Pith. sign in

REVIEW 3 major objections 6 minor 33 references

A telemetry-only, one-class monitor can detect and repair a substantial share of LLM-agent failures in real time at microsecond cost per step, without a judge model in the loop.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-04 06:48 UTC pith:EFTZH2JL

load-bearing objection The deterministic checks and repair loop are the real contribution; the telemetry monitor's headline detection numbers come from a simulator, not the real corpus, and the organic validation is at chance — fix the abstract and this is a solid, honest system study. the 3 major comments →

arxiv 2608.02464 v1 pith:EFTZH2JL submitted 2026-08-03 cs.AI cs.LGcs.SE

Real-Time Detection and Repair of LLM Agent Failures

Sunny Dubey This is my paper
classification cs.AI cs.LGcs.SE
keywords LLM agentsfailure detectionone-class anomaly detectionecho state networkCUSUMtelemetry monitoringdeterministic verificationrollback repair
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

This paper aims to establish that LLM-agent failures can be detected and partly repaired from observable step telemetry alone — semantic embeddings, token-uncertainty aggregates, and action metadata — using monitors that cost microseconds per step and train only on healthy runs. The evidence is a one-class echo-state-network ensemble with CUSUM alarms, which detects 0.71 of injected failures at a 4.4% false-alarm rate (AUROC 0.872) in the controlled study and whose advantage over a memoryless baseline grows monotonically with the number of steps after onset, plus deterministic verification that recomputes a run's stated total from the tool results it actually received and catches 60% of failures (96% with a coverage check) at zero false positives on the served corpus. Detection is then closed into repair: rolling a flagged episode back to its last fact-gathering step and re-running with the name of the failing check recovers 45% of genuinely wrong episodes against a 16% resampling control (p=0.0005), lifting net task success from 52% to 73% for about one extra model call per run. The sympathetic reading is that cheap telemetry plus arithmetic grounding covers most of the agent-failure space, with a measured boundary: the statistical monitor needs a per-deployment healthy null and does not transfer cold, and content corruption is invisible unless the telemetry channel explicitly carries content.

Core claim

On the paper's own terms, the central claim is that an always-on watchdog over step-level telemetry can carry most of the failure-detection burden that is usually assigned to a second LLM. A causal one-class reservoir (echo-state network) with per-channel CUSUM accumulation scores each step in roughly 200 microseconds, detects 0.71 of failures at a 4.4% false-alarm budget (AUROC 0.872) in the controlled study, and its margin over a memoryless detector is a monotone function of post-onset horizon (+0.09 at <=3 steps, +0.40 at >=9). Because the one-class monitor needs a per-deployment healthy null and still spends some false alarms, the paper adds a deterministic verification layer — recomputi

What carries the argument

The central mechanism is a two-layer architecture. The first layer is a one-class echo-state-network ensemble: a frozen random recurrent reservoir per telemetry channel projects the step stream into a fixed feature space, a closed-form ridge readout predicts the next step, and a one-sided CUSUM statistic accumulates the normalized prediction error channel-wise, alarming on the loudest channel. This is what makes detection temporal — slow persistent shifts integrate while noise does not — and affordable (closed-form fit, ~200 microseconds per step). The second layer is deterministic verification: total_consistency recomputes a run's stated total from the tool results it actually received, req

Load-bearing premise

The whole telemetry-monitor half of the argument rests on being able to collect a healthy null from the exact serving distribution before deployment; if a deployment cannot produce that null — because temperature, toolset, prompt probe pattern, or latency regime shift — the statistical monitor is inapplicable and only the deterministic checks remain.

What would settle it

On a held-out deployment that matches the paper's served configuration, collect a healthy null, inject a looping failure that gives the monitor at least nine post-onset steps, and measure whether the ESN/CUSUM detects it at the 5% false-alarm budget; the paper predicts a decisive win over the memoryless baseline there, so near-chance detection would falsify the horizon-dependence claim.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • Deployments can run an always-on watchdog at roughly 200 microseconds per step, three orders of magnitude below a judge call, making continuous monitoring of every agent step affordable.
  • Failures with temporal room — looping, cascading tool errors, slow drift — are the statistical monitor's strength; short-horizon failures need the memoryless baseline or the deterministic checks.
  • Deterministic checks give near-perfect precision on numeric consistency, required calls, and tool-result shape, and transfer across model families with no retraining, so they can be shipped with no healthy null.
  • When a check flags a run, rolling back to the last fact-gathering step and re-running with only the name of the failing check recovers a meaningful fraction of wrong episodes, and the net success gain (52% to 73%) is real because the checks never flag an already-correct episode.
  • The monitored system can be configured to escalate only on alarm, using a judge as a complement rather than a per-step default, because judge and monitor fail on different failure classes.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • Because judge and monitor fail on different classes, the natural deployment is an escalation layer: let the cheap monitor run every step and route only its alarms (plus judge-blind classes like context corruption) to a judge; the paper's measured judge numbers suggest the savings survive but the detection gain is smaller than a stipulated-oracle analysis implied.
  • The horizon-dependence result suggests a tiered detector: memoryless distance for the first few steps after onset, reservoir accumulation for slow drifts, and deterministic checks for content corruption; the paper's hybrid is a step in that direction but a deployment could tune the mixture online.
  • The repair finding — naming the failing check without values recovers more than supplying the correct answer — suggests the mechanism is attention redirection rather than answer-giving; a direct test would vary the prompt's information content while holding the rollback fixed.
  • The organic-failure base rate was too low for a statistical fabrication claim; longer or adversarially prompted deployments could reveal whether the grounding verifier's sensitivity under provocation (about half) holds when fabrications are more frequent.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The paper proposes a lightweight, causal detection layer for LLM-agent failures: per-step telemetry (hash embedding, token uncertainty, action metadata) is fed to a one-class ESN ensemble with CUSUM alarms trained only on healthy episodes, optionally fused with Mahalanobis and a content-grounding channel, and supplemented by deterministic checks (total consistency, required coverage, tool contract) that need no null model. The authors report a 2,823-episode real-ecosystem corpus, a controlled simulator study isolating detector mechanics, out-of-sample ranking on AFTraj-2K and ATBench, a largely negative organic-failure validation, and a rollback-and-rerun repair study with a resampling control, claiming a 45% recovery of genuinely wrong episodes and a 52% to 73% task-success lift.

Significance. If the claims hold, the paper contributes a cheap (~200 microseconds per step) alternative to per-step LLM judging, with unusually candid negative results: organic failures at/below chance, no cross-deployment transfer, an explicitly underpowered fabrication study, and kept negative repair rungs. The deterministic verification and repair results are the strongest contributions, and the artifact release with SHA-256 manifest, frozen held-out tests, and Bonferroni-corrected repair comparison is a model of reproducible empirical work. The main advertised telemetry number, however, comes from a simulator and is presented in the abstract as a real-corpus result, so the significance of the statistical monitor itself is currently overstated.

major comments (3)
  1. [Abstract and §6] The headline "0.71 of failures at 5% FA (AUROC 0.872)" is presented in the abstract as measured on the 2,823-episode real corpus, but §6 says the controlled study "is a mechanism study, and no deployment claim rests on it" and reports 0.707±0.068 / 0.872±0.015 on constructed simulator telemetry. Section 5, the real-ecosystem spine, reports only per-class coverage and per-deployment AUROCs, not a pooled 0.71; §9's organic-failure validation gives within-organic AUROC 0.31–0.42 and 1/3 catch of fabrications. This misattribution is load-bearing because the 0.71 number is the paper's public claim. Please either move the simulator number out of the real-corpus sentence or report the real-corpus pooled detection rate at the top, and reconcile the abstract with §6's caveat.
  2. [§9, §11, Conclusion] The concluding sentence "Observable step telemetry covers most of the agent-failure space" goes beyond the measured evidence. The organic (non-injected) test ranks the failure set at/below chance (AUROC 0.31–0.42), catches only 1 of 3 fabrications, and silent aborts are caught by a five-line completion check, not by telemetry; §11(2) says slow goal drift evades every per-step-surprise monitor, and §11(4) says plausible-value corruption is undetectable by construction. The supported claim is narrower: a cheap monitor catches specific mechanically visible classes under a per-deployment matched null, while deterministic verification and escalation carry the rest. The abstract and conclusion should state that boundary rather than "most of the agent-failure space".
  3. [§10, Table 3] The status of the deterministic checks' numbers is ambiguous. The text says the checks were written after inspecting failures in the serving arm, "so that arm cannot also be their test set," yet Table 3 presents head-to-head recall/false-positive figures (60%, 0/63) before introducing the frozen 120-episode held-out set (54%, 0/64). Please label which rows are development and which are the prospective test, and clarify whether the llama3.1:8b "110 of 110" figure is on the same held-out seeds. The central verification claim rests on this distinction, so it should be explicit in the table.
minor comments (6)
  1. [§6] Hypotheses H1 and H3b are referenced but never formally stated. Please define them explicitly or remove the labels.
  2. [Eqs. (3)–(4)] The one-step prediction \hat{x}_{t+1} in (3) is compared with x_t in (4). Align the time index so the reader can see the monitor is causal and the prediction is for the current step.
  3. [§5.1 and Abstract] The abstract phrase "Ranking transfers ... AFTraj-2K 0.745, ATBench 0.779" is easy to read as detection transfer; the body reports detection at only 0.048 on AFTraj-2K at the 5% budget. State both ranking AUROC and operating-point detection together.
  4. [Table 3, Figure 4] Add confidence intervals or bootstrap intervals to the per-deployment AUROC points and to the 0/63 and 0/64 false-positive counts. With 63–64 healthy episodes, a 0 count has a nontrivial upper bound and the reader currently cannot judge precision.
  5. [§4] The v2 row says tool results are appended into step text while the dimension count remains 43. Explain how the dimensionality is unchanged despite added content.
  6. [§9] The organic-failure sample is very small (11 organic failures; 2 hallucinations in the pre-registered 55 episodes). The paper is appropriately cautious, but the abstract should also state this small-n boundary rather than implying broad organic coverage.

Circularity Check

0 steps flagged

No significant circularity: the paper is an empirical systems study with external benchmarks, disjoint held-out evaluation, and no self-citation chain.

full rationale

The paper does not present a derivation that reduces to its own inputs. The ESN/CUSUM monitor is one-class and fitted only on healthy runs, with the threshold θ read from healthy validation episodes (Eq. 6) — this is calibration, not a prediction from the target. The horizon-effect 'prediction' on AFTraj-2K is an out-of-sample transfer of an observed relationship to corpora built by other groups (§5.1), so it is not a fitted input renamed as a prediction. The deterministic checks were frozen and evaluated on 120 later episodes at disjoint seeds (§10), and the paper reports its negative organic results (within-organic AUROC 0.31–0.42, 1/3 fabrications caught) and its underpowered pre-registered study (§9, §11) rather than hiding them. The simulator is explicitly quarantined: 'This section is a mechanism study, and no deployment claim rests on it' and 'The class-channel signatures are therefore designed in' (§6), so any designed-in detectability is acknowledged, not presented as evidence. There are no self-citations, no imported uniqueness theorems, and no ansatz smuggled in via citation. The abstract's placement of the simulator's 0.71/AUROC 0.872 alongside the 2,823-episode corpus is a reporting/overclaim concern that belongs under correctness risk, not circularity.

Axiom & Free-Parameter Ledger

6 free parameters · 8 axioms · 0 invented entities

The paper introduces no new physical or mathematical entities; its contributions are empirical mechanisms (telemetry channels, checks, repair policies). The central statistical claims rest on standard change-detection/reservoir machinery, while the deployment claims rest on the domain assumptions above—most notably the existence of a per-deployment healthy null and accurate labels/contracts.

free parameters (6)
  • ESN reservoir hyperparameters (size, spectral radius, leakage α, ensemble size K)
    Set before fitting; control how much temporal evidence the reservoir integrates (§3). No reported values or sensitivity sweep in the text.
  • CUSUM drift allowance κ and alarm threshold θ
    κ sets the per-step drift budget in eq. (5); θ is calibrated on healthy validation episodes to meet the false-alarm budget β (§3, eq. 6).
  • Per-channel residual scale σ_err
    Normalizes surprise in eq. (4); measured on held-out healthy runs, so the alarm scale is deployment-specific.
  • Logistic fusion weights for hybrid ESN+Mahalanobis = cross-fit weights
    Supervised fusion in §7; learned weights recover the deployment regime but are fitted to labelled injected episodes, so they are not label-free.
  • Content-grounding channel thresholds (JSON-prefix validity, char anomaly, lexical flag)
    Nine v4 features in §8; thresholds chosen to separate off-topic retrievals; no explicit threshold values are reported.
  • Telemetry dimensionality versions (43/51/60)
    Feature set grown across versions v1–v4; dimensions and feature choices are design decisions that affect the central results.
axioms (8)
  • standard math CUSUM sequential change detection and one-class anomaly detection are valid statistical tools for the telemetry stream.
    Used throughout §3; standard theory is cited and not re-derived.
  • standard math The reservoir (ESN) with frozen random recurrent weights provides a sufficiently rich feature map; ridge readout is closed-form.
    §3, Equations 2–3; the paper relies on the standard approximation property of reservoir computing.
  • domain assumption The telemetry vector x_t (hash embedding, token surprisal, action metadata) is causally computable per step and contains enough signal.
    §4; if telemetry misses content or is not structured, the monitors fail, as acknowledged in §8 and §11.
  • domain assumption Healthy null episodes can be collected under the exact serving distribution before deployment.
    §5/§11; monitors do not transfer cold, so this is a load-bearing deployment assumption.
  • domain assumption Failure labels in the corpora (injected onsets and organic labels) are accurate ground truth.
    Evaluation of detection and repair depends on labels; the paper describes verified onsets and an objective labeller but cannot prove label completeness.
  • ad hoc to paper Each figure asserted by the agent must trace to a tool result the agent actually received, or an arithmetic combination thereof.
    Core rule of the deterministic grounding verifier, §9–10; it defines what counts as fabrication for that check.
  • domain assumption Tool contracts (allowed result shapes) are known and available for validation.
    The tool_contract check requires a specification of result shapes per tool; absent for arbitrary tools in other deployments.
  • domain assumption The task oracle's success grading is reliable and unseen by repair prompts.
    §10; repair recovery and net success are measured against it.

pith-pipeline@v1.3.0-daily-deepseek · 13220 in / 12038 out tokens · 115033 ms · 2026-08-04T06:48:50.346896+00:00 · methodology

0 comments
read the original abstract

LLM agents fail mid-episode -- they loop, cascade tool errors, drift off goal, fabricate results, or silently absorb corrupted content -- and the standard remedy, judging every step with a second LLM, costs more than the agent itself. We ask how much detection is achievable from observable step telemetry alone, using monitors costing microseconds per step and trained only on healthy runs. On 2,823 committed agent episodes across three frameworks, three local models (qwen2.5 7b/3b, llama3.1 8b) and a commercial API (gemini-2.5-flash), a one-class echo-state-network ensemble with CUSUM alarms detects 0.71 of failures at a 5% false-alarm budget (AUROC 0.872). Its advantage over a memoryless baseline is a monotone function of post-onset horizon (+0.09 at <=3 steps, +0.40 at >=9), predicting its own failure region out of sample on AFTraj-2K. Ranking transfers with no retraining to two corpora from other groups (AFTraj-2K 0.745, ATBench 0.779). Monitors carry two burdens: a per-deployment healthy null (they do not transfer -- AUROC 0.527 cold against 0.885 recalibrated) and a residual false-alarm rate. We add a layer carrying neither: deterministic verification, which recomputes a run's stated total from the tool results it actually received and confirms every required call was made. Head-to-head it catches 60% of failures (96% with the coverage check) at 0 of 63 false positives against the monitor's 54% at 17%, transfers unchanged to llama3.1:8b (110 of 110 at 0 of 10), and trips on 0 of 1825 healthy episodes. Detection is then closed into repair: each flagged run is rolled back and re-run live, recovering 45% of failures against a 16% resampling control (p=0.0005) and lifting task success from 52% to 73% for about one extra model call per run. The system runs at ~200 microseconds per step, three orders of magnitude below a judge call. Code, traces and results are released.

Figures

Figures reproduced from arXiv: 2608.02464 by Sunny Dubey.

Figure 1
Figure 1. Figure 1: Real agent traces (ollama7b: qwen2.5:7b against real tools). One-class CUSUM score streams per failure class; dashed = threshold at the 5% validation FA budget, dotted = verified injection onset. The healthy run stays two orders of magnitude below the line, and every injected class — context corruption, goal drift, looping and tool cascade — alarms one step after onset. The sixth panel is grounding loss, a… view at source ↗
Figure 2
Figure 2. Figure 2: Real deployments: where the monitor works, by failure class. Primary-monitor detection rate, nine real corpora, blank where a corpus does not contain that class (absent and undetected are different claims). This is the honest coverage picture the simulator cannot give: looping is caught almost everywhere (0.48–1.00) and tool cascade widely but not uniformly (0.17–1.00), goal drift is caught wherever it is … view at source ↗
Figure 3
Figure 3. Figure 3: Monitor and judge fail on different classes. Both series are measured on the same real corpus: the judge rates from a live gemini-2.5-flash run on a labelled subset (161 distinct prompts), the monitor rates from the primary monitor on that corpus. The judge is perfect on goal drift and nearly blind on context corruption (0.18); the monitor is the reverse on context corruption (1.00). This is the empirical … view at source ↗
Figure 4
Figure 4. Figure 4: Monitor comparison on the real corpora only. Episode AUROC, one dot per real deployment and a bar at the mean; the simulator is excluded. The spread is the point: several per￾dataset orderings that look decisive are ties once power is accounted for, so the defensible comparison is the pooled one rather than any single deployment. 8 [PITH_FULL_IMAGE:figures/full_fig_p008_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Hybrid logistic fusion: episode positions at the deciding step in the (Mahalanobis, ESN) [PITH_FULL_IMAGE:figures/full_fig_p010_5.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

33 extracted references · 13 linked inside Pith

  1. [1]

    Xing, Hao Zhang, Joseph E

    Lianmin Zheng, Wei-Lin Chiang, Ying Sheng, Siyuan Zhuang, Zhanghao Wu, Yonghao Zhuang, Zi Lin, Zhuohan Li, Dacheng Li, Eric P. Xing, Hao Zhang, Joseph E. Gonzalez, and Ion Stoica. Judging LLM-as-a-judge with MT-Bench and Chatbot Arena. InAdvances in Neural Information Processing Systems (NeurIPS) Datasets and Benchmarks Track, 2023

    2023

  2. [2]

    E. S. Page. Continuous inspection schemes.Biometrika, 41(1/2):100–115, 1954

    1954

  3. [3]

    Nikiforov.Detection of Abrupt Changes: Theory and Application

    Michèle Basseville and Igor V . Nikiforov.Detection of Abrupt Changes: Theory and Application. Prentice Hall, 1993

    1993

  4. [4]

    Anomaly detection: A survey.ACM Computing Surveys, 41(3):1–58, 2009

    Varun Chandola, Arindam Banerjee, and Vipin Kumar. Anomaly detection: A survey.ACM Computing Surveys, 41(3):1–58, 2009

    2009

  5. [5]

    A simple unified framework for detecting out-of-distribution samples and adversarial attacks

    Kimin Lee, Kibok Lee, Honglak Lee, and Jinwoo Shin. A simple unified framework for detecting out-of-distribution samples and adversarial attacks. InAdvances in Neural Information Processing Systems (NeurIPS), 2018

    2018

  6. [6]

    A baseline for detecting misclassified and out-of-distribution examples in neural networks

    Dan Hendrycks and Kevin Gimpel. A baseline for detecting misclassified and out-of-distribution examples in neural networks. InInternational Conference on Learning Representations (ICLR), 2017

    2017

  7. [7]

    Isolation forest

    Fei Tony Liu, Kai Ming Ting, and Zhi-Hua Zhou. Isolation forest. InIEEE International Conference on Data Mining (ICDM), pages 413–422, 2008

    2008

  8. [8]

    echo state

    Herbert Jaeger. The “echo state” approach to analysing and training recurrent neural networks. Technical Report 148, GMD – German National Research Institute for Computer Science, 2001

    2001

  9. [9]

    Reservoir computing approaches to recurrent neural network training.Computer Science Review, 3(3):127–149, 2009

    Mantas Lukoševiˇcius and Herbert Jaeger. Reservoir computing approaches to recurrent neural network training.Computer Science Review, 3(3):127–149, 2009

    2009

  10. [10]

    Weinberger

    Chuan Guo, Geoff Pleiss, Yu Sun, and Kilian Q. Weinberger. On calibration of modern neural networks. InInternational Conference on Machine Learning (ICML), 2017

    2017

  11. [11]

    ReAct: Synergizing reasoning and acting in language models

    Shunyu Yao, Jeffrey Zhao, Dian Yu, Nan Du, Izhak Shafran, Karthik Narasimhan, and Yuan Cao. ReAct: Synergizing reasoning and acting in language models. InInternational Conference on Learning Representations (ICLR), 2023

    2023

  12. [12]

    White, Doug Burger, and Chi Wang

    Qingyun Wu, Gagan Bansal, Jieyu Zhang, Yiran Wu, Beibin Li, Erkang Zhu, Li Jiang, Xiaoyun Zhang, Shaokun Zhang, Jiale Liu, Ahmed Hassan Awadallah, Ryen W. White, Doug Burger, and Chi Wang. AutoGen: Enabling next-gen LLM applications via multi-agent conversation. arXiv preprint arXiv:2308.08155, 2023. 14

    Pith/arXiv arXiv 2023

  13. [13]

    AgentBench: Evaluating LLMs as agents

    Xiao Liu, Hao Yu, Hanchen Zhang, Yifan Xu, Xuanyu Lei, Hanyu Lai, Yu Gu, Hangliang Ding, Kaiwen Men, Kejuan Yang, Shudan Zhang, Xiang Deng, Aohan Zeng, Zhengxiao Du, Chenhui Zhang, Sheng Shen, Tianjun Zhang, Yu Su, Huan Sun, Minlie Huang, Yuxiao Dong, and Jie Tang. AgentBench: Evaluating LLMs as agents. InInternational Conference on Learning Representatio...

    2024

  14. [14]

    Pan, Shuyi Yang, Lakshya A

    Mert Cemri, Melissa Z. Pan, Shuyi Yang, Lakshya A. Agrawal, Bhavya Chopra, Rishabh Tiwari, Kurt Keutzer, Aditya Parameswaran, Dan Klein, Kannan Ramchandran, Matei Zaharia, Joseph E. Gonzalez, and Ion Stoica. Why do multi-agent LLM systems fail?arXiv preprint arXiv:2503.13657, 2025

    Pith/arXiv arXiv 2025

  15. [15]

    Which agent causes task failures and when? on automated failure attribution of LLM multi-agent systems.arXiv preprint arXiv:2505.00212, 2025

    Shaokun Zhang, Ming Yin, Jieyu Zhang, Jiale Liu, Zhiguang Han, Jingyang Zhang, Beibin Li, Chi Wang, Huazheng Wang, Yiran Chen, and Qingyun Wu. Which agent causes task failures and when? on automated failure attribution of LLM multi-agent systems.arXiv preprint arXiv:2505.00212, 2025

    Pith/arXiv arXiv 2025

  16. [16]

    AgentFore- sight: Online auditing for early failure prediction in multi-agent systems.arXiv preprint arXiv:2605.08715, 2026

    Boxuan Zhang, Jianing Zhu, Zeru Shi, Dongfang Liu, and Ruixiang Tang. AgentFore- sight: Online auditing for early failure prediction in multi-agent systems.arXiv preprint arXiv:2605.08715, 2026

    Pith/arXiv arXiv 2026

  17. [17]

    When evidence is sparse: Weakly supervised early failure alerting in dialogs and LLM-agent trajectories.arXiv preprint arXiv:2606.05414, 2026

    Avinash Baidya, Xinran Liang, Ruocheng Guo, Xiang Gao, and Kamalika Das. When evidence is sparse: Weakly supervised early failure alerting in dialogs and LLM-agent trajectories.arXiv preprint arXiv:2606.05414, 2026

    Pith/arXiv arXiv 2026

  18. [18]

    Poskitt, and Jun Sun

    Haoyu Wang, Christopher M. Poskitt, and Jun Sun. AgentSpec: Customizable runtime enforce- ment for safe and reliable LLM agents. InIEEE/ACM International Conference on Software Engineering (ICSE), 2026. arXiv:2503.18666, 2025

    Pith/arXiv arXiv 2026

  19. [19]

    Poskitt, Jiali Wei, and Jun Sun

    Haoyu Wang, Christopher M. Poskitt, Jiali Wei, and Jun Sun. ProbGuard: Probabilistic runtime monitoring for LLM agent safety.arXiv preprint arXiv:2508.00500, 2025

    Pith/arXiv arXiv 2025

  20. [20]

    PrefixGuard: From LLM-agent traces to online failure-warning monitors.arXiv preprint arXiv:2605.06455, 2026

    Xinmiao Huang, Jinwei Hu, Rajarshi Roy, Changshun Wu, Yi Dong, and Xiaowei Huang. PrefixGuard: From LLM-agent traces to online failure-warning monitors.arXiv preprint arXiv:2605.06455, 2026

    Pith/arXiv arXiv 2026

  21. [21]

    Trajectory guard: A lightweight, sequence-aware model for real-time anomaly detection in agentic AI.arXiv preprint arXiv:2601.00516, 2026

    Laksh Advani. Trajectory guard: A lightweight, sequence-aware model for real-time anomaly detection in agentic AI.arXiv preprint arXiv:2601.00516, 2026

    arXiv 2026

  22. [22]

    AgentTether: Graph-guided diagnosis and runtime intervention for reliable LLM agent operation.arXiv preprint arXiv:2607.06273, 2026

    Chenyu Zhao, Shenglin Zhang, Wenwei Gu, Yongqian Sun, Dan Pei, Chetan Bansal, Saravan Rajmohan, and Minghua Ma. AgentTether: Graph-guided diagnosis and runtime intervention for reliable LLM agent operation.arXiv preprint arXiv:2607.06273, 2026

    Pith/arXiv arXiv 2026

  23. [23]

    A survey on LLM-as-a-judge.arXiv preprint arXiv:2411.15594, 2024

    Jiawei Gu, Xuhui Jiang, Zhichao Shi, Hexiang Tan, Xuehao Zhai, Chengjin Xu, Wei Li, Yinghan Shen, Shengjie Ma, Honghao Liu, Saizhuo Wang, Kun Zhang, Yuanzhuo Wang, Wen Gao, Lionel Ni, and Jian Guo. A survey on LLM-as-a-judge.arXiv preprint arXiv:2411.15594, 2024

    Pith/arXiv arXiv 2024

  24. [24]

    Judging the judges: A systematic study of position bias in LLM-as-a-judge

    Lin Shi, Chiyu Ma, Wenhua Liang, Xingjian Diao, Weicheng Ma, and Soroush V osoughi. Judging the judges: A systematic study of position bias in LLM-as-a-judge. InConference of the Asia-Pacific Chapter of the Association for Computational Linguistics (AACL-IJCNLP),

  25. [25]

    Survey of hallucination in natural language generation

    Ziwei Ji, Nayeon Lee, Rita Frieske, Tiezheng Yu, Dan Su, Yan Xu, Etsuko Ishii, Ye Jin Bang, Andrea Madotto, and Pascale Fung. Survey of hallucination in natural language generation. ACM Computing Surveys, 55(12):1–38, 2023

    2023

  26. [26]

    LLM-based agents suffer from hallucinations: A survey of taxonomy, methods, and directions.arXiv preprint arXiv:2509.18970, 2025

    Xixun Lin, Yucheng Ning, Jingwen Zhang, Yan Dong, Yilong Liu, Yongxuan Wu, Xiaohua Qi, Nan Sun, Yanmin Shang, Kun Wang, Pengfei Cao, Qingyue Wang, Lixin Zou, Xu Chen, Chuan Zhou, Jia Wu, Peng Zhang, Qingsong Wen, Shirui Pan, Bin Wang, Yanan Cao, Kai Chen, Songlin Hu, and Li Guo. LLM-based agents suffer from hallucinations: A survey of taxonomy, methods, a...

    arXiv 2025

  27. [27]

    Potsawee Manakul, Adian Liusie, and Mark J. F. Gales. SelfCheckGPT: Zero-resource black- box hallucination detection for generative large language models. InConference on Empirical Methods in Natural Language Processing (EMNLP), 2023

    2023

  28. [28]

    Detecting hallucinations in large language models using semantic entropy.Nature, 630:625–630, 2024

    Sebastian Farquhar, Jannik Kossen, Lorenz Kuhn, and Yarin Gal. Detecting hallucinations in large language models using semantic entropy.Nature, 630:625–630, 2024

    2024

  29. [29]

    Semantic entropy probes: Robust and cheap hallucination detection in LLMs.arXiv preprint arXiv:2406.15927, 2024

    Jannik Kossen, Jiatong Han, Muhammed Razzak, Lisa Schut, Shreshth Malik, and Yarin Gal. Semantic entropy probes: Robust and cheap hallucination detection in LLMs.arXiv preprint arXiv:2406.15927, 2024

    Pith/arXiv arXiv 2024

  30. [30]

    Detect- ing strategic deception with linear probes

    Nicholas Goldowsky-Dill, Bilal Chughtai, Stefan Heimersheim, and Marius Hobbhahn. Detect- ing strategic deception with linear probes. InInternational Conference on Machine Learning (ICML), volume 267 ofPMLR, pages 19755–19786, 2025

    2025

  31. [31]

    Doomed from the start: Early abort of LLM agent episodes via a recall-controlled probe cascade.arXiv preprint arXiv:2607.06503, 2026

    Kai Ruan, Zihe Huang, Ziqi Zhou, Qianshan Wei, Xuan Wang, and Hao Sun. Doomed from the start: Early abort of LLM agent episodes via a recall-controlled probe cascade.arXiv preprint arXiv:2607.06503, 2026

    Pith/arXiv arXiv 2026

  32. [32]

    ATBench: A diverse and realistic agent trajectory benchmark for long-horizon agent safety.arXiv preprint arXiv:2604.02022, 2026

    Shanghai AI Laboratory. ATBench: A diverse and realistic agent trajectory benchmark for long-horizon agent safety.arXiv preprint arXiv:2604.02022, 2026. 16

    Pith/arXiv arXiv 2026

  33. [2025]

    arXiv:2406.07791, 2024

    arXiv 2024