Tracking the Behavioral Trajectories of Adapting Agents

Technical Summary: Tracking the Behavioral Trajectories of Adapting Agents

Problem Statement
Modern AI agents rely heavily on text-based configuration files—such as skill files, memory files, and behavioral configuration files (e.g., SOUL.md)—to define their capabilities, context, and constraints. These files are dynamic; they evolve through edits by humans, agents, or external processes. This evolution creates a significant security surface, as demonstrated by recent attacks where malicious instructions injected into memory files silently altered agent behavior across sessions. While the majority of file updates are benign, the challenge lies in reliably detecting rare, non-benign changes (such as an increased propensity to seek sensitive data) amidst a continuous stream of routine updates. Current evaluation paradigms rely on human-mediated observability or self-reported metadata, lacking a mechanism for one agent to autonomously and reliably assess the behavioral properties of another based on source file changes.

Methodology
The authors propose a methodology to measure "agent traits" by defining them as specific directions within the embedding space of a text embedding model. The core approach treats agent skills as adapting artifacts and analyzes the semantic difference (diff) between "before" and "after" versions of a skill file.

1. Trait Vector Learning:

   • Embedding: Text files are embedded using a model (specifically Qwen3-Embedding-8B) and normalized to unit length.
   • Diff Calculation: A diff vector is computed by subtracting the normalized "before" embedding from the "after" embedding. This vector is also normalized to ensure the regression learns from the direction of change rather than the magnitude of the edit.
   • Regression: A Ridge regression model is fitted to map these diff vectors to continuous labels ($y \in [-1, 1]$), where the labels represent the magnitude and direction of a trait change (e.g., -1 for strongly data-secure, +1 for strongly data-seeking). The resulting coefficient vector serves as the "trait vector."
   • Scoring: New edits are scored by projecting their normalized diff vector onto the learned trait vector.

2. Validation Framework:
   The methodology employs a closed-form leave-one-out cross-validation (LOOCV) using the PRESS statistic to ensure unbiased predictions on small datasets. Performance is measured via:

   • Sign Accuracy: The fraction of edits where the model correctly predicts the direction of the trait change (more or less trait-positive).
   • Spearman Rank Correlation ($\rho$): The model's ability to rank edits by severity.

3. Agent-to-Agent Protocol:
   To enable evaluation without direct trust between agents, the authors design a protocol mediated by a trusted runtime server.

   • Actors: A Requester (Agent A), an Executor (Agent B), and a Runtime Server.
   • Process: Agent A requests an evaluation via the server. Agent B receives a containerized executable (the embedding model) from the server, runs it locally on its own file diffs, and submits only the resulting diff vectors to the server. The server applies the trait vector to compute the score and returns the result to Agent A.
   • Security: This design ensures agents act as pure HTTP clients (no inbound endpoints) and separates execution from scoring, preventing the Executor from manipulating the final score.

Key Contributions

1. Trait Vector Methodology: A novel approach to measuring agent traits as linear directions in embedding space, applied specifically to diffs of agent skill files over time.
2. Empirical Validation: Validation of the methodology on a "data-seeking" trait using 68 labeled skill diff pairs.
3. Deployment Protocol: An agent-to-agent protocol that allows one agent to evaluate another's file updates through a trusted intermediary, generalizing beyond simple text evaluation.

Results
Evaluated on 68 labeled pairs for the trait of "propensity to seek sensitive data" under LOOCV:

• Sign Classification Accuracy: 91.2%.
• Spearman Rank Correlation: $\rho = 0.82$.
• Error Analysis: The 6 misclassified pairs all had small absolute prediction values (mean $|\hat{y}| = 0.085$) and small true label magnitudes, indicating the model was uncertain on subtle changes rather than confidently wrong.
• Baseline Comparison:
  • YARA Signatures: Achieved 63.2% accuracy and failed to fire rules on 14 diffs. The proposed method outperforms this by using context to distinguish between "credentials" in safeguards versus exfiltration instructions.
  • Frontier LLM (GPT-5.4): Achieved 100% sign accuracy. The authors position their method as a trade-off: it is less accurate than a frontier LLM but offers deterministic, fast, auditable, and reproducible scoring suitable for real-time monitoring.

Significance and Claims
The paper claims to provide a foundational step toward monitoring and evaluating AI agent behavior through their configuration files. By enabling the detection of dangerous trait changes (like increased data-seeking behavior) without human intervention, the work aims to improve the safety and trustworthiness of deployed agents. The authors note that while the methodology improves upon signature-based rules, it operates under specific trust assumptions (trusted embedding model and runtime server). They acknowledge that the same technique could theoretically be used by malicious actors to craft evasive edits, identifying adversarial robustness as a critical direction for future work. The system was successfully deployed in a live environment using a Hermes agent, demonstrating practical utility in flagging significant trait diffs, such as the addition of SSH and VM provisioning functionality.