EvoSafeHarness Evolves Safety Guardrails for Specific Models and Domains

Introduction

Large language models increasingly do more than generate text: they call tools, modify files, handle transactions, and act on external systems. In this setting, safety failures can arise from indirect prompt injections, explicitly harmful requests, or unsafe combinations of actions over a long trajectory. A safety harness placed around the model can provide an additional enforcement layer, but many existing harnesses are designed once by experts and then reused across heterogeneous models and domains.

EvoSafeHarness starts from a different premise: the right guardrail depends on the deployment. The paper presents a safety-focused optimization framework that synthesizes a harness for a frozen model in a specified domain. It jointly searches a natural-language policy and executable code that enforces the policy around tool calls and runtime actions.

Key ideas

• Adapt enforcement to model behavior. Models differ in how they follow instructions and how much external enforcement they need. A policy that protects one model may unnecessarily reduce another model’s usefulness.
• Represent domain-specific risk. File operations, financial actions, and other applications involve different effects, state variables, and action sequences. A policy transferred unchanged across domains may miss the relations that matter most.
• Optimize policy and implementation together. The framework does not stop at producing prose. It also searches for executable logic that checks actions, tool calls, and relevant trajectory state.
• Use fresh-context adversarial review. Adversarial evaluation in new contexts is intended to reject rules that merely memorize benchmark examples and to make the resulting harness more resistant to variation in attacks.

Reported results

Across four agent benchmark families, the authors report a better safety–utility trade-off than fixed defenses such as CaMeL, DRIFT, and Progent. On DecodingTrust-Agent, the average attack success rate falls from 45.6% to 10.0% with a 3.3-point utility cost, and the method achieves the best result in 14 of 15 evaluation cells. On AgentDojo, it reaches 82.8% utility at 0.0% attack success rate; at that operating point, its utility is twice that of CaMeL.

The paper also reports unchanged transfer to unseen AgentDyn suites and the best score for every tested victim on Agent-SafetyBench. Under adaptive PAIR attacks with a refinement budget of 16, mean attack success remains below 20%.

Why it matters

EvoSafeHarness shifts agent safety from a universal filter toward deployment-specific co-design of policy, enforcement code, and runtime state. Its results suggest that safety checks should reflect both the semantics of a domain and the behavioral profile of the model being protected.

The findings should not be read as a complete production guarantee. Automatically evolved rules still require auditing against new tools, permissions, workflows, and attack strategies. Safety thresholds also depend on business risk and the cost of false refusals. The framework is best understood as a way to generate and evaluate specialized harnesses, not as a replacement for monitoring, governance, or human approval.

Source: Hugging Face Daily Papers