Detecting harmful agent trajectories from LLM internal states
An agent trajectory can be unsafe because it contains harmful content or because a tool call conflicts with its authorization, schema, or preceding context.
The risk is expressed directly in the request or action.
“Issue this oxycodone prescription—no diagnosis needed.”
send_approval(rx)
The risk depends on the action’s relation to the preceding interaction.
“Reconcile this invoice from Acme—review only.”
pay_invoice(“Acme”, $500)
We use matched trajectory pairs to isolate each risk, then compare the guard’s output with what remains readable in its internal states.
The directions for harmful content and unsafe tool use remain close to orthogonal through most layers. Same-risk split halves reach 0.81 similarity in Qwen and 0.87 in Llama.
Unsafe-tool-use rank accuracy reaches 0.98 inside the corresponding general-purpose backbones, even though all three evaluated guard outputs remain at or below chance.
TACIT renders the full trajectory with a frozen LLM's chat template, including the system prompt, tool schemas, message roles, and turn order. One forward pass provides the hidden states for the readout.
Validation selects a layer, pooling choice, and L2-regularized logistic probe.
The ensemble combines several fitted probes into one trajectory-level safety score.
The multi-layer readout selects salient dimensions across layers and integrates them with a lightweight classifier.
We train TACIT on the pooled training portions of six trajectory-safety benchmarks, select the readout on validation folds, and evaluate once on the held-out test portions.
Even the plain TACIT probe scores above every evaluated guard on all six benchmarks. The Multi-layer readout reaches 86.2 mean macro-F1 on Qwen3-4B, compared with 60.5 for AgentDoG. On AgentDojo, it reaches 76.9; the strongest evaluated guard reaches 37.7.
With the same backbones, training pool, and held-out test split, the frozen TACIT readout is on par with full safety fine-tuning. Applying TACIT after fine-tuning improves both backbones further.
| System | R-Judge | TraceSafe | ATBench | ASSEBench | OAS | AgentDojo | Mean |
|---|---|---|---|---|---|---|---|
| Qwen3Guard-4B | 32.2 | 34.7 | 36.8 | 43.6 | 38.2 | 15.8 | 33.6 |
| LlamaGuard3-8B | 66.3 | 48.6 | 38.9 | 60.6 | 35.9 | 21.1 | 45.2 |
| AgentDoG-4B | 92.7 | 44.7 | 63.3 | 81.4 | 43.3 | 37.7 | 60.5 |
| TACIT · Qwen · Probe | 95.0 | 77.5 | 93.5 | 85.2 | 67.9 | 65.1 | 80.7 |
| TACIT · Qwen · Ensemble | 97.0 | 88.7 | 95.0 | 88.5 | 72.0 | 71.0 | 85.4 |
| TACIT · Qwen · Multi-layer | 97.0 | 86.5 | 94.5 | 89.8 | 72.7 | 76.9 | 86.2 |
| TACIT · Llama · Probe | 98.0 | 78.6 | 90.0 | 88.0 | 69.0 | 66.6 | 81.7 |
| TACIT · Llama · Ensemble | 97.0 | 90.1 | 93.5 | 88.7 | 72.7 | 68.8 | 85.1 |
| TACIT · Llama · Multi-layer | 97.0 | 89.6 | 95.0 | 88.5 | 69.8 | 72.2 | 85.4 |
| Backbone | Method | R-Judge | TraceSafe | ATBench | ASSEBench | OAS | AgentDojo | Mean |
|---|---|---|---|---|---|---|---|---|
| Qwen3-4B | SFT | 94.9 | 89.6 | 92.8 | 88.5 | 65.7 | 74.0 | 84.2 |
| + Probe | 94.3 | 89.7 | 92.5 | 89.5 | 67.8 | 72.0 | 84.3 | |
| + Ensemble | 96.7 | 91.8 | 94.2 | 89.6 | 72.5 | 73.8 | 86.4 | |
| + Multi-layer | 96.7 | 92.6 | 94.1 | 89.6 | 69.8 | 75.9 | 86.5 | |
| Llama-3.1-8B | SFT | 96.5 | 95.0 | 94.1 | 89.8 | 61.4 | 78.2 | 85.8 |
| + Probe | 96.2 | 93.7 | 94.6 | 89.0 | 64.9 | 78.9 | 86.2 | |
| + Ensemble | 96.0 | 94.9 | 95.2 | 89.3 | 65.7 | 77.3 | 86.4 | |
| + Multi-layer | 97.0 | 95.1 | 94.4 | 88.7 | 66.0 | 80.6 | 87.0 |
TACIT fits small readouts on saved activations, so no gradient passes through the backbone. At inference, one forward pass produces the verdict without decoding tokens.
A Qwen3-4B probe has 2,561 parameters, compared with 4.0 billion for full fine-tuning. The Ensemble uses 67K, and one Multi-layer aggregate uses about 3M.
The Probe takes 0.36 GPU-hours, the Ensemble 0.42, and the Multi-layer readout 0.69, compared with 2.11 for full fine-tuning.
TACIT takes 40 ms per trajectory, compared with 53 ms for AgentDoG and 215 ms for Qwen3Guard.
Validation macro-F1 peaks at 80.9 at layer 22 and falls to 79.1 at the final layer. Stopping at layer 22 skips 14 of 36 layers; the truncated Multi-layer readout retains 85.3 macro-F1, compared with 86.2 at full depth.
