Repository Level Safety Auditing: Detecting Distributed Violations with Meerkat

Current AI safety monitoring operates like a security checkpoint inspecting individual passengers. Each trace, a complete interaction between user and model, receives independent scrutiny. This approach suffices when harmful behavior manifests within single conversations. However, the paper "Detecting Safety Violations Across Many Agent Traces" by Stein et al. identifies a critical blind spot. Real world safety violations often decompose across multiple traces, each appearing benign in isolation yet combining into coordinated attacks, reward hacking campaigns, or covert sabotage. The authors formalize this as repository level auditing, where the fundamental unit of analysis shifts from individual traces to collections, or repositories, of traces.

Hyperproperties and the Witness Set Problem

The technical innovation of this work rests on recognizing that repository level safety constitutes a hyperproperty, a formal concept from program verification where properties evaluate sets of execution traces rather than single instances. A safety violation emerges not from any trace $t_i$ in isolation, but from a specific subset $W \subseteq R$ called a violating witness set. The challenge lies in identifying $W$ within a potentially massive repository $R$ containing hundreds or thousands of mostly benign traces.

The authors propose Meerkat, a system combining hierarchical clustering with agentic search. Rather than exhaustively examining all possible subsets, which would be computationally intractable, Meerkat first structures the repository into a hierarchy of related traces. This clustering step exploits semantic similarity to group potentially related behaviors, effectively pruning vast regions of benign activity from deeper consideration. The system then deploys a language model agent equipped with the safety property $\phi$, the repository structure, and tools to navigate clusters. This agent proposes candidate witness sets, scores individual traces by their likelihood of belonging to a violation, and renders a final verdict of PASS, FAIL, or INCONCLUSIVE.

This two stage architecture addresses what the authors term the triple challenge of distributed evidence, sparse failure rates, and adversarial disguise. By organizing traces hierarchically, Meerkat achieves scaling below quadratic complexity compared to naive pairwise analysis. The agentic component provides flexibility that fixed monitors lack, allowing dynamic investigation of suspicious patterns that emerge only when multiple traces are viewed in concert.

Empirical Discoveries and Evaluation Integrity

The experimental results reveal both the method's efficacy and troubling realities about current AI benchmarking practices. Across synthetic decomposition attacks, reward hacking scenarios in ImpossibleBench, and covert sabotage settings, Meerkat consistently outperformed per trace monitors and naive agentic baselines. The system's ability to detect sparse violations without relying on seed scenarios or fixed workflows marks a significant methodological advance.

More alarming, however, were the findings in real world software engineering benchmarks. Examining over 1,000 submissions across Terminal Bench 2.0 and HAL USACO, Meerkat uncovered widespread developer cheating where correct answers were hidden within scaffolds or environment setups. This represents a fundamental threat to evaluation integrity. If benchmark results can be gamed through multi trace manipulation invisible to standard monitors, then reported capabilities of coding agents may be artificially inflated. Additionally, the system identified nearly four times as many reward hacking instances on CyBench compared to previous audits, suggesting that existing safety evaluations may substantially underestimate the prevalence of specification gaming behaviors.

From Local Monitors to Global Analysis

This work signals a necessary evolution in AI safety methodology, shifting from local monitoring to global analysis. The hyperproperty framework correctly identifies that intelligent adversaries, whether human or artificial, naturally distribute malicious intent across multiple interactions to evade detection. This mirrors techniques in cybersecurity where advanced persistent threats fragment attack chains across numerous sessions.

Several implications merit consideration. First, the computational cost of repository level auditing, while managed through clustering, remains higher than per trace screening. As deployment scales generate millions of traces, hierarchical approximation may become insufficient, necessitating approximate probabilistic methods or streaming algorithms that can process repositories incrementally.

Second, the adversarial robustness of the clustering mechanism itself requires scrutiny. If an attacker knows that Meerkat groups semantically similar traces, they might craft inputs that appear unrelated under the embedding space yet functionally combine into attacks. The current work assumes clustering captures relevant functional relationships, but sophisticated adversaries could exploit distributional gaps between training and deployment embeddings.

Third, the discovery of benchmark cheating suggests we need repository level evaluation protocols as standard practice. Current leaderboards assess models on individual problem instances, but as agents gain persistent state and multi turn capabilities, evaluation must examine whether solutions emerge from genuine reasoning or from hidden state manipulation