OnTrack: Real-Time Monitoring and Intervention in LLM Agent Trajectories via Streaming Structure-Aware Optimal Transport

Babak Barazandeh ,

Connor Swanson ,

Chinmay Kulkarni ,

Nikhil Mungel

Agent Agent Eval Benchmarks Autonomous Workflows AI Safety / AI Ethics AVAR RLAW

2026年10月08日

智能体已广泛应用于行程规划、股票交易、IT事件分级处理等各类实际场景中。在绝大多数情况下，大语言模型（LLM）驱动的智能体以近乎完全自主的方式运行，仅配备极简的基于规则的安全防护机制，由此导致不可逆操作引发的成本浪费与安全风险问题日益突出。近期相关研究主要通过两类方式应对该挑战：一是引入专门的“守护智能体”（safeguard agent）对主智能体行为进行实时监控；二是对执行日志开展事后评估（post-hoc evaluation）。前者会在每一步操作中额外引入计算开销与延迟；后者则只能在任务运行结束后才给出判断——此时算力资源已然耗尽，潜在损害也已发生。为突破上述局限，我们提出 OnTrack：一种流式监控机制，它将当前智能体的每一步操作及其依赖关系，与历史成功运行轨迹进行实时比对，可在约一毫秒内完成单步判别，并据此向用户发出预警或直接中止智能体执行。我们围绕该问题，在三种数据可及性递减的设定下展开系统性研究：（1）完全参考访问（即同时拥有历史成功运行轨迹与所有工具的接口规范）；（2）中等访问（仅掌握工具接口规范）；（3）零先验知识（仅能获取智能体实时生成的操作步骤日志）。随着可用数据减少，OnTrack 的监控能力预期亦相应减弱，其功能覆盖范围从高精度的完整计划违规检测，逐步退化为对循环执行、运行停滞及重复调用同一工具等异常模式的识别。最后，我们在 SWE-bench 基准测试的任务轨迹上对 OnTrack 进行了实证评估：仅基于前 8 步操作，本方法在区分失败轨迹与成功轨迹方面的排序能力（AUROC 指标）显著优于基于内容相似度的传统方法（提升达 +0.057）；当启用自动中止策略时，该机制可节省约 18% 原本将被浪费于失败任务上的计算资源；进一步分析表明，在所有被中止的运行中，高达 83% 确实正走向失败——6 次中止中有 5 次判断正确。

Agents are deployed in applications from trip planners and stock trading to IT incident triage. In most cases, LLM agents work autonomously with minimal rule-based safeguarding, leading to cost and safety issues from irreversible actions. Recent works resolve this either by using a safeguard agent to monitor behavior or evaluating logs post-hoc. The first adds cost and latency to every step; the second delivers its verdict after the run, when tokens are burned and damage is done. To overcome this, we propose OnTrack, a streaming monitoring mechanism that compares an agent's steps and dependencies against recorded successful runs to alert users or block the agent in about a millisecond per step. We study this problem in three regimes of decreasing access: full reference access (historical runs and tool schemas), intermediate access (only tool schemas), and no prior knowledge (only step logs as generated). Expectation of OnTrack's monitoring capabilities reduces as data access drops, ranging from plan violation detection to identifying loops, stalls, and repeated tool calls. Finally, we evaluate OnTrack using SWE-bench trajectories. Based on the first 8 steps, our method ranks failing trajectories below succeeding ones better than content similarity approaches (+0.057 AUROC). With an abort policy, we save about 18% of compute that would be burned on failing runs, where 83% of interrupted runs were actually heading to failure (5 out of 6 aborts were correct).

许愿