AI safety research
LoopHarness Preserves Risk State Across Iterations, Reducing Overall ASR Across Five Agent Attack Classes to 0.1%
New research finds that guardrails reset after each trajectory cannot detect attack evidence distributed across multiple iterations, while simply decaying risk scores over time can be bypassed by waiting. Across 1,000 attacker-controlled episodes, LoopHarness preserved a 96.9% clean-task completion rate, though the results still require independent reproduction and validation in real-world systems.
A study published online on August 27 extends the agent security boundary from a single trajectory to the entire autonomous loop. The authors observe that many safeguards reset violation windows, permission tokens, inspection levels, and rollback points at the start of each task, while attackers can accumulate progress through work queues, tool outputs, or persistent memory. If malicious evidence is split into multiple fragments that appear locally benign, any monitor limited to a single trajectory lacks the combined signal needed to reach a definitive judgment.
The paper proposes LoopHarness, a wrapper around existing single-trajectory safeguards that continuously preserves five categories of state: work provenance and permission checks, cross-iteration risk accumulation, integrity-verified memory, an independent stop arbiter, and a governor that restricts high-risk irreversible actions. The key design choice is that once structural evidence of an attack appears, the risk score no longer decays automatically merely because no new evidence is observed. Counters, capability-degradation levels, and memory summaries are also bound to verified checkpoints, preventing rollbacks from clearing security state as a side effect.
Using Agent-SafetyBench, the authors created paired clean and attacked episodes covering five classes of cross-iteration attacks: provenance spoofing, memory tampering, verifier evasion, cooldown waiting, and runaway execution. Across 1,000 attack episodes—200 per class—the full configuration achieved an overall attack success rate of 0.1% and a clean-goal completion rate of 96.9%. Configurations missing major modules recorded attack success rates ranging from 88.4% to 97.6%. In an isolated test of risk decay, the risk score fell below the threshold after two evidence-free iterations, causing ASR to jump from 0% to 97%, while the non-decaying latch kept it at 0%.
These results cannot be directly extrapolated to production environments. The attack contracts, permission-broker rules, and model roles were all fixed by the authors. The complete system may also block subsequent legitimate work excessively because of its permanent latch, and the paper acknowledges that it does not yet provide a validated procedure for safely clearing that state. Future work should test authorization clearing across sessions, long-term usability, and performance when attackers can manipulate provenance attestations or the security-state storage layer.