{"id":"97eee201-a3a1-489b-9cd5-7c957c607990","arxiv_id":"2607.19913","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":5,"one_line_summary":"A guard trained to anticipate safety-relevant futures from partial trajectories cuts average attack success from 23.0% to 7.1% across four agent-safety benchmarks.","lead":"The paper trains an AI-safety guard that watches a partial agent trajectory, forecasts what could go wrong later, and blocks dangerous actions before they execute. Across four agent benchmarks it lowers average attack success from 23.0% to 7.1% while keeping benign task success at the no-guard level.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"RQ1's 'w/o Infer. Sum.' ablation is confounded by prompt-format shift; the necessity of inference-time summaries is not established.","rationale":"The reader's weakest assumption — that simulated trajectories and GPT-5.5 annotations transfer faithfully to real tool-use environments — is a legitimate external-validity concern and is explicitly acknowledged in the paper's Limitations section. However, it is not the most load-bearing issue for the paper's central mechanistic claim. Even if real-world transfer is imperfect, the benchmark result could still be valid. The more direct threat is internal to RQ1: the 'w/o Infer. Sum.' ablation removes a required prompt field that was present throughout training, so the performance drop cannot be unambiguously attributed to the absence of anticipated future information. This confound undermines one of the two 'necessary' components the paper claims to establish. I do not see evidence of dishonesty or a fabricated result; the main empirical table is internally consistent, and the oracle-summary comparison provides some support for the value of future information. But the specific inference-time ablation needs a neutral-placeholder control before the mechanistic conclusion is secure. Because the reader's verdict is already CONDITIONAL and this concern reinforces rather than overturns that assessment, I recommend no change to the verdict.","tokens_in":16712,"tokens_out":13365,"duration_ms":151216,"concrete_test":"Run the 'w/o Infer. Sum.' condition again, but replace the anticipated summary with a fixed neutral placeholder (e.g., 'The agent continues working on the user's request in the observed environment.') while preserving the exact prompt format used in training. Evaluate on AgentDojo, AgentLAB, and LPS-Bench under the same protocol as Table 2. If ASR and utility return to approximately Vanguard's 0.072/0.680, the original ablation was an artifact of input-format shift; if they remain near 0.123/0.557, the concern is resolved and inference-time summary information is genuinely necessary.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's claim that inference-time summary conditioning is necessary (RQ1, Table 2) is based on comparing Vanguard to 'w/o Infer. Sum.', where the anticipated-summary field is removed from the adjudication prompt at inference. But the model was trained with a populated summary field, so this condition changes two things at once: the summary information is absent, and the input distribution shifts to an unseen prompt format. The judgment prompt in the appendix is 'Instruction: {instruction} / Observed trajectory so far: {tpre} / Anticipated future summary: {summary}'; omitting the summary field is a distribution shift. The observed ASR increase from 0.072 to 0.123 and utility drop from 0.680 to 0.557 may therefore reflect the model encountering an unfamiliar input template rather than the loss of forecast information. The oracle-summary row shows that accurate summaries help, but it does not isolate whether the model's own generated summary is causally necessary, as opposed to merely having any well-formed summary field present. This is load-bearing because the paper explicitly claims that 'both training-time anticipation and inference-time future-summary conditioning are critical' — a mechanistic claim that the ablation as designed cannot cleanly support.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes Janus, a training framework for predictive guardrails in long-horizon tool-use agents. It synthesizes agent trajectories through multi-agent simulation, annotates each prefix with a GPT-5.5-produced safety label and a future-risk summary, and trains a shared policy on two coupled tasks — anticipation (forecast a safety-relevant summary from a partial trajectory) and adjudication (classify safety from the prefix plus the anticipated summary) — optimized jointly with a GRPO-style objective. The resulting guard, Vanguard, is evaluated on AgentDojo, Agent-SafetyBench, AgentLAB, and LPS-Bench, where it reports lower attack success rate than six baselines while matching no-guard benign-task utility on AgentDojo. Ablations (RQ1/RQ2) are used to argue that both training-time anticipation and inference-time future-summary conditioning are critical.","tokens_in":16938,"tokens_out":5834,"duration_ms":63983,"significance":"If the results hold, the paper makes a constructive contribution: it provides a concrete, trainable mechanism for pre-execution safety judgment and demonstrates large gains on long-horizon planning safety, which is currently an underexplored failure mode. The evaluation does not rely on the paper's own equations: AgentDojo and the other benchmarks use official or third-party judges, so the central benchmark comparison is not circular. The oracle-summary upper bound and the training-time ablation support the causal story, and the code/data release is a practical strength. However, the inference-time ablation (w/o Infer. Sum.) is confounded by a prompt-format shift, and the fully synthetic training pipeline with no human verification of labels leaves the transfer claim under-supported. These issues are fixable and do not, in my assessment, invalidate the main benchmark result, but they change the strength of the mechanistic claims that the paper draws from the ablations.","major_comments":[{"comment":"The 'w/o Infer. Sum.' condition removes the anticipated-summary field from the adjudication prompt at inference while the model was trained with a populated field. This changes two variables at once: the forecast information is absent, and the input distribution shifts to an unseen prompt template. The ASR increase from 0.072 to 0.123 and utility drop from 0.680 to 0.557 may therefore reflect the model seeing an unfamiliar format rather than the loss of forecast information. The oracle-summary row only shows that accurate summaries help, not that the model's own generated summary is causally necessary. This is load-bearing because the paper explicitly claims that both training-time anticipation and inference-time future-summary conditioning are critical. Please add a control that keeps the prompt template intact (e.g., a placeholder or a generic summary field), or train a variant where t","section":"§4, RQ1, Table 2"},{"comment":"All training labels and future summaries are produced by GPT-5.5 with no reported human verification or agreement study, and trajectories are rolled out by a Simulator without executing real tools. The paper's own Limitations section acknowledges that the simulation 'may not fully capture the distribution of tool behaviors, environmental feedback, and user interactions.' This is a correctness-risk concern for the central claim: if the simulator's observations or GPT-5.5's labels are systematically unrealistic, the guard learns those artifacts rather than real delayed-risk structure. Please report at least a human-annotation agreement study on a sample, and, if possible, evaluate on collected real-agent trajectories or a real tool-use sandbox. At minimum, the paper should more explicitly delimit the claim to simulated environments.","section":"§2.2 Step-Level Annotation and Limitations"},{"comment":"The main Vanguard results use λA = 0.5, selected from a sensitivity sweep as the 'best overall safety–utility trade-off.' If the sweep is performed on the same evaluation benchmarks that are later reported as headline numbers, the 15.9-point average protection improvement is optimistic in the sense that model selection and evaluation share a test set. The paper should state the selection protocol (e.g., a held-out validation set or selection on development data), report results for all sweep values, and clarify whether the reported improvements are for a model chosen before seeing the test benchmarks. This does not undercut the qualitative conclusion, but it affects the magnitude claim.","section":"§4, RQ3, Figure 4"}],"minor_comments":[{"comment":"The text says ablations are run 'under Qwen3-32B,' while the guard model is initialized from Qwen3-8B. Please clarify which component uses which backbone in each table, and why the ablations use a different setup from the main evaluation if that is the case.","section":"§3 and Table 2"},{"comment":"Values for λA, λD, η, GA, GD, and the GRPO KL/temperature coefficients are not reported. Since the method is RL-based and several coefficients directly shape the reward, the paper should provide the exact values and, where applicable, the search ranges.","section":"Equations (4), (6), (9)"},{"comment":"The NLI-based similarity score Sim(Sk, s) is not specified beyond citing SummaC/AlignScore. State which model is used, whether it is frozen, and how the score is normalized; otherwise the anticipation reward is not fully reproducible.","section":"Eq. (6) and data annotation"},{"comment":"The intervention protocol treats only 'unsafe' as blocking; 'potential_unsafe' does not block. Given the risk taxonomy includes a 'potential unsafe' category, the paper should explain why this label never triggers an intervention, and whether doing so would alter the ASR/utility trade-off.","section":"Inference/intervention, footnote to Table 8"},{"comment":"Figure 4's axes are not described in the text (which benchmark set does 'average ASR' cover?), and the abstract/body contain spacing artifacts such as 'V anguard' and 'JANUS'/'Janus' inconsistently. Also, the model name 'qwen-3.5-122B-uncensored-stxt' appears typographical and should be verified.","section":"Figures and typos"}],"recommendation":"major_revision","confidential_remarks":"The paper is worth pursuing: the central benchmark result is evaluated against external judges, and the training-time anticipation ablation is clean. The main technical risk is the confounded 'w/o Infer. Sum.' ablation; if the authors can provide an unconfounded version, I would likely support acceptance after minor revision. The synthetic-data/annotation-quality issue is significant but already acknowledged; it should be addressed with human agreement data or a real-tool evaluation before publication. I do not see a circularity problem in the empirical claims, as the reader's circularity score of 1.0 appears to be based on a misreading: the benchmark results use benchmark-specific evaluators (e.g., ShieldAgent for Agent-SafetyBench), not the paper's own reward equations."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Dear colleague,\n\nYou should know two things about this paper. First, the core idea is real: training a guard to forecast safety-relevant futures and rewarding those forecasts by their downstream adjudication utility (CoAA-RL) is a true departure from reactive step-level guards, and the empirical gains on long-horizon planning (LPS-Bench ASR 0.075 vs 0.323 for the best step-level baseline) are large enough to take seriously. Second, the headline 15.9-point average protection gain is selected from a hyperparameter sweep on the evaluation benchmarks themselves (λA=0.5 from Figure 4), and the paper's own ablation for \"inference-time summary conditioning\" is confounded by a prompt-format shift. Neither sinks the paper, but both should be fixed before I'd trust the numbers at face value.\n\nWhat's genuinely new: the coupled anticipation–adjudication reward is not in the prior literature — SafePred predicts futures via world models but doesn't couple forecast reward to adjudication utility — and the three-origin risk taxonomy with the 75k-example synthetic corpus is a useful artifact. The paper is also honest: the Limitations section explicitly flags the simulation-to-deployment gap, and the evaluation uses external benchmark-specific judges, so the central result is not circular.\n\nSoft spots, in order of softness. The λA selection is the most consequential: Figure 4 shows 0.5 gives the best safety–utility trade-off, but that's the test set. The authors report sensitivity, so it's not hidden, but the headline magnitude is inflated. No variance or significance testing is reported, so we can't tell if the 0.054 vs 0.062 on AgentDojo is noise. The closest predictive baseline, SafePred, is cited but never compared — that's a missing control for the central claim. And the training truth rests entirely on GPT-5.5 annotations with no human verification; if those labels encode systematic biases, the guard learns them. The stress-test on \"w/o Infer. Sum.\" is correct: removing the summary field at inference changes two things at once — the information is absent and the prompt format is unseen. The paper's claim that inference-time conditioning is \"critical\" is therefore not cleanly established. The oracle row shows accurate summaries help, but it doesn't isolate the model's own generated summary as causally necessary.\n\nBottom line: this is a real new-method paper with internally consistent evidence for the training-time anticipation mechanism and the long-horizon gains. It deserves a serious referee. I'd want the authors to add SafePred as a baseline, report variance across seeds, fix the inference-time ablation with a format-matched control (e.g., a placeholder summary), and show robustness to λA across a validation split rather than the test benchmarks.\n\nRecommendation: send to peer review with major revision. I would cite this if the revisions land.","headline":"CoAA-RL is a genuine new training scheme for predictive guardrails with plausible long-horizon gains, but the headline is inflated by benchmark-selected hyperparameters and one load-bearing ablation is confounded.","tokens_in":17532,"tokens_out":2927,"would_cite":true,"duration_ms":28151,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A guard that anticipates future risk can block unsafe agent actions before they execute, cutting average attack success to 0.071 across four benchmarks.","keywords":["agent safety","predictive guardrails","long-horizon agents","future anticipation","reinforcement learning","tool-use agents","attack success rate","trajectory simulation"],"falsifier":"Collect a set of real agent execution trajectories with human-verified safety labels, including delayed-risk cases, run Vanguard on prefixes at 25/50/75/100%, and compare its ASR and benign utility against a guard trained identically on real trajectories. If Vanguard's ASR on real trajectories is no better than step-level baselines, or if its training-set labels disagree with human adjudication at a high rate, the claim that simulated anticipation transfers would be refuted.","tokens_in":16480,"feed_emoji":"🛡️","tokens_out":3816,"duration_ms":40128,"temperature":0.7,"pith_summary":"This paper argues that for long-horizon tool-using agents, safety guards must anticipate where a trajectory is heading rather than react after an unsafe action appears. It introduces Janus, a training framework that generates diverse simulated agent trajectories across three risk origins (user, environment, agent) and teaches a shared guard policy two coupled tasks: forecasting a safety-relevant future summary from the partial trajectory, and adjudicating safety from both observed and anticipated context. The two tasks are jointly optimized by CoAA-RL, which rewards forecasts only insofar as they improve downstream safety judgments. The resulting guard, Vanguard, blocks unsafe actions before execution and, across four agent-safety benchmarks, lowers average attack success rate to 0.071 versus 0.230 for baseline guards and 0.397 with no guard, while matching benign-task utility on AgentDojo. The gains are largest on long-horizon planning (LPS-Bench), consistent with the claim that delayed risk is the core failure mode predictive guarding addresses.","feed_headline":"Predictive guard cuts agent attack success to 7.1%","feed_subtitle":"Foreseeing delayed risks lets a guard block unsafe actions early, without hurting benign task completion.","key_machinery":"The load-bearing mechanism is CoAA-RL (Coupled Anticipation and Adjudication Reinforcement Learning), a shared guard policy trained with two tasks distinguished by a mode indicator. One head generates future summaries from the observed prefix (anticipation); the other outputs a safety label plus rationale conditioned on the prefix and a sampled summary (adjudication). Group-relative advantages are computed within trajectory-prefix groups for anticipation and within summary groups for adjudication. The anticipation reward mixes similarity to the true future continuation with the adjudication utility of the summary, so forecasting is optimized for decision usefulness, not truthfulness alone. A","core_discovery":"The central claim is that safety for long-horizon agents can be reframed from detecting harmful content or actions to anticipating delayed operational risk before it materializes. Concretely, the paper claims that a guard model that samples multiple possible future summaries from a partial trajectory, and then judges safety conditioned on those summaries, can intervene before high-impact tool calls execute. The paper demonstrates this with Vanguard, which reduces average attack success rate across four benchmarks from 0.230 (six guard baselines) to 0.071, with the largest margin on LPS-Bench (0.075 vs 0.323 for the strongest step-level baseline), while maintaining AgentDojo benign-task utili","pith_inferences":["Editorial extension: if the simulation-transfer assumption holds, the method suggests a general recipe — build guardrails by simulating failure modes and training guards to forecast risk-relevant futures — that could extend beyond tool use to code execution, robotics, or other settings with delayed consequences.","Editorial extension: the oracle-future-summary upper bound (average ASR 0.052) implies headroom; a better world model or longer-horizon forecaster could improve safety further without changing the adjudication architecture.","Editorial extension: the 25%-prefix results indicate an early-warning property, so the approach may support budgeted monitoring where the guard is queried only at key decision points rather than at every step.","Editorial extension: because the training labels are model-generated with no reported human verification, the most direct next test is a human-annotated evaluation on real deployment trajectories; the paper's own limitations section flags this distribution-shift gap."],"forward_implications":["Predictive guarding could replace step-level reactive monitors in long-horizon agent workflows, intervening before harmful tool calls execute rather than after.","The 15.9-point average protection improvement suggests that anticipating delayed consequences is especially valuable as task horizons grow, as seen in the LPS-Bench results.","Benign task utility can be preserved (or improved) while cutting attack success, meaning foresight need not come at the cost of over-blocking routine tasks.","The CoAA-RL principle — rewarding forecasts by downstream decision utility — is a transferable training objective for other safety-critical prediction problems.","The three-label scheme (safe / unsafe / potential_unsafe) with only 'unsafe' blocking provides a tuning lever: the reward-mixing weight can shift between conservative and permissive behavior."],"fun_headline_variants":["Foresight guard cuts agent attacks to 7.1%","Anticipate agent risk, block attacks before execution","Guard predicts delayed risk, attack success drops to 7.1%","Janus: foresee and stop unsafe agent actions early","Agent guard with foresight slashes attack success to 7.1%"],"cache_read_input_tokens":2304,"weakest_assumption_plain":"The central empirical claim rests on the assumption that the model-simulated tool trajectories and automatically generated safety labels capture the risk structure of real tool-use environments closely enough that a guard trained on them will block real unsafe actions without over-blocking benign ones.","fun_headline_variants_meta":{"raw":{"variants":["Foresight guard cuts agent attacks to 7.1%","Anticipate agent risk, block attacks before execution","Guard predicts delayed risk, attack success drops to 7.1%","Janus: foresee and stop unsafe agent actions early","Agent guard with foresight slashes attack success to 7.1%"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000735,"raw_usage":{"total_tokens":3082,"prompt_tokens":666,"completion_tokens":2416,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":410,"completion_tokens_details":{"reasoning_tokens":2328}},"tokens_in":410,"tokens_out":2416,"duration_ms":20160,"temperature":1.0,"reasoning_tokens":2328,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-01T11:19:06.068839+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Collect a set of real agent execution trajectories with human-verified safety labels, including delayed-risk cases, run Vanguard on prefixes at 25/50/75/100%, and compare its ASR and benign utility against a guard trained identically on real trajectories. If Vanguard's ASR on real trajectories is no better than step-level baselines, or if its training-set labels disagree with human adjudication at a high rate, the claim that simulated anticipation transfers would be refuted.","supporting_citations":[],"review_version":1}