# LoopHarness persistent safety state Ends Drift _LoopHarness proves trajectory monitors fail when evidence spans iterations and bounds irreversible actions to a constant with persistent loop-level state._ **Published:** 2026-08-28 **Source:** https://www.startuphub.ai/ai-news/ai-research/2026/loopharness-persistent-safety-state-ends-drift --- Every trajectory-scoped monitor has true-positive rate equal to false-positive rate when evidence is split across iterations. The [LoopHarness persistent safety state](https://arxiv.org/abs/2608.27141v1) result on arXiv shows this is a failure of composition, not implementation. Trajectory monitors blindDriver they reset each trajectory and cannot see evidence split across iterationsLoopHarness persistent stateCoremaintains non‑decaying safety information that accumulates across loop iterations for eachFrom the article 3 mentionsThe LoopHarness persistent safety state result on arXiv shows this is a failure of composition, not implementation.enablesLocks the loopEffectbounds irreversible actions to a constant preventing drift across iterationsFrom the article 3 mentionsThe cooling-off period a patient adversary must wait is a constant that does not grow with horizon N, so stretching the loop does not stretch the risk.yieldsSeparates attack perfectlyOutcometrue‑positive rate diverges from false‑positive rate when monitor retains cross‑iteration stateFrom the articleAgainst an attack fragmented across iterations, any trajectory-scoped monitor sees TPR equal to FPR however expressive it is, because the evidence never appears in its window, while a monitor retaining cross-iteration state separates perfectly.Trajectory monitors blindDriverthey reset each trajectory and cannot see evidence split across iterationsDecay fails to helpContextgeometric risk score cooling off period stays constant regardless of horizon lengthshowsEvidence split acrossContextattack fragments its actions over multiple loop cycles to evade single‑trajectory checksFrom the article 3 mentionsEvery trajectory-scoped monitor has true-positive rate equal to false-positive rate when evidence is split across iterations.needsLoopHarness persistent stateCoremaintains non‑decaying safety information that accumulates across loop iterations for eachFrom the article 3 mentionsThe LoopHarness persistent safety state result on arXiv shows this is a failure of composition, not implementation.enablesLocks the loopEffectbounds irreversible actions to a constant preventing drift across iterationsFrom the article 3 mentionsThe cooling-off period a patient adversary must wait is a constant that does not grow with horizon N, so stretching the loop does not stretch the risk.yieldsSeparates attack perfectlyOutcometrue‑positive rate diverges from false‑positive rate when monitor retains cross‑iteration stateFrom the articleAgainst an attack fragmented across iterations, any trajectory-scoped monitor sees TPR equal to FPR however expressive it is, because the evidence never appears in its window, while a monitor retaining cross-iteration state separates perfectly. ## Why Trajectory Monitors Are Blind By Design The safeguards in wide use are defined over a single trajectory and re-initialize when the next begins. The authors prove a separation. Against an attack fragmented across iterations, any trajectory-scoped monitor sees TPR equal to FPR however expressive it is, because the evidence never appears in its window, while a monitor retaining cross-iteration state separates perfectly. ## Why Decay Cannot Save Them The obvious repair is carrying a geometrically decaying risk score. It fails. The cooling-off period a patient adversary must wait is a constant that does not grow with horizon N, so stretching the loop does not stretch the risk. ## How LoopHarness Locks The Loop [LoopHarness](https://arxiv.org/abs/2608.27141v1) restores a persistent, non-decaying safety state at the loop level. Under mediated commits and an arbiter detection floor δ_M, it bounds expected unauthorized irreversible actions by B+m-1+m/δ_M, a constant in N. The B+m-1 term is decided by a model-free rule. It therefore survives a fully colluding verifier, which matters when the model itself is the adversary. ## What Unattended Loops Mean For Builders Agents that discover work, plan, call tools, verify and persist state across unattended iterations are now the default architecture. Most startups still ship trajectory-level guardrails and assume a larger context window solves it. This paper says the market needs loop-level state, not bigger windows. Evaluation is on native Agent-SafetyBench tasks with paired clean and attacked episodes, plus an outer-state attack suite where decisive evidence exists only across iterations, with per-module ablations and an adaptive white-box red team. For founders and investors, LoopHarness persistent safety state reframes safety from per-call filtering to persistent loop accounting. The constant bound is the investable claim. --- Original analysis from [startuphub.ai](https://www.startuphub.ai), the #1 AI startup directory.