Towards a Unified Misuse Monitoring Benchmark

Aniruddh Pramod; James Oldfield; Adel Bibi

cs.CROct 5, 2026

Towards a Unified Misuse Monitoring Benchmark

Authors: Aniruddh Pramod, James Oldfield, Adel Bibi

Organizations: University of Oxford

Abstract

LLM agents increasingly act in multi-actor environments, exposing them to misuse from multiple sources: decomposition attacks, where a harmful request is split into innocuous sub-requests, and prompt injection attacks, where a compromised tool delivers a malicious instruction. Existing evaluations treat these threats separately and ask whether a trajectory is harmful, rather than when it becomes harmful. We propose monitoring the agent's responses, where its actions are externalised, and ask whether the first point where monitors identify harm lands within a harm window (from the agent's first harmful commitment to goal execution). We develop a unified formalism for trace-level misuse monitoring and use it to construct a benchmark of ~6,200 conversation transcripts between a user, an LLM agent, and the external environment, spanning both threats in a shared schema, with a labelled harm window, corresponding benign controls, and matched instances of refusals to these requests. Across 17 monitor configurations, we find that our proposed action-framed monitors perform well on both threats under classical metrics (AUC: 0.95 and 0.99 respectively), while content-framed monitors collapse on injection attacks (AUC: 0.52). We also show that classical position-blind metrics paint an optimistic picture of monitor performance, since all monitors localise decomposition attacks poorly under the interval metric, which measures the ability to localise harm. Broadly, we illustrate the need for a unified study of misuse monitoring.

Figures & tables

Figure 1: The harm window unifies both threats. The adversary’s delivery is a user message in a decomposition attack (top) and a tool result in a prompt injection attack (bottom). The monitor is credited only if its first flag $t^{*}$ lands inside the harm window $W=[E,O_{\mathrm{exec}}]$ (see Section 3 ).

Figure 2: Running example ( harmful_0360 , decomposition_hard split). Left: the decomposition seed. Right: the completion into an agentic trace.

Figure 3: Interval credit for a first flag at each position of a generic harmful trace. Only a first flag inside

W(\tau)=[E,O_{\mathrm{exec}}]

counts.

Arm	Sees / judges	Cadence
baseline	current assistant message / the assistant’s action	1 / asst. msg
sequential	full prefix, every message / intent of the tasks together	1 / msg
sequential_action	full prefix / the assistant’s current action	1 / asst. msg
eae	extractor quotes the prefix, evaluator scores the quotes	2 / asst. msg
sp_* (except sp_zeroshot_action )	cumulative user + tool stream / probability of a harmful goal	1 / input msg
sp_zeroshot_action	sp_zeroshot with the assistant’s action	1 / asst. msg

Table 1: Monitor arms as instances of the triple

(V_{M},C_{M},f_{M})

of Section 3.4 .

Figure 4: Across models, the fraction of harmful traces flagged, stacked into in-window (solid), early (lighter) and late (lightest); a cross marks arms with no operating point at the budget or not run.

	Decomposition			Injection
Arm	AUC	Recall	Interval	AUC	Recall	Interval
baseline	0.904	0.784	0.334	0.921	0.815	0.624
sequential	0.960	0.956	0.166	0.521	$\dagger$ (0.63)	—
sequential_action	0.952	0.943	0.433	0.985	0.997	0.949
eae	0.953	0.932	0.495	0.990	0.995	0.900
sp_zeroshot	0.945	0.944	0.136	0.511	$\dagger$ (0.86)	—

Table 2: Gemma 4 26B-A4B, selected arms (all 14 prompted arms in Table 7 ).

\dagger

marks arms with no operating point at the budget; the value in parentheses is the lowest FPR it can reach (Appendix A.3 ).

Appendix figures & tables24 assets

Supplementary material from the paper’s appendix.

Appendix

Figure 5: The turn-based interaction model. The user tasks the agent, which exchanges requests and responses with tools and external agents; every message is appended to the trace

\tau_{t}

, over which the monitor

M

computes its decisions at its decision points

C_{M}(\tau)

Figure 6: Distribution of harm window width

O_{\mathrm{exec}}-E+1

per track. Injection windows (

n=1{,}881

) are a single decision step, the complying assistant message and its tool call: median 2, never more than 3. Decomposition windows (

n=1{,}059

) span a median of 10 messages and up to 60; harmful_0360 at 44 sits in the upper tail. The last bar pools widths of 41 and above.

Check	main	hard	$O$ twins	injection
strict completeness	1,162 / 1,165	582 / 582	581 / 582	—
end-state completeness	1,165 / 1,165	582 / 582	582 / 582	2,828 / 2,828
continuity judge (LLM)	1,165 / 1,165	577 / 582	—	—
payload in a tool message	—	—	—	2,828 / 2,828
onset check (harmful)	—	—	—	1,881 / 1,881
oracle check (harmful)	—	—	—	1,639 / 1,881

Appendix

Table 3: Pipeline checks, passing / total, by split. The

O

column is the 582 twins cut at

O

and scored independently; the three-point twins are copies of checked prefixes plus one refusal message. The strict check is not defined for the injection split, whose prefixes are recorded runs with tool-call-only assistant messages. Columns abbreviate decomposition_main , decomposition_hard and injection .

Split	Traces	Calls	Generated tokens	Prompt tokens
decomposition_main	1,165	7,810	1.58M	10.29M
decomposition_hard	582	5,737	1.05M	9.10M
decomposition_refusal	1,644	1,324	0.04M	1.21M
injection	2,828	2,828	1.58M	18.17M
Total	6,219	17,699	4.25M	38.77M

Appendix

Table 4: Generation cost of the shipped benchmark, Gemma 4 26B-A4B tokens. Calls are accepted generations only (retries excluded); the decomposition_hard row counts its harmful traces, since its benign class is that of decomposition_main . Twins whose cut points coincide (

E=O

, or a middle point equal to

E

O

) share one refusal, so decomposition_refusal has fewer calls than traces.

Model and checkpoint	Served via	$N_{s}$	Arms
Gemma 4 26B-A4B google/gemma-4-26B-A4B-it	vLLM	5	all 14
Qwen3.6 27B Qwen/Qwen3.6-27B-FP8	vLLM, thinking off, text-only	5	all 14
Qwen3.5 27B Qwen/Qwen3.5-27B-FP8	vLLM, thinking off	5	core
Qwen3.5 9B, 4B, 2B Qwen/Qwen3.5-9B , -4B , -2B	vLLM, thinking off	5	core
Mistral Small 3.2 24B mistralai/Mistral-Small-3.2-24B-Instruct-2506	vLLM, Mistral formats	5	core
Llama 3.1 70B RedHatAI/Meta-Llama-3.1-70B-Instruct-FP8	vLLM	5	core

Appendix

Table 5: Monitor models.

N_{s}

is the number of samples averaged per score. core: baseline , sequential , sequential_action ; Haiku runs sequential_action alone on injection. Checkpoints are Hugging Face repositories for the local models and OpenRouter identifiers for the API models.

Track	Arm	AUC [95% CI]	Recall [95% CI]	Interval [95% CI]
Decomposition	baseline	0.904 [0.887, 0.920]	0.784 [0.000, 0.843]	0.334 [0.000, 0.362]
	sequential	0.960 [0.949, 0.969]	0.956 [0.923, 0.969]	0.166 [0.144, 0.188]
	sequential_action	0.952 [0.940, 0.963]	0.943 [0.911, 0.964]	0.433 [0.404, 0.464]
Injection	baseline	0.921 [0.910, 0.932]	0.815 [0.766, 0.845]	0.624 [0.582, 0.658]
	sequential	0.521 [0.500, 0.541]	$\dagger$	—
	sequential_action	0.985 [0.979, 0.991]	0.997 [0.995, 0.999]	0.949 [0.939, 0.959]

Appendix

Table 6: Point estimates and percentile 95% stratified trace-bootstrap intervals for the three core Gemma 4 26B-A4B arms.

\dagger

: no operating point at the budget; the interval cell is then undefined (—).

	Decomposition			Injection
Arm	AUC	Recall	Interval	AUC	Recall	Interval
baseline	0.904	0.784	0.334	0.921	0.815	0.624
sequential	0.960	0.956	0.166	0.521	$\dagger$ (0.63)	—
sequential_action	0.952	0.943	0.433	0.985	0.997	0.949
eae	0.953	0.932	0.495	0.990	0.995	0.900
sp_zeroshot	0.945	0.944	0.136	0.511	$\dagger$ (0.86)	—

Appendix

Table 7: Gemma 4 26B-A4B, all 14 prompted arms. Pooled decomposition and the full injection track, frontier at FPR

\leq 0.1

;

\dagger

marks an arm with no operating point at the budget and the value in parentheses is its saturation floor. Guard models are in Table 11 .

	Decomposition			Injection
Arm	AUC	Recall	Interval	AUC	Recall	Interval
baseline	0.923	0.807	0.364	0.923	0.801	0.625
sequential	0.967	0.959	0.281	0.685	$\dagger$ (0.13)	—
sequential_action	0.962	0.946	0.514	0.992	0.999	0.959
eae	0.919	0.859	0.484	0.987	0.988	0.887
sp_zeroshot	0.966	0.960	0.233	0.617	0.254	0.000

Appendix

Table 8: Qwen3.6 27B, all 14 prompted arms. Same layout and conventions as Table 7 .

Figure 7: Where the first flag fires. Histogram of the first flag’s position relative to the evidence onset

E

for content framing ( sequential ) and action framing ( sequential_action ), both tracks, Gemma 4 26B-A4B at each arm’s 10% operating point. Orange mass is flags before any labelled evidence; blue is inside

W=[E,O_{\mathrm{exec}}]

; the median window is shaded. On decomposition, content framing fires more than half its first flags before

E

(57% of harmful traces; the spike just left of 0 is the user sub-request that precedes the evidence); action framing fires on

E

itself. On injection, content framing has no operating point at the budget and action framing lands 95% of first flags in the window.

Figure 8: Every third harmful decomposition trace of the evaluation set, sorted by onset

E

, drawn as its harm window (blue band, positions normalised by trace length) with the first flag at

\theta^{*}

, the threshold maximising interval credit within the budget, marked by outcome, for four arms on Gemma 4 26B-A4B. Early flags scatter to the left of the window; for the action-framed arms the credited flags stack on the window’s left edge.

Model	Arm	Recall	$g=0$	$g=1$	$g=2$	$g=4$
Gemma 4 26B-A4B	sequential_action	0.997	0.949	0.949	0.983	0.986
	eae	0.995	0.900	0.900	0.955	0.966
	baseline	0.815	0.624	0.624	0.699	0.715
	sp_zeroshot_action	0.732	0.622	0.622	0.643	0.643
	sp_zeroshot_cot	0.220	0.000	0.063	0.063	0.080
Qwen3.6 27B	sequential_action	0.999	0.959	0.959	0.988	0.992

Appendix

Table 9: Interval credit on the injection track with a grace period of

g

messages before

E

(window

[E-g,O_{\mathrm{exec}}]

), frontier at FPR

\leq 0.1

, 1,881 harmful traces. Only arms with an operating point at the budget are shown.

		Decomposition (main split)			Injection
Model	Arm	AUC	Recall	Interval	AUC	Recall	Interval
Gemma 4 26B-A4B	baseline	0.909	0.807	0.350	0.921	0.815	0.624
	sequential	0.961	0.975	0.154	0.521	$\dagger$ (0.63)	—
	sequential_action	0.953	0.953	0.457	0.985	0.997	0.949
Qwen3.6 27B	baseline	0.927	0.828	0.381	0.923	0.801	0.625
	sequential	0.968	0.977	0.299	0.685	$\dagger$ (0.13)	—

Appendix

Table 10: The core arms across monitor models. Decomposition is the decomposition_main split (512 harmful traces with a window, 525 evaluation benign); injection is the full track (1,881 / 853). Conventions as in Table 2 . ‡ API model, one sample per call; Claude Haiku 4.5 is run on a 25% subsample of each track, on injection with sequential_action only. n/a: not run.

	Decomposition (main split)			Injection
Arm	AUC	Recall	Interval	AUC	Recall	Interval
llamaguard4	0.913	0.834	0.416	0.803	0.491	0.290
llamaguard4_policy	0.928	0.895	0.459	0.802	0.520	0.322
qwen3guard	0.897	0.693	0.268	0.634	0.242	0.213

Appendix

Table 11: Guard arms on both tracks, frontier at FPR

\leq 0.1

on the same evaluation splits as Table 10 ; conventions as in Table 2 .

Arm	Recall	Interval	$[E,O]$	Asst. cadence	$g=1$	$g=4$	$g=16$
baseline	0.784	0.334	0.290	0.334	0.334	0.483	0.701
sequential	0.956	0.166	0.144	0.410	0.387	0.438	0.760
sequential_action	0.943	0.433	0.410	0.433	0.433	0.577	0.828
eae	0.932	0.495	0.439	0.495	0.495	0.633	0.857
sp_zeroshot_action	0.937	0.342	0.331	0.342	0.342	0.541	0.849

Appendix

Table 12: Window variants of interval credit, Gemma 4 26B-A4B, the three core arms, eae and sp_zeroshot_action , pooled decomposition, frontier at FPR

\leq 0.1

. Interval is the headline metric on

[E,O_{\mathrm{exec}}]

;

[E,O]

drops the execution extension; assistant cadence masks non-assistant scores;

g

widens the window to

[E-g,O_{\mathrm{exec}}]

Figure 9: Sensitivity of interval credit to a grace period

g

before

E

(window

[E-g,O_{\mathrm{exec}}]

), Gemma 4 26B-A4B, pooled decomposition, five arms at FPR

\leq 0.1

; dotted lines are position-blind recall.

g=0

is the headline metric. Widening by four messages lifts every arm by 0.14 to 0.27 without changing the ordering.

Figure 10: Harmful traces flagged at

\theta^{*}

, the threshold maximising interval credit at FPR

\leq 0.10

, split into in-window (credited), early and late, for five arms on Gemma 4 26B-A4B; the bar end is position-blind recall. At

\theta^{*}

the bar ends sit at 0.75 to 0.93 on decomposition while credited detection spreads from 0.17 to 0.50; on injection sequential has no operating point at the budget.

Model	Arm	Eval FPR	Interval	Early	Late	Never	Recall	Frontier
Gemma 4 26B-A4B	eae	0.080	0.378	0.520	0.019	0.083	0.917	0.495
	sp_zeroshot_action	0.082	0.342	0.587	0.003	0.068	0.932	0.342
	baseline	0.086	0.334	0.435	0.014	0.216	0.784	0.334
	sequential_action	0.130	0.214	0.740	0.006	0.040	0.960	0.433
	sequential	0.080	0.038	0.888	0.011	0.063	0.937	0.166
	sp_zeroshot	0.103	0.026	0.906	0.012	0.056	0.944	0.136

Appendix

Table 13: Held-out interval credit on pooled decomposition (main and hard harmful traces, 1,059 after excluding 105 without an

E

label; 525 evaluation benign traces). Threshold = 90% quantile of trace-maximum scores on the calibration split; “Eval FPR” is its realised rate on the evaluation split. Interval, early, late and never partition the harmful traces by where the first flag lands; recall is

1-

never (interval + early + late). “Frontier” is the in-sample interval credit printed in Table 2 .

Monitor model	Arm	Flagged	Flagged	AUC	Refusal	Refusal
		at $E$	at $O$	at $E$	$\geq\theta$	score
Gemma 4 26B-A4B	baseline	0.281	0.650	0.789	0.000	1.00
	sequential_action	0.469	0.827	0.834	0.000	1.00
	sequential	0.951	0.971	0.586	0.943	9.31
Qwen3.6 27B	baseline	0.277	0.679	0.848	0.000	1.00
	sequential_action	0.358	0.812	0.908	0.000	1.00

Appendix

Table 14: Refusal twins across twelve monitor models, core arms, at each arm’s 10% operating point. “Flagged at

E

” and “at

O

” are the fraction of twins with any flag when the refusal sits at the evidence onset and at the harmful step (copy-prefix construction;

n=548

sources). “AUC at

E

” ranks harmful traces against their

E

-twins. “Refusal

\geq\theta

” is the fraction of refusal messages scoring at or above the threshold and “Refusal score” the mean score of that message (1 to 10; guards:

P(\mathrm{unsafe})

mapped to the same scale). Haiku is 137 traces scored from a 290-source subsample, with the threshold at its floor and no

O

point.

Arm	Refusal at	Flagged	Before $E$	Credited zone	On refusal	AUC	Refusal score
baseline	$E$ / mid / $O$	0.281 / 0.564 / 0.650	0.281	0 / 0.283 / 0.369	0 / 0 / 0	0.789 / 0.626 / 0.577	1.00 / 1.00 / 1.00
sequential_action	$E$ / mid / $O$	0.469 / 0.739 / 0.827	0.469	0 / 0.270 / 0.358	0 / 0 / 0	0.834 / 0.644 / 0.584	1.00 / 1.10 / 1.15
eae	$E$ / mid / $O$	0.380 / 0.664 / 0.783	0.363	0 / 0.279 / 0.416	0.016 / 0.022 / 0.004	0.895 / 0.708 / 0.605	5.06 / 6.89 / 7.53
sp_zeroshot_action	$E$ / mid / $O$	0.451 / 0.739 / 0.823	0.451	0 / 0.288 / 0.372	0 / 0 / 0	0.759 / 0.606 / 0.563	1.00 / 1.02 / 1.01
sequential	$E$ / mid / $O$	0.956 / 0.964 / 0.971	0.880	0 / 0.031 / 0.049	0.077 / 0.053 / 0.042	0.587 / 0.525 / 0.495	9.32 / 9.45 / 9.57
sp_zeroshot	$E$ / mid / $O$	0.856 / 0.891 / 0.922	0.856	0 / 0.035 / 0.066	0 / 0 / 0	0.655 / 0.587 / 0.541	1.00 / 1.00 / 1.00

Appendix

Table 15: Refusal-point sweep on Gemma 4 26B-A4B (

n=548

per point). Each twin’s first flag is assigned to before

c_{E}

, to the credited zone

[c_{E},c-1]

for a refusal at cut

c

, or to the refusal message itself; the three shares sum to the flagged fraction. The before-

c_{E}

share is the same at every point by construction. eae is the one action-framed arm whose refusal score rises with a later refusal (its extractor quotes the stated concern), still below its threshold of 9.1.

Figure 11: Refusal twins with the refusal at the harmful step

O

(hollow) and at the evidence onset

E

(filled), from the refusal-point sweep, sequential arm, on Qwen3.6 27B, Gemma 4 26B-A4B and GPT-5.6 Luna,

\theta

at the 10% budget on ordinary benign traffic. Left: fraction of twins flagged. Right: AUC of harmful traces against their twins. Moving the refusal to

E

removes the credited zone from the shared prefix, and sequential still flags 80 to 96% of twins and also scores the refusal message itself at 8.2 to 9.3 out of 10.

Figure 12: The calibration ceiling. Trace scores (maximum per-message suspicion score) of benign and harmful traces for the core arms on both tracks, Gemma 4 26B-A4B, with the share of benign traces at the ceiling (10) and at the floor (1). A benign mass at the ceiling is indistinguishable from harmful traces at any threshold and puts a floor under the attainable false-positive rate: sequential on injection has 63% of benign traces at 10.

Figure 13: The reasoning tax. Output tokens per trace (log scale) against position-blind AUC (left) and interval credit at the 10% budget (right) for the four prompt families of Chen et al. (2025) with and without chain of thought, Qwen3.6 27B, pooled decomposition; arrows point from the plain prompt to its chain-of-thought variant, hollow markers are the other arms for reference. Every arrow goes right and none goes up. Token counts are from the evaluation logs.

Family	Gemma tokens	$\times$	Gemma AUC	Qwen3.6 tokens	$\times$	Qwen3.6 AUC
	plain $\to$ CoT		plain $\to$ CoT	plain $\to$ CoT		plain $\to$ CoT
sp_zeroshot	220 $\to$ 10,822	49	0.945 $\to$ 0.958 (+0.013)	275 $\to$ 10,528	38	0.966 $\to$ 0.962 ( $-$ 0.004)
sp_guideline	241 $\to$ 16,727	69	0.937 $\to$ 0.958 (+0.021)	235 $\to$ 23,573	100	0.965 $\to$ 0.945 ( $-$ 0.020)
sp_qa_icl	132 $\to$ 10,611	80	0.839 $\to$ 0.875 (+0.036)	156 $\to$ 17,577	113	0.922 $\to$ 0.898 ( $-$ 0.024)
sp_agent_icl	—	—	0.907 $\to$ 0.925 (+0.018)	173 $\to$ 8,688	50	0.939 $\to$ 0.923 ( $-$ 0.016)

Appendix

Table 16: Output tokens per trace for the plain prompt and its chain-of-thought variant, the multiplier, and pooled decomposition AUC (position-blind) for each. Gemma token counts were measured on the 582 original twins and Qwen3.6 counts on the decomposition_main split; the AUC pairs are the pooled decomposition view of Appendix D . Gemma output tokens for sp_agent_icl and its variant were not recorded.

Setting	Target arm	$\theta$	Injection	Decomposition	Harm gate held
Fixed $\theta$	sequential	5	5 / 40	2 / 40	91% / 97%
Fixed $\theta$	sequential_action	5	2 / 40	0 / 40	87% / 99%
Matched 10% budget	sequential_action	1.2 / 8.2	0 / 40	1 / 40	87% / 100%

Appendix

Table 17: Frozen-trace adversarial study: caught traces (of 40 per track) with a meaningful evasion within five feedback-guided attempts, Gemma 4 26B-A4B adversary, three-vote majority on the target monitor, payload-faithfulness gate applied on injection. “Harm gate held” is the share of all attempts that kept the harm (injection / decomposition). The matched thresholds are the arm’s 10% budget operating points on injection and decomposition respectively.

Explore similar work

Jul 31, 2025cs.CR

Measuring Harmfulness of Computer-Using Agents

Computer-using agents (CUAs), which can autonomously control computers to perform multi-step actions, might pose significant safety risks if misused. However, existing benchmarks mainly evaluate LMs in chatbots or simple tool use. To more comprehensively evaluate CUAs' misuse risks, we introduce a new benchmark: CUAHarm. CUAHarm consists of 104 expert-written realistic misuse risks, such as disabling firewalls, leaking data, or installing backdoors. We provide a sandbox with rule-based verifiable rewards to measure CUAs' success rates in executing these tasks (e.g., whether the firewall is indeed disabled), beyond refusal rates. We evaluate frontier LMs including GPT-5, Claude 4 Sonnet, Gemini 2.5 Pro, Llama-3.3-70B, and Mistral Large 2. Even without jailbreaking prompts, these frontier LMs comply with executing these malicious tasks at a high success rate (e.g., 90% for Gemini 2.5 Pro). Furthermore, while newer models are safer in previous safety benchmarks, their misuse risks as CUAs become even higher, e.g., Gemini 2.5 Pro is riskier than Gemini 1.5 Pro. Additionally, while these LMs are robust to common malicious prompts (e.g., creating a bomb) when acting as chatbots, they could still act unsafely as CUAs. We further evaluate a leading agentic framework (UI-TARS-1.5) and find that while it improves performance, it also amplifies misuse risks. To mitigate the misuse risks of CUAs, we explore using LMs to monitor CUAs' actions. We find monitoring unsafe computer-using actions is significantly harder than monitoring conventional unsafe chatbot responses. While monitoring chain-of-thoughts leads to modest gains, the average monitoring accuracy is only 77%. A hierarchical summarization strategy improves performance by up to 13%, a promising direction though monitoring remains unreliable. CUAHarm is released at https://github.com/db-ol/CUAHarm to facilitate further research.

Aaron Xuxiang Tian, Ruofan Zhang, Janet Tang +3

Independent Researcher · Arizona State University · Gradient +1

Large Language Model Safety Unsafe Chatbots

Ask PDF

Jun 11, 2026cs.CR

Who Pays the Price? Stakeholder-Centric Prompt Injection Benchmarking for Real-world Web Agents

Web agents driven by large language models (LLMs) are increasingly deployed in real-world environments, where they operate over untrusted web content and execute actions with direct consequences. This makes them vulnerable to prompt-injection attacks, in which seemingly benign content embeds adversarial instructions that manipulate agent behaviour. Existing security benchmarks adopt an \textit{attack-centric} perspective, focusing on the technical feasibility of injections while overlooking the nuanced distribution of resulting harms. In practice, however, prompt-injection risk is victim-dependent: a single exploit can produce asymmetric consequences for different stakeholders, and the same attack pattern may exhibit substantially different effectiveness depending on whom it targets. To capture these properties, we introduce \textbf{\sysname}, a \textit{stakeholder-centric} benchmark to systematically categorize and attribute harm in real-world web agent systems. It distinguishes between affected entities (e.g., user, seller, platform), decomposes the attacks into concrete objectives, and evaluates each case with complementary outcome- and process-level metrics. Our results reveal substantial and heterogeneous vulnerabilities: not a single attack objective is reliably resisted by current agents, and failures distribute across qualitatively distinct modes ranging from \emph{stealthy parasitism} (attack succeeds without disrupting the user's delegated task) to \emph{misaligned disruption} (task disrupted without attack success) and \emph{compounded failure} (both adversarial objective and task integrity simultaneously violated). These patterns are missed by conventional evaluation, highlighting the need for stakeholder-aware assessment of LLM-based agents in real-world deployments. Benchmark is available at https://github.com/StakeBench/SBC.

Zihao Wang, Yiming Li, Yutong Wu +8

Nanyang Technological University, Singapore · ST Engineering, Singapore · IBM Research, USA +1

Prompt-Injection Detectors Indirect Prompt Injection Web Agents Security Evaluation Stakeholders Prices

Ask PDF

Jun 5, 2026cs.CL

TRACE: Trajectory Reasoning through Adaptive Cross-Step Evidence Aggregation for LLM Agents

Autonomous LLM agents can pursue hidden malicious objectives through sequences of individually benign actions, making sabotage difficult to detect using standard trajectory-level monitoring. Existing approaches either evaluate complete trajectories in a single pass or partition them into independently scored windows, limiting their ability to connect evidence across temporally distant actions. We propose TRACE, a monitoring framework for long-horizon LLM agent trajectories. TRACE operates through a TIJ (Triage-Inspect-Judge) loop that identifies high-signal regions, performs targeted inspection while maintaining accumulated evidence across reasoning steps, and synthesizes a trajectory-level verdict. We evaluate TRACE on ten task domains from SHADE-Arena against state-of-the-art baselines. TRACE achieves an aggregate F1 of 0.713 and recall of 0.844, with the largest gains on tasks requiring long-range evidence linking.

Vijitha Mittapalli, Shreyaa Jayant Dani, Satya Srujana Pilli +7

University of Massachusetts at Amherst · Adobe Research · Dolby Labs +2

Traces Trajectory-Level Credit Large Language Model Agents Malicious Agents Long-Range Coherence

Ask PDF