PaperlayerView exact revision on arXiv

Source-linked AI summary

Intrusion Detection for Agentic Processes: Evidence-Based Runtime Monitoring

Arslan Brömme

arXiv:2610.00151v1cs.CR

TL;DR

Agentic-process security deviations can arise across sequences of interactions, making it important to assess the evolving process against evidence-supported expectations. A-IDS proposes a governed, evidence-aware runtime interpretation layer; its contribution is conceptual and does not establish empirical detection performance.

  • Problem

    Agentic-process deviations can emerge across plausible event sequences, while conventional monitoring asks whether hosts or flows are anomalous rather than whether process state matches expectations.

    Source: §1 · p. 1

  • Method

    A-IDS compares evidence-supported observations with dynamically due governed expectations, separating visibility, event matching, unresolved states, and bounded findings.

    Source: §1 · p. 1, §3.1 · p. 2

  • Results

    A-IDS's conceptual design defines bounded, auditable findings that link governed expectations to observations while keeping evidentiary status distinct from operational impact.

    Source: §7 · p. 7

  • Takeaways & Limitations

    Runtime escalation can remain bounded by evidence, avoiding claims that an unobserved event did not occur or that source association proves causal prompt-injection control.

    Source: §5 · p. 6, §7 · p. 7

    The conceptual design has no empirical validation, and potential false positives and false negatives include specification gaps, incomplete visibility, observer compromise, and evasion.

    Source: §6 · p. 6, §6.1 · pp. 6–7

Abstract

from arXiv · show

Agent deployments increasingly combine language-model inference with retrieval, delegation, tool execution, external-system access, and human approval. Security-relevant deviations can therefore emerge across an evolving process rather than in one isolated input or action. Building on the author's earlier black-box architecture for agentic processes and the subsequent evidence-claim model, this paper proposes an Agentic-Process Intrusion Detection System (A-IDS), an evidence-aware security interpretation layer for runtime intrusion detection whose monitored object is the agentic process itself. A-IDS compares evidence-supported observations with a governed and versioned expectation baseline for workflow state, authorization, communication, and mandatory events. Its conceptual contribution combines dynamically due governed expectations, visibility separated from three-valued matching, explicit unresolved observation states, and bounded findings that separate evidentiary status from operational impact. The model further identifies the monitoring plane itself as an attack surface when adversarial content reaches semantic evidence producers through otherwise legitimate observation paths. Some observations may be produced outside the operational agent's self-report path, but the model does not assume complete observability or universally trustworthy capture. Prompt injection is treated both as an input-security problem and as a possible origin of later process deviations and cross-agent influence paths. A-IDS does not infer malicious intent from anomalous behavior, does not treat an unobserved event as proof of non-occurrence, and does not claim a new anomaly detector, temporal logic, or provenance model. The contribution is conceptual: it does not validate an implementation, demonstrate empirical detection performance, establish causal attribution, or provide an enforcement mechanism.

Arslan Brömme CISSP, CISM, CISA, CAISE

The document is a versioned work in progress, and comments are welcome.

1 Introduction

Agentic processes combine actors, tools, and changing governance, so security deviations can emerge across sequences of plausible events. The paper asks how to detect such deviations at runtime from evidence without treating anomalies as proof of malicious intent, and proposes A-IDS as an evidence-aware interpretation layer.

1 Introduction

  • Security deviations may emerge across otherwise plausible events, such as untrusted-content exposure, altered communication, an omitted approval observation, and privileged tool use.Source: §1 · p. 1
  • A-IDS asks whether an evolving process is consistent with expected secure state, beyond whether a host or flow is anomalous.Source: §1 · p. 1
  • The research question is how to detect process deviations at runtime from evidence without treating anomalous behavior as proof of malicious intent.Source: §1 · p. 1
  • A-IDS evaluates dynamically due governed expectations, separates visibility from matching, represents unresolved evidence, and emits bounded findings separating evidentiary status from impact.Source: §1 · p. 1
  • The design identifies adversarial observation content reaching semantic evidence producers as a monitoring-plane attack surface requiring isolation and trust boundaries.Source: §1 · p. 1
  • A policy deviation or finding does not by itself establish an intrusion, attack, compromise, intent, causality, or legal non-compliance.Source: §1 · p. 2

2 Background and Related Work

A-IDS builds on established monitoring, conformance-checking, and agent-security work while distinguishing its focus on bounded evidence and governed expectations.

2 Background and Related Work

  • A-IDS is closest to specification- and state-aware monitoring, but its governed expectations and visibility model target agentic processes rather than network-protocol state.Signature, anomaly, graph, and content detectors may supply upstream evidence without becoming A-IDS's novel core.Source: §2 · p. 2
  • Process mining, conformance checking, runtime verification, and provenance standards provide foundations, while A-IDS focuses on security interpretation under bounded visibility and governed expectations.Source: §2 · p. 2
  • Related agent-security systems analyze execution graphs, behavioral specifications, runtime compliance, or untrusted-source-to-sink flows, whereas A-IDS centers on evidence-bounded security findings.NeuroTaint is relevant as a post-hoc or nearline evidence producer, not a synchronous pre-action detector.Source: §2 · p. 2
  • Threat taxonomies and governance frameworks motivate coverage but do not define A-IDS evidence semantics; AgentDojo and InjecAgent are candidates for later prompt-injection validation.Those environments alone do not evaluate broader A-IDS dimensions such as authorization, visibility, or evidence-path monitoring.Source: §2 · p. 2

3 A-IDS Model

A-IDS evaluates observable process events against governed expectations, while keeping source trust, visibility, matching, and finding impact distinct. Its states and bounded findings preserve unresolved evidence rather than inferring malicious intent or non-occurrence.

3.1 Observations, Trust, and Threat Model

  • Observations bind events to actors, objects, time or sequence, policy version, source, and evidence references; capture integrity and source health do not establish semantic truth.The threat model assumes an attacker does not control every relevant observation source and the authoritative expectation path.Source: §3.1 · pp. 2–3

3.2 Governed Expectations and Matching

  • Expectations are governed, versioned obligations or allowed relations, matched only when due; visibility is assessed separately from true, false, or unresolved matching.A due expectation becomes Unobserved only when no true match exists and visibility is Sufficient; unresolved visibility or matching yields Unknown.Source: §3.2 · p. 3

3.3 Detection Taxonomy

  • Deviation classes can overlap across domain, evidence state, and operational impact, which remain distinct rather than implying that an agent was compromised.Authorization is evaluated against explicit authority relations; technical success alone does not establish authorization.Source: §3.3 · p. 4

3.4 Auditable Finding Structure

  • Findings link expectations to observations and preserve evidentiary basis separately from operational impact, with assumptions and limitations retained.Evidence status is not a probability that an agent is compromised; downstream queues may prioritize findings by impact while displaying evidence status separately.Source: §3.4 · p. 4

4 A-IDS Architecture and Pluggable Evidence Producers

A-IDS combines governed expectation matching with bounded evidence producers and findings, complementing existing monitoring systems. Its deployment separates monitored-process control from the monitoring plane while recognizing that permitted observation paths can still carry adversarial content.

4 A-IDS Architecture and Pluggable Evidence Producers

  • The expectation-and-evidence finding layer is A-IDS’s core; signature, anomaly, content, graph, and information-flow detectors are optional upstream evidence producers.Their outputs enter as bounded claims with their own assumptions, while evidence-path monitoring checks for gaps, conflicts, or bypass indicators.Source: §4 · p. 4

4.1 Deployment and Monitoring-Plane Isolation

  • The monitored process should not control the monitor’s baseline, configuration, credentials, evidence store, or execution state; A-IDS can complement and forward findings to existing systems.Read-only or one-way observation reduces direct control-plane manipulation but does not make monitoring immune to adversarial input.Source: §4.1 · p. 5

4.2 Monitoring-Plane Attacks and Layered Defense

  • Authorized, process-conformant actions can carry instructions targeting semantic analyzers, so one-way observation does not remove the monitoring-plane attack surface.Isolating an LLM-based analyzer as a bounded evidence producer limits, but does not eliminate, prompt-injection risk.Source: §4.2 · p. 5

4.3 Distributed Correlation and Source Separation

  • Conflicting self-reports, gateway records, and external receipts can support Observed status plus a separate Evidence Conflict finding when governed source-resolution rules allow it.Without such a rule, the affected expectation remains Unknown; corroboration is strongest across meaningful trust boundaries and distinct failure modes.Source: §4.3 · p. 6

5 Prompt Injection and Influence Paths

Prompt injection is treated both as an input-security condition and as a possible origin of later process deviations. A-IDS can associate a deviation with a source only when evidence supports a traceable path, without claiming that the source caused the action.

5 Prompt Injection and Influence Paths

  • Prompt injection matters as a detectable input condition and as a possible origin of later deviations, including cross-agent influence paths.The expected sequence includes external content, policy check, risk assessment, human approval, privileged tool call, and verification.Source: §5 · p. 6
  • A suspected approval-bypass instruction can be Observed alongside later tool use, while missing required approval with sufficient visibility is Unobserved and an ordering breach is Violated.These states do not prove that the document caused the action, that no off-system approval existed, or that an agent acted maliciously.Source: §5 · p. 6
  • An origin hypothesis requires an identifiable untrusted source, evidence of exposure or propagation, and a temporally compatible path to the deviation.Semantic similarity alone is insufficient; source-associated denotes an evidentiary relationship, not established causation or proof of agent control.Source: §5 · p. 6

6 Detection, Auditability, and Evaluation

This section separates runtime findings from incident and audit conclusions, then describes how findings should be recorded and how the conceptual model could be evaluated. It also identifies error sources and operational constraints.

6 Detection, Auditability, and Evaluation

  • Runtime detection asks whether a process deviates, whereas incident analysis reconstructs events and audit evaluates retained evidence against controls.A security finding alone should not become an incident or compliance conclusion.Source: §6 · p. 6
  • Finding records bind monitor and expectation versions, process window, input evidence, finding, evidence status, impact, and escalation, but compromised monitors can still issue false findings.Suggested safeguards include segregated monitoring, independent governance of monitor configuration and keys, change records, multiple observation sources, and periodic sampling.Source: §6 · p. 6
  • The conceptual design has no empirical validation; proposed evaluation would test injected deviations under complete and partial visibility and measure detection, robustness, and resource costs.The proposed measures include precision, recall, false-positive rate, latency, observation loss, robustness to conflicting evidence, evasion resistance, and runtime and storage overhead.Source: §6 · p. 6

6.1 Limitations

  • False positives can reflect incomplete specifications or legitimate adaptation, while false negatives can arise from off-system actions, observer compromise, collusion, or evasion.Table 3 summarizes representative false-positive, false-negative, and evasion modes; these primarily affect evidence status and assurance, separately from impact.Source: §6.1 · p. 6, Table 3 · p. 7
  • Late, duplicate, replayed, or reordered records require explicit handling; monitoring cost depends on active expectations, concurrency, correlation fan-out, and optional semantic classifiers.Cross-organization deployment also requires agreement on expectation authority, evidence disclosure, and trust boundaries.Source: §6.1 · p. 7

7 Conclusion and Future Work

The conclusion frames A-IDS as process-level runtime detection that produces bounded, auditable findings from governed expectations and evidence-supported observations. It calls for implementation and evaluation, with prevention and compliance treatment as separate future directions.

7 Conclusion and Future Work

  • A-IDS treats the agentic process as the monitored object and emits bounded findings linking authorized expectations to observations, deviation type, evidence status, impact, assumptions, and limitations.Its baseline is governed and versioned, and uncertainty is represented through visibility, three-valued matching, and explicit observation states.Source: §7 · p. 7
  • Detection remains bounded by evidence: an unobserved approval does not prove non-occurrence, and a source-associated deviation does not establish causal prompt-injection control.Evidence strength and operational impact remain distinct considerations.Source: §7 · p. 7
  • Future work should implement and evaluate the model under partial observability, monitoring attacks, policy drift, parallel workflows, and conflicting evidence.A-IPS is proposed as a separate continuation in which findings drive authorized, proportionate prevention or containment actions.Source: §7 · p. 7
  • Further work would examine compliance deviations while keeping technical findings distinct from legal conclusions, and use evidence-based incident analysis to reconstruct event paths after alerts..Source: §7 · p. 7
Loading 2610.00151v1…