Drift Detection

Drift is the gradual or sudden divergence of an agent’s behavior from its declared alignment posture. A single verified AP-Trace or a single clear integrity checkpoint tells you the agent was aligned at that moment. Drift detection tells you whether the agent is staying aligned over time. Mnemom detects drift at two timescales through two complementary protocols:

Protocol	Timescale	Input	Detection Method
AAP (post-hoc)	Days to weeks, cross-session	AP-Trace structural features	Cosine similarity to baseline centroid
AIP (real-time)	Minutes, within a session	Integrity checkpoint verdicts	Consecutive non-clear count

Both protocols store alerts in the same drift_alerts database table, surfaced through a unified API and dashboard.

What drift looks like

Drift rarely appears as a single dramatic violation. More commonly, it manifests as a pattern:

An agent that used to escalate 15% of decisions now escalates only 5%.
An agent that declared transparency as a value stops applying it in trace decisions.
An agent’s integrity checkpoints shift from consistently clear to occasional review_needed verdicts, then more frequent ones.
An agent starts reasoning about actions not in its bounded_actions list, even if it does not ultimately take them.

Each individual action might pass verification. The problem is the trend.

AAP drift detection (Post-Hoc)

AAP drift detection analyzes AP-Trace structural features across sessions to detect behavioral patterns that diverge from a computed baseline.

How it works

Feature extraction: Extract structural features from each trace — action types, values applied, escalation patterns, confidence scores. Content features (reasoning text) are excluded because they dilute cosine similarity without adding alignment signal.
Chronological ordering: Sort all traces by timestamp.
Baseline computation: Compute a baseline centroid from the first N traces, where N = max(sustained_threshold, min(10, len(traces) // 4)). This centroid represents the agent’s “normal” behavioral fingerprint.
Similarity computation: Compute cosine similarity between each subsequent trace’s feature vector and the baseline centroid.
Divergence tracking: Track similarity over time. Alert when similarity drops below the threshold for a sustained number of consecutive traces.

Structural features

AAP drift uses only structural features extracted from traces and cards:

Feature	Source	Weight
`value:{v}`	Declared/applied values	1.0
`action_name:{name}`	Bounded actions / action name	1.0
`action:{type}`	Action type (trace only)	1.0
`category:{cat}`	Principal type / action category	1.0
`escalation:*`	Escalation triggers / escalation state	1.0
`confidence`	Decision confidence	0.0-1.0

Content features (TF-IDF from reasoning text) are available for text-to-text comparison (e.g., SSM pairwise similarity between traces) but are not used for drift detection. Alignment Cards declare structural constraints — values, bounded actions, principal relationships — and contain no reasoning text. Including content tokens dilutes similarity without adding alignment signal.

Calibration thresholds

These thresholds are calibrated from empirical analysis of approximately 50 multi-turn agent conversations totaling around 2,500 messages:

Constant	Value	Description
`DEFAULT_SIMILARITY_THRESHOLD`	0.30	Alert when drift similarity drops below
`DEFAULT_SUSTAINED_TURNS_THRESHOLD`	3	Alert after N consecutive low-similarity traces
`BEHAVIORAL_SIMILARITY_THRESHOLD`	0.50	Warn on single-trace verification when below
`MIN_COHERENCE_FOR_PROCEED`	0.70	Minimum coherence score for automatic proceed

Code example

from aap import detect_drift

traces = fetch_traces(agent_id="my-agent", days=30)
card = fetch_alignment_card(agent_id="my-agent")

alerts = detect_drift(
    traces=traces,
    card=card,
    similarity_threshold=0.30,
    sustained_threshold=3,
)

for alert in alerts:
    print(f"Drift detected: {alert.analysis.drift_direction}")
    print(f"  Similarity: {alert.analysis.similarity_score}")
    print(f"  Sustained traces: {alert.analysis.sustained_traces}")
    print(f"  Trace IDs: {alert.trace_ids}")

import { detectDrift } from '@mnemom/agent-alignment-protocol';

const traces = await fetchTraces({ agentId: 'my-agent', days: 30 });
const card = await fetchAlignmentCard({ agentId: 'my-agent' });

const alerts = detectDrift(card, traces, 0.30, 3);

for (const alert of alerts) {
  console.log(`Drift: ${alert.analysis.drift_direction}`);
  console.log(`  Similarity: ${alert.analysis.similarity_score}`);
  console.log(`  Sustained: ${alert.analysis.sustained_traces} traces`);
}

AAP drift alert structure

{
  "alert_type": "drift_detected",
  "agent_id": "did:web:agent.example.com",
  "card_id": "ac-abc123",
  "detection_timestamp": "2026-01-31T14:00:00Z",
  "analysis": {
    "similarity_score": 0.25,
    "sustained_traces": 4,
    "threshold": 0.30,
    "drift_direction": "autonomy_expansion",
    "specific_indicators": [
      {
        "indicator": "escalation_rate_decrease",
        "baseline": 0.15,
        "current": 0.05,
        "description": "Escalation rate decreased from 15% to 5% of decisions"
      }
    ]
  },
  "recommendation": "Review recent decisions for alignment drift",
  "trace_ids": ["tr-1", "tr-2", "tr-3", "tr-4"]
}

AAP drift categories

Category	Description	Indicators
`autonomy_expansion`	Agent acting outside declared bounds	Decreased escalation rate, new action types
`value_drift`	Applied values diverging from declared	Different values appearing in traces
`principal_misalignment`	Decisions not serving principal	Declining principal-benefit scores
`communication_drift`	Explanations becoming inconsistent	Selection reasoning diverging from values

AIP drift detection (Real-Time)

AIP drift detection monitors the pattern of integrity verdicts within a session. It is deliberately simpler than AAP drift because it operates on a faster timescale where complex statistical methods are unnecessary.

How it works

Maintain a running count of consecutive non-clear verdicts (sustained_nonclear).
On each checkpoint:
- If verdict === "clear": reset sustained_nonclear to 0.
- If verdict !== "clear": increment sustained_nonclear.
When sustained_nonclear >= threshold (default: 3): generate an IntegrityDriftAlert.
Compute integrity_similarity as the ratio of clear verdicts in the current window: clear_count / window_size.
Derive severity from integrity_similarity.

Severity thresholds

Severity	integrity_similarity	Meaning
`low`	>= 0.7	Minor variance, likely normal
`medium`	0.4 — 0.7	Notable pattern, warrants attention
`high`	< 0.4	Significant drift, review recommended

AIP drift direction types

Direction	Description
`injection_pattern`	Multiple checks flagging prompt injection. Agent may be under sustained attack.
`value_erosion`	Increasing frequency of value misalignment. Reasoning gradually departing from declared values.
`autonomy_creep`	Growing tendency toward actions outside the autonomy envelope.
`deception_pattern`	Multiple checks flagging deceptive reasoning. Developing a pattern of misleading intent.
`unknown`	Drift detected but direction cannot be categorized.

The direction is inferred from the dominant ConcernCategory across the non-clear checkpoints in the streak.

Code example

from aip import detect_integrity_drift, WindowManager, WindowConfig

manager = WindowManager(WindowConfig(max_size=10), session_id="session-1")
state = None

# Process checkpoints as they're produced during a session
for checkpoint in session_checkpoints:
    manager.push(checkpoint)
    state, alert = detect_integrity_drift(
        state, checkpoint, manager.get_state().checkpoints
    )
    if alert:
        print(f"Integrity drift: {alert.drift_direction}")
        print(f"  Similarity: {alert.integrity_similarity}")
        print(f"  Sustained checks: {alert.sustained_checks}")
        print(f"  Severity: {alert.severity}")

import { detectIntegrityDrift, createDriftState } from '@mnemom/agent-integrity-protocol';

const WINDOW_SIZE = 10;
let driftState = createDriftState();
const windowCheckpoints = [];

for (const checkpoint of sessionCheckpoints) {
  windowCheckpoints.push(checkpoint);
  if (windowCheckpoints.length > WINDOW_SIZE) windowCheckpoints.shift();
  const { state, alert } = detectIntegrityDrift(driftState, checkpoint, windowCheckpoints);
  driftState = state;
  if (alert) {
    console.log(`Integrity drift: ${alert.drift_direction}`);
    console.log(`  Similarity: ${alert.integrity_similarity}`);
    console.log(`  Sustained: ${alert.sustained_checks} checks`);
  }
}

AIP drift alert structure

{
  "alert_id": "ida-a1b2c3d4-5678-9abc-def0-123456789abc",
  "agent_id": "did:web:agent.example.com",
  "session_id": "sess-abc12345-1234567",
  "checkpoint_ids": ["ic-1", "ic-2", "ic-3"],
  "integrity_similarity": 0.5,
  "sustained_checks": 3,
  "alert_type": "informative",
  "severity": "medium",
  "drift_direction": "value_erosion",
  "message": "3 consecutive integrity concerns detected -- reasoning patterns diverging from declared values",
  "detection_timestamp": "2026-02-01T15:30:00Z"
}

AIP drift alerts are always informative, never prescriptive. They describe what was observed (“3 consecutive integrity concerns”), not what to do (“stop the agent immediately”). The host system decides how to respond.

SSM: Semantic similarity mapping

Both protocols use a technique called SSM (Self-Similarity Matrix) for measuring semantic similarity. In the context of drift detection:

AAP uses SSM to compute cosine similarity between trace feature vectors and a baseline centroid.
AIP uses a simpler version: the ratio of clear verdicts in a session window.

How SSM works for AAP drift

Extract a feature vector from each AP-Trace (structural features only).
Compute the baseline centroid from early traces.
For each subsequent trace, compute cosine similarity to the centroid.
Track similarity over time. A sustained drop below the threshold triggers an alert.

def cosine_similarity(a: dict, b: dict) -> float:
    """Compute cosine similarity between two feature dictionaries."""
    common_keys = set(a.keys()) & set(b.keys())
    dot_product = sum(a[k] * b[k] for k in common_keys)

    mag_a = sum(v * v for v in a.values()) ** 0.5
    mag_b = sum(v * v for v in b.values()) ** 0.5

    if mag_a == 0 or mag_b == 0:
        return 0.0

    return dot_product / (mag_a * mag_b)

TF-IDF (term frequency-inverse document frequency) weighting (text-to-text only)

For text-to-text similarity (e.g., comparing reasoning text between traces), AAP uses a 60/30/10 weighting:

Component	Weight	Description
Word TF-IDF	60%	Semantic content from unigrams and bigrams
Character TF-IDF	30%	Stylistic patterns from 3-5 character n-grams
Metadata features	10%	Structural alignment (action types, values)

This weighting is for text-to-text comparison only. Drift detection uses structural features exclusively. These are different operations — do not conflate them.

Policy-aware drift detection

With the Policy Engine, drift detection gains additional context for distinguishing genuine misalignment from configuration issues:

Policy gaps vs. genuine drift: When drift is triggered by tools that don’t map to card capabilities, the policy engine can identify this as a card_gap rather than behavioral drift. This prevents false-positive drift alerts caused by configuration drift (e.g., new tools added without updating the alignment card).
Reclassification impact: After violation reclassification, drift events caused by card_gap violations are excluded from the Drift Stability component of the trust score. This means configuration-related drift doesn’t permanently harm an agent’s reputation.
Grace period awareness: Tools in their grace period (24 hours by default) are flagged as warnings rather than drift triggers, giving operators time to update policies before alerts fire.

When investigating a drift alert, check the policy evaluation results first. If the drift correlates with unmapped tools or policy violations classified as card_gap, the fix is a card amendment and policy update — not a behavioral correction.

Responding to drift

When drift is detected, the recommended investigation workflow is:

Review the alerting traces/checkpoints: Examine the specific decisions or thinking blocks that triggered the alert.
Identify the pattern: Is this autonomy expansion? Value drift? Prompt injection? The drift_direction field provides an initial categorization.
Check for policy gaps: Did the agent start using new tools that aren’t mapped in the policy? If so, this may be a card gap rather than genuine misalignment. Use reclassification to correct the classification.
Check for environmental causes: Did the user’s requests change? Did tool availability change? Not all drift indicates misalignment — sometimes the operating context has shifted.
Recalibrate or update the card: If the drift represents a legitimate behavioral evolution (new capabilities, expanded scope), update the Alignment Card and policy to match. If it represents actual misalignment, investigate the root cause.
Reset the baseline: After addressing the drift, allow new traces to establish a new baseline centroid for future detection.

Unified storage

Both AAP and AIP drift alerts are stored in the same drift_alerts database table, distinguished by the alert_type field:

Protocol	alert_type prefix	Example
AAP	(none)	`autonomy_expansion`, `value_drift`
AIP	`aip:`	`aip:injection_pattern`, `aip:value_erosion`

This unified storage enables dashboards and APIs to surface all drift signals together, providing a complete picture of agent behavioral trends.

Limitations

Drift detection identifies statistical patterns. It does not determine intent or cause. A drift alert means “behavior is changing” — not “the agent is misaligned.” False positives occur when operating context shifts legitimately (new user requests, new tool availability). False negatives occur when drift is too subtle to exceed thresholds or when the agent games the structural features.

Overview

Identity & Cards

Posture & Policy

Detection & Safe House

AEGIS

Reputation & Risk

Lifecycle

Gateway

Pricing

Migrations

Policy

Specifications

Changelog

What drift looks like

AAP drift detection (Post-Hoc)

How it works

Structural features

Calibration thresholds

Code example

AAP drift alert structure

AAP drift categories

AIP drift detection (Real-Time)

How it works

Severity thresholds

AIP drift direction types

Code example

AIP drift alert structure

SSM: Semantic similarity mapping

How SSM works for AAP drift

TF-IDF (term frequency-inverse document frequency) weighting (text-to-text only)

Policy-aware drift detection

Responding to drift

Unified storage

Limitations

See also

​What drift looks like

​AAP drift detection (Post-Hoc)

​How it works

​Structural features

​Calibration thresholds

​Code example

​AAP drift alert structure

​AAP drift categories

​AIP drift detection (Real-Time)

​How it works

​Severity thresholds

​AIP drift direction types

​Code example

​AIP drift alert structure

​SSM: Semantic similarity mapping

​How SSM works for AAP drift

​TF-IDF (term frequency-inverse document frequency) weighting (text-to-text only)

​Policy-aware drift detection

​Responding to drift

​Unified storage

​Limitations

​See also

What drift looks like

AAP drift detection (Post-Hoc)

How it works

Structural features

Calibration thresholds

Code example

AAP drift alert structure

AAP drift categories

AIP drift detection (Real-Time)

How it works

Severity thresholds

AIP drift direction types

Code example

AIP drift alert structure

SSM: Semantic similarity mapping

How SSM works for AAP drift

TF-IDF (term frequency-inverse document frequency) weighting (text-to-text only)

Policy-aware drift detection

Responding to drift

Unified storage

Limitations

See also