Semantic Drift in Autonomous Agents: Detecting Runtime Goal Mutation in Multi-Agent LLM Systems

Abstract

Autonomous large language model (LLM) agents extend the attack surface beyond classical input-output filtering. Tool outputs, retrieval-augmented generation (RAG) chunks, inter-agent messages, and persistent memory constitute internal trust boundaries that adversaries exploit through indirect prompt injection, RAG poisoning, semantic goal drift, and multi-turn crescendo jailbreaks. We present GuardAgent Runtime, a framework-agnostic middleware that interposes on agent execution, enforces zero-trust inspection of all untrusted data flows, and maintains runtime intent continuity relative to the user’s authorized objective. GuardAgent composes pattern-based injection detection, embedding-based semantic drift and intent verification (Shadow Critic), multi-layer RAG inspection, and a temporally decaying risk accumulation engine with crescendo trend detection. We formalize detection scores and policy mapping, describe an open-source implementation with LangGraph/CrewAI/AutoGen adapters, and evaluate on a 20-scenario adversarial benchmark plus a browser pre-submit extension. With isolated per-scenario evaluation, GuardAgent achieves 90.0% F1 (90.0% precision, 90.0% recall), 100% accuracy on RAG poisoning and benign corpora, and mean interception latency under 4 ms excluding cold-start embedding load.