Researchers have introduced EvoSafeHarness, a safety-specific optimization framework that synthesizes a deployable safety harness for a frozen language model operating in a target domain. The work addresses a persistent gap in agent safety: system-level harnesses that enforce policy beyond model-level defenses are typically designed once by experts and applied uniformly across heterogeneous models and domains.
According to the paper, effective protection is deployment-dependent. Models differ in how much enforcement they can tolerate before utility declines, and domains differ in the effects, state, and action sequences that must be governed. A harness strict enough for one model may over-block another, while a policy that transfers across domains may miss application-specific safety relations.
EvoSafeHarness jointly searches a natural-language policy and executable code logic, guided by model behavior, domain specifications, and fresh-context adversarial review intended to reject benchmark-specific rules. The model itself remains frozen; the harness writes both the policy and the code that enforces it on every tool call.
Across four agent benchmark families, the evolved harnesses achieved a stronger safety-utility frontier than fixed expert-designed defenses such as CaMeL, DRIFT, and Progent. On DecodingTrust-Agent, average attack success rate fell from 45.6% to 10.0% at a 3.3-point utility cost, with the best score in 14 of 15 cells. On AgentDojo, it reached 82.8% utility at 0.0% ASR — twice CaMeL's utility at the same operating point — and transferred unchanged to unseen AgentDyn suites. It also achieved the best score on Agent-SafetyBench for every victim and kept mean ASR below 20% under adaptive PAIR attacks with a refinement budget of 16.
Analysis in the paper indicates that domain semantics determine which safety relations and trajectory state are needed, while model and runtime behavior determine how and where those relations should be enforced. The authors frame the work around a simple premise: as LLM agents move money, edit files, and act on real systems, one-size-fits-all safety harnesses are insufficient.