🛰️ Daily AI Frontier
‹ back to 2026-08-27

Safety Does Not Compose: Non-Decaying Loop State for Autonomous LLM Agents

Research LLM Agents

Ranking

Overall 83
Content 100
Popularity 42

Observed public metrics from 1 member.

Representative image for Safety Does Not Compose: Non-Decaying Loop State for Autonomous LLM Agents

Merged summary

TL;DR - This paper argues that trajectory-scoped safeguards cannot detect attacks whose evidence is distributed across multiple autonomous-agent iterations. It proposes LoopHarness, which maintains persistent, non-decaying loop-level safety state to limit irreversible unauthorized actions independently of the execution horizon.

  • The authors prove that trajectory-only monitors cannot distinguish fragmented attacks from benign behavior better than their false-positive rate, regardless of monitor expressiveness.
  • Geometrically decaying risk scores remain vulnerable because patient attackers need only wait a constant cooling-off period that does not grow with the loop horizon.
  • LoopHarness combines persistent safety state, mediated commits, and an arbiter to bound expected unauthorized irreversible actions by (B+m-1+m/\delta_M), constant in horizon (N).
  • The evaluation protocol covers paired clean and attacked Agent-SafetyBench episodes, cross-iteration attacks, module ablations, and adaptive white-box red teaming.

Sources (1)

Safety Does Not Compose: Non-Decaying Loop State for Autonomous LLM Agents

arXiv cs.CR Chenhao Wu, Haoxuan Jia, Yang Liu, Yingguang Yang, Yuhan Lin, Chongyang Zhang, Hao Zheng, Yulin Huang, Jianshen Zhang, Yongzhi Qi, Shang Luo, Kefu Xu, Jifeng Zhu, Bin Chong 2026-08-27 arXiv:2608.27141
Public signals Semantic Scholar citations 0 · Semantic Scholar influential citations 0
Providers: Hugging Face · N/A OpenAlex · N/A Publisher · N/A Semantic Scholar · Citations 0 · Influential citations 0 X · N/A Fetched 2026-09-01 14:13:33.782134 UTC

TL;DR - This paper argues that trajectory-scoped safeguards cannot detect attacks whose evidence is distributed across multiple autonomous-agent iterations. It proposes LoopHarness, which maintains persistent, non-decaying loop-level safety state to limit irreversible unauthorized actions independently of the execution horizon.

  • The authors prove that trajectory-only monitors cannot distinguish fragmented attacks from benign behavior better than their false-positive rate, regardless of monitor expressiveness.
  • Geometrically decaying risk scores remain vulnerable because patient attackers need only wait a constant cooling-off period that does not grow with the loop horizon.
  • LoopHarness combines persistent safety state, mediated commits, and an arbiter to bound expected unauthorized irreversible actions by (B+m-1+m/\delta_M), constant in horizon (N).
  • The evaluation protocol covers paired clean and attacked Agent-SafetyBench episodes, cross-iteration attacks, module ablations, and adaptive white-box red teaming.
item →