LatentRiskBench: action-level checks miss state-dependent agent risk
LatentRiskBench measures whether a guardrail can tell a safe agent action from an identical one that breaks policy in another state.
· arXiv · Research by Jingyue Cong (RMIT University), Estrid He (RMIT University), Zhuang Li (RMIT University), Nan Wu, Li Shen (YepAI), RMIT University
Guardrails that judge one agent action at a time catch almost none of the policy violations that depend on workflow state, a new benchmark reports. The authors measure 0.09 detection at action level against 0.96 at state level.
01What happened
Eight authors led by Jingyue Cong of RMIT University posted LatentRiskBench to arXiv on October 13, 2026, with code on GitHub. The benchmark was accepted to the EMNLP 2026 Industry Track. The team built it for enterprise agent risks that cannot be judged from a single action, and ran it against seven guardrails and five auditor models.
02How it works
Each case pairs a risky agent trajectory with a benign one that ends in the same final action, differing only in a hidden, policy-relevant workflow state. A guardrail reading the action alone cannot separate the pair, so it has to reconstruct the earlier context. The authors score residual risk left after a defense runs, and report a State-Reconstruction Gain of 0.87 between action-level and state-level auditing.
03Who is affected
Teams running policy guardrails over multi-step enterprise agents are the audience, in particular anyone relying on filters that score a single tool call. Among the defenses tested, the authors report GuardAgent leaving the least residual risk at 0.20 and an unguarded baseline the most at 0.96. Results come from the authors' own benchmark and one anonymized e-commerce deployment, not from a reported incident.
04What to do
Test a guardrail against pairs of trajectories that end in the same action but differ in earlier workflow state, rather than scoring actions one at a time. The authors report that giving an auditor access to workflow state lifts detection from 0.09 to 0.96 on their state-dependent set.
Measured results
Residual risk by guardrail, LatentRiskBench
Residual risk after the defense runs, lower is better for defenders
| Result | Score |
|---|---|
| Vanilla | 1.0 |
| Keyword | 0.8 |
| StepRule | 0.6 |
| LLMJudge | 0.3 |
| TrajRule | 0.5 |
| LlamaGuard3 | 0.8 |
| GuardAgent | 0.2 |
Scale 0 to 1 · Source: arxiv.org, as published
Sources 3 links, all fetched
- 1arxiv.orgarXiv Paper
- 2arxiv.orgFull Text HTML
- 3github.comLatentRiskBench Code