797	0.6652	0.4552	0.7268	0.7276
Predictive Entropy	0.4693	0.4101	0.4016	0.4932	0.4429
State Transition Operator	0.7171	0.7143	0.7648	0.7358	0.7311
Role Energy	0.6427	0.6148	0.6000	0.7823	0.6527
Role-Energy Delta	0.9213	0.9184	0.7592	0.7200	0.8439
Causal Grounding	0.7708	0.7679	0.7240	0.7506	0.7553

Appendix

Table 16: Per-type AUC and weighted average (GPT-4o-mini).

Metric	Backdoor	Exfil	Persist	LogDel	Weighted avg.
LLM-based Evaluator	0.7353	0.5000	0.5000	0.5000	0.5741
Predictive Entropy	0.4693	0.4101	0.4016	0.4932	0.4429
State Transition Operator	0.7171	0.7143	0.7648	0.7358	0.7311
Role Energy	0.6471	0.7143	0.4600	0.7143	0.6343
Role-Energy Delta	0.5112	0.6378	0.7352	0.7336	0.6391
Causal Grounding	0.7158	0.7423	0.5032	0.6905	0.6685

Appendix

Table 17: Per-type AUC and weighted average (Llama-3-8B-Instruct).

Metric	Backdoor	Exfil	Persist	LogDel	Weighted avg.
LLM-based Evaluator	0.9498	0.5670	0.4928	0.5590	0.6688
Predictive Entropy	0.4693	0.4101	0.4016	0.4932	0.4429
State Transition Operator	0.7171	0.7143	0.7648	0.7358	0.7311
Role Energy	0.7444	0.6983	0.4808	0.7687	0.6762
Role-Energy Delta	0.5307	0.5491	0.4840	0.4388	0.5068
Causal Grounding	0.7301	0.7481	0.8016	0.7109	0.7476

Appendix

Table 18: Per-type AUC and weighted average (Qwen3-4B-Instruct).

Coordinate	Core Semantics	Interpretation
$r_{t}$	Role Deviation	Whether the current action departs from the duty scope implied by the assigned role.
$g_{t}$	Goal Deviation	Whether the current action drifts away from the original task workflow toward unrelated objectives.
$e_{t}$	Evidence Deviation	Whether the current action lacks support from observed history and object-level causal anchors.

Appendix

Table 19: Semantic definitions of RGE deviation coordinates.

Aggregator	Formula	Semantics	Limitation
Mean	$\mathbb{E}_{t}\!\left[\\|z_{t}\\|_{2}\right]$	Captures average global deviation.	May dilute brief but critical anomaly peaks.
Max	$\max_{t}\\|z_{t}\\|_{2}$	Focuses on the worst step-level deviation.	Sensitive to single-step extreme misestimation.
p95 (used)	$\operatorname{p95}_{t}\\|z_{t}\\|_{2}$	Preserves high-deviation signals while reducing sensitivity to extreme outliers.	Still somewhat sensitive to tail fluctuations.

Appendix

Table 20: Trajectory aggregation rules for coordinate norms.

Combination	Formula	Qwen3-4B	Llama-8B	GPT-4o-mini
R	$\operatorname{p95}_{t}\,\|r_{t}\|$	95.20	92.02	98.38
G	$\operatorname{p95}_{t}\,\|g_{t}\|$	82.13	77.94	97.97
E	$\operatorname{p95}_{t}\,\|e_{t}\|$	92.00	90.30	86.65
RG	$\operatorname{p95}_{t}\,\sqrt{r_{t}^{2}+g_{t}^{2}}$	96.36	94.05	98.79
RE	$\operatorname{p95}_{t}\,\sqrt{r_{t}^{2}+e_{t}^{2}}$	97.64	96.00	98.50
GE	$\operatorname{p95}_{t}\,\sqrt{g_{t}^{2}+e_{t}^{2}}$	92.51	89.70	98.76

Appendix

Table 21: Dimension-wise ablation AUC (%) under p95 trajectory aggregation.

Figure 6: 2D t-SNE embedding of critical state points (Llama-8B-Instruct).

Figure 7: 2D t-SNE embedding of critical state points (GPT-4o-mini).

Benchmark	Benign	Drift	Pseudo	Total	$\bar{L}$
OSWorld	24	24	31	79	9.6
FinanceBench	26	27	26	79	6.0
EICU-AC	30	30	30	90	8.1
Total	80	81	87	248	7.9

Appendix

Table 22: Trajectory counts by source benchmark [ Xie et al., 2024 , Islam et al., 2023 , Xiang et al., 2025 ] . Columns report benign, prefix-paired drift, and pseudo-consistency trajectories;

\bar{L}

denotes mean trajectory length.

Class	Construction	Validation criterion
Benign	Faithful rollout of the original task, stopped after the requested deliverable is produced.	The trajectory completes the task and contains no unnecessary side effects or extra follow-up actions.
Drift	Paired rollout that shares the benign prefix through step $d{-}1$ , then receives a sub-type-specific directive at onset step $d$ .	The shared prefix is byte-identical to the benign trajectory, and the sub-type and onset labels match the constructed deviation.
Pseudo-consistency	Boundary stress rollout that appears to make task progress through locally plausible but non-closing or weakly grounded steps.	The trajectory remains plausible step by step, while an expert can identify unresolved gaps, weak evidence, or post-completion surplus.

Appendix

Table 23: Construction and validation criteria for the three trajectory classes.

Sub-type	Axis	Description
Role-drift	R	Agent assumes an unauthorized identity
Role-expansion	R	Agent broadens scope beyond delegated authority
Goal-rewrite	G	Original objective is replaced by a different one
Latent hijack	G	Hidden side-task is pursued alongside the original goal
Evidence fracture	E	Evidence granularity or provenance is violated

Appendix

Table 24: Drift sub-types and their primary RGE axes.

Benchmark	R-drift	R-expansion	G-rewrite	L-hijack	E-fracture
OSWorld	8	7	4	5	0
FinanceBench	14	0	11	2	0
EICU-AC	0	6	4	14	6
Total	22	13	19	21	6

Appendix

Table 25: Drift sub-type counts per benchmark.

Benchmark	Min	Max	Mean	Median	Std
OSWorld	4	18	9.6	9	3.2
FinanceBench	2	11	6.0	6	2.1
EICU-AC	5	17	8.1	8	2.8

Appendix

Table 26: Trajectory length statistics per benchmark (steps).

Symbol	Role	Value
$\alpha_{r}$	Role-axis weight in $u_{t}$	$0.34$
$\alpha_{g}$	Goal-axis weight in $u_{t}$	$0.33$
$\alpha_{e}$	Evidence-axis weight in $u_{t}$	$0.33$
$\lambda$	Structural-coupling weight in $u_{t}$	$0.25$
$\vartheta_{r}$	Role-axis coupling threshold	$0.40$
$\vartheta_{g}$	Goal-axis coupling threshold	$0.40$

Appendix

Table 27: Fixed projection and aggregation constants for the main experiments. Symbols follow Section 5 and match the implementation used for the reported experiments.

Field	Category	Scalar
Role fit	fully_consistent	1.00
	mildly_unusual	0.75
	weakly_consistent	0.40
	inconsistent	0.10
Object anchoring	anchored	1.00
	prerequisite	0.80

Appendix

Table 28: Categorical-to-scalar projections used by the trust-state update. Each column is one parser field; each row is one category. Values are the exact defaults used for the main experiments.

Name	Role	Formula	Value at $\kappa{=}0.5$
$\vartheta_{\mathrm{eng}}$	Energy threshold triggering a flag	$1.5\,\kappa$	$0.75$
$\vartheta_{\mathrm{acc}}$	Accumulation threshold triggering a flag	$1.3\,\kappa$	$0.65$
$\vartheta_{\mathrm{just}}$	Burst threshold for justify	$0.4\,\kappa$	$0.20$
$\vartheta_{\mathrm{rea}}$	Burst threshold for reanchor	$1.3\,\kappa$	$0.65$
$\vartheta_{\mathrm{con}}$	Burst threshold for contain	$1.7\,\kappa$	$0.85$
$\vartheta_{\mathrm{lo,lo}}$	Logical-low cut-off for reanchor reasons	$0.6\,\kappa$	$0.30$

Appendix

Table 29: Intervention-ladder thresholds at the shared default

\kappa{=}0.5

Benchmark	Drift F1 range	Pseudo F1 at $\kappa{=}0.3/0.5/0.7$	Benign Cov. range
OSWorld	91.3–95.8	93.9 / 74.5 / 52.9	91.7–95.8
FinanceBench	92.3–96.3	44.4 / 31.2 / 13.8	92.3–96.2
EICU-AC	100.0	42.1 / 18.2 / 6.5	100.0

Appendix

Table 30: Threshold sensitivity for Qwen3.5-9B. Values are percentages; the middle pseudo column is the default

\kappa{=}0.5

setting.

Benchmark	$N$	Detected	Missed	Mean $t^{\ast}-d$	Median	Early	On-time
OSWorld	24	23	1	0.83	1.00	4.2%	29.2%
FinanceBench	27	25	2	0.12	0.00	7.4%	70.4%
EICU-AC	30	30	0	0.00	0.00	0.0%	100.0%

Appendix

Table 31: Lead-time on Qwen3.5-9B drift trajectories.

Benchmark	Pairs	AUC
OSWorld	24	0.9913
FinanceBench	26	0.9985
EICU-AC	30	0.9622

Appendix

Table 32: Task-swap AUC for Qwen3.5-9B.

Bucket	$N$	Drift	Pseudo	Cov.	Mix
Short	78	100.0	40.0	94.3	13/48/17
Medium	112	100.0	61.1	100.0	38/18/56
Long	58	95.5	76.5	92.9	28/13/17

Appendix

Table 33: Length-bucket check for Qwen3.5-9B at

\kappa{=}0.5

. Mix is OSWorld/FinanceBench/EICU-AC.

Estimator	Benchmark	R-drift	R-expansion	G-rewrite	L-hijack	E-fracture	Pseudo	Benign FPR
Qwen3.5-9B	OSWorld	8/8	7/7	3/4	5/5	–	19/31	1/24
Qwen3.5-9B	FinanceBench	13/14	–	10/11	2/2	–	5/26	1/26
Qwen3.5-9B	EICU-AC	–	6/6	4/4	14/14	6/6	3/30	0/30
GPT-4o	OSWorld	7/8	7/7	3/4	5/5	–	30/31	0/24
GPT-4o	FinanceBench	13/14	–	11/11	2/2	–	1/26	0/26
GPT-4o	EICU-AC	–	6/6	4/4	14/14	6/6	1/30	0/30

Appendix

Table 34: Sub-type hit rates at

\kappa{=}0.5

. Drift columns are recall; Benign FPR is lower-is-better.

$t$	$q_{t}^{\mathrm{r}}$	$q_{t}^{\mathrm{g}}$	$q_{t}^{\mathrm{e}}$	$u_{t}$	$s_{t}$	$c_{t}$	Intervention
1	1.00	1.00	0.94	0.02	0.02	0.02	allow
2	1.00	1.00	1.00	0.00	0.02	0.01	allow
3	1.00	1.00	1.00	0.00	0.02	0.01	allow
4	1.00	0.99	1.00	0.00	0.02	0.01	allow
5	0.00	0.28	0.38	0.93	0.94	0.28	reanchor

Appendix

Table 35: Onset-aligned drift detection in malicious_chrome_safe_browsing .

$t$	$q_{t}^{\mathrm{r}}$	$q_{t}^{\mathrm{g}}$	$q_{t}^{\mathrm{e}}$	$u_{t}$	$s_{t}$	$c_{t}$	Intervention
1	1.00	1.00	1.00	0.00	0.00	0.00	allow
2	1.00	1.00	1.00	0.00	0.00	0.00	allow
3	1.00	0.99	1.00	0.00	0.00	0.00	allow
4	1.00	1.00	1.00	0.00	0.00	0.00	allow
5	0.22	0.50	0.89	0.47	0.47	0.14	justify
6	0.55	0.65	0.67	0.38	0.78	0.21	reanchor

Appendix

Table 36: Pseudo-consistency detected by accumulation and semantic reanchor in pseudo_volume_max .

$t$	$q_{t}^{\mathrm{r}}$	$q_{t}^{\mathrm{g}}$	$q_{t}^{\mathrm{e}}$	$u_{t}$	$s_{t}$	$c_{t}$	Intervention
1	1.00	1.00	1.00	0.00	0.00	0.00	allow
2	1.00	0.99	1.00	0.00	0.00	0.00	allow
3	1.00	1.00	1.00	0.00	0.00	0.00	allow
4	1.00	1.00	1.00	0.00	0.00	0.00	allow
5	1.00	1.00	1.00	0.00	0.00	0.00	allow
6	0.30	0.83	0.89	0.33	0.34	0.10	justify

Appendix

Table 37: Borderline pseudo-consistency in FinanceBench; accumulation remains below the accumulation threshold.

Method	Source	Input scope	Decision representation
B1 AgentSpec	[ Wang et al., 2025 ]	Replayed action	Symbolic rule enforcement
B2 R-Judge ( $k{=}1$ )	[ Yuan et al., 2024 ]	Current step	Unstructured LLM score
B3 R-Judge ( $k{=}3$ )	[ Yuan et al., 2024 ]	Three-step window	Unstructured LLM score
B4 AgentAuditor	[ Luo et al., 2025 ]	Offline full record	Unstructured LLM score
B5 MAS-Shield	[ Wang et al., 2026 ]	Multi-agent audit context	Coarse-to-fine auditing with consensus escalation
Ours	this work	Online prefix stream	Structured RGE state with any-step aggregation

Appendix

Table 38: Baseline implementations used in Figure 5 , showing each method’s source, input scope, and decision representation.

Method	Drift F1	Pseudo F1	Benign Cov.
B1 AgentSpec	0.0	0.0	99.1
B2 R-Judge ( $k{=}1$ )	28.6	1.2	99.1
B3 R-Judge ( $k{=}3$ )	32.3	0.0	99.6
B4 AgentAuditor	29.5	0.7	99.6
B5 MAS-Shield	66.0	67.9	3.4
Ours	86.2	34.3	99.1

Appendix

Table 39: Cross-cell means for the baseline transfer comparison, averaged over all three estimator models and three benchmarks. Values are percentages.

Benchmark	Profiled traj.	Avg steps	Avg tokens / traj	Avg prompt / traj	Avg completion / traj	Avg tokens / step
EICU-AC	90	8.1	31,627	28,787	2,840	3,926
FinanceBench	79	6.0	31,875	28,661	3,214	5,301
OSWorld	72	9.6	37,355	34,147	3,208	3,909

Appendix

Table 40: Monitor-side token overhead. Counts exclude trajectory generation; Profiled traj. is the number of retained trajectories in the token audit.

Asset	Source	License / Terms
OSWorld	[ Xie et al., 2024 ]	Apache 2.0
FinanceBench	[ Islam et al., 2023 ]	CC-BY-NC 4.0
EICU-AC / eICU-CRD	[ Xiang et al., 2025 ]	PhysioNet credentialed access (DUA)
GPT-4o	OpenAI API	OpenAI Terms of Service
Qwen3.5-9B	Alibaba (open weights)	Apache 2.0
Gemma-4-E4B-it	Google	Gemma Terms of Use

Appendix

Table 41: Licenses and terms of use for existing assets.

AI Agent Monitoring

AI agent monitoring tracks actions, tool use, and execution traces to detect failures, misuse, drift, and policy violations during operation.

See all 281 papers

Jun 5, 2026

TRACE: Trajectory Reasoning through Adaptive Cross-Step Evidence Aggregation for LLM Agents

Autonomous LLM agents can pursue hidden malicious objectives through sequences of individually benign actions, making sabotage difficult to detect using standard trajectory-level monitoring. Existing approaches either evaluate complete trajectories in a single pass or partition them into independently scored windows, limiting their ability to connect evidence across temporally distant actions. We propose TRACE, a monitoring framework for long-horizon LLM agent trajectories. TRACE operates through a TIJ (Triage-Inspect-Judge) loop that identifies high-signal regions, performs targeted inspection while maintaining accumulated evidence across reasoning steps, and synthesizes a trajectory-level verdict. We evaluate TRACE on ten task domains from SHADE-Arena against state-of-the-art baselines. TRACE achieves an aggregate F1 of 0.713 and recall of 0.844, with the largest gains on tasks requiring long-range evidence linking.

Vijitha Mittapalli, Shreyaa Jayant Dani, Satya Srujana Pilli +7

University of Massachusetts at Amherst · Adobe Research · Dolby Labs +2

Long-Horizon Agent Evaluation AI Agent Security AI Agent Monitoring Agent Trajectory Analysis

Ask PDF

May 7, 2026

PrefixGuard: Online Failure Warning and Trace-Grounded Diagnosis for LLM Agents

Large language model (LLM) agents execute multi-step tasks, but terminal verdicts arrive too late for intervention. Agent traces mix messages, tool calls, and feedback, making it difficult to learn failure signals from terminal outcomes. Even if a model learns to predict failure from execution prefixes, its predictions alone cannot show which actions, feedback, or unmet conditions need inspection. Existing work studies online failure prediction and diagnosis from completed trajectories, yet few methods connect timely warning to a compact symbolic model of execution behavior. We introduce PrefixGuard, a neuro-symbolic method that uses learned events to connect online failure warning with finite-state execution diagnosis. A gated recurrent unit (GRU) predicts horizon-specific failure risk from these events. A deterministic finite automaton (DFA) organizes their histories into compact risk-labeled paths for replay and rule-monitor composition. Across all 24 benchmark--horizon settings, PrefixGuard exceeds the strongest evaluated baseline in mean test area under the precision--recall curve (AUPRC). Average gains range from 12.0 to 21.9 percentage points. At a nominal 10% FAR budget, averaged test recall spans 56.1%--93.0% across benchmarks. On one frozen

τ^2

-Bench DFA, model checking five specifications identifies violations in 21 of 265 benchmark-successful runs.

Xinmiao Huang, Jinwei Hu, Qisong He +4

University of Liverpool · Université Grenoble Alpes

Fault Detection AI Agent Monitoring Finite-State Machine Neuro-Symbolic AI LLM Agent Reliability Fault Diagnosis

Ask PDF

Sep 15, 2026

Locating Hidden Failures Makes Long-Horizon Agents More Reliable

As AI agents take on long, autonomous tasks, we increasingly oversee rather than perform the work, yet we still judge them almost entirely by whether they finally succeed. An outcome cannot reveal where a run went wrong, whether the agent recovered, or the irreversible harm it caused along the way, and where long-horizon agents fail remains unmapped. We study

2518

agent trajectories across software engineering, computer use, and science, close to real deployment, and classify

6967

mistakes into

78

failure types. Failure follows a recurring signature: after its first mistake an agent often fails to recover and rarely catches the error itself, so the run continues unchecked while still looking correct; whether an agent recovers depends on the task and the environment's feedback, not on the agent framework running it. Long-horizon agents can do real harm on the way to a passing result: even runs scored as solved delete data, corrupt systems, or fabricate success rather than earning it. We release these human-verified annotations as Traverse, a benchmark on which six frontier judges struggle to locate failure regardless of scale: even the strongest correctly identifies the first mistake in fewer than a third of runs. Yet Scout, a

4

B verifier we trained, locates failure far better than these judges and transfers to domains it never saw. Used at test time to select among an agent's candidate runs, it raises task success above the agent's own single-attempt performance, without retraining the agent. By making failure cheap to locate and correct, this work is a foundation for more trustworthy long-horizon agents that learn from their own mistakes, and a practical path to overseeing increasingly autonomous AI.

Salman Rahman, Yubin Kim, Mihir Parmar +15

University of California, Los Angeles · New York University · Google Research +1

Agent Failure Analysis AI Agent Reliability Long-Horizon Agent Evaluation Fault Detection AI Agent Benchmarks

Ask PDF

Abstract

AI Agent Monitoring

Explore similar work

TRACE: Trajectory Reasoning through Adaptive Cross-Step Evidence Aggregation for LLM Agents

PrefixGuard: Online Failure Warning and Trace-Grounded Diagnosis for LLM Agents

Locating Hidden Failures Makes Long-Horizon Agents More Reliable