Trajectory Guard -- A Lightweight, Sequence-Aware Model for Real-Time Anomaly Detection in Agentic AI
On the map: LLM agents and tool use → Agent threats, guardrails and governance
Abstract (arXiv)
Autonomous LLM agents generate multi-step action plans that can fail due to contextual misalignment or structural incoherence. Existing anomaly detection methods are ill-suited for this challenge: mean-pooling embeddings dilutes anomalous steps, while contrastive-only approaches ignore sequential structure. Standard unsupervised methods on pre-trained embeddings achieve F1-scores no higher than 0.69. We introduce Trajectory Guard, a Siamese Recurrent Autoencoder with a hybrid loss function that jointly learns task-trajectory alignment via contrastive learning and sequential validity via reconstruction. This dual objective enables unified detection of both "wrong plan for this task" and "malformed plan structure." On benchmarks spanning synthetic perturbations and real-world failures from security audits (RAS-Eval) and multi-agent systems (Who&When), we achieve F1-scores of 0.88-0.94 on balanced sets and recall of 0.86-0.92 on imbalanced external benchmarks. At 32 ms inference latency, our approach runs 17-27× faster than LLM Judge baselines, enabling real-time safety verification in production deployments.
Key facts. Cited by 10 papers in the map (data through 7 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 4 of its 13 references that are in the map. First posted on arXiv 2 Jan 2026.
Builds on
4 of 13 references.
References · 4
- 2019Sentence-BERT: Sentence Embeddings using Siamese BERT-Networkscited by 9,049
- 2020ColBERT: Efficient and Effective Passage Search via Contextualized Late Interaction over BERTcited by 1,160
- 2024Agent-as-a-Judge: Evaluate Agents with Agentscited by 223
- 2021Anomaly Detection in Multi-Agent Trajectories for Automated Drivingcited by 15
Built on by
Citing papers per year: 2026: 10.
10 papers.
- 2026Beyond Individual Intelligence: Surveying Collaboration, Failure Attribution, and Self-Evolution in LLM-based Multi-Agent Systemscited by 5
- 2026VerifyMAS: Hypothesis Verification for Failure Attribution in LLM Multi-Agent Systemscited by 5
- 2026Enforcing Benign Trajectories: A Behavioral Firewall for Structured-Workflow AI Agentscited by 3
- 2026Oversight Has a Capacity: Calibrating Agent Guards to a Subjective, Fatiguing Humancited by 3
- 2026Adversarial Intent is a Latent Variable: Stateful Trust Inference for Securing Multimodal Agentic RAGcited by 2
- 2026Real-Time Detection and Repair of LLM Agent Failurescited by 2
- 2026AgentDrift: A Step-Labeled Benchmark of Injection-Hijacked LLM Agent Trajectoriescited by 2
- 2026Content-Aware Attack Detection in LLM Agent Tool-Call Traffic: An Empirical Study of Features, Architectures, and Evaluation Protocolscited by 1
- 2026DriftNet: A Dual-Head Trajectory Transformer for Detecting and Localizing Prompt Injection in LLM Agentscited by 0
- 2026What Can Component-Replacement Evidence Establish? A Critical Scoping Review of Local Decisions in LLM Agentscited by 0
- 2026What Can Component-Replacement Evidence Establish? A Critical Scoping Review of Local Decisions in LLM Agents30 Sep 2026
- 2026DriftNet: A Dual-Head Trajectory Transformer for Detecting and Localizing Prompt Injection in LLM Agents9 Sep 2026
- 2026AgentDrift: A Step-Labeled Benchmark of Injection-Hijacked LLM Agent Trajectories7 Sep 2026
- 2026Real-Time Detection and Repair of LLM Agent Failures3 Aug 2026
- 2026Oversight Has a Capacity: Calibrating Agent Guards to a Subjective, Fatiguing Human8 Jun 2026
- 2026VerifyMAS: Hypothesis Verification for Failure Attribution in LLM Multi-Agent Systems17 May 2026
- 2026Beyond Individual Intelligence: Surveying Collaboration, Failure Attribution, and Self-Evolution in LLM-based Multi-Agent Systems14 May 2026
- 2026Content-Aware Attack Detection in LLM Agent Tool-Call Traffic: An Empirical Study of Features, Architectures, and Evaluation Protocols11 May 2026
- 2026Enforcing Benign Trajectories: A Behavioral Firewall for Structured-Workflow AI Agents29 Apr 2026
- 2026Adversarial Intent is a Latent Variable: Stateful Trust Inference for Securing Multimodal Agentic RAG24 Feb 2026
Similar, not cited
Close in wording, no citation either way
- 2026TRACES: Proactive Safety Auditing for Multi-Turn LLM Agents via Trajectory-State Modeling
- 2026TRACE: Trajectory Reasoning through Adaptive Cross-Step Evidence Aggregation for LLM Agents
- 2025Intention-aware Hierarchical Diffusion Model for Long-term Trajectory Anomaly Detection
- 2025Detecting Silent Failures in Multi-Agentic AI Trajectories
- 2026StepGuard: Learning Step-Level Guardrails with Scalable Supervision and Safety-Utility Balancing
- 2026Agent-ToM: Learning to Monitor Autonomous LLM Agents via Theory-of-Mind Reasoning
- 2026TrajAD: Trajectory Anomaly Detection for Trustworthy LLM Agents
- 2025Building a Foundational Guardrail for General Agentic Systems via Synthetic Data