{"id":"8dcacd56-9ddc-4675-a28c-77bd52a0431a","arxiv_id":"2608.12977","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":5,"one_line_summary":"A self-evolving runtime defense for LLM agents, HARD, improves security over static handcrafted defenses by updating context policies and action gates from failure traces.","lead":"This paper proposes HARD, a framework that lets an LLM agent's runtime security defenses rewrite themselves from records of past attacks. The authors report that evolved defenses beat handcrafted ones on four attack types while keeping most benign tasks working.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"HARD's ASR advantage may be an artifact of optimizing and evaluating with the same GLM-5 judge; no independent labels validate the metric.","rationale":"The central claim is that HARD improves security while preserving utility, and that claim is only as strong as the metric used to measure attack success. HARD's evolution loop uses GLM-5's outcome_assessment to select failures, and the final ASR is computed from the same outcome_assessment. This is a structural circularity: the defense is optimized against the very function used to evaluate it, while the handcrafted baselines are not. A systematically biased or gameable judge therefore produces exactly the observed pattern, lower ASR for evolved defenses and no reliable utility signal. The paper reports no independent judge, human audit, or calibration check, so the central empirical claim currently rests on an unvalidated oracle. The contradiction between Section 5.2's four-repeat statistics and Section A.2's single-evaluation-pass statement makes the reported statistical strength impossible to verify as submitted; this reinforces, rather than replaces, the judge-reliability concern. The concrete re-labeling test would settle the matter: if human labels reproduce the advantage, the difficulty is resolved; if not, the central claim should be rejected or heavily discounted. Since the reader already identified GLM-5's labels as the weakest assumption and issued a CONDITIONAL verdict, my read does not move the verdict.","tokens_in":23118,"tokens_out":6168,"duration_ms":67004,"concrete_test":"Recompute Table 1's ASR and UA on the held-out test split using independent human annotation instead of GLM-5's outcome_assessment. Have two security researchers, blind to defense variant, score every held-out AgentCanary trajectory (83 DPI, 78 IPI, 52 MC, 81 SP tasks) with the same rubric, resolve disagreements by adjudication, and rebuild the ASR and UA columns and the paired McNemar comparisons with the human labels. If HARD-Both's advantage over the handcrafted baselines persists under human labels, the shared-judge concern is resolved. If the advantage shrinks or reverses, HARD's reported security improvement is an artifact of optimizing the GLM-5 judge.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Section 5.1 assigns GLM-5 as both the security judge J_safe and the utility-under-attack judge J_util; Section A.4 defines ASR as the fraction of attacked tasks with GLM-5 outcome_assessment <= 0.5. The same J_safe is used in Section 4.1 to select failure traces F_t for evolution (J_safe(tau) < delta_s), and the traces given to the router and evolvers include the judge's failure_feedback and grader_breakdown (Section A.4). Thus HARD is evolved to minimize exactly the function that later reports ASR. The static baselines are not optimized against that function. If GLM-5's outcome_assessment is miscalibrated or gameable, HARD's lower ASR can come from judge-specific behavior, such as phrasing rationales that satisfy the rubric, rather than from genuinely stopping unauthorized actions. No calibration, human agreement, or judge-sensitivity analysis is reported. The paper's evaluation protocol is also internally inconsistent: Section A.2 states that reported results correspond to a single evaluation pass and should not be compared across runs, while Section 5.2 claims four independent repeats, per-cell standard deviation at most 5.7 points, and paired McNemar p < 1e-8. The judge loop is the load-bearing issue: without independent labels, neither the ASR numbers nor the claimed improvement over handcrafted defenses is verifiable.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper introduces a harness-level formulation of runtime defense for LLM agents, decomposing the harness into context-construction and action-interpretation interfaces, and proposes HARD (Harness-based Autonomous Runtime Defense Evolution), a framework that mines failure trajectories, routes them to policy or gate evolvers, and iteratively updates defense artifacts. The authors evaluate HARD against handcrafted baselines on AgentCanary plus AgentHazard tasks, under static and adaptive attacks, reporting lower attack success rates with preserved benign utility. The appendix provides detailed prompts, evolution protocols, and three case studies illustrating how evolved artifacts operate.","tokens_in":23415,"tokens_out":4819,"duration_ms":46990,"significance":"The direction is timely and potentially important: if the reported improvements are real, HARD offers a way to improve security of deployed agents without model retraining, and the harness-centric formulation is a useful organizing principle for runtime defense design. The paper is transparent about prompts and protocol, uses deterministic train/test splits, and includes case studies that help explain the mechanism. However, the central empirical claim currently rests on a closed evaluation loop in which the same judge both mines failures and scores success, with no independent validation; the paper also contains direct numerical inconsistencies between the table and the prose/abstract. The significance is therefore conditional on resolving these issues, which is why I recommend major revision rather than acceptance.","major_comments":[{"comment":"The evaluation loop is closed around a single judge. GLM-5 serves as J_safe for failure identification (Section 4.1, step 2) and as the scorer whose outcome_assessment<=0.5 defines ASR (Section A.4), and the serialized failure traces fed to the router and evolvers include failure_feedback and grader_breakdown (Section A.4). HARD is therefore evolved to minimize exactly the quantity later reported as ASR, whereas the handcrafted baselines are not optimized against this function. If GLM-5's outcome_assessment is miscalibrated or can be satisfied by rubric-conforming text, the reported advantage may reflect judge-specific behavior rather than a genuine reduction in unauthorized actions. Please add independent validation: a human-annotated subset, a second judge, or a sensitivity analysis across several judges, with agreement metrics.","section":"5.1, 4.1, A.4"},{"comment":"The reported HARD-Both static ASR values are internally inconsistent. Table 1 lists DPI 12.1, IPI 1.3, MC 13.9, and SP 7.4, while the abstract and Section 5.2 report 15.4, 1.0, 6.7, and 10.2; Appendix B repeats 6.7 and 10.2 with UA 86.3 and 92.0, whereas Table 1's MC row shows ASR 13.9 and UA 85.9. Since the central claim quantifies the improvement over handcrafted defenses, the paper must identify which set of numbers corresponds to the described protocol and make table, prose, and abstract consistent.","section":"Table 1 vs. Abstract and Section 5.2"},{"comment":"The statistical claims contradict the stated protocol. Section 5.2 says each static-attack cell is a mean over four independent repeats with standard deviation at most 5.7 and paired McNemar p<1e-8, while Section A.2 states that reported results correspond to a single evaluation pass and should not be compared across independently executed runs. These cannot both describe the reported table. Please specify which numbers come from the single pass and which from the repeats, describe the repeat protocol (seeds, handling of API nondeterminism, pooling), or remove the statistical significance claims.","section":"Section 5.2 vs. Section A.2"},{"comment":"The evaluation relies exclusively on AgentCanary, whose author list overlaps with this paper's authors (Reference [26]), and on AgentHazard tasks translated into AgentCanary's format. Given the closed-loop judge issue, the lack of an independently authored benchmark or an external evaluation pipeline makes the headline comparison harder to assess. Even a small externally scored subset, or an independent judge with reported agreement, would substantially strengthen the claim that HARD improves over handcrafted defenses in general, rather than on a benchmark developed within the same group.","section":"5.1, Appendix A.2, Reference [26]"}],"minor_comments":[{"comment":"Figure 1 is not referenced in the experimental sections; consider adding a pointer to the corresponding table rows and, if possible, error bars or a note about the number of runs.","section":"Figure 1"},{"comment":"The terms 'memory contamination' and 'memory poisoning' are used interchangeably; the explanatory sentence is helpful, but the table, prose, and abstract should use one term consistently.","section":"Section 2.2"},{"comment":"The abstract objectives J_safe and J_util are defined operationally only in Section A.4; a brief operational definition at first use in Section 3.1 would improve readability.","section":"Section 3.1 and A.4"},{"comment":"The security threshold delta_s=0.5 and the router confidence threshold 0.55 are free parameters; a sensitivity analysis or at least a rationale for these values would help assess robustness.","section":"Section 5.1"},{"comment":"Table 4 largely duplicates Table 2 with additional backbone rows; consider merging them into one table to avoid confusion.","section":"Table 4"}],"recommendation":"major_revision","confidential_remarks":"The main risk is the judge-loop issue: the same model that mines failures also defines ASR, so the headline improvement over handcrafted defenses is not independently verifiable. The internal inconsistencies in the reported HARD-Both numbers and the conflicting statements about single-pass versus repeated evaluation also need to be fixed before the paper can be evaluated fairly. If the authors add an independent judge or human validation and reconcile the numbers, the paper could become a solid contribution."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"You should know two things before reading this one. First, the core idea is better than the abstract makes it sound: framing runtime defense as evolution over harness components (context construction and action interpretation) is a clean unification of existing defenses, and routing failure traces to the right component before evolving is a sensible mechanism that I haven't seen in the cited self-evolving security work. Second, the headline numbers should not be trusted as reported. The paper's own appendix says results come from a single evaluation pass and \"absolute metric values should not be compared across independently executed runs,\" while Section 5.2 claims four independent repeats, standard deviations, and McNemar p-values. That is an internal contradiction, not a minor typo.\n\nWhat is genuinely new: HARD is not another parameter-level alignment method or a static guardrail. It treats the harness as editable and evolves policy and gate artifacts from observed failures, with a router deciding which artifact to update. The two worked case studies in Appendix B are the most convincing part—they show a single failure producing a reusable gate rule or a semantic policy invariant, and they honestly show when the gate overfits and the policy transfers better. The evaluation covers four attack types, adaptive settings, multiple evolution backbones, and utility under attack; the direction of the results is consistent and plausible.\n\nThe soft spots, in order of severity. First, the judge loop: GLM-5 is both the safety judge that defines ASR and the source of failure feedback that the evolvers optimize against. The static baselines are not optimized against that judge. Without any independent label check or judge-sensitivity analysis, the reported ASR advantage could be partly judge-specific. That is the load-bearing concern, and the paper does not address it. Second, the numbers don't reconcile: the abstract and Section 5.2 give HARD-Both ASRs of 15.4, 1.0, 6.7, 10.2, but Table 1 shows 12.1, 1.3, 13.9, 7.4. That is a large discrepancy for the main result. Third, no artifacts are released, and the primary benchmark is co-authored by members of the same group. None of these are fatal—the framework is still worth engaging—but they all need fixing before the empirical claims are citable as established.\n\nWho this is for: anyone working on LLM-agent runtime defenses or self-evolving systems. The harness formulation and routing idea are worth borrowing even if the evaluation details shake out differently. I would send it to a serious referee, but with a clear request to verify the consistency of the numbers and to demand either independent validation of the judge or a sensitivity analysis. As submitted, I would not cite the specific ASR numbers; I would cite the framing.","headline":"A genuinely useful reframing of runtime defense evolution, with a real evaluation weakness: the attack-success judge is also the evolution signal, and the paper's own appendix contradicts its claimed four-repeat statistics.","tokens_in":23952,"tokens_out":805,"would_cite":true,"duration_ms":9427,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"LLM-agent runtime defenses can be made to evolve from failure traces, outperforming handcrafted ones.","keywords":["LLM agent security","runtime defense","self-evolving defense","harness","prompt injection","memory poisoning","skill poisoning","adaptive attacks"],"falsifier":"Take the identical HARD evolution loop and replace the GLM-5 judge with an independently calibrated judge or human labels on the same AgentCanary test trajectories; if the attack-success gap over handcrafted defenses collapses, or if the evolved policies and gates reduce train-set failures but not held-out failures (the pattern the paper itself observes for HARD-Gate under long-horizon attacks), the central claim of autonomous generalization from failures is not supported. A second check is to evaluate the evolved artifacts on an attack taxonomy disjoint from AgentCanary's four threat classes and confirm that the ASR advantage persists.","tokens_in":22904,"feed_emoji":"🛡️","tokens_out":13162,"duration_ms":117701,"temperature":0.7,"pith_summary":"Handcrafted runtime defenses for LLM agents are static: once deployed they stay fixed while attackers adapt, so they inevitably miss new failure modes. This paper claims that runtime defense can instead be treated as an optimization problem over the agent's harness—the two interfaces that decide what context the model sees (context construction) and what actions it is allowed to take (action interpretation)—and that an LLM-driven loop can improve those interfaces automatically from observed failures. In the proposed system, HARD, failed execution trajectories are routed to whichever defense artifact is responsible and reused to regenerate a semantic security policy and executable gate rules. On the AgentCanary benchmark, HARD reduces attack success rate to 15.4% (direct prompt injection), 1.0% (indirect prompt injection), 6.7% (memory poisoning), and 10.2% (skill poisoning), compared with 13–66% for three handcrafted baselines, while keeping benign utility at 91.9–95.0% and raising utility under attack from 56% to 86% on memory poisoning and from 52% to 92% on skill poisoning. If true, deployed agents could continuously improve their own protection against new and adapting attacks without model retraining or manual security engineering.","feed_headline":"Self-evolving defenses cut LLM-agent attack success to 1%","feed_subtitle":"HARD rewrites context and action rules from failed traces, beating static LLM-agent defenses.","key_machinery":"The load-bearing mechanism is the harness decomposition $H=(\\phi_H,\\psi_H)$, which splits runtime defense into two independently editable intervention interfaces: context construction (what the model is shown, governed by a security policy) and action interpretation (what tool calls are permitted, governed by execution-time gate rules). This decomposition defines a structured evolution space, and HARD's loop then consists of a trace router $R$ that assigns each failure trajectory to the responsible artifact and two LLM-based evolvers, $E_P$ for the policy and $E_G$ for the gate, that regenerate the artifact from batches of eight failure traces while minimizing changes and avoiding benchmark-specific overfitting. The gate evolver only emits machine-matchable predicates over tool names and argument patterns, while the policy evolver only emits general security invariants, and the router deliberately reassigns low-confidence gate predictions to the policy. What this mechanism does is turn failure-driven human debugging into a closed loop that can be repeated across evolution rounds, with the harness objective $\\max_H \\mathbb{E}[J_{\\text{safe}}+\\lambda_u J_{\\text{util}}]$ as the target and the judge's outcome score as the feedback signal that defines which traces count as failures.","core_discovery":"At its core, the paper claims that the static, hand-authored runtime defense is replaceable by an autonomous evolution process that converts execution failures into targeted harness updates. The agent is modeled as a fixed language model $M_\\theta$ wrapped in a harness $H=(\\phi_H,\\psi_H)$, where $\\phi_H$ constructs the model's context and $\\psi_H$ interprets its output into executable actions; runtime defense becomes the optimization $\\max_H \\mathbb{E}[J_{\\text{safe}}(\\tau)+\\lambda_u J_{\\text{util}}(\\tau)]$ over editable harness configurations. HARD operationalizes this by collecting trajectories under attack, flagging failures through a judge (an attack succeeds when the judge's outcome_assessment is at most 0.5), routing each failure to the context-side policy evolver or the action-side gate evolver, and redeploying the refined harness each round. In the reported evaluation HARD-Both, which evolves both artifacts, achieves the lowest attack success rate on every static attack category and the highest utility under attack on memory poisoning and skill poisoning, and it also outperforms the strongest handcrafted baseline under both adaptive attack settings (26.5% versus 30.1% ASR on dynamic attack evolution; 12.1% versus 24.1% on long-horizon progressive attacks for the both variant, 4.8% for the policy-only variant). A case-level analysis shows that a single observed failure can suffice to synthesize an effective repair, provided the failure is routed to the layer that matches its nature: stable execution patterns are fixed by deterministic gate predicates, while semantic failures require policy-level invariants. The paper further finds that the benefits of the two artifacts are not uniformly additive under long-horizon adaptive attacks, where policy evolution transfers better than literal gate rules.","pith_inferences":["Because the feedback loop depends only on a scalar judge score and tool-call traces, the same machinery should work with non-LLM feedback—sandbox monitors, program verifiers, or human-flag telemetry—so HARD's design is a natural fit for production deployment monitoring rather than benchmark grading alone.","The policy/gate dichotomy is likely a special case of a more general principle: any harness function that can be serialized and re-generated from failure traces is a candidate evolution artifact, so future designs could add memory-access rules, confirmation workflows, or tool-schema sanitizers to the same routing loop.","A testable extension the paper does not run is cross-framework transfer: because the gate evolver is explicitly prohibited from keying on benchmark workspace paths, its rules should be studied on a different agent harness or tool set to see whether the evolved predicates transfer beyond the environment they were evolved on.","The security-utility frontier observed across backbones suggests that in deployment, the number of evolution rounds, the routing confidence threshold (0.55 in this paper), and the choice of backbone could be tuned per organization, with the reported HARD-Both numbers as one operating point rather than the optimum."],"forward_implications":["Deployed agents could improve their security over time without model retraining or manual defense engineering, because HARD converts newly observed failures directly into updated policy and gate artifacts.","Context-side policy evolution and action-side gate evolution address complementary failure modes, so jointly evolving both artifacts yields the lowest attack success rates under static attacks in the reported experiments.","Under long-horizon adaptive attacks, semantic policy evolution transfers much better than literal execution predicates, which can memorize observed attacks (HARD-Gate's test-split ASR barely moves from 28.9% to 26.5% while its evolution-split ASR drops to 23.2%).","The evolution procedure is not tied to a single model: all four tested evolution backbones substantially reduce ASR relative to no evolution, though they land at different points on the security–utility frontier.","A single observed failure can be sufficient to synthesize an effective repair when the failure is routed to the layer that matches its nature, as the SUID-enumeration and credential-exfiltration case studies show."],"supporting_citations":[{"why":"Provides the AgentCanary benchmark, the four threat models, the judge and trace format, the held-out test split, and the DAE/LPA adaptive attack protocols that all experiments and the ASR definition rely on.","marker":"[26]"},{"why":"SecureClaw is one of the three handcrafted context-side runtime defense baselines that HARD must beat on ASR, BU, and UA.","marker":"[31]"},{"why":"ClawKeeper is the action-side execution-constraint baseline that HARD-Gate and HARD-Both are compared against.","marker":"[32]"},{"why":"OpenClaw Shield is the combined context- and action-level handcrafted baseline, the strongest static alternative on several attack settings.","marker":"[33]"},{"why":"PinchBench supplies the benign tool-use tasks and the automated Python verifier that measures benign utility (BU).","marker":"[30]"},{"why":"AgentHazard supplies additional harmful computer-use task instances, translated into AgentCanary's format, to broaden the direct prompt injection evaluation.","marker":"[29]"},{"why":"GLM-5 is the security and utility judge whose outcome_assessment score defines attack success and therefore selects which traces enter the failure-driven evolution loop.","marker":"[35]"},{"why":"GLM-5.2 is the default LLM backbone for the trace router and both evolvers in the main experiments, so the headline results are produced with this model as the evolution engine.","marker":"[36]"},{"why":"Membrane is the closest prior self-evolving security artifact (an evolving external safety memory) and is the contrast that motivates HARD's harness-level, runtime-loop design.","marker":"[75]"},{"why":"FATE is the prior failure-trajectory self-evolution method for safety that works at the parameter level, which HARD explicitly differentiates itself from by not requiring training access.","marker":"[16]"}],"fun_headline_variants":["HARD evolves LLM-agent defenses from failed attack traces","Autonomous defense evolution: HARD outdoes handcrafted LLM protection","HARD turns failures into stronger LLM-agent defenses automatically","Self-evolving HARD thwarts adaptive attacks on LLM agents","HARD learns from each failure to auto-patch agent defenses"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The framework's improvement signal is the attack-judge score from a single LLM evaluator on a single benchmark split; if that judge is miscalibrated or the split is unrepresentative of real attacks, the evolved defenses are optimizing the wrong objective and the claimed gains may not transfer.","fun_headline_variants_meta":{"raw":{"variants":["HARD evolves LLM-agent defenses from failed attack traces","Autonomous defense evolution: HARD outdoes handcrafted LLM protection","HARD turns failures into stronger LLM-agent defenses automatically","Self-evolving HARD thwarts adaptive attacks on LLM agents","HARD learns from each failure to auto-patch agent defenses"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.001242,"raw_usage":{"total_tokens":5168,"prompt_tokens":1091,"completion_tokens":4077,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":707,"completion_tokens_details":{"reasoning_tokens":3990}},"tokens_in":707,"tokens_out":4077,"duration_ms":26229,"temperature":1.0,"reasoning_tokens":3990,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T19:17:44.552920+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take the identical HARD evolution loop and replace the GLM-5 judge with an independently calibrated judge or human labels on the same AgentCanary test trajectories; if the attack-success gap over handcrafted defenses collapses, or if the evolved policies and gates reduce train-set failures but not held-out failures (the pattern the paper itself observes for HARD-Gate under long-horizon attacks), the central claim of autonomous generalization from failures is not supported. A second check is to evaluate the evolved artifacts on an attack taxonomy disjoint from AgentCanary's four threat classes and confirm that the ASR advantage persists.","supporting_citations":[{"cited_title":"SecureClaw: An owasp-aligned secu- rity plugin and skill for openclaw agents","cited_arxiv_id":null,"evidence_quote":"SecureClaw is one of the three handcrafted context-side runtime defense baselines that HARD must beat on ASR, BU, and UA."},{"cited_title":"OpenClaw Shield: A defense-in-depth se- curity plugin for openclaw agents","cited_arxiv_id":null,"evidence_quote":"OpenClaw Shield is the combined context- and action-level handcrafted baseline, the strongest static alternative on several attack settings."},{"cited_title":"Pinchbench: Real-world benchmarks for ai agents","cited_arxiv_id":null,"evidence_quote":"PinchBench supplies the benign tool-use tasks and the automated Python verifier that measures benign utility (BU)."},{"cited_title":"GLM-5 technical report","cited_arxiv_id":null,"evidence_quote":"GLM-5 is the security and utility judge whose outcome_assessment score defines attack success and therefore selects which traces enter the failure-driven evolution loop."},{"cited_title":"GLM-5.2 technical report","cited_arxiv_id":null,"evidence_quote":"GLM-5.2 is the default LLM backbone for the trace router and both evolvers in the main experiments, so the headline results are produced with this model as the evolution engine."}],"review_version":1}