PaperlayerView exact revision on arXiv

Source-linked AI summary

Agent-Warden: eBPF-Based Kernel-Native Process-File Provenance Tracking for LLM Agents

Dongxu Cui, Zhichao Gu, Ping Zheng, Simeng Han, Yong Liao

arXiv:2609.38245v1cs.CRcs.OS

TL;DR

Application-layer traces may omit operating-system activity from dynamically generated scripts, native calls, and asynchronous child processes. Agent-Warden tracks process–file provenance in the kernel using dual state backends and conservative exit-triggered aggregation. In the evaluated scenario, it reconstructed a causal chain absent from the application trace, with measured overheads on x86-64 and ARM64 hosts.

  • Problem

    Application-layer traces may omit OS activity from dynamically created scripts, native system calls, and asynchronous child processes, motivating kernel-level process–file observability.

    Source: §I · p. 1

  • Method

    Agent-Warden uses an eBPF kernel-native provenance framework with process and file transition rules, dual state backends, and conservative exit-triggered causal aggregation.

    Source: §I · pp. 1–2, B. Causal Flow Transition Model Based… · p. 4

  • Results

    0.2–3.5% end-to-end overhead and 0.6–3.7% additional system CPU time accompanied reconstruction of the expected causal chain in the evaluated scenario.

    Source: §VII · p. 9

  • Takeaways & Limitations

    The functional and performance results support the feasibility of kernel-level process–file provenance tracking for LLM agents within the evaluated workloads.

    Source: §VI · p. 8, §VII · p. 9

    The current model primarily covers macrolevel process lifecycles and standard file I/O, not asynchronous io_uring, memory-mapped I/O, or timing-based covert channels.

    Source: §VI · p. 8

Abstract

from arXiv · show

LLM agents execute dynamically generated process and file operations that are often invisible to application-layer tracing. We present Agent-Warden, an extended Berkeley Packet Filter (eBPF)-based provenance monitor for tracking task and regular-file states across process creation, file access, and process termination. Agent-Warden provides two interchangeable state backends: a PID-keyed hash-map backend for compatible kernels lacking BPF local-storage support and a task/inode-local-storage backend that couples state reclamation to kernel-object lifetimes. The system emits incremental causal edges to user space for asynchronous graph reconstruction and applies conservative exit-triggered causal aggregation to preserve causal context for short-lived proxy tasks. In a controlled file-mediated propagation scenario, Agent-Warden reconstructed a cross-process causal chain that was absent from the application-layer trace. On x86-64 and ARM64 bare-metal hosts, the evaluated workloads showed 0.2-3.5% end-to-end overhead and 0.6-3.7% additional system CPU time. These results indicate that the prototype provides kernel-level visibility with the measured overheads in the evaluated settings.

I. INTRODUCTION

Application-layer traces may omit operating-system activity from dynamically generated scripts, native calls, and asynchronous child processes. Agent-Warden introduces kernel-native process–file provenance tracking with two state backends and conservative exit-triggered aggregation.

I. INTRODUCTION

  • Application-layer traces can miss OS activity from dynamically created scripts, native system calls, and asynchronous child processes.The instrumentation boundary motivates an independent kernel-level substrate for reconstructing process–file causality.Source: §I · p. 1
  • Agent-Warden combines PID-keyed hash-map and task/inode-local-storage backends for compatibility and kernel-object-coupled state management.The local-storage backend avoids repeated PID-keyed global-map lookups on the common path and delegates cleanup to kernel-object lifetimes.Source: §I · pp. 1–2
  • Its four-rule state-transition model covers process derivation and file interactions, with exit-triggered aggregation preserving context for short-lived proxy tasks.The aggregation conservatively associates a parent with a terminating child’s final provenance-influence state without claiming byte-level data flow.Source: §I · pp. 1–2
  • The prototype is evaluated on x86-64 and ARM64 bare-metal systems under cross-temporal file-mediated propagation and bursty workloads.The introduction identifies runtime overhead evaluation of both state backends as part of the study.Source: §I · p. 2

II. BACKGROUND AND RELATED WORK

The background describes eBPF monitoring mechanisms and the limits of application-layer traces, then situates Agent-Warden alongside system-provenance and agent-observability work. Its distinction is explicit process–file propagation semantics and kernel-state-lifetime design, rather than eBPF use alone.

A. eBPF Execution and Security Model

  • eBPF programs run at supported kernel hooks after verifier checks, while maps, local storage, and ring buffers support persistent state and asynchronous event delivery.The assumed trusted components include the kernel, eBPF verifier and runtime, and privileged loader.Source: A. eBPF Execution and Security Model · p. 2

B. LLM Agent Security and Application-Layer Observability

  • Application-layer traces observe events exposed by participating components, so generated scripts, native binaries, and uninstrumented child processes may be absent.Kernel-level observation provides a complementary source of process and file events beyond that instrumentation boundary.Source: B. LLM Agent Security and… · p. 2

C. System-Level Provenance Tracking and Bottlenecks of Traditional Auditing

  • Traditional audit-based provenance faces context-switching and kernel-to-user transfer overhead, while buffering and graph partitioning address event loss and online-analysis costs.Capture and analysis costs remain considerations for low-latency monitoring.Source: C. System-Level Provenance Tracking… · p. 2

D. eBPF-Based Agent Observability and Comparison with AgentSight

  • AgentSight bridges LLM intent and system effects, whereas Agent-Warden tracks process–file paths through persistent files and outside the originating process tree.The comparison identifies explicit propagation semantics and kernel-state-lifetime design—not eBPF itself—as Agent-Warden’s contribution.Source: D. eBPF-Based Agent Observability and… · pp. 2–3, Table I · p. 3

III. SYSTEM MODEL

The system model concerns LLM-agent execution on trusted Linux hosts and targets process-lifecycle and regular-file interactions within a defined monitoring scope. It frames application-layer observability blind spots around short-lived processes and detached child workflows.

A. System Assumptions and Scenarios

  • The system model targets agent execution on x86-64 and ARM64 physical hosts and monitors process-lifecycle and regular-file interactions within its defined scope.The model assumes a trusted Linux kernel and hardware, with no kernel-level privileges already gained by the adversary or compromised agent.Source: A. System Assumptions and Scenarios · p. 3, §III · p. 3

B. Threat Model and Observability Blind Spots

  • Application-layer logs can miss low-level execution, including temporary scripts that complete and exit before monitoring components poll or read their state.The threat model also includes malicious system calls arising from prompt injection, hallucinations, or unintended framework behavior.Source: B. Threat Model and Observability… · p. 3, A. System Assumptions and Scenarios · p. 3
  • A detached child process can continue covert work after an intermediate proxy exits, severing the application-layer context needed to trace backward.The stated observability goals are fine-grained lineage, causal alignment across asynchronous execution, and scope-bounded capture of process and regular-file events.Source: B. Threat Model and Observability… · p. 3

IV. METHODOLOGY

Agent-Warden maintains provenance through either PID-keyed hash maps or task/inode-local storage, and models process and regular-file events as deterministic propagation rules over a provenance graph. The model includes conservative exit-time aggregation to retain causal context without asserting byte-level data flow.

A. Dual-Backend Adaptive Observability Architecture

  • Warden-Hash provides state on kernels without BPF local storage, while Warden-Local couples task and inode provenance state to kernel-object lifetimes.The local-storage approach shares a canonical marker across threads in a TGID and lets the kernel reclaim task-associated state when the task object ends.Source: A. Dual-Backend Adaptive Observability… · pp. 3–4

B. Causal Flow Transition Model Based on Boolean Matrix Algebra

  • The model propagates provenance across process derivation, process-to-file writes, file-to-process reads, and child-exit aggregation.Successful rename operations produce a namespace edge while preserving the inode marker, rather than creating a content-flow transition.Source: B. Causal Flow Transition Model Based… · p. 4
  • The Boolean transition model represents processes and files as graph entities and marks entities conservatively associated with the monitored agent lineage.That association can result from observed data transfer or exit-time aggregation, so it does not necessarily imply byte-level dependence.Source: B. Causal Flow Transition Model Based… · pp. 4–5
  • Each atomic event is mapped to a directed causal edge, with read edges oriented from file to process and write edges from process to file.Rename is omitted from the influence-state transition because it emits a namespace-change edge without modifying that state.Source: B. Causal Flow Transition Model Based… · p. 5
  • The state transition initializes designated agent roots as marked and then updates the global provenance state through Boolean matrix multiplication and element-wise OR.The model formalizes the propagation semantics for the events considered in the work.Source: B. Causal Flow Transition Model Based… · p. 5

C. Architectural Implementation and Asynchronous Reconstruction

Agent-Warden formalizes causal semantics without requiring dense matrix computation: each observed kernel event becomes a targeted state update, while causal edges are reconstructed asynchronously in user space.

C. Architectural Implementation and Asynchronous Reconstruction

  • Each observed kernel event reduces to an expected constant-time state update on its source and destination entities rather than a high-dimensional matrix computation.The equations specify causal semantics; they do not mandate dense matrix operations.Source: C. Architectural Implementation and… · p. 5
  • For each relevant successful event, Agent-Warden asynchronously emits an incremental causal edge to user space through an eBPF ring buffer.This separates graph reconstruction from the system-call path and avoids synchronous user-space I/O during event processing.Source: C. Architectural Implementation and… · p. 5

D. Architectural Sources of Runtime Overhead

Agent-Warden’s runtime work spans synchronous kernel event handling and asynchronous user-space reconstruction, with state reclamation differing between its backends.

D. Architectural Sources of Runtime Overhead

  • The runtime breakdown includes hook dispatch and execution, event qualification, provenance-state access and update, ring-buffer submission, and asynchronous graph reconstruction.User-space reconstruction is asynchronous relative to the triggering system call but still contributes to aggregate system CPU consumption.Source: D. Architectural Sources of Runtime… · p. 5, Table II · p. 5
  • Warden-Hash explicitly maintains map state, whereas Warden-Local delegates local-storage reclamation to the lifetimes of associated kernel objects.The architectural breakdown identifies relevant cost centers, while the evaluation reports aggregate end-to-end and system CPU measurements rather than a static instruction count.Source: D. Architectural Sources of Runtime… · p. 5

V. EXPERIMENT

The experiments test whether Agent-Warden reconstructs file-mediated causal chains beyond application instrumentation and measure runtime overhead across two state backends. The evaluation uses bare-metal x86-64 and ARM64 systems and compares trace visibility with Langfuse under the same workload.

V. EXPERIMENT

  • The evaluation asks whether Agent-Warden reconstructs a file-mediated causal chain beyond application instrumentation and measures runtime overhead and cross-architecture behavior of both backends.Langfuse serves as the application-layer visibility baseline for the causal-structure comparison; backend overheads are compared with uninstrumented execution.Source: §V · p. 5

A. Experimental Setup and Workloads

  • The evaluation uses bare-metal x86-64 and ARM64 hosts to exclude virtualization interference.Both run Ubuntu 24.04 LTS with Linux kernel 6.8, which supports BTF and task-local storage; the common kernel version standardizes the backend comparison.Source: A. Experimental Setup and Workloads · pp. 5–6
  • Langfuse and Agent-Warden are compared for visible causal structures, not runtime overhead, because their event scopes differ.Application traces do not automatically cover arbitrary child processes, generated scripts, native binaries, or file-mediated context transfer to an independent process.Source: A. Experimental Setup and Workloads · p. 6
  • Warden-Hash and Warden-Local are measured against uninstrumented execution under identical workloads for runtime overhead.The study does not quantitatively compare Agent-Warden with generic eBPF monitors because their event scopes and security models differ.Source: A. Experimental Setup and Workloads · p. 6

B. Causal Tracking Effectiveness and Cross-Boundary Provenance

In the controlled file-mediated workload, Agent-Warden reconstructed the expected causal chain across processes, a renamed file, and a later independent read. It also retained the inode-associated provenance marker across a delayed read and reproduced expected behaviors across repeated runs on both platforms.

B. Causal Tracking Effectiveness and Cross-Boundary Provenance

  • Agent-Warden reconstructed the expected cross-boundary causal chain, including process derivation, file propagation, rename, independent read, and exit-triggered aggregation.The rename preserves the inode-associated marker; it does not add a content-flow transition.Source: B. Causal Tracking Effectiveness and… · pp. 6–7, Figure 2 · p. 6
  • Both backends reproduced all expected propagation behaviors in 30 of 30 runs on each platform.The checks covered process-to-file and file-to-process propagation, rename-edge recording, exit-triggered aggregation, and full-chain reconstruction.Source: B. Causal Tracking Effectiveness and… · p. 7, Table IV · p. 7
  • A delayed independent read remained associated with the earlier agent-generated file state after the original application-layer context had terminated.The association persisted within the lifetime of the corresponding in-memory inode object.Source: B. Causal Tracking Effectiveness and… · p. 7

C. Stress Testing under Bursty Workloads

Across the evaluated bursty workloads, Agent-Warden incurred low measured end-to-end and additional system CPU overhead. The measurements aggregate multiple cost centers, and the backends have comparable end-to-end overhead within the evaluated workloads.

C. Stress Testing under Bursty Workloads

  • 0.2–3.5% end-to-end overhead and 0.6–3.7% additional system CPU time were measured across the evaluated workloads.Table V reports means and standard deviations relative to the baseline system across both platforms over 90 measurement rounds.Source: Table V · p. 7, C. Stress Testing under Bursty Workloads · p. 7
  • The larger relative variance on x86-64 may partly reflect its shorter baseline latency: 1.57 s versus 8.30 s on ARM64.A similar absolute timing fluctuation can produce a larger percentage change against a shorter baseline.Source: C. Stress Testing under Bursty Workloads · p. 7
  • The backends have comparable end-to-end overhead within the evaluated workloads, but Warden-Local does not have lower aggregate CPU consumption for every workload.Warden-Hash uses explicit state maintenance; Warden-Local uses task/inode-local-storage helpers and kernel-object-coupled reclamation.Source: C. Stress Testing under Bursty Workloads · p. 8

VI. DISCUSSION

Both backends reproduced the expected process–file propagation behavior in the evaluated workloads, while Agent-Warden’s observability and causal precision remain bounded. The discussion distinguishes its process–file focus from AgentSight and identifies limits in event coverage, causal attribution, and state persistence.

Interpretation of Experimental Results

  • Both Agent-Warden backends reproduced the expected four-rule process and file propagation behavior within the evaluated workloads.The evaluation compares runtime overhead against the uninstrumented system under identical workloads; Langfuse serves only as an application-layer visibility reference.Source: §VI · p. 8

Comparative Analysis with Existing Work

  • AgentSight correlates LLM communications with system effects, whereas Agent-Warden tracks explicit process–file propagation; the systems are complementary, not interchangeable.Agent-Warden does not infer high-level intent and includes continuation through persistent files to later readers.Source: §VI · p. 8

Limitations

  • The current model primarily captures macrolevel process lifecycles and standard file I/O, leaving asynchronous io_uring, memory-mapped I/O, and timing-based side channels invisible.Extending observability to these granular events is future work.Source: §VI · p. 8
  • System-call-level flow lacks application-prompt context, and conservative exit aggregation can over-approximate causality when a parent does not consume a proxy child’s output.Process reparenting can also cause aggregation to refer to a subreaper rather than the original spawning process.Source: §VI · p. 8
  • Inode-local labels follow in-memory inode lifetimes, so they are not persistent across inode-cache reclamation or system reboots.Extended attributes or an external store are proposed as alternatives, with additional metadata-management and persistence overhead.Source: §VI · p. 8

Future Work

  • Future work proposes correlating kernel provenance with application logs, expanding event coverage and enforcement, and separately profiling hooks, state helpers, ring-buffer delivery, and reconstruction.The current evaluation reports aggregate end-to-end latency and system CPU consumption, not individual cost-center contributions.Source: §VI · pp. 8–9

VII. CONCLUSION

Agent-Warden targets observability gaps in LLM-agent process and file interactions with a four-rule kernel-level provenance model and conservative exit-triggered aggregation. Across the evaluated x86-64 and ARM64 bare-metal workloads, it reconstructed the expected causal chain with measured overheads, supporting feasibility within that scope.

Conclusion

  • The four-rule state-transition model captures process creation, file interactions, and asynchronous execution paths, while exit-triggered aggregation preserves conservative context for short-lived children.Aggregation extends causal context beyond the application-layer trace boundary.Source: §VII · p. 9
  • 0.2–3.5% end-to-end overhead and 0.6–3.7% additional system CPU time were measured as Agent-Warden reconstructed the expected causal chain on x86-64 and ARM64 bare-metal platforms.The authors frame these functional and performance results as supporting feasibility within the evaluated workloads.Source: §VII · p. 9
  • Warden-Hash supports compatible kernels lacking BPF local-storage features, while Warden-Local couples provenance state to task and inode lifetimes.Warden-Local also reduces reliance on PID-keyed global maps.Source: §VII · p. 9
Loading 2609.38245v1…