Beyond Suspicious Steps: Ontological Trust in Long-Horizon Agents

• URL: http://arxiv.org/abs/2608.17718v1
• Date: Tue, 18 Aug 2026 12:44:43 GMT
• Title: Beyond Suspicious Steps: Ontological Trust in Long-Horizon Agents
• Abstract summary: We introduce ontological trust, a task-conditioned property of trajectory prefixes, and instantiate it as RGE.<n>RGE decomposes trust along Role, Goal, and Evidence.<n>We construct a cross-domain trajectory corpus from OSWorld, FinanceBench, and EICU-AC.
• Score: 13.208673657449175
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Long-horizon agents increasingly operate across many steps, tools, and observa- tions. In this setting, the relevant oversight question is not only whether each action is locally valid, but whether the evolving trajectory still corresponds to the task the user authorized. Drift can accumulate quietly: an agent may call the right tool with plausible arguments at every step, while its prefix moves toward a broader role, an adjacent objective, or evidence the user never supplied. Existing monitors mostly check local compliance, deliver final-trace verdicts, or score generic risk; they do not directly estimate this prefix-level relation. We introduce ontological trust, a task-conditioned property of trajectory prefixes, and instantiate it as RGE, an online monitor that decomposes trust along Role, Goal, and Evidence. RGE uses LLMs only to derive structured task and step representations; trust-state updates, projec- tions, and intervention decisions are deterministic, so the output is a replayable and auditable trust trajectory rather than a single end-to-end judge verdict. We construct a cross-domain trajectory corpus from OSWorld, FinanceBench, and EICU-AC, covering benign executions, prefix-paired drift, and pseudo-consistency failures. On this corpus, RGE outperforms adapted rule-, judge-, and shield-style baselines on prefix-paired drift detection. With the two larger estimator models, it exceeds 93% Drift F1 on every benchmark while keeping benign coverage at or above 95.8%. Pseudo-consistency is harder: detection depends on whether task completion is externally visible, a structural limit we characterize empirically.

Related papers

• One Step, One Lead: Mitigating Higher-Order Interference in Multi-Domain Reinforcement Learning via Cross-Step Control [62.82372407840088]
  We show that same-point domain gradients may remain nearly even when consecutive realized updates partially reverse one another in output space.<n>We propose OSOL, which designates a focus domain at each iteration, to rank token-level rebound risk.<n>OSOL reaches a domain-macro average of 0.4822, improving by 5.7% over the strongest compared baseline, without explicit higher-order differentiation.
  arXiv  Detail & Related papers  (2026-09-06T08:32:59Z)
• Automata from Agent Traces: Failure and Next-Step Prediction [1.16693435589939]
  We collapse an entire trace corpus into a single, compact finite-state machine (FSM) that serves as a structural substrate for the behavior of LLM agents.<n>For failure prediction, per-state behavioral features reach held-out AUROC up to 0.94, and an online monitor ranks failing runs above passing ones.
  arXiv  Detail & Related papers  (2026-08-24T17:58:01Z)
• From Sequence to Structure: Relational Uncertainty Propagation for LLM Agents [75.44420701722915]
  We propose a trajectory-level UQ framework for large language model (LLM) agents.<n>RuPA represents an execution history as a directed trajectory graph in which reasoning states, tool interactions, and environment feedback are nodes connected by temporal and semantic dependency edges.<n>We evaluate RUPA on representative agent benchmarks, including $$-2, Terminal-Bench-2, and GAIA, using 6 open-source LLMs spanning multiple model families.
  arXiv  Detail & Related papers  (2026-08-17T01:40:14Z)
• ScrambleToolBench: Agents Search Exhaustively Even When Their Own Map Points to the Next Step [74.83535434786145]
  We introduce ScrambleToolBench, an interactive terminal benchmark designed to isolate behavioral reasoning.<n>The benchmark requires agents to uncover hidden tool behaviors entirely through trial-and-error interaction.<n>Our evaluation of state-of-the-art language models reveals that successful initial discovery does not translate into robust adaptation.
  arXiv  Detail & Related papers  (2026-08-03T15:07:46Z)
• TRACE: Trajectory Reasoning through Adaptive Cross-Step Evidence Aggregation for LLM Agents [62.969415789328025]
  LLM agents can pursue hidden malicious objectives through sequences of individually benign actions.<n>Existing approaches either evaluate complete trajectories in a single pass or partition them into independently scored windows.<n>We propose TRACE, a monitoring framework for long-horizon LLM agent trajectories.
  arXiv  Detail & Related papers  (2026-06-05T08:54:38Z)
• Trust No Tool: Evaluating and Defending LLM Agents under Untrusted Tool Feedback [38.251599309409]
  We study a different failure mode, cognitive poisoning, in which a malicious tool behaves plausibly during exploration.<n>We present VISTA-Guard, a backbone-agnostic framework for final-action risk scoring.
  arXiv  Detail & Related papers  (2026-05-17T13:51:34Z)
• ClawForge: Generating Executable Interactive Benchmarks for Command-Line Agents [59.626170560327274]
  We present textbfClawForge, a generator-backed benchmark framework for executable command-line categories under state conflict.<n>We instantiate this framework as the ClawForge-Bench (17 scenarios, 6 ability categories)
  arXiv  Detail & Related papers  (2026-05-13T21:34:08Z)
• AgentForesight: Online Auditing for Early Failure Prediction in Multi-Agent Systems [30.172832661173928]
  LLM-based multi-agent systems are increasingly deployed on long-horizon tasks.<n>A single decisive error is often accepted by downstream agents and cascades into trajectory-level failure.<n>We introduce AgentForesight, a framework that reframes this problem as online auditing.
  arXiv  Detail & Related papers  (2026-05-09T05:55:19Z)
• Beyond Input Guardrails: Reconstructing Cross-Agent Semantic Flows for Execution-Aware Attack Detection [32.301679396929536]
  We propose SysName, a framework that shifts the defensive paradigm from static input filtering to execution-aware analysis.<n>SysName synthesizes fragmented operational primitives into contiguous behavioral trajectories, enabling a holistic view of system activity.<n> Empirical evaluations demonstrate that SysName effectively detects over ten distinct compound attack vectors, achieving F1-scores of 85.3% and 66.7% for node-level and path-level end-to-end attack detection, respectively.
  arXiv  Detail & Related papers  (2026-03-04T01:59:16Z)
• DRAFT: Task Decoupled Latent Reasoning for Agent Safety [59.46137757545185]
  We propose DRAFT (Task Decoupled Latent Reasoning for Agent Safety), a latent reasoning framework that decouples safety judgment into two trainable stages.<n>An Extractor distills the full trajectory into a compact continuous latent draft, and a Reasoner that jointly attends to the draft and the original trajectory to predict safety.<n>DRAFT consistently outperforms strong baselines, improving accuracy from 63.27% (LoRA) to 91.18% averaged over benchmarks.
  arXiv  Detail & Related papers  (2026-02-11T07:45:14Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.