Don't Trust a 0.18% False-Positive Rate: A Deployment Checklist for Agent Workflow Anomaly Detection

Why You Have to Look at the Whole Workflow, Not One Prompt

An injected prompt or a flawed plan doesn't stop where it lands — it propagates downstream through delegation and tool calls. A defense that inspects individual steps misses that propagation. Skynet, a workflow-level anomaly detection framework, turns planner-worker delegation, MCP tool calls, and data flow into a directed graph, trains only on benign executions, and scores the whole graph under one rule that catches both adversarial manipulation and intrinsic failure.

Evaluation drew on three benchmarks released independently by different teams: 111 adversarial red-team trajectories (Agent-SafetyBench), 200 non-adversarial execution failures (AgentErrorBench), and 497 cases spanning 8 risk sources and 14 failure modes (ATBench) — 808 cases combined. None of them were seen during training.

Why a False-Positive Number Alone Is the Wrong Selection Criterion

Look at just the two narrow benchmarks and a competing detector, Guardian, looks safer with a 0.18% FPR against Skynet's 0.89%. But on ATBench, where risk types widen to eight, Guardian's recall collapses to 18.31%, and on the 808-case Combined scenario it settles at 49.75%. Skynet holds 89.36% recall under the same conditions. Stop validation at one benchmark and this gap stays invisible.

Normal Isn't One Shape

Orchestrator pipelines, ReAct loops, deep-research workflows, and multi-agent debates are all benign, yet they look nothing alike. Skynet represents benign execution as 150 k-means modes (K=150); collapsing that to a single reference point in an ablation drops recall from 94.80% to 65.59% — nearly a third gone. Flatten the diversity of normal into one shape and the detector starts flagging unfamiliar-but-benign patterns as anomalies.

Field Deployment Guide: Calibration Beats the Algorithm

Don't stop the target metric at a 1% FPR ceiling — measure recall separately across at least two independent sources, then re-validate on an 808-case combined scenario. Split the latency budget by stage, too: offline per-workflow scoring runs a mean of 80.8ms and a P95 of 228.2ms as a baseline, while online per-step scoring sits at 4.8-48.8ms early and late but spikes to a mean of 104.8ms and a P95 of 572.7ms around step 20.

The first failure pattern is adopting a detector on a narrow benchmark's FPR alone. The fix: measure recall separately against at least three independent benchmarks at the same threshold before adoption, and hold off if even one falls short of the bar.

The second pattern is flattening the benign profile into a single reference point. The fix: keep benign execution represented as multiple k-means modes, and schedule a re-clustering of the mode bank whenever new tools or task types are added.

The third pattern is generating negative training examples from random graph perturbation. Drop the counterfactual examples that violate the four workflow invariants — role, provenance, dependency, stability — and FPR jumps to nearly 1.5x the target budget. The fix: build negatives from minimal, real invariant violations instead of random noise.

The fourth pattern is ignoring the latency spike at mid-range steps. Leave the 0.57s P95 spike around step 20 unhandled and the agent pipeline can stall. The fix: build in a fallback that switches to trailing (post-completion) scoring instead of blocking whenever a timeout fires in that window.

For the operations checklist, first validate the adapter that maps each platform's execution records into the same node/edge schema, and normalize away raw text in favor of categorical attributes like role, action type, and status so graph size alone can't drive the score. Launch in shadow mode — scoring without blocking — and route mid-confidence cases near the threshold to a human review queue instead of auto-blocking. Recall varies sharply by risk type (74.03% for indirect prompt injection vs. 100% for malicious tool execution), so widen enforcement staged by confidence, starting with the categories you're most sure about.

The improvement loop starts with retraining the benign corpus and mode bank whenever new tools or tasks are added. Classify missed anomalies and false positives by which of the four invariants they trace back to, feed that back as seeds for the next round of counterfactual generation, and keep adding new red-team results and operationally discovered failure modes to the validation set so the original metric still means the same thing months later.

Takeaways at a Glance

Pick an anomaly detector on one FPR number and recall collapses the moment the threat surface widens. Validate recall separately against three independent benchmarks, represent normal as multiple modes, build training signal from counterfactual invariant violations, and add a trailing-mode fallback for the mid-step latency spike — then launch in shadow mode to cut deployment risk.

References

Skynet: Workflow-Level Anomaly Detection for Agentic AI via Semantic and Structural Modeling — arXiv