Safety Does Not Compose: Non-Decaying Loop State for Autonomous LLM Agents

• URL: http://arxiv.org/abs/2608.27141v4
• Date: Thu, 03 Sep 2026 04:56:36 GMT
• Title: Safety Does Not Compose: Non-Decaying Loop State for Autonomous LLM Agents
• Abstract summary: Large language model agents are increasingly deployed as autonomous loops.<n>We show that this is a failure of composition rather than an implementation detail.<n>We present LoopHarness, which restores a persistent, non-decaying safety state at the loop level.
• Score: 16.24087700490158
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Large language model agents are increasingly deployed as autonomous loops. Starting from one human goal, such a system repeatedly discovers work, plans, executes tool calls, verifies outcomes and persists state across many unattended iterations. The agent safeguards in wide use, however, are defined over a single trajectory, and their safety state is re-initialized when the next trajectory begins. We show that this is a failure of composition rather than an implementation detail. Our central result is a separation: against an attack whose evidence is fragmented across several iterations, every trajectory-scoped monitor has a true-positive rate equal to its false-positive rate, however expressive it is, because the evidence it would need never appears in the window it sees, whereas a monitor retaining cross-iteration state separates the two perfectly. We further show that the obvious repair of carrying a geometrically decaying risk score is insufficient, because the cooling-off period a patient adversary must wait is a constant that does not grow with the horizon $N$. We then present LoopHarness, which restores a persistent, non-decaying safety state at the loop level. Under mediated commits and an arbiter detection floor $δ_M$, it bounds the expected number of unauthorized irreversible actions by $B+m-1+m/δ_M$, a constant in $N$, of which the $B+m-1$ term is decided by a model-free rule and therefore survives a fully colluding verifier. We give a complete evaluation protocol on native Agent-SafetyBench tasks with paired clean and attacked episodes, an outer-state attack suite whose decisive evidence exists only across iterations, per-module ablations, and an adaptive white-box red team.

Related papers

• VST: Verifiable Structured Transport for Auditable Agent-to-Agent Alpha Discovery [11.790070440436294]
  Agent-to-agent (A2A) alpha discovery is slowed by repeated feedback cycles between mining and evaluation agents.<n>We first restructure this communication as a structured agent-to-agent protocol of emphtyped, causally addressable, unicast records<n>What typing provides is a state that can be schema-checked, replayed deterministically, and prevented by construction from leaking a forecast to an evaluator.
  arXiv  Detail & Related papers  (2026-09-07T05:43:50Z)
• SANE: State Anomaly Neutralization for Stable Extreme-Context Delta-Rule Models [53.86918766240095]
  Delta-Rule recurrent models maintain a fixed-size state, enabling $O(1)$ inference memory but potentially becoming unstable under extreme-context extrapolation.<n>We propose textbfState Anomaly Neutralization (SANE), which applies adaptive $tanh$ compression at chunk boundaries while preserving the intra-chunk parallel structure.
  arXiv  Detail & Related papers  (2026-08-23T10:41:07Z)
• Evidence Before Expansion: Reuse, Spawn, or Defer in Lifelong Expert Pools [0.0]
  Reuse and spawn are posed as one-sided sequential hypotheses on a conditional (mechanism-level) discrepancy.<n>We prove finite-time anytime validity for the observable surrogate discrepancy of a predictable discriminator sequence.<n>On synthetic multi-concept streams, Electricity, Covertype, and the recurrence-heavy INSECTS benchmark, the instance-accounted restarted bank achieves zero false spawns.
  arXiv  Detail & Related papers  (2026-08-20T10:54:17Z)
• Separating Covariate Shift from Mechanism Change with Two Discriminators: CJSD, a Conditional Discrepancy with an Exact Covariate-Concept Decomposition [0.0]
  Conditional Jensen-Shannon Discrepancy (CJSD)<n>On a ten-measure battery over 202 dataset pairs, only the two conditional-information estimators -- CJSD and a kNN plug-in for the same estimand -- fail.
  arXiv  Detail & Related papers  (2026-08-20T10:48:08Z)
• Agentic Security: A Systematization of Tools, Failure Modes, and Design Laws for LLM-Driven Penetration Testing [0.21990652930491858]
  Agentic security uses large-language-model (LLM) agents to plan, dispatch, and interpret security tools.<n>We systematize these failures through a hands-on evaluation of ten widely used static, dynamic, cloud, orchestration, and AI red-teaming tools.
  arXiv  Detail & Related papers  (2026-08-16T07:18:04Z)
• Online Security Learning in Cooperative Multi-Agent Systems under Hidden Byzantine Attacks [9.187804222596665]
  We study online cooperative control of a multi-agent system under Byzantine attacks.<n>An unknown, fixed subset of agents are Byzantine comprised and can stealthily overwrite its own coordinates.<n>Our studies provide comprehensive theoretical and algorithmic foundations of reliable multi-agent systems.
  arXiv  Detail & Related papers  (2026-08-06T19:03:49Z)
• ReflexTrack: A Feedback-Driven Agent for Training-Free Referring Video Object Segmentation [63.38679125666075]
  Referring object segmentation (RVOS) requires segmenting a target specified by natural language throughout a video.<n>Recent agent approaches combine multimodal large language models with promptable segmentation models to perform RVOS without task-specific training.<n>We introduce ReflexTrack, a training-free, feedback-driven agent that closes the loop at both spatial and temporal levels.
  arXiv  Detail & Related papers  (2026-07-27T07:39:20Z)
• Survive or Collapse: The Asymmetric Roles of Data Gating and Reward Grounding in Self-Play RL [76.45061154544568]
  Self-play reinforcement learning trains language models on their own generated tasks, co-evolving a proposer and solver without human labels.<n>Recent systems report strong reasoning gains, but collapse and instability are widely observed and poorly understood.<n>We argue instead that self-play stability is governed by two distinct levers: a data-level gate that decides which proposer-generated tasks enter the training pool, and the reward signal that updates the policy on tasks already admitted.
  arXiv  Detail & Related papers  (2026-05-21T09:19:23Z)
• Trust No Tool: Evaluating and Defending LLM Agents under Untrusted Tool Feedback [38.251599309409]
  We study a different failure mode, cognitive poisoning, in which a malicious tool behaves plausibly during exploration.<n>We present VISTA-Guard, a backbone-agnostic framework for final-action risk scoring.
  arXiv  Detail & Related papers  (2026-05-17T13:51:34Z)
• Tight Convergence Rates for Online Distributed Linear Estimation with Adversarial Measurements [66.94250413799232]
  We study mean estimation of a random vector $X$ in a distributed parameter-server-worker setup.<n>Key challenges are adversarial measurements and asynchrony.<n>Results provide a unified finite-time characterization of robustness, identifiability, and statistical efficiency in distributed linear estimation with adversarial workers.
  arXiv  Detail & Related papers  (2026-04-07T11:45:55Z)
• Time Is All It Takes: Spike-Retiming Attacks on Event-Driven Spiking Neural Networks [87.16809558673403]
  Spiking neural networks (SNNs) compute with discrete spikes and exploit temporal structure.<n>We study a timing-only adversary that retimes existing spikes while preserving spike counts and amplitudes in event-driven SNNs.
  arXiv  Detail & Related papers  (2026-02-03T09:06:53Z)
• CARE What Fails: Contrastive Anchored-REflection for Verifiable Multimodal [84.71254539482369]
  Group-relative reinforcement learning with verifiable rewards (RLVR) often wastes the most informative data it already has the failures.<n>We present CARE, a failure-centric post-training framework for multimodal reasoning that turns errors into supervision.<n> CARE improves accuracy and training smoothness while explicitly increasing the share of learning signal that comes from failures.
  arXiv  Detail & Related papers  (2025-12-22T16:34:21Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.