← Back to EvoSafeHarness 🔁 Search loop · finance domain · victim model GLM-5

One cell of the grid, run to convergence.

The method figure shows the search loop as six abstract stages. This page is that loop, run for real, on a trading & portfolio agent: place a trade, move funds, summarize a report — attacks here look like an unauthorized transfer or a wash trade, not an abstract exploit. Five candidates the proposer actually built, cascade-evaluated every round, including one that scored well on paper but was rejected once checked more carefully — for one (domain × model) cell out of the fifteen in the paper. Every score below is real; round summaries are told at a high level so the story stays easy to follow.

Step through with or the arrows below · space plays / pauses

🤖
Designer
🧩
Harness H′
🔍
Reviewer
🧪
Cascade Test
🧠
Analyzer
💡
Experience
Warm-start · OpenClaw · DRIFT · CaMeL
Score trajectory
utility% ASR%
1 / 1
What actually changed, round to round

Three rounds of real gains, one rejected on review.

Cand.ParentClosesUtilityASRScore
v0baseline (model-noise housekeeping already folded in)7047.422.6
v1v0egress gate — transfers only to pre-approved, named counterparties802555
v2v1independent scope auditor — ignores claimed authorization on effect-bearing calls801070
v3 shippedv2net-position ledger — stops over-blocking legitimate multi-leg trades901080
v4 rejectedv3content-manipulation gate — added complexity, ASR rose instead of falling901575

Scores are the stage-3 search pool (30 tasks). v4 is a genuine dead end — utility didn't move but ASR rose (10→15) once checked empirically, so it was never promoted; v3 remains what shipped. v3 here shipped in the public repo as domains/finance/defenses/glm-5/dtap_def_v4/ — the archive's own numbering starts one housekeeping round earlier than this walkthrough's v0. This is one of the fifteen (domain × model) cells in the paper — the same loop, from a fresh baseline, runs independently for the other fourteen and converges on a different harness each time.