Forensics of Autonomous Multi-Agent Systems: A Methodological and Algorithmic Framework for Detection, Causal Traceability, and Evidentiary Qualification of AI-Generated Deviant Behaviours

Abstract

The emergence of autonomous agents based on large language models (LLMs) such as ReAct, LangGraph, AutoGen, or CrewAI — radically transforms the nature of acts produced by artificial intelligence systems. These agents no longer merely generate text: they plan, call system tools, manipulate databases, and execute arbitrary code. This operational autonomy, combined with their demonstrated vulnerability to indirect prompt injection attacks, creates a major evidentiary blind spot: no forensic framework currently exists to legally characterise an illicit act generated by AI before a criminal court. This article proposes a methodological and algorithmic framework for the forensics of autonomous multi-agent systems, structured around three fundamental locks: non-invasive acquisition and cryptographic sealing of the agent's latent state, algorithmic quantification of behavioural deviation, and causal traceability compliant with Article 427 of the French Code of Criminal Procedure and Articles 12 & 13 of the EU AI Act. The project deploys an experimental three-layer software architecture — immutable forensic sensor, behavioural deviation index engine, causal reconstruction and judicial report — and is part of a 36-month doctoral work programme. In my daily practice as a judicial expert in digital forensics, I use classical DFIR tools (EnCase, FTK, Autopsy, Volatility, X-Ways, Axiom, Magnet, IPED) under ISO/IEC 27037. However, when facing autonomous multi-agent systems (ReAct, LangGraph, MCP protocols), these tools become ineffective: they record material alteration but remain blind to the internal probabilistic deliberation of the model. On the legal side, since AI has no legal personality (Article 121-1 of the French Penal Code), judges are powerless before the black box to characterise fault (Article 121-3 of the Penal Code, Article 1242 of the Civil Code), whether the cause is a hostile injection (OWASP LLM01) or spontaneous drift (goal drift). The proposed framework aims to fill this gap by addressing three scientific locks. The first consists in capturing decision-making telemetry (inference contexts, KV-Cache, tool calls) without prohibitive latency, with integrity guaranteed by Merkle trees and certified timestamping (RFC 3161). The second aims to formulate a composite deviation index combining semantic vector divergence (embedding space) and structural violation analysis on action graphs. The third addresses the modelling of the trajectory as causal graphs (Pearl's models) in order to isolate the corrupted input and produce a report admissible in court.