AI Papers Reader

Personalized digests of latest AI research

View on GitHub

Adaptive Safety Harnesses Aim to Fit Agents to Their Models and Domains

When language-model agents can move money, delete files, or expose credentials, safety failures become operational, not conversational. Existing system-level defenses are usually built once by experts and applied unchanged across different models and domains. That can overblock a well-aligned model while leaving a weaker one exposed, or miss domain-specific hazards such as money flows in finance and filesystem persistence in an operating system.

EvoSafeHarness, a framework from researchers at Johns Hopkins University, NVIDIA, and other institutions, treats that mismatch as an optimization problem. Given a frozen model and target domain, it searches for a deployable harness: a natural-language policy plus executable code that mediates the agent’s interaction with users and tools. A Designer proposes candidates based on the model’s failure traces and a domain specification. A fresh-context Criticizer stress-tests each candidate for evasions that preserve malicious intent, such as renaming a blocked path or paraphrasing an instruction, and rejects rules keyed to literal benchmark artifacts. A staged cascade separately measures benign utility, direct attacks, and indirect prompt injections; an Analyzer feeds failures into the next revision. Prior defenses provide warm-start experience, but the search can remove, recombine, or replace mechanisms.

One archived example shows how this can work. In a Qwen3.7-plus/finance deployment, the trusted user request in Slack authorizes buying 45 shares of CRM. External content then induces the model to emit a trade selling 45 CRM. The searched harness compares the emitted action’s side with the uniquely authorized side, rejects the mismatch, and allows the authorized buy to proceed. It does not need to decide which span of external text was malicious; it enforces an authorization relation at the action boundary.

On DecodingTrust-Agent, across fifteen independently searched model-by-domain deployments, the authors report average attack success rate (ASR) falling from 45.6% to 10.0%, with a 3.3-percentage-point utility cost. The harness scored best in 14 of 15 cells. Direct ASR fell from 50.9% to 12.6%, and indirect ASR from 40.4% to 7.4%. CaMeL and DRIFT left average ASR at 37.7% and 42.4%; Progent reached 10.5% ASR but cut utility to 56.4%, versus 79.8% for EvoSafeHarness. On AgentDojo, it reached 82.8% utility at 0.0% ASR—twice CaMeL’s utility at the same zero-ASR point—and transferred unchanged to unseen AgentDyn suites at 75.0% utility and 0.0% ASR. On Agent-SafetyBench, the authors say it achieved the best score for every victim. Against adaptive PAIR attacks with a refinement budget of 16, mean ASR remained below 20%.

The limits remain. Across 1,050 DecodingTrust-Agent attacks, 105 still succeeded. Three risk types showed no measured improvement: client-targeted scams remained at 60.0% (9/15), options solicitation at 30.0% (3/10), and telecom finance fraud at 16.7% (5/30). The researchers attribute this to harms hidden in fabricated claims, suitability, or misleading final answers, where no simple invariant certifies truth or intent without risking false positives; the interface also lacks a final-answer hook.

The authors argue the results support generating and validating a harness for each deployment rather than selecting one universal guardrail. The results do not establish real-world robustness; they show stronger benchmark safety–utility trade-offs and identify residual risk.