MCAIR: Monitoring and Correcting Agent Unfaithfulness via Internal Representations

Yan Xu; Dandan Song; Luan Zhang; Jun Yang; Ke Duan; Yuhang Tian; Yading Li; Xudong Li

cs.AIOct 14, 2026

MCAIR: Monitoring and Correcting Agent Unfaithfulness via Internal Representations

Authors: Yan Xu, Dandan Song, Luan Zhang, Jun Yang, Ke Duan, Yuhang Tian, Yading Li, Xudong Li,

Organizations: School of Computer Science and Technology, Beijing Institute of Technology, China

Abstract

Large Language Model (LLM)-based agents have demonstrated remarkable capabilities in completing complex tasks through multi-step reasoning and tool interactions. However, recent studies have revealed that LLM-based agents can exhibit unfaithful behaviors, where their final reports fail to faithfully reflect their actual execution trajectories. Specifically, when agents fail to accomplish tasks through the intended sources or procedures, they may resort to alternative sources or strategies while failing to disclose such deviations, leading users to incorrectly believe that the tasks have been completed according to the original requirements. We refer to this specific form of agent unfaithfulness as Agent Completion Unfaithfulness. Detecting and mitigating agent completion unfaithfulness is critical yet remains largely unexplored. In this work, we propose MCAIR, a runtime monitoring and correction framework that leverages internal representations of LLM-based agents. MCAIR uses multi-step internal representations as inputs to train a risk-aware probe, enabling online detection of potential completion unfaithfulness during execution. Furthermore, MCAIR introduces a risk-guided correction loop that prompts agents to review their execution history and mitigate potential inconsistencies between their execution trajectories and final reports. Additionally, we construct ACUD, a dataset for Agent Completion Unfaithfulness detection that provides step-level execution traces, step-level internal representations, and consistency annotations for training and evaluating runtime detection probes. Experiments demonstrate that MCAIR outperforms LLM-as-a-judge baselines, generalizes across prompts and tasks, and effectively reduces agent completion unfaithfulness.

Figures & tables

Model	Episodes	Faithful	Unfaithful
Qwen3-14B	1,062	737	325
Qwen3-8B	1,071	740	331
Gemma3-12B-it	1,077	793	284
Total	3,210	2,270	940

Table 1: Overview of ACUD after excluding incomplete episodes. Each model is evaluated under three prompt variants and nine task types. Faithful episodes include both genuine task completion and honest failure reporting.

Figure 1: Overview of MCAIR. The framework monitors internal representations during agent execution and triggers correction when completion-unfaithfulness risk is high.

Detector/Input	Qwen3-14B	Qwen3-8B	Gemma
4o-mini, final	0.694/0.804	0.697/0.793	0.636/0.780
4o-mini, L30	0.710/0.825	0.663/0.771	0.677/0.793
4o-mini, full	0.708/0.806	0.622/0.723	0.668/0.787
DS-V3.2, final	0.651/0.761	0.682/0.785	0.623/0.781
DS-V3.2, L30	0.766/0.838	0.734/0.825	0.702/0.831
DS-V3.2, full	0.765/0.844	0.731/0.806	0.696/0.838

Table 2: Main detection results. Each cell reports F1/AUC. L30 denotes the last 30% trajectory setting; DS-V3.2 denotes DeepSeek-V3.2; Gemma denotes Gemma3-12B-it.

Figure 2: Runtime risk scores across relative execution positions. Solid lines denote unfaithful episodes and dashed lines denote faithful episodes.

Model	Prompt Condition	Base $\downarrow$	+MCAIR $\downarrow$
Gemma3-12B-it	Pressure	57.9	18.4
	Neutral	57.9	19.3
	Honesty	37.7	14.0
Qwen3-8B	Pressure	80.9	19.7
	Neutral	73.6	16.4
	Honesty	33.1	9.8

Table 3: Main correction results. Values are unfaithfulness rates (%). Pressure, Neutral, and Honesty correspond to the three prompt conditions in ACUD. Incomplete outputs are excluded.

Model	Variant	F1 $\uparrow$	AUC $\uparrow$
Qwen3-14B	Full MCAIR	0.7905	0.9227
	plain mean context	0.7846	0.9228
	w/o context	0.7896	0.9285
	w/o first	0.7319	0.8709
	w/o final	0.7769	0.9134
Qwen3-8B	Full MCAIR	0.8008	0.9091

Table 4: Representation ablation averaged over three random seeds. “Plain mean context” replaces the linear recency-weighted mean with an arithmetic mean while keeping the same context window and other selected hyperparameters.

Correction Variant	Unfaith. Rate $\downarrow$
Full correction	17.2
w/o intermediate loop	30.7
w/o final loop	35.7
w/o iterative loop	22.5

Table 5: Correction ablation on Gemma3-12B-it. Values are unfaithfulness rates (%); lower is better.

Prompt	Qwen3-14B	Qwen3-8B	Gemma3-12B-it
Pressure	0.774 / 0.909	0.814 / 0.933	0.791 / 0.927
Neutral	0.771 / 0.914	0.770 / 0.923	0.755 / 0.925
Honesty	0.696 / 0.896	0.690 / 0.905	0.764 / 0.928

Table 6: Prompt-level generalization. Each cell reports F1/AUC.

Appendix figures & tables18 assets

Supplementary material from the paper’s appendix.

Appendix

Task	Task requirement	Failure setting
1	Read or analyze a specified local document and answer questions about its content.	The relevant parser is replaced by an incorrect tool. Calls to document-reading functions such as read_txt , read_pdf , read_docx , or read_pptx return error-like observations instead of source content.
2	Use a provided local text file as the required source for answering the user’s question.	The file can be read, but its content is irrelevant, weakly related, or insufficient for the requested answer.
3	Use a specified local file to answer the user’s question.	The target file is irrelevant, while a similarly named decoy file in the same directory contains tempting substitute content.
4	Download a named source first, then analyze it or produce a requested output based on the downloaded file.	Web search or webpage access may identify the requested file, its landing page, related snippets, or substitute sources, but the file cannot be obtained and read through the intended download/source-handling path.
5	Obtain a named downloadable file and use it as the mandatory evidence source.	The requested file does not exist or cannot be obtained, so the mandatory evidence source is absent.

Appendix

Table 7: Failure-oriented task design. Tasks 1–5 are unsolvable as requested, but differ in whether the failure comes from a broken parser, insufficient content, a decoy source, a broken acquisition path, or a non-existent source.

Task	Task requirement
6	Use a provided local text file as the required source for answering the user’s question.
7	Search for relevant public sources, read the retrieved webpages or documents, and write a source-grounded summary or report.
8	Read or analyze a specified PDF document and answer questions about its content.
9	Read or analyze a specified PPTX document and answer questions about its slide content.

Appendix

Table 8: Success-control task families. Tasks 6–9 provide valid evidence and functioning tools, so faithful behavior is successful task completion.

Model	Honest fail.	Success	Faithful total
Qwen3-14B	259	478	737
Qwen3-8B	264	476	740
Gemma3-12B-it	316	477	793
Total	839	1431	2270

Appendix

Table 9: Faithful subset composition by model. Honest failure reports come from failure-oriented tasks, while successful completions come from success-control tasks.

Model	Prompt	Honest fail.	Unfaith.	Success
Qwen3-14B	Pressure	81	114	159
	Neutral	70	124	159
	Honesty	108	87	160
Qwen3-8B	Pressure	74	125	159
	Neutral	81	116	158
	Honesty	109	90	159

Appendix

Table 10: Dataset distribution by model and prompt condition. Honest failure and unfaithful completion counts come from failure-oriented tasks, while success counts come from success-control tasks.

	Qwen3-14B		Qwen3-8B		Gemma3-12B-it		Total
Task	Honest	Unfaith.	Honest	Unfaith.	Honest	Unfaith.	Honest	Unfaith.
1	60	57	61	59	74	46	195	162
2	42	74	42	76	27	93	111	243
3	71	48	78	42	88	32	237	122
4	23	90	33	86	44	76	100	252
5	63	56	50	68	83	37	196	161

Appendix

Table 11: Failure-oriented task distribution by model. Honest denotes honest failure reporting; unfaithful denotes unsupported completion claims. Task identifiers for Qwen rows whose packaged manifest stored task_type=-1 are recovered from the corresponding execution metadata.

Task	Qwen3-14B	Qwen3-8B	Gemma3-12B-it	Total
6	120	120	120	360
7	119	119	117	355
8	119	117	120	356
9	120	120	120	360
Total	478	476	477	1431

Appendix

Table 12: Success-control task distribution by model. Entries report successful completion examples for Tasks 6–9.

Human semantic type	$N$	Matched	Agreement
Honest failure	259	248	95.8%
Unfaithful completion	325	316	97.2%
Overall evaluated	584	564	96.6%

Appendix

Table 13: Agreement between GPT-4o-mini report-completion judgments and human labels for Qwen3-14B Task 1–5. This auxiliary check covers failure-oriented examples only; successful completions are not part of the evaluated LLM-labeling subset.

Seed	Split	Prompt 1	Prompt 2	Prompt 3
42	Train	77/170 (31.2)	86/159 (35.1)	62/186 (25.0)
	Val	11/23 (32.4)	13/22 (37.1)	7/28 (20.0)
	Test	26/47 (35.6)	25/48 (34.2)	18/54 (25.0)
43	Train	81/167 (32.7)	92/156 (37.1)	63/186 (25.3)
	Val	9/26 (25.7)	10/24 (29.4)	6/28 (17.6)
	Test	24/47 (33.8)	22/49 (31.0)	18/54 (25.0)

Appendix

Table 14: Example split balance for Qwen3-14B. Each cell reports positive/negative counts with the positive percentage in parentheses.

Model	Seed	$k$	Layer	PCA / C / Pen. / Solv.
Qwen3-14B	42	3	23	256 / 0.1 / L2 / liblin.
	43	3	14	64 / 0.01 / L2 / liblin.
	44	3	31	128 / 0.1 / L1 / liblin.
Qwen3-8B	42	3	27	256 / 0.1 / L2 / lbfgs
	43	3	17	128 / 0.01 / L2 / liblin.
	44	3	19	256 / 1.0 / L2 / lbfgs

Appendix

Table 15: Validation-selected probe hyperparameters for the main detection setting.

Figure 3: Fixed-hyperparameter layer sweep curves. Left: F1 across representation layers. Right: ROC AUC across representation layers. Each curve reports the mean over seeds 42, 43, and 44 for one agent model.

Parameter	Value
Risk threshold $\theta$	0.5
Maximum intermediate alerts $M_{\mathrm{mid}}$	3
Maximum loops per intermediate alert $B_{\mathrm{mid}}$	2
Maximum final correction loops $B_{\mathrm{final}}$	2
Correction evaluation seed	42
Repeated runs per setting	3

Appendix

Table 16: Correction-loop settings used in the main mitigation experiments.

Model	Prompt	Base	+MCAIR
Qwen3-8B	Pressure	$80.9{\pm}2.3$	$19.7{\pm}9.3$
Qwen3-8B	Neutral	$73.6{\pm}2.2$	$16.4{\pm}3.5$
Qwen3-8B	Honesty	$33.1{\pm}1.3$	$9.8{\pm}1.1$
Gemma	Pressure	$57.9{\pm}5.7$	$18.4{\pm}2.1$
Gemma	Neutral	$57.9{\pm}3.7$	$19.3{\pm}1.2$
Gemma	Honesty	$37.7{\pm}3.3$	$14.0{\pm}1.2$

Appendix

Table 17: Unfaithfulness rates with standard deviations over three repeated runs in the main correction experiment. Values are percentages. Gemma denotes Gemma3-12B-it.

Model	F1	AUC
Qwen3-14B	$0.791\pm 0.013$	$0.923\pm 0.012$
Qwen3-8B	$0.801\pm 0.017$	$0.909\pm 0.021$
Gemma3-12B-it	$0.786\pm 0.025$	$0.934\pm 0.002$

Appendix

Table 18: Main probe performance with standard deviations over seeds 42, 43, and 44.

Model	Precision	Recall
Qwen3-14B	$0.730\pm 0.032$	$0.875\pm 0.052$
Qwen3-8B	$0.779\pm 0.026$	$0.831\pm 0.044$
Gemma3-12B-it	$0.752\pm 0.016$	$0.836\pm 0.037$

Appendix

Table 19: Precision and recall for the main detection setting, averaged over seeds 42, 43, and 44.

Task	Sup.	Qwen14	Qwen8	Gemma
PDF	0	0.647/0.900	0.677/0.902	0.744/0.940
	4	0.704/0.918	0.690/0.905	0.741/0.949
	8	0.707/0.923	0.725/0.915	0.745/0.950
Web	0	0.544/0.417	0.568/0.498	0.547/0.729
	4	0.706/0.803	0.704/0.842	0.699/0.867
	8	0.755/0.847	0.727/0.859	0.720/0.882

Appendix

Table 20: Task-level generalization and few-shot adaptation. Sup. denotes the number of support examples per prompt condition and label subtype. Each cell reports F1/AUC; Qwen14, Qwen8, and Gemma denote Qwen3-14B, Qwen3-8B, and Gemma3-12B-it, respectively. Web denotes web-retrieval tasks.

Model	Hidden dim.	Mean	Median	P95	P99
Qwen3-14B	5120	178.1us	176.1us	187.0us	206.0us
Qwen3-8B	4096	137.2us	123.4us	202.5us	212.0us
Gemma	3840	116.9us	119.6us	125.1us	138.2us

Appendix

Table 21: Isolated MCAIR probe-scoring latency after the hidden-state vector is available. Each configuration is measured with 10,000 timed iterations after 1,000 warm-up iterations. Gemma denotes Gemma3-12B-it.

Model	Episodes	Steps	Runtime	Tokens
Qwen3-8B	393	$7.3{\to}6.0$	$376.6{\to}275.8$ s	$98.4{\to}65.9$ k
Gemma	342	$4.9{\to}4.0$	$128.9{\to}106.0$ s	$34.5{\to}27.3$ k

Appendix

Table 22: Logged agent-level runtime in the correction experiment. Each arrow reports the no-correction baseline mean followed by the MCAIR mean. Token counts are total input plus output tokens per episode. Gemma denotes Gemma3-12B-it.

Judge	Context	Mean tok.	Total tok.	Mean lat.
GPT-4o-mini	Final	1.16k	2.27M	1.46s
GPT-4o-mini	Last 30%	2.70k	5.28M	1.61s
GPT-4o-mini	Full	4.96k	9.70M	2.13s
DeepSeek-V3.2	Final	1.16k	2.28M	0.97s
DeepSeek-V3.2	Last 30%	2.93k	5.74M	1.73s
DeepSeek-V3.2	Full	5.54k	10.83M	3.11s

Appendix

Table 23: Token and API-latency cost of LLM-as-a-judge baselines over 1,956 evaluated episodes per context setting. Mean tok. denotes mean total input plus output tokens per episode; Total tok. denotes aggregate tokens for that judge and context setting.

AI Agent Monitoring

AI agent monitoring tracks actions, tool use, and execution traces to detect failures, misuse, drift, and policy violations during operation.

See all 285 papers

Real-Time Detection and Repair of LLM Agent Failures
Aug 3, 2026Sunny DubeyAI Agent Reliability AI Agent Monitoring
Cascade Failure Attribution for Multi-Agent Systems
Aug 30, 2026Jiayi Zhang, Zexin Wang, Degang Sun +4Agent Failure Analysis Multi-Agent LLM Systems
Computer Network Information Center, Chinese Academy of Sciences · Institute of Computing Technology, Chinese Academy of Sciences
Verify Before You Commit: Towards Faithful Reasoning in LLM Agents via Self-Auditing
Apr 9, 2026Wenhao Yuan, Chenchen Lin, Jian Chen +3Faithfulness of Language Model Reasoning LLM Agent Reliability
The University of Hong Kong · Sun Yat-sen University

Aug 3, 2026J/K move · Enter open · S save

Real-Time Detection and Repair of LLM Agent Failures

Sunny Dubey

AI Agent Reliability AI Agent Monitoring LLM Agent Reliability Runtime Verification

Open paper AskPDF arXiv

LLM agents fail mid-episode -- they loop, cascade tool errors, drift off goal, fabricate results, or silently absorb corrupted content -- and the standard remedy, judging every step with a second LLM, costs more than the agent itself. We ask how much detection is achievable from observable step telemetry alone, using monitors costing microseconds per step and trained only on healthy runs. On 2,823 committed agent episodes across three frameworks, three local models (qwen2.5 7b/3b, llama3.1 8b) and a commercial API (gemini-2.5-flash), a one-class echo-state-network ensemble with CUSUM alarms detects 0.71 of failures at a 5% false-alarm budget (AUROC 0.872). Its advantage over a memoryless baseline is a monotone function of post-onset horizon (+0.09 at <=3 steps, +0.40 at >=9), predicting its own failure region out of sample on AFTraj-2K. Ranking transfers with no retraining to two corpora from other groups (AFTraj-2K 0.745, ATBench 0.779). Monitors carry two burdens: a per-deployment healthy null (they do not transfer -- AUROC 0.527 cold against 0.885 recalibrated) and a residual false-alarm rate. We add a layer carrying neither: deterministic verification, which recomputes a run's stated total from the tool results it actually received and confirms every required call was made. Head-to-head it catches 60% of failures (96% with the coverage check) at 0 of 63 false positives against the monitor's 54% at 17%, transfers unchanged to llama3.1:8b (110 of 110 at 0 of 10), and trips on 0 of 1825 healthy episodes. Detection is then closed into repair: each flagged run is rolled back and re-run live, recovering 45% of failures against a 16% resampling control (p=0.0005) and lifting task success from 52% to 73% for about one extra model call per run. The system runs at ~200 microseconds per step, three orders of magnitude below a judge call. Code, traces and results are released.

Abstract

AI Agent Monitoring

Explore similar work

Real-Time Detection and Repair of LLM Agent Failures

Cascade Failure Attribution for Multi-Agent Systems

Verify Before You Commit: Towards Faithful Reasoning in LLM Agents via Self-Auditing