On the Effectiveness of Kernel-Level Evidence for Agent Security

arXiv:2609.28915 · cs.CR, cs.AI · Submitted 2026-09-24 · Read on arXiv

cs.CR, cs.AI

Submitted: 2026-09-24

Updated: 2026-09-24

Code: https://github.com/aquasecurity/tracee

Terminology

• Trace — 33× in this paper · explained in 2 episodes
• Benchmark — 32× in this paper · explained in 2 episodes
• Ablation — 28× in this paper · explained in 1 episode
• Transformer — 19× in this paper · explained in 2 episodes
• LLM judge — 15× in this paper · explained in 2 episodes
• Aggregation — 12× in this paper · explained in 1 episode
• Foundation Model — 9× in this paper · explained in 3 episodes
• Generalization — 9× in this paper · explained in 13 episodes
• Provenance — 9× in this paper · explained in 3 episodes
• Agentic AI — 8× in this paper · explained in 1 episode
• Foundation Models — 7× in this paper · explained in 7 episodes
• Model Context Protocol — 6× in this paper
• Grounding — 5× in this paper · explained in 3 episodes
• Robustness — 5× in this paper · explained in 5 episodes
• Adaptation — 4× in this paper · explained in 1 episode
• In-Context Learning — 4× in this paper · explained in 4 episodes
• Adam — 3× in this paper · explained in 2 episodes
• Analyzer — 3× in this paper · explained in 1 episode
• Benchmarking — 3× in this paper · explained in 3 episodes
• In International Conference on Learning Representations — 3× in this paper
• AI Agents — 2× in this paper · explained in 2 episodes
• Agent Cross-Layer Evidence — 2× in this paper
• Embeddings — 2× in this paper · explained in 2 episodes
• Fine-Tuning — 2× in this paper · explained in 5 episodes
• LoRA Adapters — 2× in this paper · explained in 3 episodes
• Multi-Agent System — 2× in this paper · explained in 5 episodes
• Abstraction — 1× in this paper · explained in 1 episode
• Agent Security Bench — 1× in this paper
• Alert Fatigue — 1× in this paper · explained in 1 episode
• Calibration — 1× in this paper · explained in 7 episodes
• Core — 1× in this paper · explained in 2 episodes
• Cybersecurity and Infrastructure Security Agency — 1× in this paper
• Feature Engineering — 1× in this paper · explained in 3 episodes
• Frozen model — 1× in this paper · explained in 2 episodes
• Hallucination — 1× in this paper · explained in 3 episodes
• Heterogeneous Graph — 1× in this paper · explained in 2 episodes
• Human-in-the-Loop — 1× in this paper · explained in 3 episodes
• In International Conference on Machine Learning — 1× in this paper
• In Network and Distributed System Security Symposium — 1× in this paper
• LoRA Fine-Tuning — 1× in this paper · explained in 3 episodes
• Low-Rank Adaptation (LoRA) — 1× in this paper · explained in 9 episodes
• MCP Security Bench — 1× in this paper
• Model Context Protocol (MCP) — 1× in this paper · explained in 8 episodes
• Tokenization — 1× in this paper · explained in 2 episodes

Sources

• FlowGuard: From Signals to Evidence for MCP Security Detection
• AgentBound: Securing Execution Boundaries of AI Agents
• Defeating Prompt Injections by Design
• QLoRA: Efficient Finetuning of Quantized LLMs
• StepShield: When, Not Whether to Intervene on Rogue Agents
• RedCode: Risky Code Execution and Generation Benchmark for Code Agents
• UNICORN: Runtime Provenance-Based Detector for Advanced Persistent Threats
• LSTM-Based System-Call Language Modeling and Robust Ensemble Method for Designing Host-Based Intrusion Detection Systems
• Set Transformer: A Framework for Attention-based Permutation-Invariant Neural Networks
• ToolPRMBench: Evaluating and Advancing Process Reward Models for Tool-using Agents
• Quantifying Frontier LLM Capabilities for Container Sandbox Escape
• POIROT: Aligning Attack Behavior with Kernel Audit Records for Cyber Threat Hunting
• HOLMES: Real-time APT Detection through Correlation of Suspicious Information Flows
• TRACE: Trajectory Reasoning through Adaptive Cross-Step Evidence Aggregation for LLM Agents
• ChainWatch: A Kill Chain-Aligned Sequential Detection Framework for Multi-Step Attacks in MCP-Based AI Agent Systems
• TabICL: A Tabular Foundation Model for In-Context Learning on Large Data
• Identifying the Risks of LM Agents with an LM-Emulated Sandbox
• Toolformer: Language Models Can Teach Themselves to Use Tools
• Agent-Sentry: Bounding LLM Agents via Execution Provenance
• Training Deliberative Monitors for Black-Box Scheming Detection

Related papers

• SoK: AI-Augmented Binary Reversing
• Relaxed Sender Anonymity for CBDC Interbank Settlement: A Zero-Knowledge Approach on Permissioned EVM
• Calibration-Family Overfit: Why Trusted Sabotage Monitors Don't Transfer Across Lineages
• Efficient Fuzzy PSI under One-Sided Assumptions
• Sealing the Audit-Runtime Gap for LLM Skills
• Token Composition: A Graph Based on EVM Logs