Long-Horizon Agent Trajectory Attribution: A Unified Benchmark and Fine-Grained Annotation Framework
On the map: LLM agents and tool use → Agent threats, guardrails and governance
Abstract (arXiv)
Large language model (LLM) agents increasingly operate through long-horizon trajectories involving user instructions, tool use, external observations, and memory. Existing benchmarks primarily evaluate behavioral outcomes but provide limited support for fine-grained attribution analysis. We introduce trajectory attribution and develop a benchmark and annotation framework for this task. The benchmark organizes heterogeneous trajectories under a unified component schema and provides annotations of the primary attribution component, together with attack and execution chains where applicable. Instantiating the benchmark with trajectories from AgentDojo and the Stage and Canary settings of Agent3Sigma yields more than 1,300 annotated trajectories covering task-aligned actions, unsafe actions, and safety refusals. The benchmark defines two evaluation tasks, primary attribution localization and attribution-chain recovery, and provides reference baselines based on incremental trajectory contribution and component-level leave-one-out perturbation. It captures diverse attribution settings, including local and long-range attribution as well as structured attribution chains. Reference baseline results exhibit substantial performance differences across these settings, providing an initial characterization of the benchmark's attribution challenges. Beyond this initial instantiation, we release a reusable annotation skill that enables trajectories generated by new agent models to be standardized, annotated, and evaluated under the same framework. Project resources and future releases are available at https://github.com/chenjing-2024/agent-trajectory-attribution.
Key facts. Cited by 4 papers in the map (data through 14 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 14 of its 16 references that are in the map. First posted on arXiv 7 Aug 2026.
Builds on
14 of 16 references.
Closest ancestors · 4
Same direction, newest first
- 2026HINTBench: Horizon-agent Intrinsic Non-attack Trajectory Benchmark15 Apr
- 2026ATBench: A Diverse and Realistic Agent Trajectory Benchmark for Safety Evaluation and Diagnosis2 Apr
- 2026AttriGuard: Defeating Indirect Prompt Injection in LLM Agents via Causal Attribution of Tool Invocations11 Mar
- 2026CausalArmor: Efficient Indirect Prompt Injection Guardrails via Causal Attribution8 Feb
Other references · 10
- 2023A Survey on Large Language Model based Autonomous Agentscited by 2,242
- 2023AgentBench: Evaluating LLMs as Agentscited by 1,267
- 2025Which Agent Causes Task Failures and When? On Automated Failure Attribution of LLM Multi-Agent Systemscited by 185
- 2025MultiAgentBench: Evaluating the Collaboration and Competition of LLM agentscited by 178
- 2026AgentRx: Diagnosing AI Agent Failures from Execution Trajectoriescited by 60
- 2026Seeing the Whole Elephant: A Benchmark for Failure Attribution in LLM-based Multi-Agent Systemscited by 27
- 2026Rethinking Failure Attribution in Multi-Agent Systems: A Multi-Perspective Benchmark and Evaluationcited by 24
- 2026Causal Agent Replay: Counterfactual Attribution for LLM-Agent Failurescited by 20
- 2026AgentCanary: A Security Evaluation Framework for Autonomous AI Agents in Real Executable Environmentscited by 13
- 2026The Why Behind the Action: Unveiling Internal Drivers via Agentic Attributioncited by 11
Built on by
Citing papers per year: 2026: 4.
4 papers.
- 2026AgentDrift: A Step-Labeled Benchmark of Injection-Hijacked LLM Agent Trajectoriescited by 2
- 2026DriftNet: A Dual-Head Trajectory Transformer for Detecting and Localizing Prompt Injection in LLM Agentscited by 0
- 2026DENSE: Distilling Agent Trajectories into Evidence-Grounded Shortcut Trees for Self-Refinementcited by 0
- 2026Auditing Agent Actions through Query-Conditioned Attributioncited by 0
- 2026Auditing Agent Actions through Query-Conditioned Attribution27 Sep 2026
- 2026DENSE: Distilling Agent Trajectories into Evidence-Grounded Shortcut Trees for Self-Refinement18 Sep 2026
- 2026DriftNet: A Dual-Head Trajectory Transformer for Detecting and Localizing Prompt Injection in LLM Agents9 Sep 2026
- 2026AgentDrift: A Step-Labeled Benchmark of Injection-Hijacked LLM Agent Trajectories7 Sep 2026
Similar, not cited
Close in wording, no citation either way
- 2025TRAJECT-Bench:A Trajectory-Aware Benchmark for Evaluating Agentic Tool Use
- 2026Detect Before You Attribute: Cascade Failure Attribution for Multi-Agent Systems
- 2026DynSTEER: Dynamic Stage-wise Trajectory Evaluation and Execution-time Review for Agents
- 2026The Long-Horizon Task Mirage? Diagnosing Where and Why Agentic Systems Break
- 2026TrajLong: Co-Designing Agentic and Long-Context Supervision for Mid-Training
- 2026FALAT: Tracing Failures in LLM Agent Trajectories via Dependency-Guided Search
- 2024AgentBank: Towards Generalized LLM Agents via Fine-Tuning on 50000+ Interaction Trajectories
- 2026Agent Safety From Within: Detecting Harmful Trajectories from LLM Internal States