Source-linked AI summary
Session Risk Memory (SRM): Temporal Authorization for Deterministic Pre-Execution Safety Gates
Florin Adrian Chitan
TL;DR
Stateless pre-execution gates can miss distributed attacks assembled from individually compliant actions. The paper introduces SRM, a deterministic trajectory-aware extension using session behavior memory, and reports perfect F1 with zero false positives on an 80-session benchmark. It frames authorization safety as complementary spatial consistency per action and temporal consistency across trajectories.
Problem
Stateless gates can fail to distinguish legitimate actions from actions embedded in escalating exfiltration sequences, motivating session-level detection of patterns emerging over time.
Method
SRM extends stateless gates with a semantic centroid and exponential moving average risk accumulator while using the underlying semantic representation without additional model components or training.
Results
ILION+SRM achieves F1 = 1.0000 with 0% false positive rate, compared to stateless ILION at F1 = 0.9756 with 5% FPR, while maintaining 100% detection rate and under 250 microseconds per-turn overhead.
Takeaways & Limitations
Authorization safety can be treated as complementary spatial consistency for individual actions and temporal consistency for action trajectories.
Takeaways & Limitations
The evaluation uses structured action syntax designed for compatibility with ILION’s semantic vector space, so natural-language action descriptions may exhibit different embedding characteristics.
Abstract
from arXiv · showhide
Deterministic pre-execution safety gates evaluate whether individual agent actions are compatible with their assigned roles. While effective at per-action authorization, these systems are structurally blind to distributed attacks that decompose harmful intent across multiple individually-compliant steps. This paper introduces Session Risk Memory (SRM), a lightweight deterministic module that extends stateless execution gates with trajectory-level authorization. SRM maintains a compact semantic centroid representing the evolving behavioral profile of an agent session and accumulates a risk signal through exponential moving average over baseline-subtracted gate outputs. It operates on the same semantic vector representation as the underlying gate, requiring no additional model components, training, or probabilistic inference. We evaluate SRM on a multi-turn benchmark of 80 sessions containing slow-burn exfiltration, gradual privilege escalation, and compliance drift scenarios. Results show that ILION+SRM achieves F1 = 1.0000 with 0% false positive rate, compared to stateless ILION at F1 = 0.9756 with 5% FPR, while maintaining 100% detection rate for both systems. Critically, SRM eliminates all false positives with a per-turn overhead under 250 microseconds. The framework introduces a conceptual distinction between spatial authorization consistency (evaluated per action) and temporal authorization consistency (evaluated over trajectory), providing a principled basis for session-level safety in agentic systems.
1. Introduction
Stateless deterministic gates authorize actions individually but can miss distributed attacks whose harmful intent emerges across multiple compliant steps. SRM adds deterministic trajectory-level authorization while preserving compatibility with the underlying gate and distinguishing spatial from temporal consistency.
- Stateless gates evaluate proposed actions against role compatibility, providing interpretable, sub-millisecond authorization without probabilistic inference or fine-tuning.
- Distributed attacks can evade independent action checks by decomposing harmful intent across steps that appear legitimate until a late stage.The paper illustrates this with exfiltration progressing from internal queries to local backups and external uploads.
- SRM extends stateless gating with a semantic centroid and exponential moving average risk accumulator to detect attack patterns emerging over time.
- The framework separates spatial authorization consistency for individual actions from temporal authorization consistency for session trajectories.These dimensions are presented as complementary safety properties.
- SRM processes the same semantic signals as the underlying gate as an optional temporal module requiring no additional model components.
- 80 sessions were evaluated across slow exfiltration, gradual privilege escalation, and compliance drift, with ILION+SRM achieving perfect F1 and zero false positive rate.The benchmark is described as multi-turn and the system comparison reports elimination of stateless ILION’s 5% FPR.
2. Background: Deterministic Execution Gates
Deterministic execution gates produce reproducible, interpretable authorization decisions by checking semantic compatibility before execution. ILION provides strong per-action guarantees but lacks session memory, motivating a complementary mechanism for trajectory-level deviations.
- Deterministic pre-execution gates use rule-based or algebraic mechanisms that require no training, produce no probabilistic uncertainty, and operate at sub-millisecond latency.
- ILION implements geometric verification of semantic compatibility through four layers: CVL, IDC, IRS, and SVRF.
- ILION blocks an action when any verification score falls below its configured threshold, using a conservative veto philosophy for borderline actions.
- ILION represents actions as 21-dimensional semantic vectors computed through keyword-weighted geometric projection without neural components.
- Because ILION evaluates actions independently without prior session context, it may not distinguish legitimate actions from the same actions within an escalating exfiltration sequence.
- This limitation motivates accumulating risk signals across turns to detect patterns that become apparent only over time.
3. Session Risk Memory Architecture
SRM adds a deterministic temporal authorization layer to stateless ILION by tracking session trajectory and accumulated risk. It preserves the gate’s modular, interpretable, and low-latency operation while targeting distributed attacks that emerge across multiple actions.
- SRM processes the underlying gate’s semantic signals as an additive temporal layer, requiring no gate modification, probabilistic inference, or learned parameters.It can be enabled or disabled per deployment while preserving the base gate configuration.
- Complementarity with the Stateless Gate: SRM issues a session-level flag when accumulated risk reaches threshold τ, complementing per-action stateless authorization with trajectory-level authorization.The two layers operate independently, and the integration does not modify the core gate architecture.
- The architecture preserves deterministic, sub-millisecond operation through closed-form computation and bounded per-turn overhead.SRM’s cost is designed to remain suitable for real-time pre-execution evaluation.
- Session Behavioral Centroid: SRM tracks session behavior with an exponential-moving-average centroid and computes current-action drift against the prior session trajectory.Using the previous centroid measures deviation from the established trajectory rather than from the current action itself.
- Baseline Subtraction: Warmup baseline subtraction makes risk sensitive to escalation above each session’s established norm rather than absolute gate-risk magnitude.The baseline is estimated during the first K turns and then frozen, reducing false risk from role-specific vocabulary.
4. Mathematical Formulation
The formulation represents each action as a semantic vector, derives a composite gate-risk signal from four component scores, and maintains a compact SRM state. Its update structure uses baseline estimation, centroid tracking, and bounded exponential risk accumulation.
- Each session contains T sequential actions, and the gate maps every action to a d-dimensional semantic vector; the current ILION implementation uses d = 21.The embedding function is φ: A → ℝᵈ.
- The gate evaluation returns an ALLOW or BLOCK verdict plus four component scores, while composite raw risk is the maximum complement among those scores.The component scores are cvl, idc, irs, and svrf.
- The SRM state is represented by the tuple (φ_t, b_t, R_t), including a frozen baseline risk b_K after warmup.The baseline satisfies b_t ∈ [0,1].
- During warmup, baseline risk follows b_t = β g_t + (1-β) b_{t-1} for t ≤ K.After warmup, the baseline is frozen and subsequent risk uses the established baseline.
- The full per-turn computation has O(d) embedding, cosine-distance, and centroid-update costs, plus O(1) scalar risk operations.For d = 21, the paper characterizes this overhead as negligible relative to gate evaluation.
- The EMA risk accumulator remains bounded under g_t ∈ [0,1] and sustained per-turn risk, while retaining sensitivity to persistent risk elevation.The EMA prevents unbounded accumulation and converges toward a steady-state maximum for constant risk.
5. Experimental Evaluation
The evaluation uses an 80-session benchmark of benign and multi-turn attack workflows to compare stateless ILION with ILION+SRM. SRM preserves perfect detection while eliminating false positives, separating benign and attack trajectories after warmup with low computational overhead.
- Benchmark: The benchmark contains 80 sessions, evenly split between 40 benign and 40 attack workflows lasting 6–7 turns.Benign sessions cover 10 enterprise roles, while attacks comprise slow exfiltration, gradual privilege escalation, and compliance drift.
- Benchmark: Early attack turns contain no special keywords, so harmful patterns emerge through action sequences rather than isolated action content.This setup tests whether session-level accumulation detects distributed intent that individual gates may miss.
- Detection Timing: SRM’s average detection turn is 4.45 versus 4.05 for stateless ILION, reflecting conservative accumulation that generally triggers later.SRM nevertheless detects 5 of 40 attack sessions earlier, with a cumulative detection gain of 1.6 turns concentrated in slow exfiltration and privilege escalation.
- Risk Trajectories: After the turns 1–3 warmup window, attack risk trajectories diverge from benign sessions, which remain near zero throughout.The dashed SRM threshold is τ = 0.20, and the separation follows baseline subtraction of session-specific risk.
- Efficiency: The median per-turn SRM overhead is 239.9 microseconds, independent of session length and dominated by embedding lookup.Measurements used 1,000 benchmark repetitions on an Intel-class CPU without a GPU.
6. Discussion
The discussion frames SRM as a temporal complement to stateless spatial authorization for distributed attacks. It also identifies baseline subtraction, deployment properties, embedding dependence, and benchmark scope as important design and evaluation boundaries.
- Authorization Dimensions: Spatial authorization checks whether one action fits a role, whereas temporal authorization checks whether the session trajectory remains coherent with that role.The two dimensions address distinct threat patterns: overt violations versus harmful intent distributed across compliant-appearing steps.
- Defense in Depth: Combining both layers provides defense in depth: stateless gating catches overt violations immediately, while SRM accumulates risk across distributed attacks.The discussion presents the layers as complementary rather than universally necessary in every deployment.
- Baseline Subtraction: Baseline subtraction estimates a session-specific norm, preventing naturally high-risk role vocabularies from accumulating benign false risk.Without correction, roles such as security analysts and operations engineers can produce elevated gate outputs during legitimate work.
- Baseline Subtraction: Baseline subtraction sacrifices detection of attacks that begin on the first turn, which remain handled by the stateless gate.Its supported trade-off is near-zero false positives on longer sessions in exchange for requiring escalation above the warmup baseline.
- Limitations: The evaluation is constrained by structured action syntax and a keyword-weighted 21-dimensional embedding that may behave differently for natural-language action descriptions.The 80-session benchmark isolates three multi-turn attack categories but is not a general-coverage evaluation; broader roles, attacks, and enterprise domains would strengthen generalizability claims.
- Limitations: The current sparse embedding gives no discriminative value to the cosine-distance drift signal, although the formulation retains that term for richer continuous embeddings.The discussion expects higher-dimensional continuous embeddings to provide semantic trajectory signals unavailable in the current keyword representation.
- Deployment: SRM supports optional deployment through stateless compatibility, session-isolated state, configurable sensitivity, and fallback to stateless behavior when context is unavailable.For workflows of 10 or more turns, the paper expects increasing advantage because slow-burn attacks provide more turns for risk accumulation.
7. Conclusion
SRM extends deterministic authorization from isolated actions to session trajectories, complementing stateless gates against distributed multi-step attacks without probabilistic dependencies or architectural changes. On an 80-session benchmark, it achieved perfect F1 and zero false positives with low per-turn overhead, while future work targets broader embeddings and adaptive session modeling.
- SRM extends authorization from per-action evaluation to trajectory-aware evaluation for distributed multi-step attacks.
- ILION+SRM achieves F1 = 1.0000 with 0% false positive rate, compared to stateless ILION at F1 = 0.9756 with 5% FPR, while maintaining 100% detection rate.The benchmark contained 80 multi-turn sessions.
- SRM complements stateless gates by addressing temporal consistency alongside their spatial consistency checks.Together, the two dimensions provide complementary defense against overt and distributed agentic attacks.
- SRM extends deterministic verification without probabilistic dependencies, training requirements, or modification to the underlying gate architecture.
- Future work includes higher-dimensional continuous embeddings, hierarchical sessions, and adaptive thresholds for session-specific risk profiles.
Data Availability
The paper releases its benchmark dataset and supporting evaluation materials through a Zenodo repository. The listed materials include session definitions, results, tabular data, figures, and related benchmark resources.
- ILION-SRM-Bench v1 is publicly available on Zenodo at DOI: 10.5281/zenodo.15410944.
- The dataset includes session definitions, evaluation results, a tabular CSV version, and supporting figures.
- The repository also contains the ILION-Bench v2 per-action benchmark and the ILION Framework Simulator.