LoopHarness persistent safety state Ends Drift

LoopHarness proves trajectory monitors fail when evidence spans iterations and bounds irreversible actions to a constant with persistent loop-level state.

Daniel Singer

Editor, StartupHub.ai

Aug 28 at 8:05 PM2 min read

Diagram of LoopHarness persistent safety state across autonomous agent loop iterations — LoopHarness restores non-decaying safety state at the loop level to block fragmented attacks.

Visual TL;DRKey stepsFull picture

Trajectory monitors blindDriver

they reset each trajectory and cannot see evidence split across iterations

LoopHarness persistent stateCore

maintains non‑decaying safety information that accumulates across loop iterations for each

From the article 3 mentionsThe LoopHarness persistent safety state result on arXiv shows this is a failure of composition, not implementation.

Locks the loopEffect

bounds irreversible actions to a constant preventing drift across iterations

From the article 3 mentionsThe cooling-off period a patient adversary must wait is a constant that does not grow with horizon N, so stretching the loop does not stretch the risk.

Separates attack perfectlyOutcome

true‑positive rate diverges from false‑positive rate when monitor retains cross‑iteration state

From the articleAgainst an attack fragmented across iterations, any trajectory-scoped monitor sees TPR equal to FPR however expressive it is, because the evidence never appears in its window, while a monitor retaining cross-iteration state separates perfectly.

Trajectory monitors blindDriver

they reset each trajectory and cannot see evidence split across iterations

Decay fails to helpContext

geometric risk score cooling off period stays constant regardless of horizon length

Evidence split acrossContext

attack fragments its actions over multiple loop cycles to evade single‑trajectory checks

From the article 3 mentionsEvery trajectory-scoped monitor has true-positive rate equal to false-positive rate when evidence is split across iterations.

LoopHarness persistent stateCore

maintains non‑decaying safety information that accumulates across loop iterations for each

From the article 3 mentionsThe LoopHarness persistent safety state result on arXiv shows this is a failure of composition, not implementation.

Locks the loopEffect

bounds irreversible actions to a constant preventing drift across iterations

From the article 3 mentionsThe cooling-off period a patient adversary must wait is a constant that does not grow with horizon N, so stretching the loop does not stretch the risk.

Separates attack perfectlyOutcome

true‑positive rate diverges from false‑positive rate when monitor retains cross‑iteration state

Contents(4)

Every trajectory-scoped monitor has true-positive rate equal to false-positive rate when evidence is split across iterations. The LoopHarness persistent safety state result on arXiv shows this is a failure of composition, not implementation.

The safeguards in wide use are defined over a single trajectory and re-initialize when the next begins.

The authors prove a separation. Against an attack fragmented across iterations, any trajectory-scoped monitor sees TPR equal to FPR however expressive it is, because the evidence never appears in its window, while a monitor retaining cross-iteration state separates perfectly.

Why Decay Cannot Save Them

The obvious repair is carrying a geometrically decaying risk score.

It fails. The cooling-off period a patient adversary must wait is a constant that does not grow with horizon N, so stretching the loop does not stretch the risk.

How LoopHarness Locks The Loop

LoopHarness restores a persistent, non-decaying safety state at the loop level.

Under mediated commits and an arbiter detection floor δ_M, it bounds expected unauthorized irreversible actions by B+m-1+m/δ_M, a constant in N.

The B+m-1 term is decided by a model-free rule. It therefore survives a fully colluding verifier, which matters when the model itself is the adversary.

What Unattended Loops Mean For Builders

Agents that discover work, plan, call tools, verify and persist state across unattended iterations are now the default architecture.

Most startups still ship trajectory-level guardrails and assume a larger context window solves it. This paper says the market needs loop-level state, not bigger windows.

Evaluation is on native Agent-SafetyBench tasks with paired clean and attacked episodes, plus an outer-state attack suite where decisive evidence exists only across iterations, with per-module ablations and an adaptive white-box red team.

For founders and investors, LoopHarness persistent safety state reframes safety from per-call filtering to persistent loop accounting. The constant bound is the investable claim.

© 2026 StartupHub.ai. All rights reserved. You may not republish this article in full without a license. Search engines and AI research tools may crawl and summarize for reference. Bulk reproduction or model training requires a license. See our terms.

#AI Research #AI Agents #AI Safety #Agent-SafetyBench

Written by