EvoSafeHarness: Evolving Model- and Domain-Specific Harnesses for Securing Agents
Nanxi Li, Yingzi Ma, Yulong Cao, Edward Suh, Bo Li, Dawn Song, Chaowei Xiao
cs.CR
2026-09-05
Searches a policy plus code for a frozen model in one domain. DTAP mean ASR falls from 45.6% to 10.0% at a 3.3-point utility cost; AgentDojo hits 82.8% utility at 0% ASR.
Once an LLM agent can call tools, a failure is a transferred payment, a leaked credential, or deleted production data. Harmful instructions arrive through two channels. Indirect prompt injection is planted in email, web pages, or tool results. Direct attacks come through the user channel itself.
Model-level alignment can raise the chance of a refusal. It does not give an enforcement boundary independent of the model. A system-level harness sits between the model and the tools: it rewrites prompts, intercepts calls, and keeps trajectory state. Existing designs such as CaMeL, DRIFT, Progent, and SafeHarness are typically written once by experts and reused across models and domains. That reuse is the mismatch. Undefended ASR already spans 4.8% on Sonnet 4.6 to 71.0% on DeepSeek-V4-Flash; a capability-isolation layer that is necessary for the latter wrecks benign utility on the former. Filesystem safety cares about command effects, sensitive paths, and data flow. Finance has to tell trades from money egress and keep a ledger, because a sequence of individually legal actions can be wash trading. One fixed policy cannot track both axes.
EvoSafeHarness searches a deployable harness H=(P,C) for a frozen model M in a target domain D. P is a natural-language policy written into context: trust boundaries, refusal criteria. C is executable code that can rewrite or block tool calls, keep per-trajectory state, or call quarantined classifiers. The scalar objective is score = 100×(utility − ASR). A refuse-all harness scores zero, so the search cannot buy safety by doing nothing.
The loop has four parts.
Eight security experiences distilled from CaMeL and DRIFT warm-start the archive. They are guidance, not a template. The Designer may delete, recombine, or invent mechanisms. On DTAP the minimal adapter is a Python object with systemprompttransform, onpretoolcall, and onposttoolcall, plus helper code and per-trace state. Search never sees the held-out split.
The primary grid is DecodingTrust-Agent: five victims times three domains, 30 benign / 35 direct / 35 indirect tasks per cell.
| Method | Mean utility | Mean ASR |
| No defense | 83.1% | 45.6% |
| CaMeL | 69.7% | 37.7% |
| DRIFT | 77.1% | 42.4% |
| Progent | 56.4% | 10.5% |
| EvoSafeHarness | 79.8% | 10.0% |
Best score in 14 of 15 cells. Direct ASR falls from 50.9% to 12.6%, indirect from 40.4% to 7.4%. The one loss is Sonnet 4.6/finance, already at 2.9% undefended. Progent nearly matches the safety number and gives up more than 20 utility points. A paired McNemar test rejects no-change in 13 of 15 cells; pooled over the grid, 385 attacks are blocked against 11 newly opened.
On AgentDojo the searched harness hits 82.8% utility at 0.0% ASR, twice CaMeL's 41.0% at the same zero-ASR point. Run unchanged on AgentDyn suites with unseen tools, it keeps 75.0% utility and 0.0% ASR, above the undefended 73.3%/12.8%. It transfers because it enforces provenance and task scope, not a tool list. On Agent-SafetyBench, where harm includes unsafe user requests and poisoned final answers with no bad tool call, mean clean unsafe-behaviour rate is 12.3%, ASR 7.4%, utility under attack 63.4%. Frozen baselines either leave harm uncovered or over-block. Against a PAIR attacker with a refinement budget of 16, mean ASR stays at 19.5%, still below the undefended agent facing static prompts at 23.6%.
Removing the Criticizer never lowers the search-set score and can raise it, while held-out score drops by as much as 31 points. Nested cascade picks the same defense in all 22 candidate banks and cuts evaluation tokens 43.6%.
For anyone shipping a tool-using agent, the takeaway is not to copy one universal harness. The domain decides which safety relations and state must exist. The model and runtime decide whether those relations are semantic or deterministic, cached or recomputed, and placed before or after execution. Weaker models do not simply need more rules. GLM-5 retries equivalent calls, DeepSeek switches to obfuscated alternatives after a refusal, and Kimi can emit concurrent floods. Across the fifteen DTAP bundles, six drop the natural-language policy P entirely and four make no runtime auxiliary-LLM call. Search often compiles a semantic hypothesis into deterministic structure and then deletes machinery with no marginal value.
This is a hard form of incremental work: it turns harness engineering from product selection into per-deployment generation and validation. The search is expensive. Inner evaluation logged about 59k target-model calls. It fits high-stakes settings with a stable tool surface and a one-time search budget. It does not fit a toy agent whose stack changes every week.
Residual risk is concentrated. Of 105 remaining successes, filesystem contributes 57, finance 41, telecom 7. Five types, unauthorized access, least-privilege, consent, unsafeguarded automation, and client-targeted scams, account for 54. Client-targeted scams stay at 60.0% (9/15), options solicitation at 30.0%, and telecom finance fraud at 16.7%. Those operations can be fully in scope while the harm lives in fabricated claims or unsuitable advice. No destination, quantity, or trajectory invariant certifies truth. The adapter only exposes system-prompt, pre-tool, and post-tool hooks, so executable code never sees a tool-free final answer.
Search quality tracks the test set. Of 68 parent-child mutations, 38.2% do not raise the small-stage score, and 7 of 15 returned DTAP bundles are not the small-stage maximum in their lineage. The outer optimizer changes strictness: on Kimi-K2.5, four searchers keep utility in 83–87% while mean ASR spreads from 5.24% to 17.62%. DTAP has fourteen domains; the grid uses three. Adaptive attacks still lift ASR from 9.7% to as high as 25.0%. The paper does not amortize search cost onto live traffic, and it does not validate on production traces.