OnTrack monitors AI agent actions fast to prevent costly failures
OnTrack: Real-Time Monitoring and Intervention in LLM Agent Trajectories via Streaming Structure-Aware Optimal Transport
Artificial IntelligenceComputation and LanguageComputers and SocietyMachine Learning
Summary
Large language model (LLM) agents often act on their own, which can sometimes lead to mistakes that cost time or money. The authors designed OnTrack, a tool that watches the agent’s steps in real time and compares them to successful past runs to quickly spot if things are going wrong. It can warn users or stop the agent in milliseconds before damage happens. OnTrack works well even with limited knowledge about the agent’s environment and saves resources by aborting failing runs early.
What this means in practice
- •For ai system operators: Prevent costly or unsafe actions by AI agents through immediate detection and intervention during task execution.
- •For it support teams: Reduce wasted compute and speed up incident triage by stopping AI-driven workflows that are likely to fail early on.
- •For automated trading teams: Monitor algorithmic trading agents in real time to swiftly block harmful or repetitive trades before losses accumulate.$Commercial implications: Enables development of commercial trading safety software that minimizes financial risk by real-time intervention in trading agent actions.
Authors
Babak Barazandeh, Connor Swanson, Chinmay Kulkarni, Nikhil Mungel
Abstract
Agents are deployed in applications from trip planners and stock trading to IT incident triage. In most cases, LLM agents work autonomously with minimal rule-based safeguarding, leading to cost and safety issues from irreversible actions. Recent works resolve this either by using a safeguard agent to monitor behavior or evaluating logs post-hoc. The first adds cost and latency to every step; the second delivers its verdict after the run, when tokens are burned and damage is done. To overcome this, we propose OnTrack, a streaming monitoring mechanism that compares an agent's steps and dependencies against recorded successful runs to alert users or block the agent in about a millisecond per step. We study this problem in three regimes of decreasing access: full reference access (historical runs and tool schemas), intermediate access (only tool schemas), and no prior knowledge (only step logs as generated). Expectation of OnTrack's monitoring capabilities reduces as data access drops, ranging from plan violation detection to identifying loops, stalls, and repeated tool calls. Finally, we evaluate OnTrack using SWE-bench trajectories. Based on the first 8 steps, our method ranks failing trajectories below succeeding ones better than content similarity approaches (+0.057 AUROC). With an abort policy, we save about 18% of compute that would be burned on failing runs, where 83% of interrupted runs were actually heading to failure (5 out of 6 aborts were correct).