session-risk-memory-temporal-safety

name	session-risk-memory-temporal-safety
title	Session Risk Memory: Temporal Authorization in Multi-Turn Agent Safety Gates
version	0.0.3
engine	skillxiv-v0.0.3-claude-opus-4.6
license	MIT
url	https://arxiv.org/abs/2603.22350
keywords	["Agent Safety","Temporal Authorization","Risk Memory","Exponential Moving Average","Trajectory Evaluation"]
description	Add trajectory-level temporal authorization to stateless execution gates by maintaining a semantic centroid of agent behavioral profiles with exponential moving average risk accumulation. Improves F1 from 0.9756 to 1.0 and reduces false positives from 5% to 0% on slow-burn security violations. Use when deploying multi-turn agents and need to detect gradual privilege escalation and data exfiltration.
category	Component Innovation

What This Skill Does

Extend stateless per-action execution gates with a lightweight Session Risk Memory module that maintains behavioral context across turns. Uses exponential moving average to accumulate risk signals from slow-burn attacks (gradual privilege escalation, incremental data exfiltration) that evade per-turn thresholds.

The Component Swap

The old ILION approach evaluates authorization per-action without trajectory context, missing slow-burn attacks that individually appear benign:

# Old: stateless per-action evaluation
for action in agent_actions:
    risk_score = evaluate_action(action)  # Binary: safe or unsafe
    if risk_score > threshold:
        block_action(action)
    # No memory of previous actions; slow escalation undetected

The new approach adds a Session Risk Memory module that maintains semantic behavioral context and exponential moving average (EMA) risk accumulation:

# New: Session Risk Memory for trajectory-level authorization
class SessionRiskMemory:
    def __init__(self, embedding_dim=768):
        self.semantic_centroid = None  # Behavioral profile
        self.ema_risk = 0.0  # Accumulated risk
        self.ema_alpha = 0.2  # Decay factor

    def update(self, action_embedding, per_action_risk):
        """
        Update centroid and risk based on current action.
        Args:
            action_embedding: semantic vector of action (768-dim)
            per_action_risk: scalar risk from per-action evaluation [0,1]
        """
        # Update semantic centroid incrementally
        if self.semantic_centroid  :
            .semantic_centroid = action_embedding
        :
            .semantic_centroid = (
                 * .semantic_centroid +
                 * action_embedding
            )

        
        .ema_risk = (
            ( - .ema_alpha) * .ema_risk +
            .ema_alpha * per_action_risk
        )

     ():
        
        .update(action_embedding, per_action_risk)

        
        temporal_risk = .ema_risk

        
        spatial_risk = per_action_risk

        
        combined_risk =  * spatial_risk +  * temporal_risk

        is_safe = combined_risk < trajectory_threshold
         is_safe, combined_risk