Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

SafetyDrift: Predicting When AI Agents Cross the Line Before They Actually Do

Aditya Dhodapkar, Farhaan Pishori

Abstract

When an LLM agent reads a confidential file, then writes a summary, then emails it externally, no single step is unsafe, but the sequence is a data leak. We call this safety drift: individually safe actions compounding into violations. Prior work has measured this problem; we predict it. SafetyDrift models agent safety trajectories as absorbing Markov chains, computing the probability that a trajectory will reach a violation within a given number of steps via closed form absorption analysis. A consequence of the monotonic state design is that every agent will eventually violate safety if left unsupervised (absorption probability 1.0 from all states), making the practical question not if but when, and motivating our focus on finite horizon prediction. Across 357 traces spanning 40 realistic tasks in four categories, we discover that "points of no return" are sharply task dependent: in communication tasks, agents that reach even a mild risk state have an 85% chance of violating safety within five steps, while in technical tasks the probability stays below 5% from any state. A lightweight monitor built on these models detects 94.7% of violations with 3.7 steps of advance warning at negligible computational cost, outperforming both keyword matching (44.7% detection, 55.9% false positive rate) and per step LLM judges (52.6% detection, 38.2% false positive rate) while running over 60,000x faster.

SafetyDrift: Predicting When AI Agents Cross the Line Before They Actually Do

Abstract

When an LLM agent reads a confidential file, then writes a summary, then emails it externally, no single step is unsafe, but the sequence is a data leak. We call this safety drift: individually safe actions compounding into violations. Prior work has measured this problem; we predict it. SafetyDrift models agent safety trajectories as absorbing Markov chains, computing the probability that a trajectory will reach a violation within a given number of steps via closed form absorption analysis. A consequence of the monotonic state design is that every agent will eventually violate safety if left unsupervised (absorption probability 1.0 from all states), making the practical question not if but when, and motivating our focus on finite horizon prediction. Across 357 traces spanning 40 realistic tasks in four categories, we discover that "points of no return" are sharply task dependent: in communication tasks, agents that reach even a mild risk state have an 85% chance of violating safety within five steps, while in technical tasks the probability stays below 5% from any state. A lightweight monitor built on these models detects 94.7% of violations with 3.7 steps of advance warning at negligible computational cost, outperforming both keyword matching (44.7% detection, 55.9% false positive rate) and per step LLM judges (52.6% detection, 38.2% false positive rate) while running over 60,000x faster.

Paper Structure

This paper contains 44 sections, 7 figures, 4 tables.

Table of Contents

  1. Introduction
  2. Related Work
  3. Agent safety benchmarks.
  4. Agent reliability.
  5. Probabilistic safety monitoring.
  6. Safe reinforcement learning.
  7. LLM agent frameworks.
  8. Problem Formulation
  9. Agent execution model.
  10. Safety drift.
  11. Limitations of per step evaluation.
  12. Safety State Model
  13. Monotonicity.
  14. Risk level synthesis.
  15. Absorbing state.
  16. ...and 29 more sections

Figures (7)

  • Figure 1: Estimated transition probabilities for the coarse 5-state safety model. Notable: mild has a 13% per step probability of jumping directly to violated, making it the highest risk transient state.
  • Figure 2: Finite horizon violation probabilities. mild has higher aggregate risk than critical due to its direct transition to violated (see Section \ref{['sec:results']}).
  • Figure 3: Per category finite horizon violation probabilities. Research & communication (top right) shows clear points of no return, while sysadmin (bottom left) and code debugging (top left) show near zero violation probability.
  • Figure 4: Detection rate vs. false positive rate across thresholds for the Markov monitor.
  • Figure 5: Distribution of early warning steps for detected violations (mean 3.7, median 4).
  • ...and 2 more figures