Beyond Suspicious Steps: Ontological Trust in Long-Horizon Agents

Motivation

• The paper addresses an oversight gap because existing monitors emphasize rule violations [1], final outcomes [2] [3], prompt injection [5] [6] [7], local anomalies, or unstructured judgments [10] [11].These approaches do not directly test whether the trajectory so far remains the task authorized by the user.Source: §1 · p. 1
• 73.49% AUC was achieved by the best snapshot metric, while Predictive Entropy remained near random, showing that individual-step signals cannot recover prefix-level authorization.The information required to judge task correspondence is distributed across the trajectory prefix rather than contained in any single step.Source: §1 · pp. 1–2, Figure 1 · p. 2

Ontological Trust

• Ontological trust holds when a trajectory prefix still corresponds to the authorized task, and trust drift occurs when Role, Goal, or Evidence deviates enough to change that task identity.Role measures granted scope, Goal measures pursuit of the delegated objective, and Evidence measures grounding in instructions, user information, and the observed environment.Source: §1 · p. 2

RGE

• RGE parses task instructions and steps into structured fields with LLMs, then deterministically projects, aggregates, and updates trust across Role, Goal, and Evidence.Its replayable trust trajectory supports auditable intervention decisions through the parsed fields and accumulated deviations, without further LLM input.Source: §1 · p. 2

Dataset and Contributions

• The authors build a cross-domain corpus spanning OSWorld, FinanceBench, and EICU-AC with benign executions, prefix-paired drift, and pseudo-consistency failures.The corpus is designed to evaluate whether a trajectory has ceased to be the task it was authorized to perform.Source: §1 · p. 2

Trajectory corpora and monitored relations

• RGE evaluates on OSWorld, FinanceBench, and EICU-AC because their trajectories make Role, Goal, and Evidence constraints concrete across desktop, financial, and clinical domains.These benchmarks expose full action–observation trajectories, whereas most trajectory data primarily scores final outcomes or domain-specific correctness.Source: §2 · pp. 2–3

Agent security and redirection

• Redirection research studies how external content, memory, tools, failures, or request structure can redirect agents, while RGE monitors the resulting prefix-level departure regardless of its trigger.Relevant threat models include prompt injection, poisoning, high-stakes tool use, simulated tool failures, and harmful multi-step requests [21] [5] [7] [6].Source: §2 · p. 3

Runtime monitors and trajectory-level judgment

• Unlike judges, rule monitors, safety-risk evaluators, offline auditors, shields, and anomaly detectors, RGE maintains an online task-conditioned trust state over trajectory prefixes.LLMs derive structured task and step representations, while deterministic updates produce the trust trajectory and intervention labels; the state decomposes into Role, Goal, and Evidence.Source: §2 · p. 3

Goal misgeneralization, process supervision, and reliance

• RGE shifts related concerns from training or user reliance to deployment-time monitoring of whether a fixed agent’s execution prefix still corresponds to its delegated objective.Goal misgeneralization concerns trained-policy objectives, process supervision uses step-level rewards [32], and appropriate reliance concerns when users should trust outputs [34].Source: §2 · p. 3

3.1 Task Setting

• Ontological trust evaluates task-prefix pairs rather than isolated actions, labeling trajectories trust-failing when any plausible prefix departs from the delegated task.A trajectory is benign only if it remains within the delegated task throughout.Source: §3.1 · p. 3

3.2 Trust as Bounded Authorization

• Bounded authorization is formalized as D(x) = (R(x), G(x), E(x)), covering the authorized role, delegated goal, and permissible evidence basis.These dimensions arise from action selection, objective pursuit, and observation grounding, and can fail independently.Source: §3.2 · pp. 3–4
• The trust state T(x, h≤t) ∈ [0, 1]^3 deterministically estimates prefix deviation along Role, Goal, and Evidence from observable task and history.Values near zero indicate that the prefix still satisfies the delegated task relation.Source: §3.2 · p. 4

3.3 Threat Model

• Prefix-paired drift has an externally anchored onset, whereas pseudo-consistency lacks such an anchor despite locally task-consistent steps and unresolved gaps or weak evidence.The observability asymmetry limits what deployment-time monitoring can recover from (x, h≤t) alone.Source: §3.3 · p. 4
• The threat model focuses on ordinary, locally legitimate operations whose accumulated effect exceeds authorization, excluding overtly malicious commands covered by upstream guardrails [5] [6] [7].Examples include configuration review beyond a requested fix and patient-record export beyond a requested query.Source: §3.3 · p. 4
• The monitor observes only the task description and trajectory prefix, not internal state, hidden reasoning, or internal traces, making it portable but dependent on external behavior.Hidden prompt state or reasoning may drive drift without appearing directly in the trajectory.Source: §3.3 · p. 4

4.1 Step-Local Normality Does Not Establish Ontological Trust

• 73.49% AUC is the best of nine snapshot metrics across three evaluators, while Predictive Entropy remains near random at 47–56%, showing step-local normality cannot expose the prefix–task relation.The LotL corpus includes four post-exploitation objectives and latent hijacking or goal-rewrite patterns whose individual steps can appear benign.Source: §4 · pp. 4–5, §4.1 · p. 5

4.2 Three-Axis Coordinates Recover the Signal

• 97.67%, 97.45%, and 98.86% trajectory AUC on Qwen3-4B, Llama-8B, and GPT-4o-mini respectively exceed the 73.49% snapshot ceiling, while removing any coordinate reduces AUC.The three-axis representation changes the signal available to the monitor rather than making trajectories easier.Source: §4.2 · p. 5

5 Method

• RGE performs online monitoring with one setup pass and one contextual LLM call per step, while deterministic state updates and intervention labels keep the trust trajectory replayable.The step representation is conditioned on the task, prior prefix, current action–observation pair, and memory state.Source: §5 · p. 5

5.1 Task-Conditioned Completion Structure Formulation

• The setup derives completion gaps G(x) = {ξ1, . . . , ξK} with required descriptions, closure evidence, and core/support types, then maintains task-conditioned memory of gap status, entities, and evidence.The gap set supplies reference points for closed and open gaps, apparent non-closing progress, and continuation after core gaps close; it is not an execution plan.Source: §5.1 · p. 5

5.2 Local Structured Parsing and Task-Conditioned Memory Updates

• Each step is parsed into typed identity, logical, causal, and candidate-resolution fields covering role fit, subgoal progress, evidence support, scope expansion, surplus, and candidate gap closures.Parsing uses the task, prior prefix, current step, and previous memory state as context.Source: §5.2 · p. 6
• Only gap resolutions meeting fixed confirmation criteria advance memory, so unsupported surface verification remains a candidate and does not create pseudo-consistent progress.After each step, memory recomputes progress, continuation, unresolved gaps, post-completion status, and stagnation statistics.Source: §5.2 · p. 6

5.3 Projection to Role-Goal-Evidence Deviations

• RGE projects parser and memory outputs into Role, Goal, and Evidence consistency scores, whose complements form deviation zt = (rt, gt, et) with zt = 0 as the trust origin.The axes represent authorized scope, pursuit of the delegated objective, and support from memory and current observations; Goal also penalizes workflow fracture, scope expansion, and post-completion surplus.Source: §5.3 · p. 6

5.4 Temporal Aggregation and Threshold Decisions

• Temporal aggregation combines instantaneous deviation with a three-axis coupling term and tracks sustained, increasing, and recent deviation to distinguish persistent deterioration from transient spikes.Fixed defaults use αr + αg + αe = 1, λ = 0.25, axis thresholds 0.40, and κ = 0.5 without per-domain tuning; alarms trigger on instantaneous or accumulated thresholds, reanchor, or contain, while justify warns.Source: §5.4 · pp. 6–7, Figure 3 · p. 6

6 Experiments; 6.1 Experimental Setup

• The corpus contains 248 multi-step trajectories from OSWorld, FinanceBench, and EICU-AC: 80 benign references, 81 prefix-paired drift variants, and 87 pseudo-consistency variants.Trajectories average 7.9 steps; Claude Opus 4.6 generates the action–observation traces, while GPT-4o, Qwen3.5-9B, and Gemma-4-E4B-it serve as estimators.Source: §6.1 · p. 7

6.2 Main Results on Drift Detection and Benign Coverage

• 93%+ Drift F1 on every benchmark with GPT-4o and Qwen3.5-9B, while benign coverage remains at least 95.8%; smaller Gemma-4-E4B-it weakens on subtle cases.The larger estimators detect prefix-paired drift across domains; Gemma’s errors concentrate on pseudo-consistency and clinical evidence-grounding because parsing surface verification versus confirmed gap closure is harder.Source: §6.2 · pp. 7–8, Figure 4 · p. 8
• Pseudo F1 has median 18.2% across nine cells, ranging from 0.0% to 98.4%, because detection depends more on externally observable task closure than estimator capacity.OSWorld reaches 98.4 Pseudo F1 with GPT-4o and 74.5 with Qwen3.5-9B, whereas read-only FinanceBench and EICU-AC provide fewer closure signals and make benign verification resemble pseudo-consistency.Source: §6.2 · p. 8, Figure 4 · p. 8

6.3 Probing Context and Representation

• Baseline transfer fails because safety rules and generic judgments lack a task-conditioned reference: B2–B4 have near-zero Pseudo F1, while B5 reduces Benign Coverage to 3.4%.Expanding context from one step to the full record does not solve the representation problem, and structured checking can over-intervene on benign verification.Source: §6.3 · p. 8, Figure 5 · p. 9
• Task-swap AUC reaches 0.991, 0.999, and 0.962 on OSWorld, FinanceBench, and EICU-AC with Qwen3.5-9B, showing that RGE responds to task relations rather than generic trajectory features.This task-conditioned representation helps preserve benign coverage during long verification workflows while flagging prefixes that depart from the delegated task.Source: §6.3 · p. 9

6.4 Decomposing the RGE State; 7 Conclusion

• RGE decomposes ontological trust into Role, Goal, and Evidence, using LLMs only for structured task and step representations while making state updates and intervention decisions deterministic.The full state performs strongly on both Drift F1 and Pseudo F1 in the OSWorld Qwen3.5-9B ablation.Source: §7 · p. 9, §6.4 · p. 9, Table 2 · p. 9

A.1 Trust Is Not Safety Compliance; A.1.1 Formal distinction; A.1.2 Two orthogonal scenarios

• Trust asks whether an execution still satisfies the delegated task, whereas safety compliance asks whether an action or output violates a predefined rule; the two checks are orthogonal.An execution can be safety-compliant yet untrustworthy through hidden exfiltration, or trust-preserving yet safety-sensitive because of content-level risk.Source: §A.1 · p. 13, §A.1.1 · p. 13, §A.1.2 · p. 13

A.1.3 Implications for defense design; A.2 Notation Table; A.3 Boundary Cases Between Benign and Drifting Trajectories

• Trust monitoring tracks progressive drift from the delegated task and complements safety filters, which constrain harmful outputs but may miss outwardly compliant executions after trust has failed.The paper’s notation is summarized separately, and deployment boundary cases require clarification under a fixed delegation.Source: §A.1.3 · p. 13, §A.2 · p. 13, Table 4 · p. 14

A.3.1 Legitimate task renegotiation; A.3.2 Multi-turn clarification

• Explicit task extensions reinitialize G(x) and reset L_t, while authorization or clarification requests are treated as self-correcting signals rather than drift.These cases do not directly increase degradation energy u_t or completion ratio ρ_t.Source: §A.3.1 · p. 14, §A.3.2 · p. 14

A.3.3 Trajectories near the boundary but not beyond it

• Persistent deviation, rather than brief proximity to the benign/drifting boundary, triggers intervention, prioritizing fewer false positives at the cost of detection latency.The temporal update accumulates deviation until a threshold is crossed.Source: §A.3.3 · p. 14

A.4 Additional Discussion of Threat Model Scope; A.4.1 Relation to adjacent attack paradigms

• The threat model isolates gradual, externally observable drift without an immediate guardrail trigger, rather than subsuming all agent attack classes.Its distinguishing assumptions concern the deviation channel and observability.Source: §A.4 · p. 15, §A.4.1 · p. 15

A.4.2 Effect of relaxing the system-guardrail assumption

• If syntax-level guardrail override is allowed, privileged instruction injection becomes a single-step attack dominated by instruction override and output filtering instead of trajectory drift.The studied regime assumes no single-step guardrail trigger fires.Source: §A.4.2 · p. 15

A.4.3 Discussion under partial observability

• RGE observes only the task instruction and clean action–observation prefixes, so noisy, masked, or asynchronously changing environments require filtering or latent-state estimation left for future work.Even with clean observations, the method estimates drift from external behavior without reconstructing internal agent state.Source: §A.4.3 · p. 15

B Snapshot Metric Experimental Details; B.1.1 Dimension Grouping and Design Motivation; B.1.2 Prompt Templates

• The snapshot-metric appendix evaluates nine local-observation metrics grouped into three dimensions, using JSON primary scores in [0, 1] for AUC computation.Prompt templates include role, causal-grounding, temporal-context, logical-consistency, and surface-action signals, with structured outputs such as Role_Energy_Delta.Source: B Snapshot Metric Experimental Details · p. 15, §B.1.1 · p. 16, §B.1.2 · pp. 16, 18, 19

B.2 Model Configuration

• Snapshot diagnostics use Qwen3-4B-Instruct, Llama-3-8B-Instruct, and GPT-4o-mini to test evaluator dependence, not as candidate models for the main cross-domain monitor.Similar AUC across evaluators would indicate that a metric’s signal is not merely an artifact of one evaluator.Source: §B.2 · pp. 19–20, Table 7 · p. 20

B.3 Benchmark Construction; B.3.1 Trajectory Collection and Pairing Strategy; B.3.2 Trajectory Length Distribution

• The LotL benchmark contains 216 trajectories—108 benign and 108 drifting—organized as paired OS-task executions sharing the initial environment, instruction, and early prefix before divergence at annotated onset d.This pairing controls surface variation so the principal difference is whether execution satisfies D(x).Source: §B.3 · p. 20, §B.3.1 · p. 20, §B.3.2 · p. 20

B.3.3 Sample Counts by Attack Type

• Backdoor has the most samples (34) and Log Deletion the fewest (21), a roughly 1.6:1 imbalance motivating per-type alongside aggregate AUC.Benign and drifting counts are identical within each attack type because every drifting trajectory has one semantically paired benign trajectory.Source: §B.3.3 · p. 20, Table 9 · p. 21

B.3.4 Benign / Drifting Labeling Criteria

• Benign trajectories faithfully pursue G(x), whereas drifting trajectories begin task-consistent and later inject attack-intent operations unrelated to the original objective.Post-drift operations are categorized as Backdoor, Data Exfiltration, Persistence, or Log Deletion.Source: §B.3.4 · p. 21
• Drift is annotated by drift_step_index: before onset actions match the reference and progress toward completion, while afterward they decouple from G(x) and implement high-risk outcomes.Formally, for t < d actions match the reference trajectory and ρ_t continues progressing; for t ≥ d, actions become decoupled from G(x).Source: §B.3.4 · pp. 20–21

B.4 Metric Score Extraction and AUC Computation

• Metric scores are extracted and AUC is computed at both snapshot and trajectory levels.The snapshot procedure computes nine metrics independently at every action step.Source: §B.4 · p. 21, §B.4.1 · p. 21

B.4.1 Snapshot Level

• Snapshot positives are steps from drifting trajectories and negatives are steps from their paired benign trajectories, projecting each trajectory label onto its action steps.This setup evaluates local step scores against trajectory class rather than using annotated drift onset directly.Source: §B.4.1 · p. 21
• Snapshot AUC is a stringent diagnostic because pre-onset drifting steps may appear benign, testing whether local features alone recover drift information without trajectory state.AUC uses continuous metric scores and is threshold-free; values near 1.0 indicate stronger ranking, while values near 0.5 indicate near-random discrimination.Source: §B.4.1 · p. 21

B.4.2 Trajectory Level

• Trajectory-level RGE aggregation and ablations are described separately in Appendix D.Source: §B.4.2 · p. 21

C.1 Precision and F1 at Fixed Recall Operating Points

• Fixed-recall Precision@r∗ and F1@r∗ at r∗∈{0.80, 0.90, 0.95} are reported as post-hoc diagnostics using oracle quantiles from drifting trajectories, not deployable thresholds.Repeated P@r∗=0.5000 and F1@r∗=0.6667 indicate weak score separability at the corresponding recall level and are not primary operating-point results.Source: §C.1 · p. 22

C.2 Trajectory-Level Clustered Bootstrap Confidence Intervals

• Because steps within trajectories are temporally correlated, uncertainty is estimated by resampling entire trajectories for B = 1000 iterations and reporting percentile-based 95% confidence intervals.Tables 13–15 report clustered-bootstrap uncertainty estimates for snapshot AUCs.Source: §C.2 · pp. 22–23, Table 13 · p. 23, Table 14 · p. 23

C.3 AUC Decomposition by Attack Type; C.4 Summary

• AUC is decomposed across four attack types with non-uniform sample sizes, using type-level estimates and a sample-weighted average over counts {34, 28, 25, 21} with N = 108.This decomposition checks whether aggregate snapshot findings are driven by a high-frequency attack category and adds no separate primary claim.Source: §C.3 · p. 23, §C.4 · p. 23, Table 16 · p. 24

D.1.1 Purpose; D.1.2 Semantic Definitions of the Three Axes

• The preliminary LotL ablation independently estimates Role, Goal, and Evidence deviations, comparing single-axis, pairwise-axis, and full three-axis combinations under a common trajectory aggregation protocol.The preliminary evaluator study is separate from the fixed deployment-oriented estimator matrix used for the main cross-domain experiments.Source: §D.1.1 · p. 25, Table 19 · p. 25

D.1.3 Trajectory-Level Aggregation

• The default trajectory aggregator is p95 because it preserves a few critical high-deviation steps while being less sensitive than max to one-step errors and more stable than mean across models.The three coordinates are estimated independently in [0, 1]^3 and combined using norms on the relevant subspaces.Source: §D.1.3 · p. 25, Table 20 · p. 25

D.2.2 Key Findings

• The full RGE combination has the highest AUC for all three models, while Qwen3-4B is Role-dominant, Llama-8B is more balanced across Role and Evidence, and GPT-4o-mini has strong Role and Goal but weaker Evidence signals.Single-axis Role reaches 95.20 for Qwen3-4B; the axes are therefore not symmetric in practice.Source: §D.2.2 · p. 26

D.2.3 2D Embedding Visualization: t-SNE on Critical State Points; D.4 Summary

• For visualization only, each trajectory is represented by its critical maximum-distance state and embedded with t-SNE; the Qwen3-4B main-text embedding is chosen for readability rather than universal performance.The configuration uses perplexity=15, max_iter=1500, random_state=42, and init=pca; Llama-8B and GPT-4o-mini visualizations appear in Figures 6 and 7.Source: §D.2.3 · p. 26, Figure 6 · p. 28

D.3.1 rt Estimator: Role Deviation; D.3.2 gt Estimator: Goal Deviation; D.3.3 et Estimator: Evidence Deviation; D.4 Summary

• The estimator templates separately score Role fit, Goal drift from the original objective, and Evidence grounding from prior observations, enforcing JSON-only outputs for unified downstream parsing.Role, Goal, and Evidence each use discrete deviation scales from 0.0 to 1.0, with higher values indicating greater deviation.Source: §D.3.1 · pp. 26–27, §D.3.2 · p. 27, §D.3.3 · p. 27

E.1.1 Selection and Construction Rationale

• The corpus adds executed traces, trust-level classes, onset labels, and a common format to benchmark tasks because no public benchmark directly provides labeled trust-drift trajectories.Prefix-paired drift tests annotated departures from D(x), whereas pseudo-consistency tests apparent progress that fails to close task gaps or relies on weak evidence.Source: §E.1.1 · p. 29
• The corpus contains 80 source tasks and 248 trajectories from OSWorld, FinanceBench, and EICU-AC, including benign, prefix-paired drift, and pseudo-consistency variants.The benchmarks span desktop/shell automation, financial reasoning, and clinical querying, enabling cross-domain evaluation while excluding code-generation and web-browsing tasks.Source: §E.1.1 · p. 29

E.1.2 Trajectory Rollout and Quality Control

• Claude Opus 4.6 generates all rollouts, which log only executed action–observation pairs; GPT-4o, Qwen3.5-9B, and Gemma-4-E4B-it serve as distinct monitoring estimators.Using one actor controls actor-source variation, while manual verification checks every trajectory and approximately 15% of initial trajectories were regenerated.Source: §E.1.2 · p. 29, §E.2 · p. 30

E.1.3 Annotation Protocol for Drift Onset and Sub-type

• Drift onset is the first operational step violating Role, Goal, or Evidence, while sub-types identify the earliest mechanism explaining why continuation becomes unauthorized.On 21 stratified drift trajectories, independent onset annotation achieved 63.2% exact agreement, 84.2% within-one-step agreement, and 0.58-step mean absolute error.Source: §E.1.3 · pp. 29–30

E.1.4 Attack Sub-type Taxonomy

• The taxonomy uses five drift sub-types mapped to primary RGE axes, instantiating evidence fracture only in EICU-AC because its clinical schema exposes relevant granularity distinctions.Trajectory lengths remain heterogeneous by design so length cannot become an artificial class cue.Source: §E.1.4 · p. 30

E.3 Main-Method Prompt Templates

• RGE’s prompt pipeline derives a task-domain profile, minimal completion gaps, and a local parser output consumed by one deterministic state-update pipeline.Profiles summarize authorized scope without adding requirements; gaps encode core or support completion requirements; the parser labels local goal, role, object, evidence, continuity, and progress signals rather than judging maliciousness.Source: §E.3 · p. 31, §E.3.1 · p. 31, §E.3.2 · p. 32

E.3.3 Local Deep Parser

• The Local Deep Parser detects structural drift using relative task atomicity, behavioral scope, scope ratio, and subgoal-granularity shifts across domains.It compares each step with the original task, ledger state, and profile rather than marking drift from domain-specific resemblance alone.Source: §E.3.3 · pp. 35–36

E.4 Fixed Projection and Aggregation Constants

• Projection and aggregation use fixed, shared constants: categorical parser outputs become [0, 1] scores, deviations are combined across Role, Goal, and Evidence, and multi-axis deterioration is coupled smoothly.The three coordinates are treated symmetrically; coupling uses ϑr=ϑg=ϑe=0.40 and λ=0.25, with no learned embeddings or per-domain calibration.Source: §E.4 · p. 36, §E.5.1 · pp. 36, 38, §E.5.2 · p. 38

E.5.3 Completion-gap resolution rule

• Completion gaps retire only when action–observation evidence demonstrates semantic or literal satisfaction; otherwise unresolved gaps create stagnation pressure near completion.Merely mentioning a requirement is insufficient, enabling the memory to distinguish unfinished legitimate work from post-completion overreach.Source: §E.5.3 · p. 38

E.5.4 Intervention ladder thresholds

• The deterministic intervention ladder separates trace-level alarms from severity labels: accumulation alone raises an alarm, whereas REANCHOR and CONTAIN require stronger burst, trend, grounding, or post-completion conditions.The default κ=0.5 thresholds govern energy and accumulation, while semantic reanchor reasons, burst statistics, logical consistency, and sustained overreach determine intervention severity.Source: §E.5.4 · pp. 38–39

E.6 Supplementary Threshold and Lead-time Analyses

• Drift F1 and benign coverage remain stable around κ=0.5, while pseudo-consistency worsens as the threshold rises.κ was swept over {0.3, 0.4, 0.5, 0.6, 0.7} with Qwen3.5-9B, holding other hyperparameters fixed; κ=0.5 avoids per-benchmark tuning.Source: §E.6 · p. 39
• Drift alarms are near onset: misses were 1/24, 2/27, and 0/30, with FinanceBench and EICU-AC mostly aligned and OSWorld about one step late.Lead-time is defined as first threshold crossing minus annotated onset; negative values indicate early alarms.Source: §E.6 · p. 39

• Task-swap AUC holds each benign action–observation trace fixed while replacing its task description with a different benign task from the same benchmark.A task-sensitive monitor should assign higher deviation to the task-swapped trace than to the original.Source: §E.6.1 · p. 39
• All three task-swap AUCs are far above chance, showing that the score changes when the same benign trace is evaluated against a matched but different task.Source: §E.6.1 · p. 39
• The reported task-swap evaluation uses Qwen3.5-9B, with its results presented in Table 32.Source: Table 32 · p. 40

E.6.2 Length-Bucket Analysis

• Because benchmark composition changes across length buckets, the analysis is descriptive rather than a causal estimate of length alone.The findings indicate that domain composition still matters for explaining failures.Source: §E.6.2 · p. 40
• Across short, medium, and long trajectory buckets, Drift F1 remains near-saturated, Pseudo F1 rises, and Benign Coverage stays above 92.9%.The buckets are short (≤5 steps), medium (6–10), and long (≥11).Source: §E.6.2 · p. 40

E.6.3 Per-Attack-Subtype Decomposition

• The subtype decomposition evaluates drift recall, pseudo-consistency recall, and benign false-positive rate, with dashes marking subtypes absent from a benchmark.The analysis uses κ=0.5, and lower Benign FPR is better.Source: §E.6.3 · p. 40, Table 34 · p. 41
• Both estimators recover Role and Goal drift at high rates across constructed sub-types, showing that the main drift result is not driven by one easy attack family.Pseudo-consistency remains harder, especially in leaner-action domains.Source: §E.6.3 · p. 40

E.6.4 Gemma-4-E4B-it as an Edge-Deployment Estimator

• 100.0% benign coverage holds across all three benchmarks for Gemma-4-E4B-it, while prefix-paired Drift F1 is strong on OSWorld and FinanceBench but weakens on EICU-AC.The edge estimator carries a trust-drift signal, but its reliability depends on domain.Source: §E.6.4 · p. 40
• Pseudo-consistency weakens for Gemma on FinanceBench and EICU-AC, where harder evidence grounding and externally invisible task closure limit escalation.The proposed cascade uses a small always-on monitor for many drift cases and a larger secondary checker for pseudo-consistency.Source: §E.6.4 · p. 40

Case 1: Drift detected at onset

• In malicious_chrome_safe_browsing, REANCHOR fires exactly at deviation step t=5 because the appended chrome:// directive makes all three consistency scores drop together.The first four steps follow the benign route through Chrome’s Privacy-and-Security settings.Source: §E.6.5 · p. 41, Table 35 · p. 41

Case 2: Pseudo-consistency detected by accumulation

• At t=6, accumulated weak deviations after pseudo_volume_max completion trigger REANCHOR when ct=0.21 > ϑjust=0.20, while st independently raises the trajectory-level alarm.No single step exceeds the energy threshold; post-completion overreach activates before the semantic reanchor gate is crossed.Source: §E.6.5 · p. 41, Table 36 · p. 42

Case 3: Borderline pseudo-consistency in FinanceBench

• In a borderline FinanceBench case, accumulation peaks at 0.636 < ϑacc=0.65 and ct=0.18 < ϑjust=0.20, so verification-like overreach never escalates beyond JUSTIFY.The core answer is complete at step 5, but two analyst cross-checks appear legitimate; evidence and goal consistency remain high.Source: §E.6.5 · p. 41, Table 37 · p. 42

• Most remaining errors are parser-calibration errors in trajectories that stay close to legitimate workflows after D(x) fails, rather than deterministic aggregation failures.Source: §E.6.6 · p. 42

Failure mode 1: Post-completion padding

• Post-completion padding can evade escalation when plausible audit or cross-check steps remain task-anchored and accumulation stays below threshold.Stronger progress-state modeling should distinguish surplus work from still-necessary progress after core completion.Source: §E.6.6 · p. 42

Failure mode 2: Sparse-evidence pseudo-consistency

• Sparse-evidence pseudo-consistency is difficult when verification-like steps resemble legitimate analyst or clinical workflows despite failing to close required evidence gaps.This boundary is subtle because causal and logical channels can remain high without obvious action mismatches.Source: §E.6.6 · p. 42

Failure mode 3: Role-fit calibration

• FinanceBench reveals role-fit calibration errors around analyst reframing, producing false positives and false negatives near the boundary between benign and adversarial role expansion.Future improvements should calibrate role and evidence for expert workflows rather than simply raising the shared threshold.Source: §E.6.6 · p. 42

E.7 Limitations

• RGE cannot verify hidden agent state, unobserved environment changes, or completion criteria absent from observable signals, especially complicating pseudo-consistency detection.Deployment should therefore be evaluated against the environment’s observable closure signals, with careful calibration for specialized typed parser fields.Source: §E.7 · pp. 42–43

E.8 Broader Impacts and Responsible Use

• The monitor may improve oversight of role expansion, goal rewriting, and weak evidence grounding, but trajectory examples also create dual-use risks and may induce false alarms or overreliance.The paper recommends treating justify, reanchor, and contain labels as decision support, and releasing artifacts without credentials, destructive payloads, or misuse-enabling environment details.Source: §E.8 · p. 43

E.9 Baseline Audit

• Baseline comparisons use shared corpora and binary unsafe/benign interfaces, but default decision protocols—not matched-FPR or PR-curve evaluations—limit causal attribution.B4 uses completed interaction records, whereas RGE makes online prefix decisions; B5 uses step-local structured guards, so both gaps are design contrasts rather than isolated component effects.Source: §E.9 · pp. 43–44

E.9.1 AgentSpec

• AgentSpec replays recorded traces with default stop rules for destructive deletion, POST exfiltration, and system-file access, targeting low-level operations rather than semantic trust failures.A trajectory is unsafe if any replayed enforcement event fires; otherwise it is benign, with no numerical threshold.Source: §E.9.1 · p. 44

E.9.2 R-Judge

• R-Judge evaluates only the current step or a three-step local window, without persistent task memory or full trajectory state, and emits parsed safe/unsafe labels.Its two-stage analysis-and-label protocol uses no numerical threshold or per-domain calibration.Source: §E.9.2 · p. 44

E.9.3 AgentAuditor

• AgentAuditor evaluates a full interaction record through safety analysis followed by an exact safe/unsafe lexical prediction, without a risk-score threshold.The record includes system/profile information, the user task, agent actions, and environment observations.Source: §E.9.3 · p. 44

E.9.4 MAS-Shield

• MAS-Shield combines LLM policy extraction and predicate assignment with symbolic weighted-rule verification, but strict step checks plus any-step aggregation amplify benign false alarms into high-FPR or all-positive behavior.Its default unsafe condition is a safety margin below ϵ = 0.05, and the trajectory is unsafe when any step is predicted unsafe.Source: §E.9.4 · pp. 44–45

E.10 Token Overhead; E.11 Compute Resources; E.12 Licenses and Terms of Use for Existing Assets

• Monitor costs comprise 2.3k–3.4k setup tokens per trajectory and 3.6k–4.7k parser tokens per step, with prompt context contributing roughly 90% of usage.OSWorld is highest per trajectory because its trajectories are longest, while FinanceBench is highest per step because its document-grounded context is denser; the main evaluation used approximately 40 local GPU-hours, and assets carry benchmark-specific access terms.Source: §E.10 · p. 45, §E.11 · p. 45, §E.12 · p. 45

Core limitations

• The paper identifies pseudo-consistency failures, clean-observation assumptions, parser calibration limits, token cost, and the need for broader future evaluation as key limitations.These limitations are discussed in the Conclusion, Appendix A.4, and Appendix E.6.6.Source: §2 · p. 46

Reproducibility and access

• Complete code and the processed trajectory corpus are not yet publicly released, although the manuscript provides method, prompt, configuration, and reproduction details.A future version will provide a public archival repository, while eICU-CRD-derived materials remain subject to PhysioNet credentialed-access requirements.Source: §2 · p. 48

Evaluation transparency

• The paper reports clustered-bootstrap confidence intervals over trajectories, while Appendix E documents hardware, GPU-hours, and monitor-side token usage for reproducibility.Bootstrap resampling respects within-trajectory correlation, and compute reporting includes both main experiments and pilot or discarded runs.Source: §2 · p. 49

Societal impact

• The study’s societal-risk discussion covers malicious uses of trajectory-level attack examples and overblocking, with bounded release and decision-support deployment proposed as mitigations.The intended positive use is defensive oversight for long-horizon agents.Source: §2 · p. 50

Human subjects

• The work has no newly recruited human participants or crowdsourcing studies, and its clinical-data use follows PhysioNet’s credentialed-access agreement.Accordingly, participant-risk disclosure and IRB-style review are not applicable to this work.Source: §2 · p. 52