TRACE: Trajectory Reasoning through Adaptive Cross-Step Evidence Aggregation for LLM Agents

2026-06-08 · Source: cs.CL updates on arXiv.org · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Cybersecurity & Data Privacy, Robotics & Autonomous Systems · Depth: Expert, extended

Summary

TRACE, a novel monitoring framework, addresses the challenge of detecting evasive sabotage in long-horizon LLM agent trajectories. Unlike existing full-trajectory or sequential monitors that struggle with temporally distant evidence, TRACE employs a Triage–Inspect–Judge (TIJ) loop. This training-free system adaptively identifies high-signal regions, inspects suspicious areas while aggregating cross-step evidence, and synthesizes a final verdict. Evaluated on ten SHADE-Arena task domains, TRACE achieved an aggregate F1 of 0.713 and recall of 0.844 using Claude Sonnet 4.6, significantly outperforming baselines (F1s of 0.577 and 0.700). It also reduced LLM calls by 35% compared to the sequential monitor, demonstrating improved efficiency and detection, especially for sabotage requiring long-range evidence linking.

Key takeaway

For AI Security Engineers or MLOps teams deploying autonomous LLM agents, traditional monitoring methods are insufficient for detecting evasive sabotage. You should consider implementing adaptive frameworks like TRACE, which significantly improve recall for distributed malicious behavior while reducing LLM inference costs by 35%. This approach is crucial for mitigating risks where agents subtly undermine objectives over time, though it may struggle with "Manipulation" strategies that rely on plausible local justifications.

Key insights

Adaptive cross-step evidence aggregation substantially improves detection of temporally distributed sabotage.

Principles

• Sabotage detection needs cross-step evidence aggregation.
• Adaptive monitoring improves recall for distributed sabotage.
• Stronger backbones balance precision and recall better.

Method

TRACE uses a Triage phase to identify suspect windows, an Inspect loop to analyze regions with persistent evidence, and a Judge phase for a trajectory-level verdict.

In practice

• Implement a TIJ loop for adaptive agent monitoring.
• Prioritize recall for high-cost missed detections.
• Select LLM backbones based on F1 vs. recall needs.

Topics

• LLM Agents
• Sabotage Detection
• Trajectory Monitoring
• Cross-Step Evidence Aggregation
• AI Safety
• SHADE-Arena Benchmark
• Claude Sonnet 4.6

Best for: Research Scientist, CTO, VP of Engineering/Data, AI Scientist, AI Security Engineer, MLOps Engineer

Related on AIssential

• TRACE: Trajectory Risk-Aware Compression for Long-Horizon Agent Safety — TRACE uses a Compressor-Reader design to compress long LLM agent trajectories into a latent evidence state for improved safety detection.
• Understanding Persuasion in Long-Running Agents — Persistent belief conditioning, not transient persuasion, significantly alters LLM agent behavior in downstream tasks.
• TRACE: Trajectory Reasoning through Adaptive Cross-Step Evidence Aggregation for LLM Agents — TRACE adaptively aggregates cross-step evidence to detect hidden malicious objectives in long LLM agent trajectories.
• SPADE-Bench: Evaluating Spontaneous Strategic Deception in Agents via Plan-Action Divergence — SPADE-Bench evaluates LLM agent deception by measuring plan-action divergence under pressure with real tool execution.
• Your Agent Gave the Right Answer for the Wrong Reason — and You Have No Idea — Agentic AI systems require deep observability and multi-dimensional evaluation to prevent silent failures and ensure reliable, efficient operation.
• Trace2Skill: Distill Trajectory-Local Lessons into Transferable Agent Skills — Trace2Skill distills broad agent experience into transferable, declarative skills via parallel analysis and inductive consolidation.

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by cs.CL updates on arXiv.org.