Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Catching Contamination Before Generation: Spectral Kill Switches for Agents

Valentin Noël

TL;DR

This work addresses the risk of contamination in multi-step, retrieval-augmented agent reasoning by introducing a training-free inline verifier based on spectral analysis of attention-induced token graphs. The core idea is the high-frequency energy ratio ($HFER$), which exhibits a robust bimodal separation in early transformer layers, enabling a binary kill-switch with sub-millisecond latency during the forward pass. The approach is supported by theoretical guarantees (scale invariance, Dirichlet-energy bounds, Bayes-optimal thresholding under MLR) and practical calibration protocols using as few as ~20 labeled examples, demonstrated across multiple model families. By integrating HFER into RAG pipelines and enabling per-step verification and backtracking, the method provides a scalable, interpretable, and production-friendly safety primitive that complements existing post-hoc detectors and defense-in-depth strategies.

Abstract

Agentic language models compose multi step reasoning chains, yet intermediate steps can be corrupted by inconsistent context, retrieval errors, or adversarial inputs, which makes post hoc evaluation too late because errors propagate before detection. We introduce a diagnostic that requires no additional training and uses only the forward pass to emit a binary accept or reject signal during agent execution. The method analyzes token graphs induced by attention and computes two spectral statistics in early layers, namely the high frequency energy ratio and spectral entropy. We formalize these signals, establish invariances, and provide finite sample estimators with uncertainty quantification. Under a two regime mixture assumption with a monotone likelihood ratio property, we show that a single threshold on the high frequency energy ratio is optimal in the Bayes sense for detecting context inconsistency. Empirically, the high frequency energy ratio exhibits robust bimodality during context verification across multiple model families, which enables gating decisions with overhead below one millisecond on our hardware and configurations. We demonstrate integration into retrieval augmented agent pipelines and discuss deployment as an inline safety monitor. The approach detects contamination while the model is still processing the text, before errors commit to the reasoning chain.

Catching Contamination Before Generation: Spectral Kill Switches for Agents

TL;DR

This work addresses the risk of contamination in multi-step, retrieval-augmented agent reasoning by introducing a training-free inline verifier based on spectral analysis of attention-induced token graphs. The core idea is the high-frequency energy ratio (), which exhibits a robust bimodal separation in early transformer layers, enabling a binary kill-switch with sub-millisecond latency during the forward pass. The approach is supported by theoretical guarantees (scale invariance, Dirichlet-energy bounds, Bayes-optimal thresholding under MLR) and practical calibration protocols using as few as ~20 labeled examples, demonstrated across multiple model families. By integrating HFER into RAG pipelines and enabling per-step verification and backtracking, the method provides a scalable, interpretable, and production-friendly safety primitive that complements existing post-hoc detectors and defense-in-depth strategies.

Abstract

Agentic language models compose multi step reasoning chains, yet intermediate steps can be corrupted by inconsistent context, retrieval errors, or adversarial inputs, which makes post hoc evaluation too late because errors propagate before detection. We introduce a diagnostic that requires no additional training and uses only the forward pass to emit a binary accept or reject signal during agent execution. The method analyzes token graphs induced by attention and computes two spectral statistics in early layers, namely the high frequency energy ratio and spectral entropy. We formalize these signals, establish invariances, and provide finite sample estimators with uncertainty quantification. Under a two regime mixture assumption with a monotone likelihood ratio property, we show that a single threshold on the high frequency energy ratio is optimal in the Bayes sense for detecting context inconsistency. Empirically, the high frequency energy ratio exhibits robust bimodality during context verification across multiple model families, which enables gating decisions with overhead below one millisecond on our hardware and configurations. We demonstrate integration into retrieval augmented agent pipelines and discuss deployment as an inline safety monitor. The approach detects contamination while the model is still processing the text, before errors commit to the reasoning chain.

Paper Structure

This paper contains 52 sections, 4 theorems, 14 equations, 3 figures, 1 table, 2 algorithms.

Table of Contents

  1. Introduction and Motivation
  2. Building on spectral methods for agent safety.
  3. The Agentic Verification Problem
  4. Our Approach: Spectral Kill Switch
  5. Why This Matters for Trustworthy Agents
  6. Position in the Trustworthy AI Landscape
  7. Contributions
  8. Paper Organization
  9. Reproducibility.
  10. Method source.
  11. Formal Setup
  12. Properties and Guarantees
  13. Statistical Estimation and Uncertainty
  14. The Bimodal Regime: Detection vs Acceptance
  15. Supporting observations.
  16. ...and 37 more sections

Key Result

Lemma 1

For any $c>0$ and signal $x$, replacing residuals by $c\,x$ leaves $\overline{\mathrm{HFER}}$ and $\overline{\mathrm{SE}}$ unchanged.

Figures (3)

  • Figure 1: Graph Signal Processing framework for transformer analysis. Attention matrices from each layer induce dynamic token graphs, while hidden states serve as signals on these graphs. Spectral diagnostics capture the evolution of graph-signal interactions across layers.
  • Figure 2: Layer-wise HFER differences for semantic hallucinations. Delta computed as (contradicted minus supported). Early layers (2 to 5) show robust separation across models, with LLaMA-3.2-1B exhibiting the strongest effect. Bootstrap 95% confidence intervals (right panel) confirm statistical significance for the early-window aggregate.
  • Figure 3: Layer-wise spectral entropy differences for semantic hallucinations. LLaMA-3.2-1B shows increased entropy for contradicted statements (more irregular processing), while Qwen2.5-7B exhibits decreased entropy (more organized misprocessing). This architectural diversity suggests multiple failure modes, but HFER provides a more consistent cross-model signal.

Theorems & Definitions (10)

  • Definition 1: High-Frequency Energy Ratio (HFER)
  • Definition 2: Spectral Entropy (SE)
  • Lemma 1: Scale invariance
  • proof
  • Lemma 2: Lower bound via Dirichlet energy
  • proof
  • Theorem 1: Bayes optimality of thresholding
  • proof
  • Proposition 1: SE stability to sparse perturbations
  • proof