AI Agent Monitoring

Follow this topic Ask about this topic

Momentum

20 papers in the last four weeks, up 186% on the four weeks before. 0.2% of all new papers.

Jul 13Week of Sep 28

Latest papers 170

All topics

When Local Monitors Miss Compositional Harm: Diagnosing Distributed Backdoors in Multi-Agent Systems
Jul 13, 2026Yibo Hu, Ren WangBackdoor Attacks Backdoor Detection
Illinois Institute of Technology
NextFund: A Unified Performance Tracking Platform for Agentic Portfolio Management
Jul 13, 2026Changlun Li, Peixian Ma, Qiqi Duan +2Quantitative Finance LLM Agent Evaluation
Paradoox AI Research
Token-Flow Firewall: Semantic Runtime Auditing for Persistent AI Agents
Jul 9, 2026Puji Wang, Yingchen Zhang, Ruqing Zhang +2AI Agent Security AI Agent Monitoring
State Key Laboratory of AI Safety · Institute of Computing Technology, Chinese Academy of Sciences · University of Chinese Academy of Sciences, Beijing, China
Persuasion Attacks Can Decrease Effectiveness of CoT Monitoring
Jul 9, 2026Jennifer Za, Julija Bainiaksina, Nikita Ostrovsky +2Language Model Safety Evaluation Adversarial Attacks on LLMs
LASR Labs · University College London · Google DeepMind
Agent Delivery Engineering Predictive Reliability Framework
Jul 8, 2026Dexing LiuAI Agent Reliability Multi-Agent LLM Systems
Shanghai Qijing Digital Technology Co., Ltd · Shanghai Qijing Digital Technology Co., Ltd.
Multi-Agent AI Control: Distributed Attacks Hamper Per-Instance Monitors
Jul 8, 2026Oliver Makins, Orazio Angelini, Zohreh Shams +1Multi-Agent Control AI Agent Security
UK AI Security Institute MATS Research · MATS Research
When Agents Go Rogue: Activation-Based Detection of Malicious Behaviors in Multi-Agent Systems
Jul 7, 2026Haowen Xu, Xue Tan, Lei Ma +6LLM Agent Security AI Agent Monitoring
Department of Computer Science, Worcester Polytechnic Institute, MA, USA · School of Computer Science, Fudan University, Shanghai, China · Institute of Big Data, Fudan University, Shanghai, China +1
Calibration-Family Overfit: Why Trusted Sabotage Monitors Don't Transfer Across Lineages
Jul 6, 2026Lucas PintoBackdoor Detection AI Agent Monitoring
Independent Researcher
AGL-1: The Enterprise AI Governance Layer as a Control Plane for Trusted Enterprise Intelligence
Jul 3, 2026Roopam W. SureAI Assurance AI Agent Monitoring
Independent Researcher
Distributed Attacks in Persistent-State AI Control
Jul 2, 2026Josh Hills, Ida Caspary, Asa Cooper SticklandAI Agent Security AI Agent Security Benchmarks
1Constellation Astra Fellowship · 2Imperial College London · 3UK AI Security Institute
Behind the Refusal: Determining Guardrail Activation via Behavioral Monitoring
Jul 2, 2026William Hackett, Peter GarraghanLLM Auditing LLM Guardrails
Mindgard · Lancaster University
LabGuard: Grounding Natural-Language Laboratory Rules into Runtime Guards for Embodied Laboratory Agents
Jun 30, 2026Jingpu Yang, Fengxian Ji, Zhengzhao Lai +8AI Agent Safety AI Agent Monitoring
1Wuhan University · 2MBZUAI · 3Northeastern University
MESA: Prioritizing Vulnerable Communication Channels for Securing Multi-Agent Systems
Jun 29, 2026Kunyang Li, Kyle Domico, Jonathan Gregory +1AI Agent Monitoring Multi-Agent System Security
University of Wisconsin–Madison
Internal-State Probes Read the Situation, Not the Action: Three Negative Results for Pre-Action Misalignment Monitoring
Jun 29, 2026Max Fomin, Elad David, Amit LeViLanguage Model Safety Evaluation AI Agent Monitoring
Zenity
Agent-Native Immune System: Architecture, Taxonomy, and Engineering
Jun 26, 2026Bo Shen, Lifeng Chang, Tianyuan Wei +7AI Agent Security AI Agent Monitoring
Novo Ordo for AI
Training Observable Control Policies to Expose Agent State Through Actions
Jun 25, 2026Andres Enriquez Fernandez, John J. BirdAI Agent Monitoring State Tracking
Department of Aerospace and Mechanical Engineering, 500 W University, El Paso, TX 79968
Litmus: Zero-Label, Code-Driven Metric Specification for Evaluating AI Systems
Jun 22, 2026Prajjwal Gupta, Prasang Gupta, Vishal Bhutani +4AI Agent Evaluation AI Agent Monitoring
PricewaterhouseCoopers, U.S.
Measuring What Persists: Conditioning Mechanisms and a Geometric Framework for AI Agent Identity
Jun 20, 2026Andrew TannerAI Agent Monitoring LLM Agent Reliability
Anisotrope AI
Efficient and Sound Probabilistic Verification for AI Agents
Jun 18, 2026Alaia Solko-Breslin, Pramod Kaushik Mudrakarta, Mihai Christodorescu +2AI Agent Security AI Agent Monitoring
Google DeepMind · Google · University of Wisconsin–Madison
DeXposure-Claw: An Agentic System for DeFi Risk Supervision
Jun 17, 2026Aijie Shu, Bowei Chen, Wenbin Wu +2Financial Services AI Agent Monitoring
University of Edinburgh · University of Glasgow · University of Cambridge
Execution-bound advisory automation for agentic AI: a reproducible AIBOM-driven CSAF-VEX framework
Jun 16, 2026Petar Radanliev, Omar Santos, Carsten Maple +1Cybersecurity Software Security
Department of Computer Sciences, University of Oxford, Wolfson Building, Parks Rd, Oxford OX1 3QG · The Alan Turing Institute, British Library, 96 Euston Rd., London NW1 2DB · Cisco Systems, RTP, North Carolina, United States +2
Bistable by Construction: Wall-Clock-Calibrated State Monitors Have No Moment-Detection Regime at Agent Cadence
Jun 15, 2026Manvendra ModgilAgent Reliability AI Agent Monitoring
Modint Intelligence
When Errors Become Narratives: A Longitudinal Taxonomy of Silent Failures in a Production LLM Agent Runtime
Jun 12, 2026Wei WuAgent Failure Analysis AI Agent Monitoring
Independent researcher
Agent Behavior Mining: Generative AI Agent Governance in Business Processes
Jun 12, 2026Hoang Vu, Maximilian Körner, Adrian Rebmann +4Process Mining Business Process Automation
SAP, Berlin, Germany · Umeå University, Umeå, Sweden
Bootstrapped Monitoring: Leveraging Transparent Reasoning to Oversee Stronger AI Agents
Jun 10, 2026Frank Xiao, Mary PhuongAI Agent Safety AI Agent Monitoring
California Institute of Technology
The Arbiter Agent: Continually Monitoring Multi-Agent Conversations to Detect Emergent Misalignment
Jun 9, 2026Filippo Tonini, Federico Torrielli, Anton Danholt Lautrup +3AI Agent Auditing LLM Auditing
University of Southern Denmark Odense, Denmark · University of Turin Turin, Italy · University of Southern Denmark Vejle, Denmark
The Distributed Detectability Band Against Marginal-Preserving Attacks
Jun 9, 2026Zhang Qinqin, Gao YuzeAdversarial Attacks AI Agent Security
MIRAGE: A Polarity-Flipping Encoding Subspace in LLM Agents
Jun 9, 2026Pratibha Revankar, Kargi Chauhan, Jihye Kim +3LLM Interpretability AI Agent Security
University of California, Santa Cruz.
Observability for Delegated Execution in Agentic AI Systems
Jun 8, 2026Abhinav Mishra, Kumar SharadAI Agent Auditing AI Agent Monitoring
Splunk, Cisco Inc
Projecting the Emerging Mindset of SWE Agent by Launching a Wild Code Understanding Journey
Jun 7, 2026Zhengyi Zhuo, Yan LiuSoftware Engineering Software Engineering Agents
School of Computer Science and Technology, Tongji University,Jun Shanghai, People’s Republic of China.

Jul 13, 2026, cs.CRJ/K move · Enter open · S save

When Local Monitors Miss Compositional Harm: Diagnosing Distributed Backdoors in Multi-Agent Systems

Yibo Hu, Ren Wang

Illinois Institute of Technology

Backdoor Attacks Backdoor Detection AI Agent Monitoring Multi-Agent System Security

Open paper AskPDF arXiv

As multi-agent, tool-using LLM systems are deployed, a common safety net is a runtime monitor that checks each message, tool call, or step on its own. We show this net has a fundamental hole. A distributed backdoor splits a harmful payload across agents, so every local check passes while the assembled object is the attack. The monitor can be right on every step and still miss the attack. The problem is not splitting itself: split fragments can still leak suspicious tokens or provenance edges. The hard case is \emph{local benignness}. No fragment carries the harm, and what is left looks like ordinary benign traffic. We formalize this as an \emph{observability boundary}: a monitor catches only what its view can tell apart from benign traffic. We prove that once the fragments look benign in the monitored view, no detector on that view can catch them, however strong it is. Across a controlled testbed, an external benchmark, and end-to-end agent runs, local monitors lose the signal exactly as local evidence disappears, and it returns only when the monitor sees the assembled object. A monitor trained only on benign traffic recovers the attack's code structure across held-out encodings (0.874 mean AUROC). A decoded-view gate, given the encoding family, blocks every tested attack. But seeing more is not enough: full-trace monitors and decoders still fail unless they reach the representation where the payload is exposed. Local safety is not global safety when harm is compositional, and the open problem is finding that representation.

Momentum

Related topics

Latest papers 170