Safety Does Not Compose: Non-Decaying Loop State for Autonomous LLM Agents

📄 arXiv: 2608.27141v1 📥 PDF

作者: Chenhao Wu, Haoxuan Jia, Yang Liu, Yingguang Yang, Yuhan Lin, Chongyang Zhang, Hao Zheng, Yulin Huang, Jianshen Zhang, Yongzhi Qi, Shang Luo, Kefu Xu, Jifeng Zhu, Bin Chong

分类: cs.CR, cs.AI

发布日期: 2026-08-27

💡 一句话要点

提出LoopHarness以解决自主LLM代理的安全性问题

🎯 匹配领域: 支柱九：具身大模型 (Embodied Foundation Models)

关键词: 自主代理 安全监控 跨迭代攻击 大型语言模型 LoopHarness 非衰减状态 智能系统

📋 核心要点

  1. 现有的安全监控机制在处理跨迭代攻击时存在显著不足，导致安全状态重置，无法有效识别潜在威胁。
  2. 本文提出LoopHarness，通过保持跨迭代状态，解决了现有方法在多次迭代中无法有效监控安全性的问题。
  3. 实验结果表明，LoopHarness在Agent-SafetyBench任务中显著降低了未授权不可逆操作的预期数量，验证了其有效性。

📝 摘要（中文）

大型语言模型代理越来越多地作为自主循环系统被部署。现有的安全机制仅在单一轨迹上定义，且在新轨迹开始时会重置安全状态。本文揭示了这一问题的根源在于组合性失败，而非实现细节。我们提出LoopHarness，恢复循环级别的持久非衰减安全状态，显著提高了对跨迭代攻击的防护能力，并通过完整的评估协议验证了其有效性。

🔬 方法详解

问题定义：本文旨在解决自主LLM代理在多次迭代中安全状态重置的问题。现有方法的痛点在于其安全监控仅限于单一轨迹，无法有效应对跨迭代的攻击。

核心思路：论文的核心思路是通过保持跨迭代的安全状态，确保监控系统能够有效识别和区分真实的攻击证据与误报，从而提高安全性。

技术框架：整体架构包括LoopHarness模块，该模块在循环级别维护持久的安全状态，并结合中介提交和仲裁检测机制，限制未授权操作的数量。

关键创新：最重要的技术创新在于提出了非衰减的安全状态保持机制，解决了现有方法在面对跨迭代攻击时的组合性失败问题。

关键设计：关键设计包括设置仲裁检测阈值δ_M，以及通过模型无关规则决定的B+m-1项，确保在完全合谋的验证者面前仍然有效。

🖼️ 关键图片

fig_0
img_1
img_2

📊 实验亮点

实验结果显示，LoopHarness在Agent-SafetyBench任务中，未授权不可逆操作的预期数量被限制在B+m-1+m/δ_M，显著优于传统方法，验证了其在处理跨迭代攻击中的有效性。

🎯 应用场景

该研究的潜在应用领域包括自主系统的安全监控、智能助手的安全性提升以及其他需要长期运行的自动化任务。通过提高安全性，能够在更广泛的场景中部署自主代理，减少潜在风险。

📄 摘要（原文）

Large language model agents are increasingly deployed as autonomous loops. Starting from one human goal, such a system repeatedly discovers work, plans, executes tool calls, verifies outcomes and persists state across many unattended iterations. The agent safeguards in wide use, however, are defined over a single trajectory, and their safety state is re-initialized when the next trajectory begins. We show that this is a failure of composition rather than an implementation detail. Our central result is a separation: against an attack whose evidence is fragmented across several iterations, every trajectory-scoped monitor has a true-positive rate equal to its false-positive rate, however expressive it is, because the evidence it would need never appears in the window it sees, whereas a monitor retaining cross-iteration state separates the two perfectly. We further show that the obvious repair of carrying a geometrically decaying risk score is insufficient, because the cooling-off period a patient adversary must wait is a constant that does not grow with the horizon $N$. We then present LoopHarness, which restores a persistent, non-decaying safety state at the loop level. Under mediated commits and an arbiter detection floor $δ_M$, it bounds the expected number of unauthorized irreversible actions by $B+m-1+m/δ_M$, a constant in $N$, of which the $B+m-1$ term is decided by a model-free rule and therefore survives a fully colluding verifier. We give a complete evaluation protocol on native Agent-SafetyBench tasks with paired clean and attacked episodes, an outer-state attack suite whose decisive evidence exists only across iterations, per-module ablations, and an adaptive white-box red team.