Distributed Black-Box Monitors: Overview

• Distributed black-box monitors are mechanisms that infer system properties solely from external observations such as messages, logs, and telemetry while coordinating across distributed components.
• They enable model-free runtime verification, audit trails, and protocol compliance by relying on decentralized probe-based strategies and formal correctness criteria.
• They enhance scalability and fault detection in diverse systems—from microservices to cyber-physical networks—while maintaining low system intrusion and high efficiency.

Distributed black-box monitors are distributed monitoring mechanisms that infer properties of systems from externally observable behavior—messages, logs, traces, measurements, software provenance records, or agentic action sequences—without requiring access to the monitored component’s source code, private reasoning, activations, or other internals. Across the literature, the term covers several technically distinct settings: model-free runtime verification of hyperproperties, probe-based monitoring of RPC microservices, synthesized monitors for multiparty session protocols, audit-trail and provenance infrastructures for vehicles and IoT, monitoring of scattered uncertain logs in cyber-physical systems, non-intrusive performance telemetry in distributed computing, and action-only monitors for scheming detection in AI agents (Stucki et al., 2019, Rowicki et al., 20 Aug 2025, Heuvel et al., 2023, Falco et al., 2020, Chatzigiannis et al., 2021, Ghosh et al., 2022, Witt et al., 2018, Sinha et al., 28 May 2026). The unifying idea is external observation plus distributed coordination; the principal technical differences concern what “black-box” excludes, what auxiliary model is permitted, and which guarantees—soundness, completeness, transparency, immutability, low-FPR detection, or energy efficiency—are achievable.

1. Terminological range and research scope

The literature does not use “distributed black-box monitors” in a single, uniform sense. In formal runtime verification, a black-box monitor is model-free: it sees only finite observations and cannot rely on knowledge of the program or the reachable behavior space. In audit-trail and provenance systems, “black-box” is used in the sense of an aviation Flight Data Recorder: a tamper-evident recorder whose purpose is later auditability. In cyber-physical systems and distributed computing, black-box typically means non-intrusive observation of logs, counters, and sensor values rather than inspection of internal dynamics. In AI control, black-box denotes action-only oversight without chain-of-thought or model-internal access. These uses are related, but they are not interchangeable (Stucki et al., 2019, Falco et al., 2020, Ghosh et al., 2022, Witt et al., 2018, Sinha et al., 28 May 2026).

Research setting	Meaning of “black-box”	Distributed structure
Hyperproperties and runtime verification	Monitor sees observations only and assumes no system model	Cross-trace reasoning over distributed inputs or trace sets
RPC deadlocks and session protocols	Monitor observes only incoming and outgoing messages	Per-service or per-role monitors exchange probes or dependency messages
Automotive audit trails and IoT provenance	Tamper-evident recorder and externally verifiable provenance	ECU-local DHTs, aggregators, gateways, and blockchain anchoring
CPS, PPM, and AI oversight	Internals unknown; logs, telemetry, or actions only	Multi-source log fusion, telemetry buses, adaptive sampling, or cascaded monitors

A persistent misconception is that “black-box” always implies the absence of any model. The CPS monitoring framework of uncertain logs uses an over-approximated but expressive bounding model, and the AI scheming monitors are action-only while still being trained from specification-grounded rationales. Conversely, the hyperproperty-monitoring literature uses “black-box” in the strict model-free sense and proves strong impossibility results under that interpretation (Ghosh et al., 2022, Sinha et al., 28 May 2026, Stucki et al., 2019).

2. Formal foundations: observations, monitorability, and correctness

The most explicit formal treatment appears in hyperproperty monitoring. A trace property is a set $P \subseteq \Sigma^\omega$, where $\Sigma = 2^{AP}$, and each trace is evaluated independently. A hyperproperty is a set of sets of traces $H \subseteq \mathcal{P}(\Sigma^\omega)$; satisfaction therefore requires simultaneous reasoning over multiple traces. HyperLTL separates trace quantification from the inner temporal formula: $$\phi ::= \forall \pi.\phi \mid \exists \pi.\phi \mid \psi, \qquad \psi ::= a_\pi \mid \neg \psi \mid \psi \lor \psi \mid X \psi \mid \psi U \psi.$$ This distinction matters because runtime observations are finite, whereas the quantified semantics range over sets of infinite traces (Stucki et al., 2019).

The same work refines monitorability by making system knowledge explicit. For observations $O$, a behavior universe $BSys$, and a system set $Sys \subseteq BSys$, permanent satisfaction and permanent violation are defined relative to $Sys$: $O \;\Vdash_{[Sys]}\; \phi$ iff every $B \in Sys$ extending $\Sigma = 2^{AP}$0 satisfies $\Sigma = 2^{AP}$1, and $\Sigma = 2^{AP}$2 iff every such $\Sigma = 2^{AP}$3 falsifies $\Sigma = 2^{AP}$4. A formula is semantically monitorable if every observation admits an extension yielding one of those permanent verdicts; strong monitorability additionally requires a sound computable monitor that eventually returns $\Sigma = 2^{AP}$5 or $\Sigma = 2^{AP}$6. This separates semantic feasibility from computability (Stucki et al., 2019).

Within that framework, black-box monitoring of HyperLTL is shown to be generally infeasible for alternation patterns such as $\Sigma = 2^{AP}$7. The stated criterion is exact: a formula of the form $\Sigma = 2^{AP}$8, where $\Sigma = 2^{AP}$9 is a purely state predicate, is non-monitorable in the semantic black-box sense iff $H \subseteq \mathcal{P}(\Sigma^\omega)$0 is non-reflexive and serial. Distributed Data Minimality (DDM), expressed as a HyperLTL formula over single-step traces, inherits that barrier: it is semantically black-box monitorable iff the input domain $H \subseteq \mathcal{P}(\Sigma^\omega)$1 is finite. This result is central because it establishes that distributed observation alone does not suffice for permanent verdicts when existential witnesses range over unknown future behavior (Stucki et al., 2019).

By contrast, black-box monitoring becomes provably correct in more structured operational settings. For RPC-style microservices, a service is abstracted as $H \subseteq \mathcal{P}(\Sigma^\omega)$2 and the SRPC process state is one of $H \subseteq \mathcal{P}(\Sigma^\omega)$3, $H \subseteq \mathcal{P}(\Sigma^\omega)$4, or $H \subseteq \mathcal{P}(\Sigma^\omega)$5. The wait-for relation $H \subseteq \mathcal{P}(\Sigma^\omega)$6 is defined by $H \subseteq \mathcal{P}(\Sigma^\omega)$7 iff service $H \subseteq \mathcal{P}(\Sigma^\omega)$8 is locked on $H \subseteq \mathcal{P}(\Sigma^\omega)$9; a deadlock set $$\phi ::= \forall \pi.\phi \mid \exists \pi.\phi \mid \psi, \qquad \psi ::= a_\pi \mid \neg \psi \mid \psi \lor \psi \mid X \psi \mid \psi U \psi.$$0 is non-empty and closed under that relation. On this model, distributed black-box monitors that observe only incoming and outgoing messages and exchange probes are proved sound and complete, and the proofs are mechanised in Coq (Rowicki et al., 20 Aug 2025).

A related but distinct correctness notion governs multiparty session monitoring. There, each blackbox is an LTS, each role is coupled with a synthesized finite-state monitor, and correctness is expressed by a satisfaction relation between monitored behavior and role-specific relative types projected from a global type. The paper proves soundness—monitored blackboxes correctly follow the protocol—and transparency—monitored and unmonitored correct blackboxes are behaviorally equivalent. This is stronger than mere error detection: it establishes that the monitors are minimally intrusive for correct implementations (Heuvel et al., 2023).

This suggests that feasibility depends less on distribution itself than on the observation model and the strength of the operational abstraction. In the hyperproperty setting, the monitor cannot constrain the future behavior space. In deadlock detection and session monitoring, the message discipline, protocol structure, and local monitor state suffice to reconstruct the relevant dependencies.

3. Architectural patterns and monitoring mechanisms

Several recurrent architectural patterns appear across the literature. One is the centralized coordinator over distributed observations. In gray-box monitoring of DDM, a global monitor maintains a finite observation set $$\phi ::= \forall \pi.\phi \mid \exists \pi.\phi \mid \psi, \qquad \psi ::= a_\pi \mid \neg \psi \mid \psi \lor \psi \mid X \psi \mid \psi U \psi.$$1 of I/O pairs, checks consistency against the program $$\phi ::= \forall \pi.\phi \mid \exists \pi.\phi \mid \psi, \qquad \psi ::= a_\pi \mid \neg \psi \mid \psi \lor \psi \mid X \psi \mid \psi U \psi.$$2, and issues SMT queries through an oracle

$$\phi ::= \forall \pi.\phi \mid \exists \pi.\phi \mid \psi, \qquad \psi ::= a_\pi \mid \neg \psi \mid \psi \lor \psi \mid X \psi \mid \psi U \psi.$$3

The implementation described by the tool minion uses KeY for symbolic execution and Z3 for discharging those runtime queries; the resulting monitor returns $$\phi ::= \forall \pi.\phi \mid \exists \pi.\phi \mid \psi, \qquad \psi ::= a_\pi \mid \neg \psi \mid \psi \lor \psi \mid X \psi \mid \psi U \psi.$$4 or $$\phi ::= \forall \pi.\phi \mid \exists \pi.\phi \mid \psi, \qquad \psi ::= a_\pi \mid \neg \psi \mid \psi \lor \psi \mid X \psi \mid \psi U \psi.$$5, and is sound for violation detection under the gray-box assumptions (Stucki et al., 2019).

A second pattern is peer-to-peer monitor coordination. DDMon deploys a lightweight proxy monitor alongside each Erlang/OTP service. The monitor keeps a current probe, a waiting set of clients, and an alarm flag. On outgoing query it allocates a new probe; on incoming query while locked it propagates the lock’s probe backward to waiting clients; when a monitor receives the probe it originally created and still believes its service is locked, it raises an alarm. The algorithm is explicitly probe-based edge-chasing, but adapted to black-box message observation and asynchronous SRPC semantics (Rowicki et al., 20 Aug 2025).

A third pattern is dependency-broadcast synthesis from protocol specifications. In multiparty session monitoring, per-role monitors are generated automatically from a global type. Besides checking ordinary send and receive actions, monitors broadcast dependency labels to roles whose future legal behavior depends on a non-local choice. Runtime coordination is therefore not performed by reconstructing a wait-for graph, but by disseminating branch labels needed to make blackbox-local protocol checking precise (Heuvel et al., 2023).

Audit-trail designs use a layered storage and anchoring architecture rather than verdict-oriented runtime verification. The connected and automated vehicle design stores hashed and signed ECU event records in ECU-local DHT nodes, uses parity clusters for redundancy, computes a vehicle-wide meta-hash at a gateway or head unit, and anchors that meta-hash or a Merkle root on a public blockchain through a light client. The data flow is ECU event $$\phi ::= \forall \pi.\phi \mid \exists \pi.\phi \mid \psi, \qquad \psi ::= a_\pi \mid \neg \psi \mid \psi \lor \psi \mid X \psi \mid \psi U \psi.$$6 hashed and signed $$\phi ::= \forall \pi.\phi \mid \exists \pi.\phi \mid \psi, \qquad \psi ::= a_\pi \mid \neg \psi \mid \psi \lor \psi \mid X \psi \mid \psi U \psi.$$7 inserted in a local DHT cluster with parity $$\phi ::= \forall \pi.\phi \mid \exists \pi.\phi \mid \psi, \qquad \psi ::= a_\pi \mid \neg \psi \mid \psi \lor \psi \mid X \psi \mid \psi U \psi.$$8 aggregated and meta-hashed at the head unit $$\phi ::= \forall \pi.\phi \mid \exists \pi.\phi \mid \psi, \qquad \psi ::= a_\pi \mid \neg \psi \mid \psi \lor \psi \mid X \psi \mid \psi U \psi.$$9 anchored on a public blockchain $O$0 validated against OEM configuration libraries (Falco et al., 2020).

BBox-IoT adopts a similar distributed-storage logic for constrained sensors, but with a different cryptographic core. Sensors broadcast measurements authenticated by a chain-based one-time hash signature. If $O$1, the signature on message $O$2 is $O$3, where $O$4. Aggregators verify signatures, cross-check with sibling aggregators, aggregate accepted entries into transactions, and submit them to a permissioned blockchain. The sensor performs only hashing, not public-key operations, and the scheme removes any need for clock synchronization (Chatzigiannis et al., 2021).

In black-box CPS monitoring, the architectural core is set propagation over uncertain, distributed logs. Each source contributes a measurement set and a timestamp interval; the monitor aggregates these as constraints on a global trajectory, propagates reachable sets under an uncertain linear dynamical model, intersects them with safety or unsafe sets, and in the online mode triggers the next sample at the earliest discrete time

$O$5

This is distributed monitoring in the sense of asynchronous, multi-source, uncertainty-aware fusion rather than distributed verdict exchange (Ghosh et al., 2022).

The AI scheming-detection work introduces a cascade-oriented deployment pattern. Open-weight, action-only deliberative monitors can be placed at the edge, at tool or service gateways, or at centralized aggregators. They score trajectories, emit rationales, and escalate only flagged cases to stronger frontier monitors or humans. The architecture is explicitly designed for large numbers of agents and services, with batching, sharding, and a cost-throughput-latency model (Sinha et al., 28 May 2026).

4. Representative application domains

In privacy and security, the canonical example is Distributed Data Minimality. Inputs come from multiple independent sources $O$6, the program produces one-step I/O traces $O$7, and the DDM hyperproperty requires that each input coordinate influence the output when the other coordinates are held fixed. The HyperLTL formulation quantifies over four traces and states, for each coordinate $O$8, that whenever two traces differ on the $O$9-th input, there exist two further traces that agree on all other inputs but yield different outputs. Under strict black-box assumptions, permanent verdicts are generally unavailable; under gray-box assumptions, sound violation detection becomes possible by combining observations with symbolic analysis of $BSys$0 (Stucki et al., 2019).

In concurrent and distributed microservices, the target property is deadlock. The monitors of DDMon observe only incoming and outgoing RPC-style messages, not internal service state, and are applicable to Erlang/OTP gen_server and gen_statem systems. The formalism distinguishes the “core” deadlocked set from propagated blocking, so the reported result is the cycle of mutually waiting services rather than every service stalled as a consequence. The approach is explicitly aimed at diagnosing deadlocks that are obscured by the rest of the system’s blocking behavior (Rowicki et al., 20 Aug 2025).

For multiparty session protocols, the monitored artifact is a network of communicating components whose exact specification is unknown, but whose intended coordination is given by a global type. The framework synthesizes per-role monitors from the global type, including explicit dependency handling for non-local choice, and covers protocols that cannot be analyzed by existing projection-based techniques. The implementation mentioned in the paper, RelaMon, synthesizes JSON monitors from Rascal-global types and deploys JavaScript monitor microservices that exchange dependency labels and forward messages (Heuvel et al., 2023).

In automotive software assurance, distributed black-box monitoring is a provenance infrastructure. The design records ECU firmware and software version, variant codes, update history, compatibility checks, VIN, odometer, crash status, module presence changes, V2V/V2X credential status, service events, and actor metadata. The goal is not immediate behavioral verdicts but immutable and publicly verifiable provenance: users, service providers, and OEMs can later establish what changed, by whom, where, and when, and compare the anchored snapshot against OEM-approved configurations (Falco et al., 2020).

In IIoT, BBox-IoT targets Class 0 low-SWaP sensors. Sensors periodically broadcast authenticated measurements; aggregators verify, cross-check, and store them on a permissioned blockchain. The claimed properties are tamper-evidence, non-repudiation, and provenance without sensor-side public-key cryptography or time synchronization. This places BBox-IoT in the same broad family as automotive audit-trail systems, but under much tighter energy and memory constraints (Chatzigiannis et al., 2021).

In distributed CPS, the monitored inputs are sparse, aperiodic, and uncertain both in value and in time. The framework accepts interval- or zonotope-valued measurements with timestamp intervals widened by bounded skew and delay, and monitors safety invariants by combining those observations with reachable-set over-approximations. The paper reports three benchmarks—an anesthesia model, an adaptive cruise controller, and an aircraft orbiting system—and emphasizes both offline falsification with limited false alarms and online, energy-aware sampling (Ghosh et al., 2022).

In distributed computing, black-box monitoring is an input to predictive performance modeling rather than a runtime verifier in the strict sense. Monitors collect system logs, OS and hypervisor counters, hardware performance counters, benchmark scores, and lightweight probes; models then predict execution duration, peak memory, wait time, transfer duration, and scalability curves for scheduling and resource allocation. The surveyed methods include statistical regression, regression trees, local learning, time-series forecasting, and Gaussian Processes, all under a non-intrusive monitoring assumption (Witt et al., 2018).

In AI control, distributed black-box monitors detect scheming and sabotage from action-only agentic trajectories. Observable events include user messages, tool calls, shell commands, file edits, browser or computer-use actions, tool outputs, and assistant messages, including the final response. The monitor outputs a structured rationale and a numeric risk score, but does not access chain-of-thought, scratchpad, logits, activations, or any model internals. The deployment model is explicitly distributed across many agents or services, with low-cost first-stage monitors and selective escalation (Sinha et al., 28 May 2026).

5. Guarantees, metrics, and empirical characteristics

The guarantees claimed for distributed black-box monitors vary sharply with the problem setting. In gray-box DDM monitoring, the monitor $BSys$1 is sound for violation detection: if it returns $BSys$2, then any valid extension violates the DDM formula. Satisfaction is vacuous in the infinite-domain case because the monitor never returns $BSys$3; this is a direct consequence of the non-monitorability of satisfaction for infinite $BSys$4. If $BSys$5 is finite, however, DDM is strongly monitorable in $BSys$6, and a perfect monitor exists by tabulating verdicts over all finite observations $BSys$7 (Stucki et al., 2019).

For deadlock detection, the guarantee is stronger. The distributed probe algorithm is proved sound and complete: if a monitored network reports a deadlock, the deinstrumented network contains a deadlock, and if the deinstrumented network contains a deadlock, then some monitor execution eventually reports one. The eventual-reporting theorem additionally assumes fairness. The implementation study reports systems ranging from $BSys$8 to approximately $BSys$9k services; message forwarding by proxy monitors roughly triples the total number of messages, while delayed probes reduce probe traffic in transient lock periods and still allow deadlocks to be reported at scale (Rowicki et al., 20 Aug 2025).

For blackbox multiparty session protocols, the two headline properties are soundness and transparency. Soundness means monitored executions advance along the global protocol and do not reach $Sys \subseteq BSys$0 for correct blackboxes. Transparency is established as a weak bisimulation result: monitored and unmonitored correct blackboxes are behaviorally equivalent in the enhanced LTS with label oracles. In this literature, correctness therefore includes both protocol conformance and non-interference with correct behavior (Heuvel et al., 2023).

Audit-trail and provenance systems emphasize cryptographic and systems metrics. The CAV design discussion states expected DHT routing complexity of $Sys \subseteq BSys$1 hops, parity clusters such as $Sys \subseteq BSys$2 data nodes plus one parity node, and public-chain anchoring that typically completes in seconds to minutes depending on network load and required confirmations; it also notes that the paper does not provide empirical benchmarks. BBox-IoT, by contrast, provides hardware measurements: signature size is $Sys \subseteq BSys$3 bytes, sensor signing on an ATmega328P at $Sys \subseteq BSys$4 MHz is approximately $Sys \subseteq BSys$5 ms per signature, aggregator verification on a Raspberry Pi 3 is approximately $Sys \subseteq BSys$6 ms per signature, and the scheme is two and three orders of magnitude faster than ECDSA for signing and verification respectively, enabling more than $Sys \subseteq BSys$7 more signing operations for the same amount of power (Falco et al., 2020, Chatzigiannis et al., 2021).

In CPS monitoring, guarantees are formulated at discrete time steps. The offline algorithm is sound: if the actual system is unsafe at some discrete time step, it returns unsafe. It is not complete in general because reachable-set over-approximation can still create false alarms, although the refinement step using the next sample reduces them. The online algorithm minimizes sampling while maintaining correctness at discrete time steps. The reported benchmarks show substantial sample reductions: the anesthesia example proves safety in approximately $Sys \subseteq BSys$8 s using $Sys \subseteq BSys$9 samples over $Sys$0 steps, and the ACC example proves safety in approximately $Sys$1–$Sys$2 s using $Sys$3–$Sys$4 samples over $Sys$5 steps (Ghosh et al., 2022).

In AI scheming detection, the dominant metrics are pAUROC@20, AUROC, low-FPR recall, formatting reliability, and marginal inference cost per $Sys$6 evaluations. The reported mean-OOD frontier includes Qwen3.5-27B (SFT+RL) at pAUROC@20 $Sys$7, AUROC $Sys$8, cost $Sys$9; GPT-OSS-20B (SFT) at $O \;\Vdash_{[Sys]}\; \phi$0, $O \;\Vdash_{[Sys]}\; \phi$1; and several prompted frontier models with higher pAUROC@20 but much higher cost. The paper states that stronger prompted frontier monitors achieve higher performance but at roughly $O \;\Vdash_{[Sys]}\; \phi$2–$O \;\Vdash_{[Sys]}\; \phi$3 higher marginal inference cost, and that Qwen3.5-27B and Kimi-K2.6 recover a majority of frontier recall at $O \;\Vdash_{[Sys]}\; \phi$4 FPR, with mean OOD TPR approximately $O \;\Vdash_{[Sys]}\; \phi$5 and $O \;\Vdash_{[Sys]}\; \phi$6 respectively (Sinha et al., 28 May 2026).

These metrics are not commensurable across subfields. Semantic monitorability, Coq-mechanised soundness and completeness, DHT routing complexity, signing latency, discrete-time safety guarantees, and pAUROC@20 all quantify different aspects of what a “distributed black-box monitor” is expected to do.

6. Limits, misconceptions, and research directions

A first limit is fundamental non-monitorability. Purely black-box monitoring cannot, in general, provide permanent verdicts for HyperLTL formulas with quantifier alternation over unbounded trace sets, and DDM remains non-monitorable for satisfaction when $O \;\Vdash_{[Sys]}\; \phi$7 is infinite. Gray-box analysis—symbolic execution, SMT, or other system knowledge—is therefore not an implementation convenience in that setting; it is what makes sound runtime violation detection possible at all (Stucki et al., 2019).

A second limit is assumption sensitivity. Deadlock detection depends on the SRPC abstraction, reliable asynchronous delivery, and fairness for eventual reporting; failures, partitions, and timeouts lie outside the formal proof. Multiparty session monitoring assumes finite $O \;\Vdash_{[Sys]}\; \phi$8-sequences, input/output mutual exclusion, no transitions after end, and well-formed global types with defined relative projections. CPS monitoring depends on a sound bounding model, bounded clock skew and delay, and discrete-time semantics; very large timestamp uncertainty or very sparse logging increases combinatorial exploration and false alarms (Rowicki et al., 20 Aug 2025, Heuvel et al., 2023, Ghosh et al., 2022).

A third limit concerns trust and infrastructure. Automotive audit trails and BBox-IoT require PKI or membership management, trusted bootstrap or configuration services, consensus services, and secure handling of revocation. The vehicular DHT-plus-blockchain design acknowledges privacy leakage risks even with pseudonymous anchors, and BBox-IoT notes a signature-layer MITM vulnerability mitigated by multi-aggregator cross-checking rather than eliminated cryptographically. These systems are black-box with respect to the monitored component, not trust-free with respect to the monitoring substrate (Falco et al., 2020, Chatzigiannis et al., 2021).

A fourth limit is distributional shift and supervision quality. Action-only scheming monitors depend on the strength of the teacher and judge models, the coverage of the scheming specification, and the breadth of the training mixture. The paper explicitly reports OOD fragility on SHADE-Arena, shorter context-window limits for smaller models, and the possibility of spurious correlations or adversarial adaptation. In distributed computing, the survey likewise emphasizes concept drift, cold start, trace-specific behavior, and the difficulty of integrating prediction accuracy with scheduling objectives (Sinha et al., 28 May 2026, Witt et al., 2018).

The forward-looking directions are correspondingly heterogeneous. The hyperproperty work identifies reactive systems with longer traces, bounded model checking with over- and under-approximations, HyperSTL, and broader concurrent or distributed hyperproperties. Deadlock monitoring points to failure detectors, partial synchrony, timeouts, AND/OR models, and observing monitors that do not act as proxies. Audit-trail systems propose zero-knowledge inclusion proofs, Reed–Solomon coding, and standardized DHT choices. CPS and PPM work emphasize tighter uncertainty calibration, scalable reductions, active learning, continuous prediction, and online adaptation. AI oversight points toward broader mixtures, domain-specific retraining, and calibrated cascades that preserve low FPR under large-scale deployment (Stucki et al., 2019, Rowicki et al., 20 Aug 2025, Falco et al., 2020, Ghosh et al., 2022, Witt et al., 2018, Sinha et al., 28 May 2026).

Taken together, these works show that distributed black-box monitors are not a single technique but a family of externally observing, distributedly coordinated mechanisms. Their feasibility hinges on the structure of the monitored phenomenon: some properties, especially quantified hyperproperties under model-free semantics, are provably beyond black-box runtime verification, whereas deadlock detection, protocol conformance, provenance assurance, uncertain-log safety checking, non-intrusive performance modeling, and action-only misalignment detection admit practical and sometimes formally verified black-box monitoring under domain-specific assumptions.