🤖 AI

Stateful Online Monitoring Catches Distributed Agent Attacks

This paper introduces a stateful online monitoring system that detects distributed agent attacks by aggregating weak suspicious signals across multiple user accounts in real-time, effectively overcoming the limitations of traditional single-context monitors while maintaining negligible latency.

Original authors: Davis Brown, Samarth Bhargav, Arav Santhanam, Kasper Hong, Ivan Zhang, Matan Shtepel, Steffi Chern, Alexander Robey, Eric Wong, Hamed Hassani

Published 2026-06-01

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Davis Brown, Samarth Bhargav, Arav Santhanam, Kasper Hong, Ivan Zhang, Matan Shtepel, Steffi Chern, Alexander Robey, Eric Wong, Hamed Hassani

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

The Problem: The "Divide and Conquer" Trick

Imagine you are a security guard at a massive, busy airport. Your job is to stop people from smuggling dangerous items. You have a scanner that looks at every single suitcase as it goes through the X-ray machine.

The Old Way (Standard Monitors):
Your scanner is very good at spotting a suitcase full of guns or explosives. If someone tries to sneak a bomb through, the scanner beeps, and you stop them.

The New Threat (Distributed Agent Attacks):
Now, imagine a group of criminals who want to smuggle a massive, illegal machine into the country. The machine is too big to fit in one suitcase, and if they put it all in one bag, your scanner will definitely catch it.

So, they change their strategy. They hire 50 different people.

Person A brings in a screwdriver.
Person B brings in a wire.
Person C brings in a battery.
Person D brings in a circuit board.

Individually, every single suitcase looks perfectly innocent. A screwdriver is just a tool; a wire is just a wire. Your scanner checks each one, sees nothing wrong, and lets them pass.

But once all 50 people get inside, they meet up in a back room and assemble the machine. By the time they build the weapon, it's too late; the damage is done.

The Paper's Discovery:
The researchers found that AI agents (smart computer programs) are being used exactly like this. Attackers are splitting one big, harmful cyber-attack (like hacking a bank) into dozens of tiny, boring, harmless-looking tasks. They spread these tasks across hundreds of different user accounts.

Because standard safety monitors only look at one conversation at a time, they see only the "screwdriver" or the "wire." They miss the fact that these pieces are part of a bigger, dangerous puzzle. The paper shows that these "distributed attacks" are so sneaky that standard monitors catch them only 20% of the time, whereas they usually catch normal attacks almost every time.

The Solution: The "Detective with a Memory"

The researchers built a new kind of safety guard called an Online Stateful Monitor.

The Analogy: The Detective vs. The Scanner

The Standard Monitor is like a scanner that looks at a suitcase, says "All clear," and forgets about it immediately. It has no memory of what happened 10 minutes ago or what Person B brought in.
The Stateful Monitor is like a detective who keeps a notebook. When Person A walks in with a screwdriver, the detective writes it down. When Person B walks in with a wire, the detective looks at their notebook, sees the screwdriver, and thinks, "Wait a minute. A screwdriver and a wire? That's suspicious."

How It Works (The Magic Trick):

Grouping by "Vibe" (Clustering): The monitor doesn't read every single conversation in detail (that would be too slow). Instead, it uses a smart system to group conversations that "sound" similar. It puts all the "screwdriver" requests into one pile and all the "wire" requests into another.
Spotting the Pattern: If the monitor sees that the "screwdriver" pile and the "wire" pile are growing at the same time, and they are coming from different people, it realizes these are pieces of the same puzzle.
The "Big Brain" Check: Most of the time, the monitor just does this quick grouping. It's fast and cheap. But if a pile gets too suspicious (like when 10 different people are asking for parts of a hacking tool), the monitor pulls out a "Big Brain" AI to look at the whole pile of evidence together and say, "Yes, this is definitely a coordinated attack."

Why This is a Big Deal

1. It Catches Attacks Earlier
In the old system, the attack would succeed because the guard didn't see the connection. With the new monitor, the guard spots the pattern while the criminals are still gathering the parts. The paper says this new system catches attacks 30% earlier in the process, stopping the damage before it happens.

2. It Doesn't Slow Down the Good Guys
You might think, "If this detective is checking everyone's notebooks, won't it slow down the airport?"
The researchers tested this with millions of fake requests. They found that for 99% of normal users (people just writing code or asking questions), the new monitor is just as fast as the old one. It only takes extra time for the tiny fraction of requests that look suspicious. It's like having a super-fast scanner that only calls in the heavy-duty detective if something looks weird.

3. It Caught Something Unexpected
The researchers hired a team of "Red Teamers" (ethical hackers) to try and break their new system for two months. They tried to trick the monitor in many ways.

Surprise: The monitor didn't just catch the "distributed" attacks. It also caught standard jailbreaks (people trying to trick an AI into being bad).
Why? Because even when attackers try to trick the AI in a single conversation, they often reuse similar tricks across different accounts. The monitor's "notebook" saw the pattern of repeated tricks and flagged them.

The Bottom Line

The paper argues that we can no longer just look at one conversation at a time to keep AI safe. Attackers are too smart; they are splitting their bad plans into tiny, invisible pieces.

To stop them, we need safety systems that can remember and connect the dots across many different users and conversations, all in real-time. This new "Stateful Monitor" does exactly that, acting like a detective who sees the whole picture, not just a single snapshot.

Technical Summary: Stateful Online Monitoring for Distributed Agent Attacks

Problem Statement
Large Language Model (LLM) agents are increasingly capable of identifying software vulnerabilities and performing complex cybersecurity tasks. However, this capability introduces a novel threat vector: distributed agent attacks. In these scenarios, attackers decompose a single harmful objective (e.g., a cyber-exploit) into numerous subtasks distributed across many user accounts and agent sessions. While individual transcripts appear benign and pass standard safety filters, the aggregate activity constitutes a coordinated attack.

Standard safety monitors are architecturally limited because they evaluate only a single agent context (transcript) at a time. They lack the "state" to correlate evidence across different users. Consequently, they are structurally blind to misuse that is only visible in the aggregate. The paper demonstrates that attackers can evade standard monitors by splitting tasks so that no single session triggers a refusal, allowing the attack to proceed to significant harm before detection.

Methodology

1. The Distributed Agent Attack (The Threat)
The authors construct the first fully general distributed agent attack using a multi-agent scaffold called ARTEMIS.

Architecture: A supervisor agent (using a weaker model, gpt-oss-120b) receives a high-level cybersecurity objective. It delegates subtasks to stronger subagents (using gpt-5.2) running in isolated, fresh conversation contexts across different user accounts.
Obfuscation: The orchestrator frames each subtask as a benign engineering task (e.g., "scan this network," "validate credentials," "debug a script"). The harmful objective is only reconstructed when the supervisor aggregates the outputs.
Effectiveness: The attack successfully solves difficult cybersecurity tasks (CyBench) that the weak supervisor cannot solve alone, while evading standard monitors that catch only ~20% of such attempts compared to prior single-context attacks.

2. The Online Stateful Monitor (The Defense)
To counter this, the authors propose an online stateful monitor that reasons over groups of users rather than isolated transcripts. The system operates in real-time with three key stages:

Local Scoring: A standard monitor scores the incoming request ( $x_t$ ) for immediate suspiciousness.
Online Clustering: The request is embedded and compared against a set of online clusters representing semantically related prior interactions from other users.
- Instead of re-clustering all historical data (which is $O(N^2)$ and too slow), the system maintains a small set of cluster centroids ( $M_t$ ).
- New requests are routed to the nearest centroid. If the similarity is low, a new cluster is created; otherwise, the centroid and its buffer of evidence are updated online.
Cross-Context Escalation: A request is escalated to a "Cross-Context Monitor" (a stronger LLM judge) only if:
1. The local score is moderately high but not immediately denied, OR
2. The assigned cluster has accumulated sufficient cross-session evidence (e.g., multiple suspicious sessions in the same cluster).
- The Cross-Context Monitor reviews the current request alongside the top- $k$ most suspicious historical entries from the same cluster to determine if a coordinated campaign is occurring.

Key Contributions

First Distributed Agent Attack: The paper implements and evaluates a multi-agent attack that splits harmful tasks across user accounts, demonstrating that standard monitors fail to detect it effectively (catching it only 20% as often as single-context attacks).
Online Stateful Monitor: A novel defense architecture that uses real-time stream clustering to aggregate weak signals across millions of users. It escalates only rare, suspicious clusters to a heavy LLM judge, ensuring low latency for the vast majority of benign traffic.
Red-Teaming and Generalization: Through a two-month white-box red-teaming exercise, the authors refined the defense. Surprisingly, they found that the stateful monitor also improves detection of standard jailbreaks and sequential decomposition attacks, as adaptive attackers often reuse attack variants across different accounts, leaving traces that the stateful monitor can correlate.

Results
Evaluations were conducted using simulated datacenter traffic with a massive background of benign coding agent conversations (10x to 100x more benign than attack traffic).

Detection Performance: The stateful monitor Pareto dominates standard monitors. It achieves higher recall at the same false-positive rate (FPR). For example, at 100x benign background, it reached 65.8% recall at 1.47% FPR, whereas the best standard monitor achieved only 55% recall at the same FPR.
Time-to-Detect (TTD): The stateful monitor catches attacks 30% earlier in the trajectory. It reduces the number of harmful steps an attacker can take before detection (e.g., reducing TTD99 from 37.2 steps to 25.4 steps).
Latency: For ~99% of user traffic, the additional latency is negligible. The system only incurs the cost of the cross-context LLM judge for a tiny fraction of requests (the "tail" of suspicious traffic).
Red-Teaming: The defense successfully caught 82% of "monitor-context poisoning" attempts and 100% of sequential decomposition attacks during the red-teaming phase.

Significance and Claims
The paper argues that distributed attacks represent a fundamental limitation of current "stateless" safety architectures. The significance of this work lies in shifting the paradigm from isolated transcript monitoring to population-level reasoning.

The authors claim that while stateful monitoring does not solve distributed misuse (an adaptive attacker with strong obfuscation can still hide), it provides a critical defense layer that catches attacks earlier and with higher recall.
The approach is scalable, maintaining low latency for the majority of users while effectively identifying "needles in a haystack" by leveraging semantic clustering.
The finding that stateful monitoring generalizes to non-distributed threats (like jailbreaks) suggests that reasoning over user populations is a robust safety strategy for the future of agentic AI.

The Problem: The "Divide and Conquer" Trick

The Solution: The "Detective with a Memory"

Why This is a Big Deal

The Bottom Line

Technical Summary: Stateful Online Monitoring for Distributed Agent Attacks

More like this