Research map / Multi-agent systems and games / LLM agents

Beyond Suspicious Steps: Ontological Trust in Long-Horizon Agents

NeurIPS 2026 · Multi-agent systems and games › LLM agents · approach: Agent safety and attack benchmarks · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Introduces ontological trust, a task-conditioned prefix-level property decomposed into Role, Goal, and Evidence, and RGE, a deterministic-update online monitor using LLMs only for structured parsing, evaluated on a cross-domain drift corpus from OSWorld, FinanceBench, and EICU-AC.

Problem

Long-horizon agents can drift from the user-authorized task through locally plausible steps; existing monitors check local rule compliance, final outcomes, or generic risk and do not estimate whether the trajectory prefix still corresponds to the delegated task.

Approach

Maintain an online three-axis trust state (Role, Goal, Evidence) over trajectory prefixes, where an LLM only parses each step into typed fields and all state updates, aggregation, and intervention labels are deterministic, yielding a replayable audit trail.

Key results

• GPT-4o and Qwen3.5-9B exceed 93% Drift F1 on every benchmark while keeping benign coverage at or above 95.8%.
• Best snapshot metric reaches only 73.49% AUC (Causal Grounding with Llama-3-8B-Instruct); RGE three-axis scores reach 97.67%, 97.45%, 98.86% trajectory AUC on Qwen3-4B, Llama-8B, GPT-4o-mini.
• Pseudo-consistency F1 has median 18.2% across nine cells, ranging 0.0% to 98.4%, tracking whether task closure is externally visible.

Surprising findings

• Predictive Entropy stays near random (47-56% AUC) across all evaluators, and step-local metrics fail to separate benign and drifting steps.
• Pseudo-consistency detection is capped in read-only domains (FinanceBench, EICU-AC) because task closure is not externally observable.

Limitations

• Pseudo-consistency detection is structurally limited where task completion is not externally visible.
• Assumes clean action-observation prefixes; noisy or partially observable settings are not handled.
• Small estimator (Gemma-4-E4B-it) is weaker on subtle pseudo-consistency and clinical evidence cases.

Experimental setup

Datasets: OSWorld FinanceBench EICU-AC AgentBench Living-off-the-Land corpus

Benchmarks: OSWorld FinanceBench EICU-AC

Metrics: Drift F1 Pseudo F1 Benign Coverage trajectory AUC

Baselines: AgentSpec R-Judge (k=1) R-Judge (k=3) AgentAuditor MAS-Shield LLM-as-judge snapshot metrics

Builds on: AgentSpec R-Judge AgentAuditor MAS-Shield GuardAgent

Closest papers by meaning

• ACED-Bench: Evaluating How LLM Agents Acquire and Act on Causal Evidence (NeurIPS 2026 · similarity 0.87)
• AgentForesight: Online Auditing for Early Failure Prediction in Multi-Agent Systems (NeurIPS 2026 · similarity 0.86)
• Offline Preference-Based Trajectory Evaluation (NeurIPS 2026 · similarity 0.86)
• PROBE: Learning to Audit Policy Compliance in Tool-Using LLM Agents (NeurIPS 2026 · similarity 0.86)
• Instrumental Choices: Measuring the Propensity of LLM Agents to Pursue Instrumental Behaviors (NeurIPS 2026 · similarity 0.85)
• ST-WebAgentBench: A Benchmark for Evaluating Safety and Trustworthiness in Web Agents (ICLR 2026 · similarity 0.85)