AI Research
Preferred on Google
Google News

LoopHarness persistent safety state Ends Drift

LoopHarness proves trajectory monitors fail when evidence spans iterations and bounds irreversible actions to a constant with persistent loop-level state.

5 min read
Diagram of LoopHarness persistent safety state across autonomous agent loop iterations
LoopHarness restores non-decaying safety state at the loop level to block fragmented attacks.
Visual TL;DR
Trajectory monitors blindDriver
they reset each trajectory and cannot see evidence split across iterations
LoopHarness persistent stateCore
maintains non‑decaying safety information that accumulates across loop iterations for each
From the article 3 mentionsThe LoopHarness persistent safety state result on arXiv shows this is a failure of composition, not implementation.
Locks the loopEffect
bounds irreversible actions to a constant preventing drift across iterations
From the article 3 mentionsThe cooling-off period a patient adversary must wait is a constant that does not grow with horizon N, so stretching the loop does not stretch the risk.
Separates attack perfectlyOutcome
true‑positive rate diverges from false‑positive rate when monitor retains cross‑iteration state
From the articleAgainst an attack fragmented across iterations, any trajectory-scoped monitor sees TPR equal to FPR however expressive it is, because the evidence never appears in its window, while a monitor retaining cross-iteration state separates perfectly.
Trajectory monitors blindDriver
they reset each trajectory and cannot see evidence split across iterations
Decay fails to helpContext
geometric risk score cooling off period stays constant regardless of horizon length
Evidence split acrossContext
attack fragments its actions over multiple loop cycles to evade single‑trajectory checks
From the article 3 mentionsEvery trajectory-scoped monitor has true-positive rate equal to false-positive rate when evidence is split across iterations.
LoopHarness persistent stateCore
maintains non‑decaying safety information that accumulates across loop iterations for each
From the article 3 mentionsThe LoopHarness persistent safety state result on arXiv shows this is a failure of composition, not implementation.
Locks the loopEffect
bounds irreversible actions to a constant preventing drift across iterations
From the article 3 mentionsThe cooling-off period a patient adversary must wait is a constant that does not grow with horizon N, so stretching the loop does not stretch the risk.
Separates attack perfectlyOutcome
true‑positive rate diverges from false‑positive rate when monitor retains cross‑iteration state
From the articleAgainst an attack fragmented across iterations, any trajectory-scoped monitor sees TPR equal to FPR however expressive it is, because the evidence never appears in its window, while a monitor retaining cross-iteration state separates perfectly.
Contents(4)

Every trajectory-scoped monitor has true-positive rate equal to false-positive rate when evidence is split across iterations. The LoopHarness persistent safety state result on arXiv shows this is a failure of composition, not implementation.

Why Trajectory Monitors Are Blind By Design

The safeguards in wide use are defined over a single trajectory and re-initialize when the next begins.

The authors prove a separation. Against an attack fragmented across iterations, any trajectory-scoped monitor sees TPR equal to FPR however expressive it is, because the evidence never appears in its window, while a monitor retaining cross-iteration state separates perfectly.

Why Decay Cannot Save Them

The obvious repair is carrying a geometrically decaying risk score.

It fails. The cooling-off period a patient adversary must wait is a constant that does not grow with horizon N, so stretching the loop does not stretch the risk.

How LoopHarness Locks The Loop

LoopHarness restores a persistent, non-decaying safety state at the loop level.

Under mediated commits and an arbiter detection floor δ_M, it bounds expected unauthorized irreversible actions by B+m-1+m/δ_M, a constant in N.

The B+m-1 term is decided by a model-free rule. It therefore survives a fully colluding verifier, which matters when the model itself is the adversary.

What Unattended Loops Mean For Builders

Agents that discover work, plan, call tools, verify and persist state across unattended iterations are now the default architecture.

Most startups still ship trajectory-level guardrails and assume a larger context window solves it. This paper says the market needs loop-level state, not bigger windows.

Evaluation is on native Agent-SafetyBench tasks with paired clean and attacked episodes, plus an outer-state attack suite where decisive evidence exists only across iterations, with per-module ablations and an adaptive white-box red team.

For founders and investors, LoopHarness persistent safety state reframes safety from per-call filtering to persistent loop accounting. The constant bound is the investable claim.

© 2026 StartupHub.ai. All rights reserved. Do not enter, scrape, copy, reproduce, or republish this article in whole or in part. Use as input to AI training, fine-tuning, retrieval-augmented generation, or any machine-learning system is prohibited without written license. Substantially-similar derivative works will be pursued to the fullest extent of applicable copyright, database, and computer-misuse laws. See our terms.
#AI Research#AI Agents#AI Safety#Agent-SafetyBench