# Behavior-Guided LLM Audit Triggering

The work presents a two-stage LLM agent monitoring framework in which single-event and trace-sequence gate rules select pending actions for inspection and an LLM audit agent judges each selected action in the context of the inspected agent's preceding trace before execution, with an optimizer LLM jointly refining gate rules and audit prompts. On the OpenAgentSafety test split, the tuned gated audit reduces mean audits from 8.15 to 2.33 per run and tokens from 47.8k to 14.6k, with 72.8% detection versus 81.5% for auditing every action and a lower false-positive rate (5.9% versus 11.8%); in two simulated multi-agent scenarios it flags all attack runs while cutting audit token usage by more than 80%.

The work presents a two-stage LLM agent monitoring framework in which single-event and trace-sequence gate rules select pending actions for inspection and an LLM audit agent judges each selected action in the context of the inspected agent's preceding trace before execution, with an optimizer LLM jointly refining gate rules and audit prompts. On the OpenAgentSafety test split, the tuned gated audit reduces mean audits from 8.15 to 2.33 per run and tokens from 47.8k to 14.6k, with 72.8% detection versus 81.5% for auditing every action and a lower false-positive rate (5.9% versus 11.8%); in two simulated multi-agent scenarios it flags all attack runs while cutting audit token usage by more than 80%.