arXiv AI
Aug 28

Safety Does Not Compose: Non-Decaying Loop State for Autonomous LLM Agents

The paper demonstrates that safety mechanisms for autonomous large language model agents fail to compose across iterative loops, as trajectory‑scoped monitors cannot detect attacks whose evidence is spread over multiple iterations. It introduces LoopHarness, a system that maintains a persistent, non‑decaying safety state across loops, bounding unauthorized actions with a constant that does not grow with the number of iterations. The authors provide a comprehensive evaluation protocol, including attacks that require cross‑iteration evidence, module ablations, and adaptive white‑box red‑team testing.

By Chenhao Wu, Haoxuan Jia, Yang Liu, Yingguang Yang, Yuhan Lin, Chongyang Zhang, Hao Zheng, Yulin Huang, Jianshen Zhang, Yongzhi Qi, Shang Luo, Kefu Xu, Jifeng Zhu, Bin Chong
arXiv AI
Sep 10

Structurally Close, Temporally Distant: Measuring Security Exposure in Long-Horizon LLM Agents

The paper introduces a provenance‑aware execution graph for long‑horizon LLM agents, defining influence distance (DI) as the shortest structural path from an untrusted source to a sensitive action. Compared to the traditional sequence distance (DT), DI is always less than or equal to DT, revealing a median gap of nine hops in 454 injection–sink pairs across multiple models and datasets. The study shows that most pairs exhibit a non‑zero gap, and a deterministic DI‑based gate can block attacks missed by a sequence‑only gate without extra benign blocking.

By Md Jafrin Hossain, Nur Al Hasan Haldar