Evolving model- & domain-specific harnesses for securing agents.
An agent that turns language into real-world effects can be subverted through the content it reads — or through a malicious request itself. Instead of hand-designing one fixed defense for every deployment, EvoSafeHarness searches the harness around a frozen model — a natural-language policy P coupled with executable code logic C — tailored to exactly how that model breaks in that domain.
Nanxi Li1 · Yingzi Ma2 · Yulong Cao3 · Edward Suh3 · Bo Li4 · Dawn Song5 · Chaowei Xiao1,3
1Johns Hopkins University · 2University of Wisconsin–Madison · 3NVIDIA · 4University of Illinois Urbana–Champaign · 5UC Berkeley
ASR on AgentDojo and unseen AgentDyn — at 82.8% / 75.0% utility
EvoSafeHarness dominates the utility–security trade-off on all four benchmark families. Each panel plots utility against safe rate (100 − ASR), so the ideal defense sits top-right; large markers are cross-model averages, small dots individual cells. DecodingTrust-Agent: five models × three domains. Agent-SafetyBench: utility under attack, three victims. AgentDojo: held-out, three victims. AgentDyn: zero-shot transfer of the AgentDojo harness — no re-search, no re-tuning.
The problem
Reach is what makes an agent useful — and vulnerable.
A tool-using agent can be subverted two ways: indirectly, through content it reads — a file, an email, a tool result — and directly, through a malicious request itself. Both exploit the same gap, between the task a user intended and the actions an adversary can induce, and that gap widens with every tool the agent can reach. The defenses we have are real, but they share one weakness.
🧱
Built once, applied everywhere
A detector tuned to one model misfires on another; a tool gate calibrated for one domain over-blocks in the next. One fixed artifact cannot fit every deployment.
🎯
Threat surfaces vary sharply
A framing one cautious model treats as a hard wall, a more compliant model walks straight through. Each model fails in its own idiosyncratic way.
🔁
The artifact is static; the deployment is not
That mismatch — between a defense designed once and the model and domain it must actually protect — is exactly where attacks live.
So the unit worth optimizing is not the model, but the harness around it — searched per model and per domain.
Two axes of adaptation.(C) One fixed defense over-defends a well-aligned model and under-defends a vulnerable one. (A) Holding the domain fixed, model behavior determines how the same security relation is enforced — Sonnet 4.6 needs a light policy plus two semantic checks; GLM-5 needs deterministic gates and provenance state. (D) Holding the model fixed, domain semantics determine which relations and state to protect — command effects for the filesystem, an account book for finance. (B) EvoSafeHarness searches a distinct (P, C) pair for every model × domain deployment.
The idea
Optimize the harness, not the model.
The model stays frozen — but the pipeline that wraps it (system messages, gates that screen each tool call, sandboxes, output audits) is entirely ours to write. It is the one place a security decision can sit beyond the attacker's reach, and unlike the model, it is programmable and searchable.
The EvoSafeHarness framework. Given a frozen model M, a target domain D, and existing defenses as warm-start, the Designer drafts a candidate harness H = (P, C) and iterates with a fresh-context Criticizer. Survivors enter the Cascade Test Environment — cheap-to-expensive stages (static → smoke → confidence gate → search) that score benign utility and direct/indirect ASR separately — and the Analyzer distills failed traces into experience for the next round.
Five real candidates (v0→v4), real cascade scores, and one round that scored well but got rejected on review — built from the proposer's own search logs for one of the fifteen cells.
ScopeOne harness, applied uniformly to every model & domain.
OverfitNo guard — a benchmark-specific rule can quietly inflate the score.
Prior artTreated as competing alternatives.
🛡️ EvoSafeHarness — the same machinery, turned to safety
GoalSafety. The same search, scored by a single secure-harness objective.
ScopePer model × per domain — fitted to how this model breaks here.
OverfitA Criticizer rejects rules that key on benchmark vocabulary before any budget is spent.
Prior artEnters as warm-start seeds, not rivals — the search starts from the field's best ideas.
NL Natural-language policy P
The policy transform applied to the model's context — trust-boundary declarations, provenance framing, refusal criteria. On AgentDojo, an authority-anchoring policy with an anti-over-refusal clause reaches 0.0% ASR at 82.8% utility.
CODE Executable code logic C
Any program valid under the application's adapter — deterministic gates on tool calls, output sanitizers, per-trajectory state, quarantined classifier calls. On DecodingTrust this is load-bearing: six of the fifteen returned bundles drop the NL policy entirely.
Both surfaces act through a small interception API — anything expressible there is searchable. These are interception points, not a fixed taxonomy of mechanism slots:
4 Per-trajectory state · ledgers, caches, provenance
5 Quarantined judges · classify, never act
Demos · design principles
Why a harness must be model- & domain-specific
Three short demos that show the rationale behind the design. The same attack is stopped by very different machinery depending on the model and the domain — pick one, then hover any component to see what it does, which taxonomy slot it fills, and which surface it lives on.
A deeper, step-by-step replay of one real direct attack and one real indirect attack, built from the held-out evaluation logs — see exactly where each is caught.
What transfers, what doesn't
The domain decides what to protect; the model decides how to enforce it.
Across the fifteen returned harnesses, what carries between deployments is the principle — scope, provenance, effect authorization — never the concrete predicate, state machine, or hook graph. Domain semantics fix which safety relations and trajectory state must be protected; the victim's failure behavior fixes whether each check is semantic or deterministic, cached or recomputed, and placed before or after execution.
🎯 Domain-specific — which relations & state
Effect / harm-predicate gateswhat a tool call can actually harm here — command effects & secret paths for the filesystem, trades vs. money egress for finance.
Trajectory statewhat history to keep — an account book for finance (a sequence of legal trades can still be a wash), a call ledger for telecom.
Credential-egress redactionblanks the password / cvv / ssn that this domain's tools expose.
Trust boundarieseach domain's workspace has its own untrusted information sources.
🧠 Model-specific — how & where to enforce
Semantic vs. deterministicSonnet 4.6 hits zero held-out ASR with a policy + two quarantined checks; GLM-5 needs deterministic gates (50.0% → 11.4% ASR).
Verdict cachingGLM-5 retries equivalent calls — so a verdict is cached and applied consistently on retry.
Concurrency-safe placementKimi emits batched floods — so the volume cap moves into a synchronous pre-tool critical section.
Escalation handlingDeepSeek switches to obfuscated alternatives after a refusal — so checks key on effects, not phrasings.
Results
No single fixed defense did this. The search did — one model, one domain at a time.
Four benchmark families, both attack channels, and one adaptive attacker. Pick a benchmark: each panel shows the cross-model summary first, with the per-model breakdown one click away. Baselines are ported once and frozen; EvoSafeHarness is searched per cell, and held-out outcomes never reach the search.
🟢
On AgentDojo, ASR → 0.0% at 82.8% utility
CaMeL also reaches zero ASR — at 41.0% utility, half of ours. The searched policy anchors authority in the user's request and tells the agent to ignore embedded commands while continuing the task, killing both attack-following and over-refusal at once.
🚀
It transfers zero-shot to AgentDyn
Frozen and re-run on unseen shopping / GitHub / daily-life suites: 75.0% utility at 0.0% ASR. The rule keys on where an instruction originates and whether an action stays in the user's scope — not on suite names or tool vocabulary — so it survives the domain shift.
🔵
On DecodingTrust, code is load-bearing
In the hard regime the search compiles semantics into deterministic runtime structure: six of the fifteen returned bundles drop the NL policy entirely, and four run with no auxiliary LLM at all — a separate secure agent per domain and per victim.
🛡️
It holds against an attacker that adapts
Freeze the harness and let a PAIR attacker rewrite prompts against the live agent: ASR moves from 9.7% to a mean of 19.5% across three attacker models at a refinement budget of 16 — still below the undefended agent facing static prompts (23.6%). The relations it enforces depend on provenance and scope, not on any attack's wording.
Citation
Cite EvoSafeHarness
If this work is useful to your research, please cite the paper.
@article{evosafeharness2026,
title = {EvoSafeHarness: Evolving Model- and
Domain-Specific Harnesses for Securing Agents},
author = {Li, Nanxi and Ma, Yingzi and Cao, Yulong and Suh, Edward
and Li, Bo and Song, Dawn and Xiao, Chaowei},
year = {2026}
}
