Visual TL;DR
Trajectory monitors blindDriver
they reset each trajectory and cannot see evidence split across iterations
LoopHarness persistent stateCore
maintains non‑decaying safety information that accumulates across loop iterations for each
From the article 3 mentionsThe LoopHarness persistent safety state result on arXiv shows this is a failure of composition, not implementation.
Locks the loopEffect
bounds irreversible actions to a constant preventing drift across iterations
From the article 3 mentionsThe cooling-off period a patient adversary must wait is a constant that does not grow with horizon N, so stretching the loop does not stretch the risk.
Separates attack perfectlyOutcome
true‑positive rate diverges from false‑positive rate when monitor retains cross‑iteration state
From the articleAgainst an attack fragmented across iterations, any trajectory-scoped monitor sees TPR equal to FPR however expressive it is, because the evidence never appears in its window, while a monitor retaining cross-iteration state separates perfectly.
Trajectory monitors blindDriver
they reset each trajectory and cannot see evidence split across iterations
Decay fails to helpContext
geometric risk score cooling off period stays constant regardless of horizon length
Evidence split acrossContext
attack fragments its actions over multiple loop cycles to evade single‑trajectory checks
From the article 3 mentionsEvery trajectory-scoped monitor has true-positive rate equal to false-positive rate when evidence is split across iterations.
LoopHarness persistent stateCore
maintains non‑decaying safety information that accumulates across loop iterations for each
From the article 3 mentionsThe LoopHarness persistent safety state result on arXiv shows this is a failure of composition, not implementation.
Locks the loopEffect
bounds irreversible actions to a constant preventing drift across iterations
From the article 3 mentionsThe cooling-off period a patient adversary must wait is a constant that does not grow with horizon N, so stretching the loop does not stretch the risk.
Separates attack perfectlyOutcome
true‑positive rate diverges from false‑positive rate when monitor retains cross‑iteration state
From the articleAgainst an attack fragmented across iterations, any trajectory-scoped monitor sees TPR equal to FPR however expressive it is, because the evidence never appears in its window, while a monitor retaining cross-iteration state separates perfectly.
