- The paper introduces an online auditing protocol that detects and localizes decisive errors in multi-agent systems in real-time.
- It leverages the novel AFTRAJ-2K corpus with dense prefix-level supervision to train an auditor using a two-stage reinforcement learning approach.
- Empirical evaluations show significant gains in error localization accuracy and reduced latency, ensuring robust deployment-time safety.
AgentForesight: Online Auditing for Early Failure Prediction in Multi-Agent Systems
Problem Setting and Motivation
Multi-agent systems composed of LLM-based agents have transformed long-horizon task execution, leveraging specialized roles and inter-agent communication for domains including software engineering, mathematical reasoning, and autonomous web interaction. A critical reliability bottleneck arises from error propagation: a single decisive upstream agent error, if not promptly intercepted, can cascade throughout the downstream trajectory, yielding task-level failures with potentially irrecoverable operational consequences. Existing failure attribution approaches almost exclusively operate in the post-hoc regime, analyzing and diagnosing failure only after execution has concluded and downstream effects are locked in. This paradigm fundamentally precludes deployment-time intervention and allows harmful policies to remain unmitigated during task execution.
AgentForesight (2605.08715) introduces an online auditing protocol for failure analysis, in which an external auditor monitors multi-agent trajectories as they unfold, issuing CONTINUE-or-ALARM verdicts at every step based solely on the visible execution prefix. The research reframes both supervision and evaluation around prefix-level error detection and precise localization, enabling real-time interventions before error propagation becomes irrecoverable.
AFTRAJ-2K: Corpus for Prefix-Level Supervision
Effective online auditing requires a new standard of data supervision. AFTRAJ-2K is introduced as a high-fidelity corpus comprising 2.3K curated multi-agent trajectories with per-turn annotations. It covers three heterogeneous domains: Coding (HumanEval+, MBPP+), Math (MATH-500), and Agentic tasks (GAIA, HotpotQA), instantiated across frameworks such as AutoGen, MetaGPT, and Smolagents. The corpus is systematically partitioned into strictly verified safe trajectories, which pass multi-stage outcome, integrity, and coherence predicates, and unsafe trajectories, each labeled with the decisive error step and responsible agent.
Unsafe trajectories originate from two complementary streams:
- Constructive stream: Controlled injection of decisive faults into verified-safe trajectories, ensuring precise knowledge of decisive error location and agent role.
- Diagnostic stream: Systematic localization of decisive errors in natural failure cases, using proposer-verifier ensembles, strict step selection, and LLM-as-a-judge consensus over four binary criteria (existence, substantive, decisiveness, and earliestness).
This data collection strategy yields dense prefix-level supervision, supporting direct training of online auditors for both safe and unsafe regimes.
Coarse-to-Fine Reinforcement Learning for Online Auditing
Training an online auditor to operate with only prefix-level evidence under the online auditing contract presents dual challenges: (1) reliable discrimination of the critical safe-unsafe boundary, and (2) precise step-level localization and agent attribution. AgentForesight-7B implements a two-stage reinforcement learning procedure grounded in Qwen2.5-7B-Instruct:
- Stage 1 – Failure-Boundary Alignment (BPPO): Adjacent boundary pairs of trajectory prefixes—one just before, one just after the decisive error—are constructed for every unsafe trajectory. A boundary-pair preference optimization objective is imposed, enforcing sharp discrimination between CONTINUE and ALARM across the failure boundary.
- Stage 2 – Three-Axis Verdict Sharpening (GRPO): Building on the boundary-aligned initialization, a composite reward is used to optimize step-level verdicts over structural (schema and grounding), temporal (error step proximity), and causal (responsible agent) axes. The reward is symmetric across what, where, and who, and prevents degenerate solutions. Optimization uses Group Relative Policy Optimization, with the Stage 1 checkpoint as a fixed reference, ensuring preservation of risk anticipation while sharpening step-level precision.
The result is a compact 7B parameter online auditor that robustly localizes decisive errors, attributes responsibility, and minimizes spurious alarms in both curated and previously unseen agentic systems.
Empirical Evaluation
Main Results on AFTRAJ-2K
AgentForesight-7B is benchmarked on the AFTRAJ-2K held-out partition and the external Who&When dataset. Evaluation strictly adheres to the online auditing protocol: at each prefix, the auditor emits a verdict without access to future turns.
Key performance metrics include:
- Exact-Step F1 (Exact-F1): Harmonic mean of recall and precision for exact decisive-step localization.
- Absolute Step Shift (ASS): Mean absolute localization error for detected decisive steps.
AgentForesight-7B achieves a 66.44 Exact-F1 and 0.59 ASS on AFTRAJ-2K, outperforming the leading proprietary baseline (DeepSeek-V4-Pro) by +19.88 Exact-F1 and exhibiting threefold lower localization error. The model maintains superior performance across all three domains, especially in Math and Coding, and is the only model occupying the empirically defined deployable region (≤2.4% FAR, ≥59.5% Step-Accuracy), fully supporting deployment-time oversight.
Out-of-Domain Generalization
On the Who&When benchmark, which is fully disjoint from the AFTRAJ-2K training domain, AgentForesight-7B retains its advantage, achieving 57.69% Step-Accuracy and 1.62 ASS, leading all commercial and open-source baselines by substantial margins.
Ablations and Deployment Considerations
Thorough ablations reveal the necessity of the two-stage training protocol: BPPO alone builds risk anticipation but fails on precise localization, GRPO alone achieves high precision but suffers on hard-to-separate boundaries, especially in tasks with diffuse causal structure. Only the full recipe achieves robust performance across all domains.
Deployment analysis demonstrates that AgentForesight-7B, even at 7B scale, is cost- and latency-efficient relative to both open-source and proprietary competitors, with a per-call latency (1.03s on H200) that supports step-wise integration in actual multi-agent systems, and without incurring API costs associated with commercial LLMs.
Methodological and Theoretical Implications
The reframing from post-hoc to online auditing ensures that decisive errors can be intercepted at the earliest opportunity, closing the critical intervention loop required for practical safety in LLM-agent deployments. The separation of auditing specialization from agent policy parameterization circumvents the generator-verifier bias inherent in prior in-agent reflectivity/self-correction paradigms and avoids feedback-induced reward hacking. Modularization of auditing facilitates independent scaling, updating, and adaptation of runtime oversight without retraining the execution backbone.
The three-axis reward design operationalizes not only correctness, but interpretability, supporting deployment scenarios requiring explainable, actionable alerts, and direct integration with human-in-the-loop or automated triage subsystems.
Limitations and Prospective Directions
Current coverage is restricted to Coding, Math, and QA/Web agentic tasks with moderate trajectory horizon lengths. While AgentForesight-7B generalizes robustly to external frameworks, further work is warranted to extend online auditing to high-dimensional sensorimotor robotics, open-ended scientific discovery, and adversarially adaptive agents that may attempt to evade runtime oversight. Scaling AFTRAJ-2K to those domains and developing new reward axes reflective of their unique error structure is an immediate extension.
Strategic combination of online auditing with red-teaming, post-hoc attribution, and continuous auditor retraining is recommended to guard against drift and adaptive circumvention.
Conclusion
AgentForesight establishes online, prefix-level failure auditing as a practical and theoretically-grounded framework for oversight in LLM-based multi-agent systems. Through the dense supervision of AFTRAJ-2K and a principled coarse-to-fine RL recipe, it achieves strong gains in precise, low-latency error localization—eclipsing both model scale and prior methodology as the dominant factor in deployment-time safety. This advance lays the technical groundwork for runtime safeguards in increasingly autonomous agentic systems, supporting proactive, transparent, and interpretable intervention at the earliest manifestation of agentic error.
