Building a Behavioral Baseline: Action Distributions, Tool-Call Profiles, and Sequence Models

Any detector of abnormal agent behavior is only as good as its notion of normal, and that notion is not something you can write down from first principles. An autonomous agent's normal conduct is an empirical fact about a particular model, prompt, tool set, and task mix; it must be measured. A behavioral baseline is the artifact of that measurement — a fitted model that assigns a probability, or at least a plausibility, to any behavior the agent might exhibit. Build it carelessly and every downstream alarm inherits the error; build it well and you gain a runtime reference against which deviation becomes visible. This piece is about building it well.

What a Baseline Is, Precisely

A behavioral baseline is an estimated probability model over an agent's actions. Rather than enumerating allowed operations, it learns the shape of normal operation from observed traces and assigns each new behavior a likelihood under that model. Low likelihood is the raw material of an alarm. Framing the baseline as a probability model, rather than a rule set, is what lets it generalize to behavior no one enumerated in advance — the property a non-deterministic agent demands.

The taxonomy of anomalies set out by Chandola, Banerjee, and Kumar tells us the baseline cannot be a single model. A point anomaly is a lone action that is rare in itself; a contextual anomaly is an action that is ordinary in general but wrong in its context; a collective anomaly is a subsequence that is suspicious as a whole even though each action is common. These three failure modes map onto three questions a baseline must answer, and answering all three requires three nested representations rather than one.

Those representations are: a marginal action distribution that captures how often each action occurs overall; context-conditioned tool-call profiles that capture what is normal for a given task, role, or step; and a sequence model that captures normal order and structure. They compose from coarse to fine — the marginal is a special case of the conditional with an empty context, and the conditional is a special case of the sequence model with history length zero — so building all three is a matter of adding conditioning, not maintaining three unrelated systems.

The Data: Trace Schema, Provenance, and Leakage

The unit of observation is a trace: an ordered record of an agent's decisions on a task. A workable schema captures, for each step, the tool invoked, a stable hash of its arguments, the surrounding context (task type, role, step index), the result status, and a timestamp. Hashing arguments rather than storing them raw is deliberate: it preserves the ability to compare argument patterns while limiting how much sensitive content the baseline store retains.

Provenance discipline is not optional. The NIST AI Risk Management Framework and its Generative AI Profile both name data leakage and the mishandling of sensitive inputs as first-order risks, and an agent trace is a concentrated stream of exactly such inputs — file paths, query text, recipient addresses, secrets passed as arguments. A baseline built from raw traces silently becomes a secondary store of sensitive data and a new exfiltration target. Minimize at capture: hash or redact argument values, keep only the features the model needs, and govern the trace store with the same controls as the data it reflects.

There is also a subtler, data-science hazard: label leakage and contamination. If the observation window from which you fit normal already contains compromised behavior, the baseline learns the attack as normal and will never flag it. A baseline is only as trustworthy as the claim that its training window was benign, so that claim must be established by independent means — not assumed — and revisited whenever the environment changes.

Level 1 — The Marginal Action Distribution

The coarsest baseline is the marginal distribution over actions: how often, across all observed traces, the agent invokes each tool. Estimated by simple frequency with smoothing for unseen actions, it answers the point-anomaly question — is this action, in isolation, rare for this agent at all. An agent that has never once invoked a shell tool in a benign window, suddenly doing so, is a point anomaly the marginal catches even with no notion of context.

The marginal is cheap, interpretable, and a good early-warning layer, but it is deliberately blunt. It cannot tell that a database query is normal for a research task yet abnormal during a formatting task, because it has averaged over all contexts. Its value is as a first sieve and as a sanity check on richer models: if a rich model calls something normal that the marginal says is vanishingly rare, that disagreement is itself worth surfacing.

Concretely, treat each action's smoothed frequency as its marginal probability and its negative logarithm as a point-surprisal score. Rank actions by surprisal to read off which behaviors are inherently unusual for this agent — the shortlist a reviewer should look at first.

Level 2 — Context-Conditioned Tool-Call Profiles

The second representation conditions the distribution on context: task type, the agent's assigned role, and the position in the workflow. This answers the contextual-anomaly question — is this action normal here, even if it is normal somewhere. The OWASP Agentic Security Initiative frames excessive agency precisely as capability used outside its intended context, and a context-conditioned profile is the measurement that makes intended context concrete rather than aspirational.

Profiles extend beyond which tool to how it is called. For each tool in each context, the baseline can model the distribution of argument shapes — the hashed argument value, its type, its size class, its egress destination category — so that an authorized tool used with an unusual argument, such as a file read whose target is a credential path, registers as contextual deviation. This argument-level conditioning is where a permission-passing but intent-violating call first becomes statistically visible.

Conditioning has a cost the data scientist must respect: it fragments the data. Each additional context dimension multiplies the number of profiles to estimate and shrinks the sample behind each, raising variance and the risk of calling rare-but-benign behavior anomalous. Choose context dimensions that carry real signal, pool sparse profiles into parent contexts, and report per-profile sample sizes so consumers know which profiles are trustworthy.

Level 3 — Sequence Models for Structure

The richest representation models order. An order-k sequence model estimates the probability of the next action given the previous k actions, capturing that read-then-encode-then-send is a different object from the same three actions in any other order or company. This answers the collective-anomaly question, and it is the layer that sees an exfiltration chain assembled entirely from individually ordinary, individually authorized steps.

The classic and still-instructive baseline is an order-k Markov model — equivalently, an n-gram model over the action alphabet — scored by the sequence's log-likelihood or its per-action perplexity. It is transparent, cheap to fit, and directly interpretable: a low-probability transition points at exactly which step broke the expected structure. Richer sequence models trade that transparency for capacity, but the Markov baseline is the right first instrument because it makes the collective-anomaly signal legible.

Sequence modeling also inherits the sharpest limitation of the whole enterprise, established by Wagner and Soto for system-call intrusion detection: an adversary who knows the sequence model can pad a malicious sequence with normal-looking transitions until it lies inside the model's high-probability region. Order alone is mimicable. The practical response is to combine the sequence signal with the argument-level and egress signals from Level 2, so that conforming to normal order does not also grant conformance in what is actually being moved.

Building It: From Traces to a Fitted Baseline

The construction is a standard estimation pipeline with a security-specific discipline at each stage. Collect benign traces over a representative window; extract the trace schema into features; fit the three nested models with smoothing; then evaluate on a held-out benign split before any of it touches enforcement. The estimation is semi-supervised: the model learns only from normal operation, because labeled attacks against a specific agent are scarce and non-recurring, exactly the regime Chandola and colleagues identify as the common case for anomaly detection.

Evaluation must be quantitative and honest. Report held-out log-likelihood or perplexity to show the model fits normal without memorizing it; report per-profile sample sizes to expose thin estimates; and, where any labeled or synthetic abnormal behavior exists, report the score separation between it and held-out normal rather than a single accuracy number. A baseline that cannot demonstrate separation on the cases you do have is not ready to gate anything.

Finally, version the baseline as a first-class artifact. Record the model, the window it was fit on, the feature definitions, the smoothing and thresholds, and the evaluation metrics, so that every later alarm can be traced to the exact baseline that raised it. This is what makes the behavioral layer auditable under the NIST AI Risk Management Framework's MEASURE function, which asks not just that a metric exist but that it be documented, valid, and reproducible.

Threats to Validity

The governing assumption of any baseline is stationarity: that normal tomorrow resembles normal today. Agents violate it routinely. A model upgrade, a new tool, a prompt revision, or a shift in the task mix all move the behavior distribution, and a baseline that is not refreshed will drift into flagging the new normal as anomalous, degrading into noise. Treat the baseline as perishable: monitor its own goodness-of-fit on recent benign traffic and re-fit on a schedule and on known change events.

The second threat is contamination, already noted at capture: if the fitting window was not truly benign, the attack is learned as normal. The third is over-conditioning, where too many context dimensions leave profiles estimated from a handful of samples that swing between over- and under-flagging. The fourth, and least escapable, is the mimicry adversary who treats the published baseline as a specification to satisfy. None of these is a reason to abandon the baseline; each is a reason to state its limits, layer independent signals, and never present a single fitted model as a complete boundary.

Practitioner Toolkit

Copy-paste, strictly defensive artifacts you can use today. Nothing here attacks a real system.

{
  "trace_id": "uuid",
  "step": 7,
  "tool": "read_file",
  "arg_hash": "sha256:...",     // hash, never the raw value
  "arg_type": "path",
  "arg_size_class": "small",
  "egress_category": "none",
  "context": { "task": "research", "role": "reader" },
  "result_status": "ok",
  "ts": "2026-01-01T00:00:07Z"
}

function fit_baseline(benign_traces, k, alpha):
    counts = {}
    for trace in benign_traces:            # benign ONLY
        for t in range(len(trace)):
            hist = tuple(trace[max(0,t-k):t])
            counts[(hist, trace[t])] += 1
    return smooth(counts, alpha)            # add-alpha smoothing

function sequence_surprisal(trace, model, k):
    s = 0
    for t in range(len(trace)):
        hist = tuple(trace[max(0,t-k):t])
        s += -log(model.prob(hist, trace[t]))
    return s / len(trace)                    # per-action; compare to held-out normal

Glossary

Behavioral baseline

An estimated probability model of an agent's normal behavior, used to score the plausibility of new behavior.

Point anomaly

A single action that is rare in itself, independent of context or order.

Contextual anomaly

An action that is normal in general but abnormal for its particular task, role, or step.

Collective anomaly

A subsequence of actions that is suspicious as a whole even though each individual action is common.

Marginal action distribution

The overall frequency of each action across all observed traces, ignoring context and order.

Order-k Markov model

A sequence model estimating the next action's probability from the previous k actions; equivalently an n-gram over the action alphabet.

Perplexity

The exponential of the average negative log-probability a model assigns to a sequence; lower means a better fit to normal.

References

1. NIST AI 100-1, Artificial Intelligence Risk Management Framework (AI RMF 1.0)
2. NIST AI 600-1, Generative AI Profile
3. NIST SP 800-207, Zero Trust Architecture
4. OWASP Top 10 for Large Language Model Applications (2025)
5. OWASP Agentic Security Initiative — Agentic AI Threats and Mitigations
6. MITRE ATLAS — Adversarial Threat Landscape for AI Systems
7. Chandola, Banerjee & Kumar, Anomaly Detection: A Survey (ACM Computing Surveys, 2009)
8. Wagner & Soto, Mimicry Attacks on Host-Based Intrusion Detection Systems (ACM CCS, 2002)