SHE: Trajectory-driven Safety Harness Evolution for... | AI Research

SHE: Trajectory-driven Safety Harness Evolution for LLM Agents introduces a framework designed to improve the safety of LLM agents by allowing their safety mechanisms to evolve alongside emerging risks. Rather than relying on static, human-designed rules that remain fixed after deployment, this approach uses an iterative loop to learn from past execution failures, refining safety boundaries based on actual performance in task environments.

Decoupling Safety Responsibilities

The researchers address the challenge of "coupled functions," where safety failures are difficult to diagnose because multiple components of an agent's harness are intertwined. To solve this, the framework decomposes the agent harness into four distinct, editable artifacts, each with specific safety responsibilities:

• System Prompt: Defines the global behavioral contract and trust boundaries.

• Rule Bank: Stores specific safety rules for classifying and intervening in risks.

• Safety Memory: Retains experience from persistent failure cases that were not resolved in previous iterations.

• Tool Policy: Governs tool-use authority and runtime enforcement.
  By separating these components, the framework enables localized evolution, where a failure in one area can be addressed without unintentionally disrupting the functionality of other parts of the harness.

The Evolution Loop

The framework employs an attribution-guided loop to turn failure data into actionable improvements. When an agent completes a task, the system evaluates the trajectory to identify safety-relevant failures. These failures are then processed through a structured diagnosis that categorizes the harm domain, the attack surface, and the failure mode.
Once diagnosed, the system routes the issue to the specific harness artifact responsible for that safety boundary. It then generates a "bounded edit"—a targeted refinement—which must pass a validity check to ensure it is a genuine safety improvement rather than a shortcut or a degradation of the agent's utility. Only candidates that improve safety scores while maintaining or improving task utility are accepted as the new "best harness."

Performance and Generalization

Experiments conducted on the Agent-SafetyBench dataset show that this evolving approach significantly outperforms static safety mechanisms. The researchers report that the framework achieved a 3.1x reduction in the Attack Success Rate (ASR) compared to a static "SafeHarness" baseline, while simultaneously improving the agent's utility.
Furthermore, the evolved harness demonstrated the ability to generalize to unseen risks on the held-out AgentHarm benchmark. The researchers also noted that the evolved harness could transfer across different agent models without requiring additional evolution cycles, suggesting that the learned safety boundaries are robust and not tied to a single specific model.

Considerations for Implementation

The framework is designed to optimize the harness while keeping the base LLM policy, the task environment, and the evaluation protocol fixed. A key limitation addressed by the design is the potential for "reward hacking" or unnecessary capability removal; the validity check and the requirement for best-harness selection are intended to prevent these issues. By treating the safety harness as an evolving system rather than a fixed deployment artifact, the framework aims to bridge the gap between identifying safety failures and implementing effective, long-term corrections.