Multi-Agent Semantic Drift Detection and Self-Correction in Cybersecurity LLM Pipelines

Abstract

Large Language Model (LLM) pipelines in cybersecurity contexts face a critical but under-studied failure mode: semantic drift, in which outputs progressively deviate from original intent, technical constraints, or safety boundaries as they pass through multiple agent handoffs. This paper presents CyberDrift, a multi-agent closed-loop architecture for semantic drift detection and self-correction in cybersecurity intelligence pipelines. The system makes two primary contributions: (i) discordance-aware reasoning, in which conflict between seven heterogeneous evaluator agents is computed as a structured signal beyond weighted similarity, enabling detection of subtle drift patterns such as entity suppression masked by surface-level fluency; and (ii) an Intelligent Gatekeeper Agent that makes Pass/Repair/Block routing decisions based on both drift magnitude and inter-agent discordance. The discordance signal identifies four interpretable conflict patterns (entity-compression, compression-uncertainty, semantic-compression, and entity-structural), each corresponding to a distinct cybersecurity failure mode. We further characterise the Repair Module through explicit algorithmic specification, demonstrate that repair effectiveness (87.0% mean drift reduction, 99.4% constraint preservation) is robust to classifier error, and establish an ablation baseline confirming that discordance-aware routing reduces unnecessary repair invocations relative to threshold-only gating. CyberDrift demonstrates that evaluator disagreement is itself a structured diagnostic signal, not a noise artefact to be averaged away.