Safety Does Not Compose: Non-Decaying Loop State for Autonomous LLM Agents
作者: Chenhao Wu, Haoxuan Jia, Yang Liu, Yingguang Yang, Yuhan Lin, Chongyang Zhang, Hao Zheng, Yulin Huang, Jianshen Zhang, Yongzhi Qi, Shang Luo, Kefu Xu, Jifeng Zhu, Bin Chong
分类: cs.CR, cs.AI
发布日期: 2026-08-27 (更新: 2026-08-28)
💡 一句话要点
提出LoopHarness以解决自主LLM代理的安全性问题
🎯 匹配领域: 支柱九：具身大模型 (Embodied Foundation Models)
关键词: 自主代理 安全监测 跨迭代攻击 大型语言模型 风险评分 循环状态管理 智能系统
📋 核心要点
- 现有的安全机制在处理跨迭代攻击时表现不佳，导致安全状态重置，无法有效监测潜在威胁。
- 本文提出LoopHarness，通过保持跨迭代状态来实现持久的非衰减安全状态，从而提高监测的准确性。
- 实验结果表明，LoopHarness在面对复杂攻击时，能够显著降低未授权不可逆操作的预期数量，提升安全性。
📝 摘要（中文）
大型语言模型代理越来越多地被部署为自主循环系统。现有的安全机制仅在单一轨迹上定义，且在新轨迹开始时重置安全状态。本文揭示了这一问题的本质是组合失败，而非实现细节。我们提出LoopHarness，恢复循环级别的持久非衰减安全状态，显著提高了对跨迭代攻击的防御能力，并在Agent-SafetyBench任务上进行了全面评估。
🔬 方法详解
问题定义：本文旨在解决自主LLM代理在多次迭代中安全状态重置的问题。现有方法在处理跨迭代攻击时，监测器的真阳性率与假阳性率相等，无法有效识别威胁。
核心思路：论文提出通过保持跨迭代状态的监测器，来实现持久的非衰减安全状态。这种设计能够确保监测器在面对分散证据的攻击时，能够准确区分真阳性与假阳性。
技术框架：整体架构包括循环级别的安全状态管理、监测器设计和风险评分机制。主要模块包括状态保持模块、攻击检测模块和决策模块。
关键创新：LoopHarness的核心创新在于其非衰减的安全状态保持机制，能够在多次迭代中有效监测和防御攻击，与现有方法形成鲜明对比。
关键设计：在设计中，设置了中介提交和仲裁检测阈值δ_M，以限制未授权不可逆操作的预期数量，确保安全性与效率的平衡。
🖼️ 关键图片
📊 实验亮点
实验结果显示，LoopHarness在Agent-SafetyBench任务中，能够将未授权不可逆操作的预期数量限制在B+m-1+m/δ_M的常数范围内，相较于传统方法显著提升了安全性，尤其在面对跨迭代攻击时表现优异。
🎯 应用场景
该研究的潜在应用领域包括自主系统的安全监测、智能助手的安全性提升以及机器人技术中的决策支持。通过提高自主代理的安全性，能够在更广泛的场景中应用这些技术，确保人机协作的安全性和可靠性。
📄 摘要（原文）
Large language model agents are increasingly deployed as autonomous loops. Starting from one human goal, such a system repeatedly discovers work, plans, executes tool calls, verifies outcomes and persists state across many unattended iterations. The agent safeguards in wide use, however, are defined over a single trajectory, and their safety state is re-initialized when the next trajectory begins. We show that this is a failure of composition rather than an implementation detail. Our central result is a separation: against an attack whose evidence is fragmented across several iterations, every trajectory-scoped monitor has a true-positive rate equal to its false-positive rate, however expressive it is, because the evidence it would need never appears in the window it sees, whereas a monitor retaining cross-iteration state separates the two perfectly. We further show that the obvious repair of carrying a geometrically decaying risk score is insufficient, because the cooling-off period a patient adversary must wait is a constant that does not grow with the horizon $N$. We then present LoopHarness, which restores a persistent, non-decaying safety state at the loop level. Under mediated commits and an arbiter detection floor $δ_M$, it bounds the expected number of unauthorized irreversible actions by $B+m-1+m/δ_M$, a constant in $N$, of which the $B+m-1$ term is decided by a model-free rule and therefore survives a fully colluding verifier. We give a complete evaluation protocol on native Agent-SafetyBench tasks with paired clean and attacked episodes, an outer-state attack suite whose decisive evidence exists only across iterations, per-module ablations, and an adaptive white-box red team.