Daily Paper Briefing

Abstract Overview

HazardAuditor is an execution-grounded safety framework for computer-use agents that focuses on runtime behavior rather than static prompts or responses. Its infrastructure runs heterogeneous agents in controlled environments and converts their interactions into a canonical event representation, allowing a single guard model to learn from traces produced by Claude Code, Codex, Hermes, and OpenClaw. The paper also introduces Guard Policy Optimization (GuardPO), a post-training objective for generative guard models that treats the safety decision as the effective unit of optimization instead of letting longer rationales dominate token-level updates. The resulting system produces an auditable analysis plus a binary verdict and is evaluated across multiple agent-safety benchmarks and agent backends.

Novelty

The main novelty is the combination of cross-framework executable safety supervision with a dedicated optimization method for generative guards. In particular, HazardAuditor normalizes heterogeneous execution traces into a shared schema and introduces GuardPO to correct the mismatch between decision-level safety supervision and token-level training objectives.

Results

Across the balanced CUA-Exec diagnostic, HazardAuditor improves accuracy by up to 16.5 percentage points over the strongest prior guard and achieves the best reported metrics across all four evaluated agent frameworks. On AgentHazard and additional external benchmarks, it generally matches or surpasses prior trajectory-trained guards, while ablations show that execution-grounded data and GuardPO both contribute, with GuardPO adding a further 10.4 points on cross-agent traces in one reported setting.

Key Points

1. HazardAuditor builds executable safety infrastructure that collects agent-environment interactions and maps heterogeneous logs into a canonical event representation for guard training.
2. GuardPO is designed for generative safety guards and uses response-level normalization so that variable-length rationales do not dominate optimization relative to the final safety verdict.
3. The evaluated system shows strong cross-agent and cross-benchmark transfer, including best results on multiple CUA-Exec subsets and competitive or leading performance on AgentHazard and other external benchmarks.

References

• arXiv: https://arxiv.org/abs/2609.15134v1
• Fugu-MT: https://fugumt.com/fugumt/paper_check/2609.15134v1
• Hugging Face Papers: https://huggingface.co/papers/2609.15134
• Project: https://yunhao-feng.github.io/HazardAuditor/