MemRiskBench: Trace-Aware Risk-Preserving Evaluation for Long-Horizon LLM Agents

• URL: http://arxiv.org/abs/2609.14976v1
• Date: Mon, 14 Sep 2026 03:31:19 GMT
• Title: MemRiskBench: Trace-Aware Risk-Preserving Evaluation for Long-Horizon LLM Agents
• Abstract summary: MemRiskBench is a 120-episode scripted benchmark with full trace logging and no LLM-as-judge on the pass/fail path.<n>A risk-preserving subset selector preserves risk-type coverage and high-risk detection using trace-grounded deterministic features.<n>All episodes, traces, the scoring implementation, and the selector are released to support reproducible evaluation and risk assessment of deployed LLM agents.
• Score: 5.605743575854166
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Long-horizon LLM agents accumulate memory across sessions, creating sparse but high-impact risks: stale facts, conflicting updates, cross-user leakage, revoked-memory reuse, and constraint decay. Standard aggregate scores hide per-risk failure rates--a model achieving 78% average accuracy may still leak data in 4% of episodes--and benchmark compression preferentially discards the rare high-severity events that distinguish a mostly-working model from one that occasionally causes harm. We present MemRiskBench. The primary contribution is a five-category risk taxonomy (plus one documented, unscored category) operationalized by deterministic trace grounded checks, instantiated as a 120-episode scripted benchmark with full trace logging and no LLM-as-judge on the pass/fail path, evaluated on five locally run quantized instruction-tuned models. Second, a risk-preserving subset selector: a coverage-constrained greedy selector on deterministic trace-derived features that retains full ranking (Spearman rho = 0.975, deterministic; CI collapses to a point estimate with zero bootstrap variance), risk coverage (1.0), and high-risk model detection (1.0) at a 20% subset size, reducing compute 5x. Unlike ranking-only subset selectors, this selector additionally preserves risk-type coverage and high-risk detection using trace-grounded deterministic features that do not require an LLM judge. All episodes, traces, the scoring implementation, and the selector are released to support reproducible evaluation and risk assessment of deployed LLM agents

Related papers

• LLMs for Zero-Shot Threat Detection via Structured Risk Indicators [3.888900238305354]
  We propose a two-stage large language model (LLM) framework for zero-shot detection of insider threats and advanced persistent threats (APTs) from heterogeneous security logs.<n>The framework models behavioural activity as chronological timelines and incorporates retrieval-augmented generation (RAG) to provide personalised context from each user's historical activity.<n>It is evaluated on two benchmark datasets, CERT r5.2 for insider threat detection and PicoDomain for APT detection.
  arXiv  Detail & Related papers  (2026-08-17T12:47:38Z)
• Uncertainty-Aware Sequential Decision Rules for Event-Triggered LLM Invocation in Streaming Systems [3.556355987197792]
  Streaming inference pipelines increasingly pair lightweight fast models with Large Language Models (LLMs)<n>We cast this as a risk-based sequential stopping problem, where a trigger policy fires when a risk functional over the observation history exceeds a threshold.<n>We prove six results: a minimum inter-event time bound excluding trigger; optimality of threshold policies via smooth pasting; approximate SPRT guarantees under estimated parameters.
  arXiv  Detail & Related papers  (2026-06-27T08:18:09Z)
• An Embarrassingly Simple Detector for Model Extraction Attacks in Large Language Model API Traffic [16.151531550259993]
  Large language models (LLMs) are increasingly deployed through hosted APIs, making model extraction a practical threat to model ownership and service security.<n>We formulate model extraction monitoring as benign-calibrated traffic-window distribution testing.<n>We show that an embarrassingly simple detector is effective: embed incoming queries into a semantic space and test whether their aggregate distribution deviates from historical benign traffic.
  arXiv  Detail & Related papers  (2026-06-04T05:33:49Z)
• What to Test Next: Interpretable Coverage Gap Discovery in Driving VLMs [52.50210189669399]
  Driving vision-language models (VLMs) must accurately understand scenes across diverse conditions defined by Operational Design Domains (ODDs)<n>We propose SliceScorer, a deterministic scoring rule for missing-slice recommendation.<n>We show that SliceNav surfaces high-risk coverage gaps more effectively than prior slice-discovery methods.
  arXiv  Detail & Related papers  (2026-06-01T03:18:01Z)
• SilentRetrieval: Hijacking Retrieval-Augmented Generation via Semantically-Preserving Adversarial Data Poisoning [1.0998907972211756]
  We present SilentRetrieval, a two-stage data poisoning attack that hijacks RAG systems through adversarially crafted documents.<n>SilentRetrieval achieves 84.6%/81.3% HR@10 and 57.5%/54.8% ASR-LLM on Natural Questions and MS MARCO, while maintaining near-benign perplexity.
  arXiv  Detail & Related papers  (2026-05-27T07:30:30Z)
• Estimating near-verbatim extraction risk in language models with decoding-constrained beam search [66.14049361268074]
  We show that greedy-decoding methods miss how extraction risk varies across sequences.<n>We introduce decoding-constrained beam search, which yields deterministic lower bounds on near-verbatim extraction risk.
  arXiv  Detail & Related papers  (2026-03-26T01:15:16Z)
• Conformal Lesion Segmentation for 3D Medical Images [82.92159832699583]
  We propose a risk-constrained framework that calibrates data-driven thresholds via conformalization to ensure the test-time FNR remains below a target tolerance.<n>We validate the statistical soundness and predictive performance of CLS on six 3D-LS datasets across five backbone models, and conclude with actionable insights for deploying risk-aware segmentation in clinical practice.
  arXiv  Detail & Related papers  (2025-10-19T08:21:00Z)
• Conformal Inference under High-Dimensional Covariate Shifts via Likelihood-Ratio Regularization [35.16750653336608]
  We introduce the likelihood ratio regularized quantile regression algorithm, which combines the pinball loss with a novel choice of regularization.<n>We show that the LR-QR method has coverage at the desired level in the target domain, up to a small error term.<n>Our experiments demonstrate that the LR-QR algorithm outperforms existing methods on high-dimensional prediction tasks.
  arXiv  Detail & Related papers  (2025-02-18T16:46:44Z)
• Safe Deployment for Counterfactual Learning to Rank with Exposure-Based Risk Minimization [63.93275508300137]
  We introduce a novel risk-aware Counterfactual Learning To Rank method with theoretical guarantees for safe deployment. Our experimental results demonstrate the efficacy of our proposed method, which is effective at avoiding initial periods of bad performance when little data is available.
  arXiv  Detail & Related papers  (2023-04-26T15:54:23Z)
• Risk Minimization from Adaptively Collected Data: Guarantees for Supervised and Policy Learning [57.88785630755165]
  Empirical risk minimization (ERM) is the workhorse of machine learning, but its model-agnostic guarantees can fail when we use adaptively collected data. We study a generic importance sampling weighted ERM algorithm for using adaptively collected data to minimize the average of a loss function over a hypothesis class. For policy learning, we provide rate-optimal regret guarantees that close an open gap in the existing literature whenever exploration decays to zero.
  arXiv  Detail & Related papers  (2021-06-03T09:50:13Z)
• Orthogonal Statistical Learning [49.55515683387805]
  We provide non-asymptotic excess risk guarantees for statistical learning in a setting where the population risk depends on an unknown nuisance parameter. We show that if the population risk satisfies a condition called Neymanity, the impact of the nuisance estimation error on the excess risk bound achieved by the meta-algorithm is of second order.
  arXiv  Detail & Related papers  (2019-01-25T02:21:24Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.