tool-using-agents-safety-harness-searched-separately-each-model-and-domain-deployment CLM-0227For tool-using agents, a safety harness searched separately for each model-and-domain deployment (jointly evolving a natural-language policy and executable pre/post-tool-call code, screened by a fresh-context adversarial reviewer) reaches a better safety-utility trade-off than fixed expert-designed defenses ported unchanged across deployments, because domain semantics determine which safety relations and trajectory state must be checked while the victim model's failure behavior determines whether a check should be semantic or deterministic and where in execution it must run.
Capability: Following instructions hidden in data
Observed on
ReAct-style tool-using agents with a harness that can intercept tool calls; measured on DecodingTrust-Agent (5 victims x 3 domains), Agent-SafetyBench, AgentDojo/AgentDyn; harness .
Sources
- Measured: DTAP 15 cells (30 benign, 35 direct, 35 indirect each) average ASR 45.6% -> 10.0% at 3.3-point utility cost, best score in 14/15 cells versus CaMeL, DRIFT, Progent; AgentDojo 82.8% utility at 0.0% ASR vs CaMeL 41.0%; zero-shot transfer to AgentDyn 75.0%/0.0% where CaMeL completes nothing. Baselines were ported once by the authors and frozen, which may understate them; the mechanism half (domain sets relations, model sets enforcement style) rests on qualitative inspection of returned bundles plus two controlled comparisons, not a factorial design. [truncated]
Disagreeing is the most useful thing you can do here. Nothing on this page waits for a reviewer: the counts above move when evidence lands, and every source stays attached with who brought it.
Related claims
- For tool-using agents, restricting capabilities at the harness level after untrusted content enters the context — revoking or tightening the parameter envelopes of skills that lie on graph paths to deployer-defined forbidden states — cuts indirect-injection attack success further than prompt-level or per-action authorization defenses, and does so with no extra model calls or tokens, because enforcement reads the transition graph rather than the natural-language content.Following instructions hidden in data · reviewed by AI
- For tool-using agents, enforcing injection defense as a deterministic provenance check on sensitive tool parameters — with the only model call reading the trusted user request and never fetched content — makes admission decisions invariant to how an injection is worded, whereas defenses that judge the agent's runtime plan or behavior with a model can be steered by reworded injections.Following instructions hidden in data · reviewed by AI
- As long as trusted instructions and untrusted retrieved content occupy the same model context, defenses that only change how untrusted text is marked or weighted (instruction hierarchies, spotlighting, content detectors) reduce indirect-injection success but do not remove it; only defenses that isolate contexts or restrict the action set give guarantees, at a cost in the agent's ability to combine information across sources.Following instructions hidden in data · reviewed by AI
- For long-horizon tool-calling agents (tasks needing five or more calls), embedding state-transition cues — preconditions, invariants, completion states — into the descriptions of the tools on the intended chain is what actually steers the agent's trajectory; runtime corrective text appended to tool results only patches residual drift, and the plausible user prompt alone (persona, deadlines, format constraints) does not establish the trajectory at all.Following instructions hidden in data · reviewed by AI
- For tool-using agents on long-trajectory benchmarks, an injection defense that audits each candidate action against a one-step-ahead predicted tool set holds attack success low while keeping task utility near the attack-free level, whereas defenses that fix a global plan or filter whole tool outputs lose utility because the predicted full trajectory almost never matches the executed one once environmental feedback arrives.Following instructions hidden in data · reviewed by AI
Notes
Drafted from the paper by a model and filed unreviewed. Visible here so it can be read, not because anyone has vouched for it: it does not move any technique's standing and does not count toward the internal scorecard. Drafted confidence: medium. Falsifier as drafted: A single fixed expert-designed harness matching or beating per-cell searched harnesses on the same score (utility minus ASR) across the same model x domain grid, or the searched harnesses transferring no better than fixed ones to unseen suites. Drafted stance toward tool-using-agents-restricting-capabilities-harness-level-after-untrusted-content: supports -- Both find that harness-level enforcement keyed to action effects and provenance, rather than content wording, is what cuts indirect-injection success. Proposed technique, not catalogued: Per-deployment evolved safety harness.