Research seriesL2data science
Static signatures and fixed permissions were built for deterministic software; autonomous agents defeat both. This series builds behavior-based defense for AI agents from the ground up: why signature and permission controls fail on non-deterministic agents, how to construct a behavioral baseline from action distributions and tool-call profiles, anomaly detection on agent traces with the cold-start problem, enforcement by observed behavior rather than static permission, and the mimicry-evasion limits every behavioral detector must confront. Grounded in NIST AI RMF, NIST SP 800-207 Zero Trust, OWASP LLM Top 10, the OWASP Agentic Security Initiative, MITRE ATLAS, and the anomaly-detection and intrusion-detection literature.
Signatures enumerate the bad; permissions enumerate the allowed. Autonomous agents defeat both by generating novel, legitimate-looking action sequences no list anticipated.
A behavioral baseline is an estimated model of how an agent normally acts. Three nested representations — marginal, conditional, and sequential — capture the three kinds of anomaly it must catch.
Turning a behavioral baseline into alarms means scoring deviation, choosing a detector for your data regime, and solving the hardest case of all — having no normal to learn from yet.
A behavioral signal that no one acts on is monitoring, not security. Turning deviation into allow, deny, and step-up decisions is a design problem with its own failure modes.
A behavioral detector can be evaded whenever a malicious goal is reachable by behavior it accepts. This piece formalizes that limit and shows what robustness actually buys.