Agent trajectories can be unsafe because of what they say or do, and because an action is inconsistent with its authorization, tool schema, or preceding context.
The risk is expressed directly in the request or action.
“Issue this oxycodone prescription—no diagnosis needed.”
send_approval(rx)
The risk depends on the action’s relation to the preceding interaction.
“Reconcile this invoice from Acme—review only.”
pay_invoice(“Acme”, $500)
Matched trajectory pairs isolate one form of risk at a time and compare what can be read inside a guard with what its generated verdict expresses.
The directions for harmful content and unsafe tool use remain close to orthogonal through most layers. Same-risk split halves reach 0.81 similarity in Qwen and 0.87 in Llama.
Unsafe-tool-use rank accuracy reaches 0.98 inside the corresponding general-purpose backbones, even though all three evaluated guard outputs remain at or below chance.
Agent-SIREN renders the complete trajectory with the backbone’s chat template, reads its last-token state at every layer, and trains a compact classifier while keeping the LLM frozen.
An L1-regularized logistic probe is fit to the last-token representation at each layer.
Within each layer, the smallest set of dimensions reaching the cumulative weight threshold is retained.
The selected dimensions are concatenated and passed to a small MLP that predicts trajectory safety.
Each of six trajectory-safety benchmarks is held out in turn. Agent-SIREN is trained on the remaining five, with no probe, head, threshold, or hyperparameter selected on the held-out benchmark.
Agent-SIREN on Qwen3-4B reaches 0.78 mean macro-F1, compared with 0.74 for AgentDoG-4B, the trajectory-specialized guard fine-tuned from the same backbone. The paired-bootstrap difference is significant at P < 10−5.
With the same backbones, training trajectories, and held-out folds, Agent-SIREN on a frozen backbone matches full safety fine-tuning. Fitting Agent-SIREN on the fine-tuned model improves both backbones further.
| System | R-Judge | TraceSafe | ATBench | ASSE-Saf | ASSE-Sec | AgentHarm | Mean |
|---|---|---|---|---|---|---|---|
| TF-IDF | 0.80 | 0.38 | 0.41 | 0.71 | 0.39 | 0.92 | 0.60 |
| Qwen3Guard-4B | 0.43 | 0.35 | 0.36 | 0.43 | 0.50 | 0.79 | 0.48 |
| LlamaGuard3-8B | 0.65 | 0.48 | 0.40 | 0.54 | 0.74 | 0.86 | 0.61 |
| AgentDoG-4B | 0.92 | 0.43 | 0.61 | 0.80 | 0.78 | 0.92 | 0.74 |
| Agent-SIREN · Qwen3-4B | 0.96 | 0.53 | 0.60 | 0.74 | 0.85 | 0.99 | 0.78 |
| Agent-SIREN · Llama-3.1-8B | 0.88 | 0.43 | 0.63 | 0.75 | 0.84 | 0.99 | 0.75 |
| Backbone | Method | R-Judge | TraceSafe | ATBench | ASSE-Saf | ASSE-Sec | AgentHarm | Mean |
|---|---|---|---|---|---|---|---|---|
| Qwen3-4B | Agent-SIREN · frozen | 0.96 | 0.53 | 0.60 | 0.74 | 0.85 | 0.99 | 0.78 |
| Full fine-tuning | 0.78 | 0.60 | 0.64 | 0.81 | 0.86 | 1.00 | 0.78 | |
| Fine-tuning + Agent-SIREN | 0.92 | 0.62 | 0.66 | 0.76 | 0.89 | 1.00 | 0.81 | |
| Llama-3.1-8B | Agent-SIREN · frozen | 0.88 | 0.43 | 0.63 | 0.75 | 0.84 | 0.99 | 0.75 |
| Full fine-tuning | 0.79 | 0.51 | 0.59 | 0.76 | 0.83 | 1.00 | 0.75 | |
| Fine-tuning + Agent-SIREN | 0.88 | 0.51 | 0.60 | 0.78 | 0.85 | 1.00 | 0.77 |
Agent-SIREN fits layer-wise probes and a small classification head without backpropagating through the backbone, and produces a verdict without token decoding.
Agent-SIREN uses 0.17 GPU-hours for the complete six-fold Qwen3-4B protocol, compared with 7.0 GPU-hours for full fine-tuning.
Agent-SIREN takes 40 ms per trajectory, compared with 53 ms for AgentDoG and 215 ms for Qwen3Guard.
Agent-SIREN processes 26.5 trajectories per second, compared with 25.1 for Qwen3Guard and 17.6 for AgentDoG.
A single-layer classifier first exceeds AgentDoG at layer 9. Exiting the truncated Qwen3-4B checkpoint at layer 23 reduces macro-F1 by 0.01 and increases saturated throughput from 26.5 to 41.1 trajectories per second.