Safety does not compose across reset monitor windows

The point

What the source found. safeguards scoped to one trajectory re-initialize safety state when the next trajectory begins. An attack can split decisive evidence across iterations so no trajectory-scoped monitor ever sees enough to distinguish it.

What the source found. the paper proves a separation in which every trajectory-scoped monitor has true-positive rate equal to false-positive rate for the constructed fragmented-evidence attack, while a monitor retaining cross-iteration state separates the paired cases perfectly.

What the source found. LoopHarness restores persistent, non-decaying external safety state, mediated commits, and an arbiter. A geometrically decaying risk score is not an adequate repair because a patient adversary's cooling-off wait stays constant rather than growing with horizon.

The actual failure mechanism

What the source found. the monitor's safety state is re-initialized at the next trajectory boundary. An attacker fragments evidence across multiple iterations. Each local window looks like its clean counterpart because the decisive pattern exists only in the outer loop history.

This is not a claim that ordinary agent work state persists too long. The paper's repair is specifically an external safety state that persists across iteration and trajectory boundaries. The previous version reversed those namespaces and incorrectly made non-decay the problem.

Separation result and LoopHarness

What the source found. for the paper's outer-state attack, a trajectory-scoped monitor has true-positive rate equal to its false-positive rate, however expressive it is, because the necessary evidence never appears in one observed window. A cross-iteration monitor retains the missing evidence and separates attacked from clean episodes in the controlled construction.

What the source found. LoopHarness adds persistent non-decaying loop-level safety state, mediated commits, and an arbiter. Under the paper's mediated-commit and arbiter detection-floor assumptions, it bounds expected unauthorized irreversible actions by a quantity constant in horizon N. The paper states the bound as B + m - 1 + m / delta_M.

What the source found. a geometrically decaying risk score is insufficient. The cooling-off period needed by a patient adversary remains constant instead of increasing with horizon, so decay does not restore the required accumulation.

Claims withdrawn from the earlier version

The paper is no longer said to introduce a memory-integrity guard, continuing-influence check, ten-acceptable-actions case, or an iteration-independence and state-decay theorem. Those claims were not traceable to the accessible source.

The earlier recommendation to decay every piece of loop-carried state is withdrawn as a paper repair. TTL and revalidation for ordinary work state may be a separate Labs policy, but the external safety accumulator must not reset or decay in the way the paper shows is vulnerable.

Labs interpretation and limits

Our reading. keep two namespaces explicit. Agent work state may have freshness rules. External safety state accumulates cross-iteration evidence and stays outside agent control. A freshness policy for the first must never erase the second.

The proof and evaluation concern controlled Agent-SafetyBench tasks, paired clean and attacked episodes, module ablations, and an adaptive white-box red team. They do not establish production incidence or operating points for every domain.

The guarantee also depends on complete mediated-commit coverage and the stated arbiter detection floor. An irreversible path that bypasses mediation falls outside the bound.

How we would test it. Split decisive evidence across reset boundaries

In a synthetic authorized environment, create paired clean and attacked episodes whose decisive evidence appears only when two or more iterations are combined. Compare a monitor reset at each boundary with one that retains external safety state.

Separately test a geometrically decaying score and measure whether waiting allows the same fragmented pattern through. Verify that every synthetic irreversible effect goes through the mediated-commit path. Do not predict success; preserve the traces and report the observed operating point.

What remains unknown

• How LoopHarness generalizes from the controlled protocol to production agent fleets.
• What arbiter detection floor and false-positive cost are achievable in a specific deployment.
• Whether every irreversible path can be covered by mediated commits without bypasses.
• How persistent non-decaying safety accumulation should be bounded or reviewed without recreating reset blindness.

Primary sources

• Safety Does Not Compose: Non-Decaying Loop State for Autonomous LLM Agents (arXiv:2608.27141)
• How Fast Do Agents Rot? - related long-horizon reliability evidence
• Monitoring Web Agents Without Internal Signals - related external supervision evidence
• The Irreversibility Budget - related admission control for irreversible effects