Extracting Behavioral Drift Signals From Production Traces Before They Compound Into Failures

Production agent traces support a compounding improvement loop when teams use them to detect behavioral drift, locate the responsible harness layer, and validate targeted fixes through replay before release. The essential shift is from monitoring whether an agent returned an answer to examining how it reached that answer. Behavioral drift becomes actionable before visible failure when trace evidence connects detection, attribution, intervention, and regression testing.

Why standard monitoring misses behavioral drift in LLM agents

An agent can return HTTP 200 in under a second, pass every infrastructure health check, and still produce the wrong output. Server crashes, HTTP 500s, CPU spikes, and unhandled exceptions give application performance monitors something explicit to catch. An agent that hallucinates an action, misroutes a tool call, or stops honoring a user’s constraints can do none of those things.

This is a structural blind spot. Conventional monitoring describes the health of execution, while agent reliability also depends on the decisions made during execution. Hallucination spirals, sycophancy loops, and tool misuse need not generate an error code. Gradual degradation makes that distinction particularly dangerous because the agent continues producing plausible outputs as its behavior moves away from intent. Monitoring silence can therefore be mistaken for correctness.

What behavioral drift actually is, and how it differs from a model failure

Behavioral drift is a change in an agent’s decisions, tool selections, or action sequences that can occur without a model weight update or prompt change. Semantic drift, by contrast, concerns shifts in the meaning of outputs. Both can arise when a retrieval index updates, a provider model swaps, or a tool backend changes. The distinction identifies what has changed while leaving its cause open. A different answer and a different sequence of actions are related observations, but they are not interchangeable diagnoses.

Persona drift exposes a subtler form of behavioral inconsistency. During long sessions, an agent can forget user-specified constraints, repeat habits the user explicitly rejected, or confabulate agreements that never occurred. This need not be a factual recall failure. The agent may have the relevant information but fail to act on it, making consistency the central problem.

That distinction also changes the repair target. A prompt that scored at 95% context-adherence last week can degrade as retrieval indices or tool behavior shift, even though the agent still produces output. Treating that change as a model failure leads teams to look at retraining or a model swap. Treating it as a harness problem leads teams to look instead at the prompt, tool, workflow, or memory layer whose behavior changed.

How drift originates across harness layers before it becomes visible

A shipping agent shows how drift can start between harness layers that sit next to each other. Its tool description specified an “appropriate HTTP error code with description on failure,” while its prompt instructed it to “retry transient failures.” The distinction was left unresolved between those instructions. The agent retried both 4xx and 5xx responses, trying again and again even after a 400 for an invalid postal code format. The tool returned an error, but the agent’s interpretation turned that response into an inappropriate action sequence.

A schema mismatch can produce a catchable runtime error. A description mismatch instead changes when the model calls a tool, omits it, or retries it, without necessarily producing a separate behavioral alert. The description guides the model’s decision about use. In the shipping case, the tool-invocation layer and retry logic interacted, so the repair target was more specific than a general instruction to behave carefully.

As summarization cycles accumulate, the agent’s representation of its original goal degrades, making termination conditions harder to evaluate. An instruction that was clear at step one can become ambiguous by step ten. Working memory and long-term retrieval can also drift independently, while context compaction introduces summaries that misrepresent prior state. Because multi-step success degrades sharply when per-step accuracy is imperfect, small deviations can compound across the run.

Which signals in production traces indicate drift is forming

The record needs full conversation state, tool inputs and outputs, the model used, model routing decisions, token counts, per-step latency, failures, and retries. Missing structure limits what any detector can distinguish. A final answer alone cannot reveal whether a tool was omitted, a retry was unnecessary, or a termination condition was evaluated repeatedly before the answer appeared.

At the tool layer, unexpected retry counts are an early signal, especially when concentrated on a specific tool. Changes in sequence are equally revealing. A call may appear in trajectories where it previously did not, or disappear from trajectories where it previously always appeared. These are shifts in behavior that must be understood through the tool-call trajectory, while runtime errors can be seen in the success status of a single request.

Prompt and termination drift are visible when tasks take more steps than before, termination checks keep repeating without a result, or sessions grow longer even though tasks are no more complex. Memory drift is visible in compressed summaries that keep dropping the same kinds of prior context. Retrieval drift can appear as progressively less relevant context. Comparing these signals across runs helps show whether the execution pattern has changed or a single task has varied in an ordinary way.

Conventional tests such as PSI and KS are insufficient on their own in high-dimensional embedding spaces, where approaches that make no distributional assumptions and exploit hierarchical semantic structure are better suited to semantic shift. AgentDrift examines a narrower but instructive case. Its financial-agent research identifies tool corruption that produces unsafe recommendation drift while ranking metrics such as NDCG remain otherwise reassuring. That finding supports inspecting intermediate behavior without treating ranking quality as a general measure of agent safety.

How finite-state machines built from trace corpora make drift structurally visible

Automata from Agent Traces collapses an entire trace corpus into a compact finite-state machine, exposing shared behavioral structure that individual runs do not reveal. Presented at the ICML 2026 Workshop on Agents in the Wild, the work constructs FSMs across twelve public datasets. The machines build in milliseconds. They replay held-out data at high fitness and show near-identical topology across splits, providing a stable representation of how the agent moves through its tasks.

The most consequential finding concerns what shapes that structure. A single FSM achieves perfect fitness across four chat models on the same task, suggesting that behavioral topology depends more on the deployment harness than on the underlying LLM. This makes the FSM a model-agnostic monitoring primitive. Rather than interpreting every trace independently, the monitor can examine behavior in relation to the shared states and transitions recovered from the corpus.

That structure also supports prediction before a run ends. Per-state behavioral features reach held-out AUROC up to 0.94 for failure prediction, and an online monitor ranks failing runs above passing ones from partial traces. No task descriptions or manual specifications are required. Construction also needs no success filters, allowing the corpus to include the imperfect behavior that production monitoring must understand.

When new traces cause a sudden rise in state count, they show behavioral modes outside the established topology and draw attention to changes that endpoint scores might hide. Growth alone leaves the cause of the defect unclear. It makes the structural change visible, after which trajectory-level evidence can distinguish changes in a harness layer from their effects elsewhere.

Reading trajectory-level signals to localize which harness layer drifted

DriftNet demonstrates step-level attribution for prompt injection through a dual-head Transformer that reads logged tool-call trajectories. One head classifies whether the trajectory is compromised, while the other labels every step as benign, injection point, hijacked, or failed injection. The distinction makes the verdict useful for repair. It identifies where the attack entered, which later actions it corrupted, and whether apparent poison was resisted or followed.

The method operates only on the logged trajectory. It needs no agent internals, re-execution, or live loop, so it can work with trace infrastructure that is already in place. Its scope remains prompt-injection detection and localization, rather than attribution of every possible harness defect. Even within that scope, it demonstrates why a whole-run verdict is incomplete, since the point of entry and the downstream manifestation can be different steps.

Real-Time Detection and Repair of LLM Agent Failures provides a complementary deterministic approach. It recomputes a run’s stated total from the tool results that the run actually received, catching omissions such as silent aborts without a statistical threshold or null hypothesis. The study reports zero false positives in healthy episodes. Separate checks of tool-call coverage and output shape help localize the defect without relying on a trained trajectory classifier.

AgentFail contributes a repair-oriented taxonomy grounded in 307 annotated failure traces. Its categories classify visible symptoms and connect where failures originate and how they propagate to actionable repair strategies. Attribution must preserve that connection to repair. A tool description, termination condition, memory-compaction artifact, and workflow branch demand different interventions, even when each ultimately produces an incorrect answer.

Why prefix-based monitoring enables intervention before a drift event completes

The FSM study’s online monitor triggers early stopping at 32% completion. That timing makes the result operationally distinct from retrospective diagnosis, because the monitor can act while much of the potentially failing sequence remains unexecuted. The signal comes from an unfinished trajectory. An agent does not have to reach its final answer before its path becomes informative enough to support intervention.

PrefixGuard, published in May 2026, addresses the same timing problem through prefix-risk scoring. Within the framework, StepView induces deterministic typed-step adapters from raw trace samples, and the scorer learns from terminal outcomes to assess partial runs. Evaluation spans WebArena, τ²-Bench, SkillsBench, and TerminalBench. The strongest monitors reach AUPRC of 0.900 on WebArena, supporting the use of trace evidence before final outcome checks.

The real-time detection study reaches a complementary finding from observable step telemetry alone. Its monitors use semantic embeddings of step output, token-level uncertainty, and action metadata, cost microseconds per step, and train only on healthy runs. Labeled failures are therefore not a prerequisite for that approach. With a content-grounding telemetry channel, content-corruption detection gets much better and behavioral detection also improves, which shows that the two channels can help each other.

These results come from different methods tested in different settings. Their shared operational implication is that partial traces can support both real-time gating and post-hoc debugging. For teams acting on that evidence, the shift is from investigating complaints after completion to intercepting a risky sequence before it compounds. Attribution then gives the intercepted run’s alert a repair target.

How teams close the loop from agent monitoring to verified fixes through replay

Replay validation connects a detected production pattern to evidence that a proposed harness edit resolves it. An evaluation harness disconnected from production traces can show performance on a static dataset, but not whether the candidate fixes the behavior observed in live runs. The repair needs the original evidence. Recording tool outputs from affected traces and replaying them deterministically against the candidate exposes whether the deviation disappears without introducing regressions on previously healthy sequences.

For teams turning that evidence into a release gate, golden tasks should be tiered into smoke, core, and torture coverage. They should reflect real failure modes extracted from traces, including wrong tool choices, retry loops, and termination failures. Tool canaries provide a more focused check. A single evaluation prompt for each tool should test the full call-response cycle so that CI can catch a description mismatch that might go unnoticed when the final answer looks good.

Wang et al.’s 2026 evaluation of RELAI-VCL adds an explicit regression constraint. The continual-learning optimizer rejects proposed harness edits if they help with newly targeted tasks but hurt tasks the agent could already solve. Improvement is conditional on preserving prior success. This discipline prevents a targeted repair from becoming a trade between failure modes that an aggregate score could conceal.

The resulting improvement loop is auditable because each change has an inspectable chain of evidence. Reviewers can examine what changed, why it changed, and what evidence supported release. That traceability separates systematic harness engineering from guesswork.