PaperlayerView exact revision on arXiv

Source-linked AI summary

GRAD: Graph-Structured Antibody Defense for LLM Agents

Tianqi Song, Jiawei Du, Xuemei Jia, Zheng Wang

arXiv:2610.22828v1cs.CR

TL;DR

LLM-agent attacks can distribute malicious evidence across interactions, while detectors must adapt to new tasks without losing useful earlier capabilities. GRAD combines graph-based risk detection with reusable task-specific experts; it outperforms locally adapted baselines across three benchmarks, and CAA improves cross-dataset accuracy over Replay.

  • Problem

    Memory poisoning and decomposition attacks spread malicious evidence across operations, while existing request-level defenses may not connect earlier information to later actions.

    Source: §1 · p. 1

  • Method

    GRAD uses SSUM to aggregate operation text, event attributes, and typed candidate relations into graph-level risk, while CAA adds experts on frozen snapshots and routes by graph signatures.

    Source: §1 · p. 2

  • Results

    GRAD outperforms locally adapted Agent-Sentry and NeuroTaint across Decomp, MCP, and MRT, with 97.19 AUROC on Decomp; CAA improves cross-dataset final accuracy over Replay by 13.08 points.

    Source: §1 · p. 2, §6 · p. 9

  • Takeaways & Limitations

    The drop-in gate performs local model inference in milliseconds without monitoring API calls, and CAA’s cross-dataset accuracy gain remains 9.05 points with equal family/base-case weights within each task.

    Source: §1 · p. 2

    GRAD depends on observable execution records, and incomplete logging or out-of-context information can limit detection.

    Source: §6 · p. 9

Abstract

from arXiv · show

Memory poisoning and decomposition attacks distribute malicious evidence across the operations of large language model agents. Existing request-level defenses can miss such attacks because they assess individual inputs without connecting earlier information to later actions. Moreover, detectors must adapt as task contexts change, while updates to shared parameters can impair previously learned detection capabilities. To address these challenges, we propose GRAD, which combines graph-based evidence aggregation across operations with an extensible collection of detection experts. Its Semantic-Structural Understanding Module (SSUM) jointly encodes operation text, event attributes, and typed candidate relations in an execution graph to aggregate distributed attack evidence into a graph-level risk score. Its Continual Antibody Adaptation (CAA) adds experts on frozen encoder snapshots and routes inputs by observable graph signatures, acquiring and reusing detection capabilities as tasks arrive. Across Decomp, MCP, and MRT, GRAD achieves AUROCs of 97.19%, 77.59%, and 86.60%, respectively, outperforming Sequential Monitor and locally adapted Agent-Sentry and NeuroTaint. CAA improves final accuracy by 13.08 percentage points over Replay on the cross-dataset task stream. The gain remains 9.05 points with equal family/base-case weights within each task. Its compact drop-in gate performs local model inference in milliseconds without monitoring API calls.

1 INTRODUCTION

LLM-agent attacks can distribute malicious evidence across interactions, challenging request-level defenses that do not connect earlier information to later actions. GRAD combines execution-graph risk detection with task-specific experts that can be added and reused as tasks arrive.

1 INTRODUCTION

  • Memory poisoning and decomposition attacks distribute malicious evidence across interactions, while request-level safeguards may miss harmful intent split across seemingly benign subtasks.Memory poisoning can also influence later decisions through retrieval.Source: §1 · p. 1
  • Detectors must adapt to changing tasks while retaining earlier capabilities, and a separate family-isolated stream probes transfer to unseen attack families.Updating shared parameters can alter performance on earlier tasks.Source: §1 · p. 2
  • SSUM combines operation content, event attributes, and typed candidate relations in an execution graph to assess pre-execution risk.The proposed representation targets distributed decomposition evidence and locally visible cues such as poisoned tool content.Source: §1 · pp. 1–2
  • CAA adds compact task-specific detector experts that can be reused, while GRAD’s drop-in gate performs local inference in milliseconds without monitoring API calls.The method overview describes centroid routing to select an expert for graph-level risk prediction.Source: §1 · p. 2, Figure 2 · p. 3
  • GRAD outperforms locally adapted Agent-Sentry and NeuroTaint across Decomp, MCP, and MRT, with AUROCs of 97.19, 77.59, and 86.60, respectively.The contribution summary also reports Sequential Monitor results under native Decomp and adapted MCP prefix protocols.Source: §1 · p. 2

2 RELATED WORK

Prior work studies memory poisoning and decomposition attacks, defenses for LLM agents, and continual learning for AI safety. GRAD is positioned as supervised risk prediction over operation graphs, with candidate execution relations aggregating content.

2.1 MEMORY POISONING AND DECOMPOSITION ATTACKS

  • Memory-poisoning methods manipulate stored or retrieved knowledge, while decomposition attacks distribute harmful intent across inputs or stateful subtasks.These settings motivate assessing operation content together with earlier actions.Source: §2.1 · p. 3

2.2 DEFENSES FOR LLM AGENTS

  • Agent defenses include structured-input separation, tool-use policies, harmfulness classifiers, sequential monitors, and temporal or dependency graphs; GRAD predicts risk over operation graphs.GRAD aggregates content through candidate execution relations.Source: §2.2 · p. 3

2.3 CONTINUAL LEARNING FOR AI SAFETY

  • Continual-safety approaches include rehearsal, iterative updates, and prompt pools; CAA instead acquires frozen detector snapshots and routes among them across agent tasks.The cited work also includes continual robust training and incremental graph-based monitoring.Source: §2.3 · p. 3

3 METHOD

GRAD detects memory-poisoning and decomposition attacks from operation graphs, then adapts across labeled task streams. SSUM predicts graph-level risk from event content and relations; CAA expands and routes among task-specific experts.

3.1 PROBLEM FORMULATION AND SCOPE

  • The study evaluates graph-level detection of memory poisoning and decomposition attacks, then adaptation across labeled tasks, with trusted monitoring infrastructure and adaptation data.The attacker controls subrequest content and ordering or can contaminate memory through record insertion; the monitor observes recorded operation content, event attributes, and the proposed action.Source: §3.1 · pp. 3–4
  • At runtime, the graph contains observed history and the proposed action before execution; a risk score at or above a development-set threshold triggers intervention.Offline evaluation measures graph classification, while closed-loop evaluation measures attack success and legitimate task completion after intervention.Source: §3.1 · p. 4

3.2 OVERVIEW OF GRAD

  • GRAD first learns graph representations with SSUM, then expands detector specialists through CAA; inference selects an expert, while a separately trained SSUM detector scores proposed actions for closed-loop intervention.The agent executes or replans according to the gate decision.Source: §3.2 · p. 4

3.3 SEMANTIC–STRUCTURAL UNDERSTANDING MODULE

  • SSUM connects adjacent events and adds typed candidate edges from operation types and textual cues, encoding node text and attributes alongside relation types, weights, and descriptions.Node attributes include permissions, normalized position, and lexical indicators.Source: §3.3 · p. 4
  • One GINE layer and two TransformerConv layers aggregate edge-conditioned messages, and learned attention pools final node states into a graph embedding for risk prediction.Graph-wise modality dropout and two auxiliary classifiers are used in training; inference activates all input blocks and uses the joint head.Source: §3.3 · pp. 4–5

3.4 CONTINUAL ANTIBODY ADAPTATION

  • CAA updates a working backbone with current and bounded replay examples, freezes a stage-specific snapshot, and trains a new task-specific antibody while retaining earlier snapshots.Each task stores a mean training-graph signature, and nearest-centroid routing selects an expert; the collection grows through task-specific updates.Source: §3.4 · p. 5

4 EXPERIMENTS

The experiments compare GRAD with defense implementations under stated observation protocols, test its encoder channels and continual adaptation, and evaluate closed-loop behavior and scoring time. GRAD leads matched decision-time learned controls on the original Decomp split, while continual-learning gains vary with task and family weighting.

4.1 EXPERIMENTAL SETUP

  • The evaluation uses Decomp, MCP, and MRT, compares locally adapted defense components and alternative CAA strategies, and reports AUROC, operating-point rates, continual accuracy and forgetting, closed-loop outcomes, and runtime.The cross-dataset stream uses five seeds and forward/reverse task orders; its arms share a 512-character window, architecture, splits, and optimization settings.Source: §4.1 · pp. 5–6, §4.4 · p. 7

4.2 COMPARISON WITH EXISTING DEFENSES

  • On the original split, GRAD achieves 97.0% AUROC, exceeding Temporal and Text-only by 5.30 and 10.64 percentage points, respectively; paired base-case bootstrap 95% intervals are [2.0, 9.1] and [7.2, 14.4].Source: §4.2 · p. 7

4.3 ENCODER ABLATIONS

  • On Decomp, GRAD exceeds text-only and graph-only encoders by approximately 10.4 and 10.8 AUROC points; on MRT, graph-only reaches 86.07%, near GRAD’s 86.60%.The graph-only arm includes event attributes as well as topology. On MCP, GRAD reaches 77.59%, near text-only at 79.89% and above graph-only at 67.41%.Source: §4.3 · p. 7, Table 4 · p. 7

4.4 CONTINUAL LEARNING OF ANTIBODY EXPERTS

  • CAA raises cross-dataset final accuracy from Replay’s 64.78% to 77.86%, a 13.08-point gain, while reducing forgetting from 0.0629 to 0.0079.With equal family/base-case weights within each task, the accuracy gain remains 9.05 points; Decomp and MRT account for the larger gains.Source: §4.4 · p. 8, Table 5 · p. 8
  • CAA’s cross-dataset gain remains positive under resampling, but equal family weighting reverses the family-isolated comparison in favor of Replay.Under equal weighting of label-pure families, snapshot experts score 47.5% versus Replay’s 53.5% (paired difference −6.0 points; 95% CI [−9.7, −2.2]).Source: §4.4 · p. 8
  • Centroid routing scores 77.86% accuracy, below task-oracle routing at 79.86% but above all-expert averaging at 71.58%; stage snapshots also outperform stage-0 experts on the cross-dataset stream.The stage-snapshot gain is 9.49 points; on the family-isolated stream, snapshot updates increase forgetting by 0.0285.Source: §4.4 · p. 8

4.5 EXPLORATORY TRANSFER AND CLOSED-LOOP EVALUATION

  • Across 240 closed-loop runs, GRAD and Sequential Monitor show backbone-dependent security–utility tradeoffs on DeepSeek and GLM.The offline transfer comparison reports joint adaptation at 96.08% gate-test AUROC and 96.88% on Decomp.Source: §4.5 · pp. 8–9, Table 6 · p. 9

4.6 ONLINE SCORING TIME

  • 8.4/8.3 ms: GRAD’s median model-forward times on DeepSeek/GLM traces, versus 603.3/619.4 ms for monitor calls; GRAD requires no monitoring API calls.Graph preparation is outside the gate timer.Source: §4.6 · p. 9, Table 7 · p. 9

5 DISCUSSION

Joint encoding shows its clearest advantage on decomposition attacks, while results vary by dataset; CAA improves cross-dataset accuracy and retention over Replay, with Decomp and MRT providing the largest gains.

Benchmark detection

  • Decomposition attacks show the largest joint-encoder improvement over both single-channel arms, while MRT graph-only and joint encoding perform similarly.On MCP, text-only encoding attains 79.89% AUROC, compared with 77.59% for GRAD.Source: §5 · p. 9

Adaptation and retention

  • CAA improves cross-dataset accuracy and retention over Replay, with Decomp and MRT providing the largest gains.The results concern sequential task contexts with recurring attack families; a separate family-isolated stream probes held-out-family behavior.Source: §5 · p. 9

6 LIMITATIONS AND CONCLUSION

GRAD combines execution-graph risk detection with a growing snapshot-expert library, while the reported scope is bounded by observable records, task-stream conditions, and implementation details.

6 LIMITATIONS AND CONCLUSION

  • GRAD depends on observable execution records, and incomplete logging or out-of-context information can limit detection.New environments require labeled data and mappings to graph attributes and candidate relations; CAA also incurs growing snapshot storage, and held-out-family gains are endpoint-dependent.Source: §6 · p. 9
  • GRAD achieves 97.0% AUROC on the original matched Decomp evaluation versus 91.7% for the temporal detector, and CAA improves cross-dataset accuracy over Replay by 13.08 points.With equal family/base-case weights within each task, CAA's gain is 9.05 points; the closed-loop evaluation characterizes security–utility tradeoffs of local blocking and replanning.Source: §6 · p. 9

AI USE STATEMENT

  • Generative AI tools assisted with writing, literature retrieval, research and experimental execution, drafting, and synthetic dataset generation; the authors retain responsibility for the final manuscript, references, datasets, and results.Source: AI USE STATEMENT · p. 10

ETHICS STATEMENT

  • The closed-loop evaluations use simulated tool environments, and reported results concern those environments rather than authorizing attacks against external systems.The paper notes that attack payloads and traces have dual-use implications and that shared artifacts should protect sensitive information.Source: ETHICS STATEMENT · p. 10

REPRODUCIBILITY STATEMENT

  • The appendix documents dataset transformations, baselines, input windows, training settings, seeds, task orders, threshold selection, and aggregation procedures.Experiment records include configuration and split information, per-run outputs, and, where recorded, code and checkpoint hashes.Source: REPRODUCIBILITY STATEMENT · p. 10

A DATASETS AND EVALUATION PROTOCOLS

  • Primary test comparisons use Decomp, MCP, and MRT evaluation units per seed, while the reported counts are evaluation counts rather than total corpus sizes.There are 174 positive/58 negative Decomp, 114/118 MCP, and 50/50 MRT units per seed, with three seeds.Source: A DATASETS AND EVALUATION PROTOCOLS · p. 12

A.1 DATA CONVERSION AND LEAKAGE AUDITS

  • Historical MG/MINJA panels retain template/category confounds, and derived InjecAgent/ASB panels contain shortcut cues, so they are diagnostic rather than evidence of attack generalization.For the primary datasets, SSUM encodes operation content and reconstructs candidate edges from event order, operation types, and textual cues.Source: §A.1 · p. 12

A.2 MODEL SELECTION AND CALIBRATION TIMELINE

  • The 512-character configuration was frozen before the static replication, while CAA checkpoints are selected by development AUROC on task streams.The CAA stream evaluates sequential acquisition and retention under sample-level splits; the closed-loop evaluation reuses a fixed case panel across batches.Source: §A.2 · p. 12

B.1 DETECTION RESULT VERSIONS AND AGGREGATION

This block documents historical result provenance and comparability constraints, then audits undefended AgentDojo attack coverage and outcomes across P1, attack-transfer checks, and R1.

B.1 DETECTION RESULT VERSIONS AND AGGREGATION

  • Historical G3 p25 results reuse 33 runs across Decomp, MCP, and MRT, with AUROC recomputed from per-sample ranks and sample SD across seeds.The archived batch alignment audit attributes batch differences to repeat-run variation; historical values retain their original aggregation for provenance.Source: §B.1 · pp. 12–13, Table 8 · p. 13
  • Historical GRAD-192 thresholds were selected per run on development data at a 10% FPR constraint, but pooled test counts include repeated seed evaluations.MRT used 32 calibration graphs and 20 admission graphs per fold and showed poor transfer of the calibration operating point.Source: §B.1 · p. 13
  • Historical extended detection comparisons retain implementation and observation-window caveats; diagnostic datasets with confounds or shortcut cues do not establish attack generalization.The cited comparisons also include adapted or partial baseline implementations, and operating points are not matched across methods.Source: §B.1 · pp. 13–14, Table 9 · p. 13

C AGENTDOJO ATTACK VALIDITY AND COVERAGE

  • The AgentDojo attack-validity panels measure undefended attack success and payload delivery under the tested DeepSeek Flash configuration, not GRAD.P1 and R1 are separate undefended protocols; defense comparisons use matched batches described elsewhere.Source: C AGENTDOJO ATTACK VALIDITY AND COVERAGE · p. 14, §C.3 · p. 15

C.1 FROZEN CONFIRMATION SET (P1)

  • P1 includes 35 independent user tasks, 70 attack runs, and 35 benign runs; all 105 runs completed without runtime errors.Attack success, benign task completion, and legitimate task completion under attack are reported separately.Source: §C.1 · p. 14, Table 12 · p. 14

C.2 ATTACK DEVELOPMENT, TRANSFER, AND EVALUATOR AUDITS

  • The P1 direct attack succeeded in 0/68 confirmation runs, versus 1/2 for poison moved; poison forward transfer was untested.Numeric-order configuration selection limited injection-goal coverage, and verified delivery alone does not establish an effective attack.Source: §C.2 · p. 14

C.3 OFFICIAL-ATTACK ADAPTATION DIAGNOSTIC (R1)

  • 0 attack successes were observed among 94 recorded R1 results, while automatic delivery checks passed for 87/94 records.The 0–4/97 full-plan ASR range is descriptive, not a confidence interval; seven failed delivery checks still require manual review.Source: §C.3 · p. 15, Table 13 · p. 15

D.1 FULL ABLATION MATRIX

This block distinguishes historical ablations and operating-point diagnostics from final configurations, then reports deployment and routing protocols. Its cross-batch comparison is exploratory, and the gate-test set is not an independent held-out estimate.

D.1 FULL ABLATION MATRIX

  • Historical feature/relation ablations use Table 14, while final 512-character encoder comparisons use Table 21; these are distinct evaluations.The historical component ablations are not reruns on the final 512-character backbone.Source: §D.1 · p. 15

D.2 HISTORICAL G3 COMPONENT PROTOCOL

  • The historical G3 component protocol uses existing runs, with three Decomp runs and 15 each for MCP and MRT; its original-encoder row mixes paired and archived runs.The historical records use legacy splits, and pooled-score group-bootstrap estimates are not interchangeable with fold-weighted estimates.Source: §D.2 · pp. 15–16

D.3 THRESHOLD AND SCORE DIAGNOSTICS

  • 13.79%, 14.12%, and 58.00%: test FPRs on Decomp, MCP, and MRT apply development-selected thresholds unchanged.The corresponding development FPRs were 8.71%, 4.12%, and 0.42%.Source: §D.3 · p. 16

E.1 TASK MATRICES AND RETENTION METRICS

  • The final G3 panel uses five seeds and two task orders, reporting final accuracy and forgetting; offline joint training is an accuracy reference.The full routing endpoints are in Table 25 and per-task accuracy in Table 26.Source: §E.1 · p. 16

E.2 ROUTING, CAPACITY, AND FAIR COMPARISONS

  • Final G3 centroid, all-expert, and task-oracle routing results appear in Table 25, while final random, learned, top-2, and fallback results are unavailable.The completed random/all-expert/centroid/task-oracle comparison is historical and appears in Table 16.Source: §E.2 · p. 16

F.1 JOINT-TRANSFER DEPLOYMENT

  • The gate-test split affected T3 qualification, so its AUROC is not treated as an independent held-out estimate.T3 was the only qualifying configuration; its 96.08% value is descriptive, and the transfer comparison is exploratory.Source: §F.1 · p. 17
  • 15% to 0%: the unchanged monitor’s GLM ASR shifts across batches while GRAD’s GLM BU shifts from 95% to 40%.The batches combine stochastic agent execution with a changed gate, so these shifts are not an isolated gate comparison.Source: §F.1 · p. 18

F.2 EARLIER FROM-SCRATCH GATE BATCH

  • The earlier closed-loop batch uses a fixed case panel and matched reruns of None, Sequential Monitor, and GRAD; Sanitizer was not rerun with this gate.The from-scratch gate uses a fixed checkpoint across agent models without target-specific recalibration; blocked actions trigger at most two replanning attempts.Source: §F.2 · p. 18

F.3 ERRORS, INTERVENTIONS, AND LABEL REVISIONS

The matched closed-loop batch reports harmful outcomes, completions, and intervention counts by backbone and defense, alongside a flagged benign-condition harm case.

F.3 ERRORS, INTERVENTIONS, AND LABEL REVISIONS

  • 7/20 harmful outcomes occurred for None on both backbones; DeepSeek had 0/20 for both defenses, while GLM had 3/20 for Sequential Monitor and 4/20 for GRAD.The GLM GRAD harmful outcomes were concentrated in the shopping family (4/5).Source: §F.3 · p. 18
  • 17/20 DeepSeek and 19/20 GLM benign-condition runs completed with GRAD, versus 12/20 and 9/20 with Sequential Monitor.Under attack, legitimate completion was 13/20 for DeepSeek GRAD and 9/20 for GLM GRAD.Source: §F.3 · p. 18
  • 10/40 DeepSeek and 3/40 GLM GRAD runs recorded at least one block, compared with 31/40 and 22/40 for Sequential Monitor.Denominators preserve errors as failures; no infrastructure error occurred in this batch.Source: §F.3 · p. 18
  • One GLM benign-condition GRAD run had independent harm=true and completion=false without a block or runtime error, at a score below threshold.The gate score was 0.997315 against a frozen threshold of 0.999991536; corresponding None and Monitor runs completed the task.Source: §F.3 · p. 18
  • Earlier-batch latency combines local and server hosts and is not a single-hardware benchmark.The first 38 runs were local; subsequent runs were on the GPU server after code, prompt, and gate hashes were verified.Source: §F.3 · pp. 18–19

G EFFICIENCY AND REPRODUCIBILITY

This block describes the efficiency accounting and reproducibility scope, then specifies GRAD’s threat model, detector and adaptation procedures, and evaluation boundaries.

G EFFICIENCY AND REPRODUCIBILITY

  • The 2.6 MB G3-512 gate performs in-process inference, while the continual-learning snapshot pool occupies 7.74 MB.The logged GRAD timer covers model inference after graph construction and tensor preparation; full-path latency and monitoring-token counts were not recorded.Source: G EFFICIENCY AND REPRODUCIBILITY · p. 19

H.1 ATTACK FORMULATION

  • The attacker seeks a harmful objective that violates policy, using decomposition attacks or memory poisoning to distribute evidence across subtasks or separate insertion from later use.The model trusts the monitoring infrastructure, detector parameters, and labeled adaptation data.Source: §H.1 · pp. 19–20

H.2 INTERPRETATION AND EVALUATION SCOPE

  • Offline graph labels supervise the evaluated graph, not each operation, and task-stream and closed-loop experiments assess distinct system configurations.CAA uses the expert collection in task-stream evaluation; closed-loop intervention uses a separately trained standalone detector.Source: §H.2 · p. 20

H.3 SSUM IMPLEMENTATION AND TRAINING

  • SSUM builds typed candidate relations between ordered events and encodes operation text, event attributes, and edge features for graph-level classification.The G3 architecture uses 512-character node and 160-character edge windows, with one GINE layer and two TransformerConv layers.Source: §H.3 · p. 20

H.4 TRAINING AND PREDICTION PROCEDURE

  • The runtime gate scores a graph formed from observed history and a proposed action, intervening when the score reaches its development-selected threshold.The runtime detector is a separately trained SSUM model rather than the CAA expert collection.Source: §H.4 · p. 20, §H.5 · p. 21

H.5 CAA IMPLEMENTATION

  • CAA adds a frozen encoder snapshot and task-specific adapter and head for each task, then routes inputs using observable graph signatures and stored centroids.The signature combines a normalized node-type histogram with scaled graph counts; inference selects among stored centroids and executes the selected expert.Source: §H.5 · p. 21

I HISTORICAL CONTINUAL-LEARNING REFERENCE

  • The historical continual-learning table covers MCP in-domain and cross-dataset task streams, with joint training presented as an offline accuracy reference.Its forgetting cells are omitted for joint training because they are not sequential-retention results.Source: Table 20 · p. 21

J LIMITATIONS AND EVALUATION SCOPE

  • Longer sessions increase graph size and retained evidence, while continual-learning outcomes depend on the task stream, training allocation, initialization, and routing policy.Integrating GRAD into another agent framework requires mapping its tool and memory events to the input schema; runtime results also depend on attack signal, agent configuration, and intervention behavior.Source: J LIMITATIONS AND EVALUATION SCOPE · p. 22

K INPUT-WINDOW REPLICATION

The replication block separates final 512-character results from historical evaluations, documents operating-point and timing protocols, and reports snapshot-based continual-learning comparisons.

K INPUT-WINDOW REPLICATION

  • Decomp and MCP paired bootstrap intervals for GRAD minus the graph-only encoder are positive in all three seeds, while MRT single-channel comparisons do not reach significance.MRT is tested with task-level sign tests, and its within-task bootstrap intervals are degenerate because each task cell contains one group.Source: K INPUT-WINDOW REPLICATION · p. 22
  • The observed dataset-specific results led to adopting the 512-character input repair as the backbone for subsequent antibody experiments.The GRAD-192 versus GRAD comparison controls encoder design and training configuration within this batch; legacy-text comparisons also change the run batch.Source: K INPUT-WINDOW REPLICATION · p. 22, Table 21 · p. 22

K.1 HISTORICAL DECOMP V2 EVALUATION

  • The historical Decomp v2 evaluation uses 665 newly converted graphs and 334 base-id groups; G3-minus-structure-only paired intervals include zero in every seed.This historical batch is distinct from the final 512-character legacy-split replication.Source: §K.1 · p. 22, Table 22 · p. 23

K.3 CURRENT-VERSION OPERATING POINTS AND ARTIFACT COVERAGE

  • Development-selected thresholds were applied unchanged to test scores, and MRT shows a large development-to-test calibration shift.The confirmation-batch pooled development FPRs were 8.71%, 4.12%, and 0.42% for Decomp, MCP, and MRT.Source: §K.3 · p. 23

K.4 ONLINE COST MEASUREMENT PROTOCOL

  • The timing table measures GRAD’s model forward pass and sigmoid against the monitor’s hosted judge call; agent generation and replanning are outside both timers.The local gate adds no monitoring API request, but uses local compute whose cost is not monetized; full-path latency and peak detector memory remain unmeasured.Source: §K.4 · p. 23

L SNAPSHOT-BASED ANTIBODY EVALUATION

  • 13.08 percentage points: snapshot experts exceed Replay in cross-dataset accuracy, with ACC +0.1308 and forgetting -0.0551.On the family-isolated panel, snapshot minus Replay gives ACC +0.1191; its forgetting advantage is not statistically established.Source: L SNAPSHOT-BASED ANTIBODY EVALUATION · p. 24
  • The final continual-learning replication uses a 512-character node window, 160-character edge window, and 200 updates for every arm.Snapshot experts took a mean 97 seconds to train across 20 runs, versus 56 seconds for Replay and stage-0 experts.Source: L SNAPSHOT-BASED ANTIBODY EVALUATION · p. 24

L.1 CROSS-DATASET GAINS ACROSS WEIGHTING AND RESAMPLING SCHEMES

CAA’s accuracy advantage over Replay persists under family/base-case weighting and paired resampling, while task-level and baseline comparisons depend on the weighting scheme. The mechanism-stream family-weighted results differ from the cross-dataset gains.

L.1 CROSS-DATASET GAINS ACROSS WEIGHTING AND RESAMPLING SCHEMES

  • 13.08 percentage points over Replay under the original endpoint and 9.05 points with equal family/base-case weights; both gains have positive paired confidence intervals.The original gain is reproduced under the paired-seed analysis, and the snapshot-centroid advantage remains positive under both resampling schemes.Source: §L.1 · p. 25, Table 27 · p. 25, Table 28 · p. 25
  • Task-macro sample accuracy, pooled accuracy, and family-equal accuracy use different weighting; family-equal weights families within tasks and tasks equally.Decomp groups base-case variants, MCP groups generated pairs and runtime templates, and MRT groups scenarios; only five MRT scenarios and two orders are available for corresponding sensitivity analyses.Source: §L.1 · pp. 25–26
  • [7.72, 19.94] points: the sample-pooled family-cluster sensitivity interval resamples runs and families while retaining paired sample differences.This pooled statistic differs from task-macro weighting.Source: §L.1 · p. 25
  • 62.13% versus 57.31%: Sequential FT exceeds Replay on family-equal accuracy despite ranking below it at the sample level.Stage-0 centroid minus Replay shifts from +3.59 points under the original endpoint to -1.05 points under family-equal weighting; neither interval excludes zero.Source: §L.1 · p. 25
  • Decomp and MRT drive the aggregate improvement under both weights, while MCP changes sign under family weighting and its interval includes zero.Equal weighting of distinct MCP families yields -9.33 points, unlike the -6.72-point endpoint that weights families within each run before averaging runs.Source: §L.1 · p. 25, Table 29 · p. 26

L.2 FAMILY WEIGHTING IN THE MECHANISM STREAM

  • 47.5% for snapshot centroid versus 53.5% for Replay on the mechanism-stream family-equal endpoint; snapshot minus Replay is -6.0 points.The run-bootstrap 95% CI is -9.7 to -2.2 points; the endpoint weights label-pure families within tasks and tasks equally.Source: §L.2 · p. 26

M MATCHED DECISION-TIME DETECTION COMPARISON

In the matched decision-time Decomp comparison, GRAD has higher mean AUROC than Temporal and Text-only, but the reanalysis uses a previously exposed test split. Frozen new-case validation does not reproduce the advantage over Temporal, and candidate-relation wiring does not establish an advantage over matched random rewiring.

M MATCHED DECISION-TIME DETECTION COMPARISON

  • The comparison truncates attacks at the proposed harmful action and gives all learned methods identical 200-character step strings, but uses a previously exposed test split.The split contains 232 test cases in 58 base-case groups.Source: M MATCHED DECISION-TIME DETECTION… · p. 26
  • 5.30 points over Temporal and 10.64 points over Text-only in mean AUROC; paired 95% intervals are [2.0,9.1] and [7.2,14.4] points.The single-model and score-ensemble endpoints are distinct analyses.Source: M MATCHED DECISION-TIME DETECTION… · pp. 26–27
  • At development-frozen operating points, GRAD has higher TPR and lower FPR than Text-only, but these are not equal-test-FPR comparisons.Test FPR exceeds nominal development targets on average for all three methods; 1% operating points are not reported.Source: M MATCHED DECISION-TIME DETECTION… · p. 27, Table 31 · p. 27
  • The sequential monitor’s first-trigger ordinal score reaches 91.24% AUROC; GRAD inference takes 6.8 ms p50 and 45.5 ms p95 on an M2 CPU.The monitor result reuses judgments from cached calls; the comparison does not establish invariance to trace length or isolate a causal effect of graph edges.Source: M MATCHED DECISION-TIME DETECTION… · p. 27

N DETAILED AI USE STATEMENT

  • The AI-use disclosure covers writing and drafting, literature discovery, research and experiments, and synthetic dataset generation; authors retain responsibility for selection and interpretation.AI-generated examples alone do not establish attack success during agent execution.Source: N DETAILED AI USE STATEMENT · p. 28, §N.1 · p. 28, §N.2 · p. 28

O SUPPLEMENTARY CODE AND ARTIFACT GUIDE

P FROZEN NEW-CASE VALIDATION AND RELATION ATTRIBUTION

  • 0.615 versus 0.675: on 47 generated base-case clusters scored offline, GRAD’s seed-mean AUROC is below Temporal’s, so the original advantage over Temporal does not reproduce.These were LLM-generated cases, not executed real-world trajectories; thresholds were not recalibrated.Source: P FROZEN NEW-CASE VALIDATION AND… · p. 30
  • Candidate relations score 0.970 AUROC versus 0.898 without cross-node edges, but 0.959 with matched random rewiring; their specific wiring advantage is not established.The results do not establish recovery of causal execution dependencies.Source: P FROZEN NEW-CASE VALIDATION AND… · p. 30
Loading 2610.22828v1…