DART: monitoring internal representation transitions detects multi-turn LLM agent attacks

Rather than inspecting isolated agent actions, DART tracks accumulated representation shifts across dialogue turns, cutting multi-turn agent attack success from 84% to 25% with minimal latency overhead.

Primary source: arXiv:2610.00400: https://arxiv.org/abs/2610.00400

What’s new: Autonomous LLM agents operating in multi-turn environments are vulnerable to composite attacks, where individually benign instructions gradually steer the system toward dangerous tool invocations or unauthorized actions. Because individual actions appear harmless, conventional prompt shields and per-turn guardrails routinely fail to intervene. In Representation Transitions Reveal Emerging Safety Risks in Multi-Turn LLM Agents (arXiv:2610.00400, 30 Sep 2026), researchers Haoyu Wang, Wei Zhao, Yedi Zhang, Christopher M. Poskitt, and Jun Sun discover that multi-turn exploits leave an unmistakable cumulative trace in an agent’s internal latent states.

The authors show that malicious trajectory drift produces progressive shifts along safety-critical latent directions across sequential context updates. However, naive accumulation along safety axes suffers from false positives caused by benign representation drift during ordinary multi-turn reasoning. To solve this, the authors introduce a projection technique that anchors benign traffic at zero and strips out leading benign variance directions with zero runtime computational cost. They materialize this finding in DART, a runtime monitoring framework that tracks representation transitions, attributes emerging risk to triggering contexts, and injects targeted corrective reminders. Across six open and proprietary LLM backbones on the MT-AgentRisk and ASEval benchmarks, DART reduces attack success rates from 84% to 25% on MT-AgentRisk (with a 12% false-alarm rate) and from 97% to 52% on ASEval, outperforming state-of-the-art defenses like ToolShield while adding only 0.14 to 0.56 seconds of latency per step without requiring auxiliary judge models.

Why it matters: Securing agentic workflows against multi-step social engineering and indirect prompt injection is a major prerequisite for autonomous workplace deployments. By diagnosing latent representation shifts directly inside the model during inference, DART provides an efficient, judge-free security layer capable of blocking multi-turn exploits before high-consequence tools are executed.

Caveats: DART requires direct access to model residual stream representations and hidden activations, making it primarily applicable to open-weight models or cloud APIs that expose token-level activation hooks. In addition, highly adaptive adversaries with knowledge of the safety projection direction might attempt orthogonal attack trajectories designed to conceal representation transitions.