ScholarPulse 日报 2026-08-11

2026-08-11 学术简报：2 篇。SHE框架通过轨迹驱动的演化机制，显著提升LLM代理安全罩的动态适应性，实现安全性能3.1倍ASR降低与良性效用同步提升。

今日速览

序号	标题	来源	日期	主题	推荐等级
1	SHE: Trajectory-driven Safety Harness Evolution for LLM Agents	arXiv	2026-08-10	AI-Agent	高
2	Multi-Agent AI Safety as an Institutional Design Problem	arXiv	2026-08-10	AI-Agent	高

重点论文与技术动态

1. SHE: Trajectory-driven Safety Harness Evolution for LLM Agents

来源：arXiv
日期：2026-08-10
作者/机构：Wanying Qu, Qinghua Mao, Yu Li, Jiyao Liu, Xin Zhang, Dadi Guo
主题标签：AI-Agent, arXiv
推荐等级：高
分类：cs.AI, cs.CV

一句话结论

SHE框架通过轨迹驱动的演化机制，显著提升LLM代理安全罩的动态适应性，实现安全性能3.1倍ASR降低与良性效用同步提升。

核心内容

SHE将安全罩分解为系统提示、规则库、安全记忆和工具策略四个组件，明确定义安全责任边界以支持局部演化。
引入归因引导的演化循环，将轨迹失败转化为结构化诊断，学习组件特定边界优化，并通过安全-效用验证选择演化后的安全罩。
实验在Agent-SafetyBench上验证，SHE实现3.1倍ASR降低，同时提升良性效用，并泛化至AgentHarm基准的未见风险。

方法与数据

方法基于轨迹演化框架，核心为安全罩四组件分解与归因引导的演化循环。
实验在Agent-SafetyBench和AgentHarm基准上进行，摘要未明确数据细节。

价值判断

值得关注：创新性解决安全罩固定化问题，支持动态适应新兴风险。
可复用点：组件分解方法与演化循环设计可迁移至其他安全机制开发。
局限/待核查：摘要未明确提及具体局限或待核查点。

摘要

The safety of large language model (LLM) agents depends not only on model weights but also on the agent harness that manages context, memory, tools, permissions, and runtime control. Existing safety mechanisms often treat the harness as a fixed deployment artifact, limiting their ability to evolve with emerging risks. Moreover, coupled functions across harness components obscure safety responsibility attribution, making localized evolution difficult. We propose Safety Harness Evolution (SHE), a framework that learns evolving safe boundaries from rollout trajectories. SHE decomposes the harness into four artifacts with explicit safety responsibilities, including the System Prompt, Rule Bank, Safety Memory, and Tool Policy, defining clear functional boundaries for localized evolution. Based on this decomposition, SHE introduces an attribution-guided evolution loop that converts trajectory failures into structured diagnoses, learns artifact-specific boundary refinements, and selects evolved harnesses through safety-utility validation. Experiments on Agent-SafetyBench demonstrate that SHE effectively enhances safety through harness evolution, achieving a 3.1x ASR reduction compared with static SafeHarness, while also improving benign utility. The evolved harness further generalizes to unseen risks on the held-out AgentHarm benchmark and transfers across agent models without additional evolution.

2. Multi-Agent AI Safety as an Institutional Design Problem

来源：arXiv
日期：2026-08-10
作者/机构：Abdullah X
主题标签：AI-Agent, arXiv
推荐等级：高
分类：cs.LG, cs.AI, cs.MA

一句话结论

AI安全不仅依赖规则本身，还取决于系统信任的权威状态和阻塞后路径。

一段话：本研究通过5,280-episode实验验证，AI安全作为机构设计问题，规则形式、权威状态及阻塞后路径共同作用，揭示了机构设计在多代理系统中的核心影响。

核心内容

宪法提示和证明来源守护者实现0/384违规，其中证明来源守护者阻塞51/384尝试但44/51后续安全完成。
本地状态守护者失败集中于政策变化而起源权威固定场景，洗钱实验中承认22/96违规，而证明来源执行实现0/96（p=4.77×10⁻⁷）。
资源分配实验显示，揭示数值上限改变代理请求行为，相同违规率可能隐藏不同机制。

方法与数据

5,280-episode研究套件，含委托实验（四模型家族）和资源分配实验。
摘要未明确具体数据集来源。

价值判断

值得关注：将AI安全纳入机构设计框架，强调规则、权威与路径的交互作用。
可复用点：宪法提示和证明来源守护者机制可直接应用于多代理系统安全设计。
局限/待核查：本地状态守护者在特定场景（政策变化权威固定）失败，需优化机制。

摘要

AI agents increasingly work inside systems that govern how they delegate tasks, move information, execute actions, and use shared resources. Recent work already shows that deployment rules can change collective behavior. Here we ask which parts of an AI institution produce safety and how they do it. This is the first paper from POLIS, an ongoing research programme studying algorithmic institutions for multi-agent systems. We report a frozen 5,280-episode study suite. The main pre-specified delegation experiment spans four model families; a targeted high-conflict diagnostic adds three additional model endpoints. In matched structured workflows, the model sees different rule formulations and guards consult different authority states. We also vary the attractiveness of the immediate compliant internal/self fallback and allow blocked workflows to continue. A detailed constitutional prompt produces 0/384 realized violations. A provenance-aware executable guard also produces 0/384, although it blocks prohibited attempts in 51/384 episodes; 44/51 of those episodes later complete safely. The local-state guard's failures concentrate in scenarios where an ordinary transformation changes visible policy while originating authority stays fixed. In matched laundering scenarios, that guard admits violations in 22/96 episodes and provenance enforcement in 0/96 (p = 4.77 x 10^-7). A separate resource-allocation experiment shows that revealing the numerical value of an otherwise identical cap changes agent requests. In these structured workflows, the same final violation rate can hide very different mechanisms. The rule itself is only part of the institution. The authority state the system trusts matters, and so does the path available after a block.