Efficient auditing cuts costly checks of ai agent actions by on demand review
Efficient Auditing of Adversarial AI Agent Behavior from Agent Traces
Cryptography and Security
Summary
AI agents sometimes do harmful things, and watching all their actions closely is expensive. The authors found a way to check only the suspicious actions instead of every single one, saving time and resources. They do this by setting simple rules that filter actions, then use a smart AI to carefully inspect just those actions. This method catches most harmful behavior while using far less computing power than checking everything.
What this means in practice
- •For ai development teams: Reduce resource costs of monitoring AI agent actions while keeping high detection of harmful behavior.
- •For cybersecurity operations teams: Flag malicious sequences of automated actions in multi-agent environments with fewer computational resources.
Authors
Eugene Zhang, Cheng-Yun King Yang, Dongyan Xu
Abstract
AI agents powered by large language models (LLMs) can perform complex tasks but may harm the systems they operate in, either intentionally or unintentionally. Existing agent monitoring approaches rely on rule-based guardrails or LLM-based trace auditing. However, rule-based guardrails can be bypassed through obfuscation and may miss harmful actions beyond their predefined rules, whereas applying an LLM to audit every action is costly. We present a two-stage agent trace auditing framework. The first stage uses single-event and trace-sequence rules to select pending actions for inspection; the second uses an LLM audit agent to examine each selected action in the context of the agent's preceding trace before execution. We jointly refine the gate rules and audit instructions using training data, allowing the framework to adapt to complex agent behaviors rather than relying solely on predefined rules. On the public benchmark OpenAgentSafety, our framework reduces the average number of LLM audits from 8.15 to 2.33 per run and token usage from 47.8k to 14.6k, with a detection rate of 72.8\% compared with 81.5\% when every action is audited. In two simulated multi-agent case studies, the framework flags all malicious traces while reducing audit token usage by more than 80\%.