Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper introduces OnTrack, a streaming, structure-aware optimal transport mechanism for real-time monitoring and intervention of LLM agent trajectories. By comparing an agent's current execution path against historical successful runs and tool schemas, OnTrack can detect deviations indicative of failure, such as plan violations, loops, stalls, and repeated tool calls, with minimal latency. Evaluation on SWE-bench trajectories demonstrates OnTrack's superior ability to distinguish failing from succeeding runs early, leading to significant compute savings through timely intervention.
LLM agents can now be monitored and intervened upon in real-time, saving 18% of compute by detecting failures within the first 8 steps with 83% accuracy.
Agents are deployed in applications from trip planners and stock trading to IT incident triage. In most cases, LLM agents work autonomously with minimal rule-based safeguarding, leading to cost and safety issues from irreversible actions. Recent works resolve this either by using a safeguard agent to monitor behavior or evaluating logs post-hoc. The first adds cost and latency to every step; the second delivers its verdict after the run, when tokens are burned and damage is done. To overcome this, we propose OnTrack, a streaming monitoring mechanism that compares an agent's steps and dependencies against recorded successful runs to alert users or block the agent in about a millisecond per step. We study this problem in three regimes of decreasing access: full reference access (historical runs and tool schemas), intermediate access (only tool schemas), and no prior knowledge (only step logs as generated). Expectation of OnTrack's monitoring capabilities reduces as data access drops, ranging from plan violation detection to identifying loops, stalls, and repeated tool calls. Finally, we evaluate OnTrack using SWE-bench trajectories. Based on the first 8 steps, our method ranks failing trajectories below succeeding ones better than content similarity approaches (+0.057 AUROC). With an abort policy, we save about 18% of compute that would be burned on failing runs, where 83% of interrupted runs were actually heading to failure (5 out of 6 aborts were correct).