SHE: Trajectory-driven Safety Harness Evolution for LLM Agents
Ranking
Observed public metrics from 1 member.
Merged summary
TL;DR - SHE is a framework that treats an LLM agent's "harness" (system prompt, rules, memory, tool policy) as an evolvable safety artifact, learning refined safe boundaries from rollout trajectories instead of freezing safety at deployment time. It matters because it shifts agent safety work from static model-level guardrails to adaptive runtime scaffolding that can respond to newly observed risks.
- Decomposes the harness into four artifacts with explicit safety responsibilities — System Prompt, Rule Bank, Safety Memory, and Tool Policy — so responsibility attribution is localized and each component can evolve independently.
- Uses an attribution-guided evolution loop: trajectory failures are converted into structured diagnoses, which drive artifact-specific boundary refinements, with candidate harnesses selected via joint safety-utility validation.
- On Agent-SafetyBench, SHE reports a 3.1x attack success rate (ASR) reduction versus a static SafeHarness baseline while also improving benign utility, indicating the safety gain is not purely from over-refusal.
- Evolved harnesses generalize to unseen risks on the held-out AgentHarm benchmark and transfer across different agent models without re-running evolution, suggesting the learned boundaries are somewhat model-agnostic.
Sources (1)
SHE: Trajectory-driven Safety Harness Evolution for LLM Agents
TL;DR - SHE is a framework that treats an LLM agent's "harness" (system prompt, rules, memory, tool policy) as an evolvable safety artifact, learning refined safe boundaries from rollout trajectories instead of freezing safety at deployment time. It matters because it shifts agent safety work from static model-level guardrails to adaptive runtime scaffolding that can respond to newly observed risks.
- Decomposes the harness into four artifacts with explicit safety responsibilities — System Prompt, Rule Bank, Safety Memory, and Tool Policy — so responsibility attribution is localized and each component can evolve independently.
- Uses an attribution-guided evolution loop: trajectory failures are converted into structured diagnoses, which drive artifact-specific boundary refinements, with candidate harnesses selected via joint safety-utility validation.
- On Agent-SafetyBench, SHE reports a 3.1x attack success rate (ASR) reduction versus a static SafeHarness baseline while also improving benign utility, indicating the safety gain is not purely from over-refusal.
- Evolved harnesses generalize to unseen risks on the held-out AgentHarm benchmark and transfer across different agent models without re-running evolution, suggesting the learned boundaries are somewhat model-agnostic.