The paper proposes Safety Harness Evolution (SHE), a framework that learns evolving safe boundaries from rollout trajectories. SHE decomposes the agent harness into four artifacts: System Prompt, Rule Bank, Safety Memory, and Tool Policy. An attribution-guided evolution loop converts trajectory failures into structured diagnoses, learns artifact-specific boundary refinements, and selects evolved harnesses through safety-utility validation. Experiments on Agent-SafetyBench show a 3.1x reduction in Attack Success Rate (ASR) compared to baseline.
Researchers introduce SHE, a framework for evolving the safety harness of LLM agents by learning from rollout trajectories. The harness is decomposed into four components with explicit safety responsibilities, enabling localized evolution. An attribution-guided loop diagnoses failures, refines boundaries, and validates safety-utility trade-offs. On Agent-SafetyBench, SHE achieves a 3.1x ASR reduction.
SHE's decomposition of the agent harness into four artifacts with clear functional boundaries allows for localized safety evolution, addressing the challenge of coupled functions that obscure responsibility attribution. The attribution-guided evolution loop uses trajectory failures to drive artifact-specific refinements, potentially enabling more precise and adaptive safety mechanisms than static harnesses.
This research highlights a shift from treating safety as a fixed deployment artifact to an evolving component of LLM agent systems. For companies deploying agents, SHE suggests a path toward adaptive safety that can respond to emerging threats without full system redesign, though practical integration and computational overhead remain open questions.
For enterprises deploying LLM agents, SHE could reduce safety incidents and the need for manual harness updates, potentially lowering operational risk and maintenance costs. However, the framework is still at the research stage and not yet productized.
Next signals include whether SHE's approach is adopted in open-source agent frameworks, if follow-up work validates its effectiveness on more diverse benchmarks, and how it compares to other adaptive safety methods. The 3.1x ASR reduction is promising but requires reproduction and real-world testing.