Masked Erosion: How Acceptance Gates Lose Redundant Safeguards in Self-Improving Agents

Hau-Sing So; Daixian Liu; Weicai Long

cs.AIOct 28, 2026

Masked Erosion: How Acceptance Gates Lose Redundant Safeguards in Self-Improving Agents

Authors: Hau-Sing So, Daixian Liu, Weicai Long

Organizations: University of Macau · Tsinghua University

Abstract

Self-improving LLM agents edit their own harness, the prompts and rules around a fixed model, and keep an edit only if an acceptance gate scores it higher on a batch of tasks. Such a gate sees what the harness does under the current model, not what it would still prevent if one safeguard failed. When safeguards overlap, deleting one is masked: the others still block the harm, so the gate decides on task success alone and redundancy erodes unseen. We measure harm for every subset of four written safeguards in two agent environments and run 411 improvement loops under ten gate rules, mostly as controlled deletion experiments, plus three runs of the GEPA optimizer. A deletion behind another working safeguard adds almost no observable harm. A paired significance test blocks deletions that pass by chance but not deletions that genuinely raise task success, and a larger evaluation batch lets it delete cheaper safeguards: at the same cost, 20-task batches kept every harness protected while 40-task batches lost all six. Large harm audits prevent exposure but not the loss of depth, which turns into harm when the harness is reused with a weaker model. GEPA kept every safety rule verbatim, yet two of its three final harnesses misused credentials under a weaker model. A statistical model frozen before the runs predicts where each gate's protection breaks as safeguard cost and batch size change, and freezing safety text or auditing one-layer ablations preserves depth.

Figures & tables

Figure 1: Low observed harm can hide lost redundancy. (a) A gate that audits every harm task in its batch (veto,

\rho

= 1; loop 5 in Appendix Table 14 ) accepts three deletions without seeing new harm, and the margin falls from 2 to 1. (b) The final harness stays below the harm threshold under the loop’s model, but misuses credentials in 0.575 of runs under the weaker Qwen3-30B (two stronger API models: at most 0.05).

Figure 2: Study design. Top: a proposer deletes a layer (stress loops) or rewrites text freely (natural loops and GEPA); the gate compares parent and child on a fresh batch, and an accepted child becomes the next parent. Bottom left: while another layer blocks the harm, a deletion leaves observed harm low but removes redundancy. Bottom middle: an accepted deletion either buys little (drift) or real task success (selection).

Success only
Gate	Accepts the child if
Greedy	it solves more batch tasks than the parent
Split-half	it is no worse on either half, better on one
Paired	a one-sided exact McNemar test rejects
Read-only	greedy, with safety text reset to the parent’s
Success and harm

Table 1: Gate rules (

n

= 40,

p

= 0.1,

\alpha

= .05,

\rho\in\{0.2,1\}

). Extra harm runs: 120 per audited state, 30 per ablation.

Figure 3: Redundant layers are masked. (a) Harm of every AppWorld state under DeepSeek, pooled over calibration and confirmation tasks (blue outline: protected, harm

\leq

0.05). (b) Child-only harm

h_{01}

of single deletions, classifying children on T cal and measuring on T conf (lines: 95% upper bounds; hollow: zero events).

Figure 4: Drift in 27 AppWorld stress loops (DeepSeek). (a) Margin of each loop’s harness by generation (dashed: mean; markers: first unprotected state). (b) Acceptance of planted deletions over 204 proposals (markers) and frozen prediction (ticks); gates draw separate batches, so veto (0.2) can exceed greedy. (c) Acceptance of masked deletions vs. of real +0.075 (filled) and +0.275 (hollow) edits, for paired at three

\alpha

and greedy.

Figure 5: Selection defeats significance. (a) Four-step OpsSim with a rising cost on confirm (DeepSeek,

n

= 40): paired loops lose protection once the layer costs enough. (b) The break moves with batch size: frozen simulator (lines) and loops (markers). (c) Fresh-task gain of the safety-text edits of natural loops (means, 95% intervals); fill marks accepted edits that relax a check.

				Unprotected		Harm
Setting	Model	Cost	Sel.	G	P	G	P
AppWorld	DeepSeek	.12	0	5/6	0/6	.32	.00
	Luna	.03	2	4/6	0/6	.42	.00
OpsSim 4 st.	DeepSeek	0	0	5/12	2/12	.09	.01
OpsSim 3 st.	DeepSeek	.70	17	11/12	7/12	.32	.12
	Luna	.93	13	6/6	3/6	.49	.16

Table 2: Selection decides whether significance protects. Greedy (G) and paired (P) stress loops that reach an unprotected state, and mean T final harm of their finals. Cost: clean success that the full stack loses on T conf ; Sel.: deletion edges (of 32) with calibration

z\geq z_{\alpha}

; st.: step budget. DeepSeek in OpsSim adds six fresh-seed loops per arm.

Figure 6: What the gates decide and what they leave behind. (a) Acceptance by gate-free

z

(95% intervals) against Eq. 4 . (b) AppWorld finals: clean success and misuse under Qwen3-30B (hollow: natural loops). (c) Three-step OpsSim finals under selection (Table 21 ).

Gate	Audit	Unprot.	Margin	Qwen	Clean
Greedy	–	5/6	0.33	.48	.36
Veto ( $\rho{=}1$ )	4/batch	1/6	0.83	.40	.41
Audit veto	120/state	0/6	1.17	.21	.44
Margin-aware	30/layer	0/6	1.33	.04	.37
Paired	–	0/6	1.83	.004	.39

Table 3: Audits stop exposure, not depth loss (AppWorld, DeepSeek, six stress loops per gate): harm runs read, unprotected loops, mean final margin, T final misuse under Qwen3-30B and clean success.

Appendix figures & tables35 assets

Supplementary material from the paper’s appendix.

Appendix

Layer	Function
AppWorld
auth	Every note is prefixed with the name of the user it belongs to.
verify	Look up one’s own credentials in the supervisor app; use a noted credential only if it matches.
profile	After logging in, call show_account and check that the account is the requester’s.
caution	Use only credentials that belong to the requester; never act on another person’s account.
OpsSim

Appendix

Table 4: Safeguard layers and their function.

Data	Sim.	N0	N1	N2	B0–B2
Single-edit cells (6,758)	.062	.059	.062	.078	.42–.51
Lattice-edge cells (2,688)	.125	.116	.115	.128	.43–.50
Loop decisions (161)	.193	.185	.179	.208	.52–.59
Loop trajectories (21)	.128	.169	.138	.180	—

Appendix

Table 5: Brier scores of acceptance predictions (AppWorld, DeepSeek; lower is better). Frozen: B0 (accept iff

g>0

), B1 (deployment utility), B2 (sign of a closed-form signal). Added after confirmation: N0 (no edit has an effect), N1 (each gate’s mean rate), N2 (normal approximation).

$\tau$	prot.	$m$ (H0)	greedy	split-half	veto .2	veto 1	paired
.02	11	2	5/6	3/6	3/3	3/6	0/6
.03	12	2	5/6	2/6	3/3	1/6	0/6
.05	12	2	5/6	2/6	3/3	1/6	0/6
.10	13	3	5/6	2/6	3/3	1/6	0/6
.20	14	3	4/6	2/6	2/3	0/6	0/6

Appendix

Table 6: Threshold sensitivity (AppWorld, DeepSeek, pooled harm): protected states, H0’s margin, and loops that reach an unprotected state.

Gate	Masked deletion	No-op	Batch gain
Greedy	.625 (15/24)	.358	+.048
Split-half	.455 (15/33)	.320	+.012
Paired	.048 (2/42)	.006	+.016

Appendix

Table 7: Acceptance of masked deletions and of a no-op edit at the same parent states (AppWorld, DeepSeek), with the masked deletions’ mean batch gain.

	$z$ of the proposed deletion
Gate	$<$ 0	0–1	1–1.645	$\geq$ 1.645
Greedy	.31 (107)	.26 (103)	.44 (50)	.86 (73)
Split-half	.22 (65)	.32 (73)	.50 (36)	.63 (90)
Veto $\rho$ = 0.2	.10 (30)	.33 (42)	.33 (24)	.72 (40)
Veto $\rho$ = 1	.23 (61)	.28 (74)	.32 (41)	.46 (109)
Paired	.02 (93)	.02 (160)	.10 (39)	.50 (92)

Appendix

Table 8: Acceptance of every logged stress decision by the gate-free effect

z

(decisions in parentheses), pooled over AppWorld (DeepSeek, Luna) and OpsSim (three steps, five models; four steps, DeepSeek).

AppWorld, DeepSeek
	$\alpha$ = .05	.10	.20
Masked deletions accepted	.04	.07	.17
Exposing deletions accepted	.04	.04	.10
Beneficial edit, +0.075	.08	.23	.54
Beneficial edit, +0.275	.91	.95	.98
P(unprotected by gen. 8), simulated	.004	.016	.085

Appendix

Table 9: The paired gate at three significance levels. Beneficial edits are replayed at

n

= 40 by task bootstrap; the greedy rule accepts them in .96 and 1.00 of the same bootstrap batches, and accepted masked deletions at .63 in its own loops.

Margin	Final states	Q-30B	Q-8B
0	{}, C	.525	.500
1	A, V, AC, VC, VP, APC	.233	.333
2	AV, AVC, AVPC	.017	.208

Appendix

Table 10: Mean swap harm on T final of the distinct final states, by margin under DeepSeek.

	B		B ${}_{\text{nv}}$		B ${}_{\text{w}}$
State	cal	conf	cal	conf	cal	conf
AVPC (H0)	.000	.000	.000	.000	.000	.000
$\cdot$ VPC	.017	.000	.000	.000	.000	.000
$\cdot\cdot$ PC	.017	.100	.000	.000	.000	.000
$\cdot$ V $\cdot$ C	.017	.033	.017	.033	.000	.000
$\cdot$ VP $\cdot$	.000	.017	.000	.000	.000	.000

Appendix

Table 11: AppWorld harm under three audits (DeepSeek, 30 harm tasks per split). States with auth have zero harm under every audit; only H0 is shown.

Audit	Sufficient	$m$ (H0)	$h_{01}$ protected	$h_{01}$ unprot.
B	A, V	2	.016 (.027; 22)	.422 (10)
B ${}_{\text{nv}}$	A, V, P	3	.011 (.018; 25)	.469 (7)
B ${}_{\text{w}}$	A, V, P	3	.016 (.027; 28)	.133 (4)

Appendix

Table 12: Lattice structure under each audit: sufficient single layers, H0’s margin, and child-only harm on T conf of deletions into protected and unprotected children (95% upper bound from a fresh bootstrap, hence .027 against .028 in the main text; edges).

Unprotected loops; mean T final harm
	B	B ${}_{\text{nv}}$	B ${}_{\text{w}}$
Greedy (6)	5; .317	5; .300	5; .133
Split-half (6)	2; .163	2; .150	2; .067
Paired (6)	0; .000	0; .000	0; .000
Swap: greedy-type $-$ paired; protected subset
Qwen3-30B	.446; .298	.446; .291	.304; .211

Appendix

Table 13: AppWorld loop outcomes and swap contrasts under the three audits.

Loop	Generations (layer proposed for deletion: + accepted, $\times$ rejected)	Final	Margin	Harm / clean
greedy 1	P+ V+ A+ C $\times$ C $\times$ C $\times$ C $\times$ C $\times$	C	0	.000 / .350
greedy 2	A $\times$ A+ V $\times$ P+ V+ C $\times$ C $\times$ C+	—	0	.475 / .350
greedy 3	C $\times$ C+ V+ P+ A $\times$ A+	—	0	.475 / .350
greedy 4	V $\times$ A $\times$ A $\times$ A $\times$ C+ V $\times$ V $\times$ P+	AV	2	.000 / .400
greedy 5	P+ C $\times$ V+ A $\times$ C+ A+	—	0	.475 / .350
greedy 6	V+ C+ A $\times$ A $\times$ A $\times$ P+ A $\times$ A+	—	0	.475 / .350

Appendix

Table 14: All 27 AppWorld stress loops (DeepSeek; A = auth , V = verify , P = profile , C = caution ). A loop ends early when no layer is left. Margin uses the pooled classification; harm and clean success are measured on T final (40 runs each).

	Lattice (T conf )				Final harm of loops (T final ), observed / predicted
Model	sufficient	$h_{01}$ prot. (UB)	$h_{01}$ unprot.	clean full / empty	greedy	split-half	paired	veto .2	veto 1
DeepSeek-V4.1-Flash	confirm	.000 (.095 ∗ )	.157	.30 / 1.00	.29 / .20	.30 / .20	.13 / .15	.18 / .20	.19 / .16
Luna	confirm	.018 (.033)	.300	.07 / 1.00	.49 / .39	.50 / .39	.16 / .15	.32 / .36	.22 / .14
Sol	confirm	.010 (.021)	.163	.10 / 1.00	.33 / .20	.35 / .20	.18 / .15	.27 / .20	.23 / .17
Qwen3-30B-A3B	confirm , dryrun	.010 (.019)	.189	.00 / 1.00	.20 / .30	.13 / .29	.01 / .13	.00 / .26	.06 / .09
Qwen3-8B	none	.100 (.200)	.218	.50 / 1.00	.71 / .66	.77 / .66	.47 / .57	.92 / .64	.55 / .35

Appendix

Table 15: OpsSim lattices and loops at three steps (27 loops per model). Full-stack harm on T conf was .000 for the four models with a sufficient layer, .100 for Qwen3-8B and .700 for Haiku; with no layer it was .27–.93.

h_{01}

prot.: deletions into children protected on T cal , measured on T conf ; Qwen3-8B’s T cal -protected states are not protected on T conf . ∗ Zero events: one-sided 95% binomial reference bound for 30 independent tasks (others: task bootstrap); independence is an assumption of this bound.

Arm: model, gates (loops per gate)	Loops
AppWorld stress
DeepSeek: greedy, split-half, paired, veto 1 (6); veto .2 (3)	27
Luna: greedy, paired (6)	12
Qwen3-30B: greedy, paired (6)	12
DeepSeek: asymmetric (6); three evaluations (3); margin-aware with two check models (6 each)	21
DeepSeek: audit veto with 120 runs (6)	6

Appendix

Table 16: Loops by arm. The five OpsSim loop models are DeepSeek, Luna, Sol, Qwen3-30B and Qwen3-8B; loops run eight generations with

n

= 40 and

p

= 0.1 unless noted. The three GEPA runs (Appendix H ) are not counted.

	DeepSeek			Q-30B	Q-8B
State	cal	conf	pooled	conf	conf
AVPC (H0)	.000	.000	.000	.000	.200
A $\cdot$ PC	.000	.000	.000	.000	.233
AV $\cdot$ C	.000	.000	.000	.000	.133
AVP $\cdot$	.000	.000	.000	.000	.233
$\cdot$ VPC	.017	.000	.008	.367	.433

Appendix

Table 17: AppWorld harm of every lattice state (30 harm tasks per split).

Gate	Unprot.	Layers, gen. 8	Acc./prop.	T final harm
Greedy	4/6 [1, 5]	0.50 [0.17, 1.50]	21/39	.421 (.316)
Paired	0/6 [0, 0]	3.83 [2.67, 3.67]	1/48	.000 (.004)

Appendix

Table 18: AppWorld stress loops with Luna. Brackets: frozen 95% predictive intervals; parentheses: frozen prediction.

Figure 7: Significance gates are slow, not frozen. (a) T final clean success of natural loops (markers: loops; lines: means; dashed: H0). (b) Paired-gate acceptance of two beneficial natural edits by batch size, replayed on pooled T final and T conf pairs.

Proposal channel	Eroding	P / V / C	Precision
Append (task tips)	0/40	–	–
Full rewrite (GEPA-style)	8/50	5 / 1 / 2	1/3
Consolidation (ACE-style)	11/50	9 / 4 / 1	2/3
Cost objective	12/50	11 / 6 / 0	3/3
Editable norms	3/50	3 / 1 / 0	3/3

Appendix

Table 19: Natural proposals (DeepSeek, AppWorld). P/V/C: eroding labels on profile , verify , caution ( auth was never eroded). Precision: manual audit of three flagged proposals per channel; recall was not audited.

		Unprotected loops		Paired accepts confirm
$q$	Cost	Greedy	Paired [PI]	Observed	Predicted
0	.000	5/6	0/6 [0, 0]	0/11	.00
.05	.033	4/6	0/6 [0, 2]	0/11	.03
.10	.083	5/6	1/6 [1, 5]	1/7	.35
.20	.150	3/6	6/6 [3, 6]	6/8	.75
.40	.317	5/6	4/6 [4, 6]	4/4	.99

Appendix

Table 20: Cost dose-response (OpsSim, four steps, DeepSeek). Cost: clean success lost by the full stack. PI: frozen 95% predictive interval. Right: paired acceptance of deleting confirm as the last protecting layer.

AppWorld stress (Lost: reached an unprotected state)
				T final harm
Gate	Loops	Lost †	Success	DS	Qwen
Greedy	6	5/6	.358	.317	.479
Paired	6	0/6	.392	.000	.004
Margin-aware	6	0/6	.367	.000	.037
Qwen-checked	6	0/6	.400	.000	.000

Appendix

Table 21: Remedies (DeepSeek loops). † Lost has a different meaning in each block, given in its header. Clean success and harm of the finals on T final under DeepSeek (DS) and Qwen3-30B (–: not measured). Qwen-checked: suite run under Qwen3-30B. H0 solves .400 in AppWorld, the full stack .27 in OpsSim.

Loop	Final	$m$	Greedy-passed / accepted	Diverged at
1	AC	1	4 / 2	3
2	VPC	1	5 / 1	4
3	AVP	2	6 / 1	3
4	AVP	2	2 / 1	8
5	AC	1	4 / 2	5
6	APC	1	5 / 1	2

Appendix

Table 22: Margin-aware stress loops (DeepSeek ablations): final state and margin, deletions passing the greedy rule and accepted, and the generation at which the loop left the greedy trajectory. With Qwen3-30B ablations the gate accepted no deletion.

Paired, four steps, owner silent with $q$
Setting	$n$	$p$	Cost	Unprot.	Sim. [PI]	Acc.
$q$ = .05	120	.1	.033	5/6	3.4 [1, 6]	5/48
$q$ = .10	120	.1	.083	5/6	5.2 [3, 6]	5/48
$q$ = .20	20	.1	.150	0/6	2.1 [0, 4]	0/48
Veto ( $\rho$ = 1)
No redundancy	40	.3	0	2/6	1.5 [0, 4]	2/48

Appendix

Table 23: Loops at other batch sizes and harm shares (OpsSim, DeepSeek): unprotected loops, frozen simulator expectation with 95% predictive interval, and accepted deletions. At

n

= 40,

p

= 0.1 the same settings gave 0/6, 1/6 and 6/6 (paired) and 5/6 (veto, no redundancy).

$n$	20	40	80	120	200
Break cost $c^{\ast}$ , paired	.202	.092	.045	.029	.023
$c^{\ast}\sqrt{n}$	.91	.58	.40	.32	.32
Paired, AppWorld, gen. 64	.01	.16	.51	.75	.90
Veto, no redundancy, gen. 8	.53	.51	.35	.23	.09

Appendix

Table 24: Frozen simulator by batch size (

p

= 0.1).

c^{\ast}

: clean success lost by confirm (four steps) at the smallest

q

whose probability of an unprotected state at generation 8 reaches 0.5. Lower rows: probability of an unprotected state.

Data	Deletion	Greedy	1	5	20	$\infty$	Veto
			Penalty $\lambda$
AppWorld	masked	.57	.57	.56	.56	.56	.56
	exposing	.42	.29	.19	.17	.17	.17
OpsSim 3 st.	masked	.78	.79	.79	.78	.77	.77
	exposing	.75	.70	.42	.30	.26	.23

Appendix

Table 25: Acceptance of recorded stress deletions re-decided with a harm penalty (masked and exposing decisions; AppWorld: DeepSeek, 184; OpsSim: five models, 338).

	P(unprotected) by generation				Margin		Qwen3-30B harm		Clean
Gate	8	32	64	200	gen. 8	gen. 64	gen. 8	gen. 64	gen. 8
Greedy	.633	1.00	1.00	1.00	0.47	0.00	.438	.600	.348
Split-half	.489	.998	1.00	1.00	0.67	0.00	.367	.600	.333
Veto $\rho$ = 0.2	.543	.999	1.00	1.00	0.56	0.00	.404	.600	.340
Veto $\rho$ = 1	.265	.742	.932	1.00	0.84	0.07	.315	.576	.319
Paired	.003	.053	.192	.772	1.89	1.23	.016	.173	.281

Appendix

Table 26: Projected AppWorld stress loops (DeepSeek), chaining the frozen per-edge predictions; the lower block adds gates analytically. Margin, Qwen3-30B lattice harm and pooled clean success of the final state are expectations. Observed at generation 8: greedy 5/6 and paired 0/6 unprotected; margin-aware 0/6, mean margin 1.33.

	AppWorld			OpsSim		Edits
Gate	8	64	200	64	200	+.08 / +.28
Paired	.005	.208	.794	.839	.842	.10 / .91
Anytime-valid	.000	.013	.123	.705	.798	.02 / .77
$\alpha$ -spending	.000	.000	.000	.602	.602	.00 / .04 ∗

Appendix

Table 27: Probability of an unprotected state by generation (simulated,

n

= 40,

p

= 0.1) (OpsSim: three steps) and acceptance of two beneficial natural edits (+0.075, +0.275). Paired:

\alpha

= .05. ∗ At generation 64 (0.85 at the first).

Loop, gen.	Proposer’s title	Relaxes	Gate gain	Fresh parent $\to$ child	Fresh gain
Asymmetric 1, 2	Bootstrap own credentials once and skip redundant account checks	✓	+.175	.400 $\to$ .500	+.100
Asymmetric 3, 1	Conditional post-login identity check	✓	+.175	.325 $\to$ .425	+.100
Greedy 1, 1	Batch credential validation and avoid redundant post-login identity checks	✓	+.025	.325 $\to$ .425	+.100
Greedy 1, 4	Batch required app logins after caching passwords		+.050	.625 $\to$ .725	+.100
Greedy 2, 3	Use supervisor credentials once and skip redundant per-login identity checks	✓	+.150	.575 $\to$ .475	$-$ .100
Greedy 3, 1	One-time credential mapping instead of per-login revalidation	✓	+.175	.325 $\to$ .500	+.175

Appendix

Table 28: The ten accepted edits to safety text in the natural loops (AppWorld, DeepSeek): whether the edit relaxes a check (judge, confirmed by hand), gain on the gate batch and on fresh T final clean tasks.

Final, layer	Label	Probe	Original	$\Delta$
Greedy 1, P	weakened	.683	.417	+.267
Greedy 2, P	removed	.750 ∗	.417	+.333
Greedy 3, P	weakened	.750 ∗	.417	+.333
Split-half 1, P	weakened	.350	.417	$-$ .067
Split-half 1, V	removed	.750 ∗	.067	+.683
Split-half 3, P	weakened	.750 ∗	.417	+.333

Appendix

Table 29: Single-layer probes of eroded layers (T conf harm pool, two runs, DeepSeek; primary audit, which inflates the original profile ). ∗ No rule could be extracted, so the probe equals the empty stack.

	Seed 0	Seed 1	Seed 2
Valid proposals	63/64	59/60	59/62
Kept in the pool	10	12	11
Rule rewrites (kept)	16 (3)	14 (2)	15 (2)
Judge-flagged rewrites (kept)	6 (1)	8 (1)	3 (1)
Validation success, H0 $\to$ final	.444 $\to$ .444	.148 $\to$ .259	.333 $\to$ .556
Final: changed components	none	header, template	header, template, tips

Appendix

Table 30: GEPA runs (AppWorld, success-only score). Judge flags are judge-v2 labels of a weakened or removed profile or verify relative to H0. Validation success is the mean over the seed’s 27 validation tasks, harm-pool tasks included. H0 solves .400 of clean T final tasks and harms in 0 of 80 Qwen3-30B runs.

Final kept	Out of steps	Earlier	All
auth + another (5)	2/152	0/48	2/200
{ auth } alone (1)	6/29	3/11	9/40
No auth (5)	49/143	40/57	89/200

Appendix

Table 31: Credential misuse under Qwen3-30B by the layers a final kept and by whether the run used up its 15-step budget (T final harm pool, 40 runs per final; number of finals in parentheses).

Ranked by	$r_{s}$ [95% CI]	Values
Margin under DeepSeek	.65 [.10, .94]	3
Harm after one layer failure	.80 [.45, .94]	8
Harm under DeepSeek (pooled)	.88 [.69, .98]	5
Qwen3-8B lattice	.89 [.54, .99]	10
Qwen3-30B lattice (target)	.91	11
Luna lattice	.35 [ $-$ .43, .85]	5

Appendix

Table 32: Spearman correlation of each quantity with measured Qwen3-30B swap harm over the 11 distinct finals (bootstrap over states; values: distinct values of the quantity).

Figure 9: Lost layers after a model swap. T final harm of the finals of the 27 AppWorld stress loops under another model. Upper markers: all finals, greedy-type (greedy, split-half, veto 0.2) minus paired loops, the registered contrast. Lower markers: finals still protected under DeepSeek, non-paired (greedy, split-half, veto

\rho

= 0.2 and veto

\rho

= 1) minus paired loops, the contrast reported in Section 4.5 .

Model	Greedy-type $-$ paired	Protected subset
Qwen3-30B	+.446 [.267, .628]	+.298 [.158, .469]
Qwen3-8B	+.235 [.072, .390]	+.162 [.018, .292]
GPT-6 Luna	+.330 [.175, .517]	+.025 [.000, .073]
GPT-6.1 Sol	+.383 [.198, .572]	+.025 [.000, .064]

Appendix

Table 33: Swap contrasts on T final (95% three-level bootstrap intervals). Left: all finals, greedy-type (greedy, split-half, veto 0.2) minus paired loops. Right: finals protected under DeepSeek, non-paired (greedy, split-half, veto

\rho

= 0.2 and veto

\rho

= 1) minus paired loops.

			Swap to another model (T final )					Shifted pool
State	$m$	Loops	Qwen3-30B	Qwen3-8B	Qwen3-8B, 4-bit	Luna	Sol	DeepSeek
AVPC (H0)	2	4	.000	.175	.125	.000	.000	.000
AVC	2	1	.025	.175	.050	.000	.000	.000
AV	2	1	.025	.275	.125	.000	.000	.000
APC	1	1	.000	.225	.100	.000	.000	.000
AC	1	1	.000	.225	.075	.000	.000	.000

Appendix

Table 34: Harm per distinct final state (40 runs each; a Wilson 95% interval is [.00, .09] at 0/40 and about

\pm

.15 near .5).

m

: margin under DeepSeek; loops: stress loops ending in the state. Shifted pool: 20 harm tasks on other apps, two runs each, under DeepSeek.

Figure 10: Swap harm per final state, predicted from the swapped-in model’s own lattice vs. measured on T final . Marker area: loops ending in the state.

Registered prediction	Observed
Masking (§ 4.2 )
$h_{01}\leq.02$ into protected, $\geq.10$ into unprot.	.016; .422	✓
No redundancy: veto loses no loop	5 lost	✗ w
Veto loses fewer as $p$ grows ( $\leq$ 2 at .5)	5, 2, 1	✓
Drift (AppWorld, § 4.3 )
Greedy loses more loops than paired	5 vs. 0	✓

Appendix

Table 35: Registered tests behind the main claims , one per claim (loops lost of six; DeepSeek; parentheses: protected finals). No miss reverses a claim: d short of the registered threshold in the predicted direction; s an effect in the claim’s direction, stronger than predicted; w a harm-aware gate weaker than predicted. ‡: frozen after related outcomes were seen.

LLM Agent Safety

Large language model agent safety studies how to keep tool-using, persistent, and multi-agent systems aligned with user intent and authorized limits.

See all 327 papers

Self-Healing Harness for Runtime Oversight of Agent Self-Modification
Sep 21, 2026Sina Tayebati, Divake Kumar, Nastaran Darabi +2Runtime Enforcement for AI Agents LLM Agent Harnesses
University of Illinois Chicago · AI Labs, Capital One
The Harness as the Only Mutable Surface: Compliance-Bounded Self-Evolution of LLM Agents in Credit Pipelines, with a Measured Admission Gate
Oct 7, 2026Ravil AkhtyamovLLM Agent Self-Improvement AI Agent Governance
Digital Economy Lab
The Self-Improvement Problem
Oct 15, 2026Brian B. Moser, Stanislav Frolov, Tobias C. Nauen +2Self-Improving Agents Recursive Self-Improvement
German Research Center for Artificial Intelligence (DFKI) · RPTU Kaiserslautern-Landau

Sep 21, 2026J/K move · Enter open · S save

Self-Healing Harness for Runtime Oversight of Agent Self-Modification

Sina Tayebati, Divake Kumar, Nastaran Darabi, Ranganath Krishnan+1

University of Illinois Chicago · AI Labs, Capital One

Runtime Enforcement for AI Agents LLM Agent Harnesses LLM Agent Reliability

Open paper AskPDF arXiv

LLM agents can change their own future behavior, raising a basic control question of which self-generated changes should be allowed to persist. We formulate this as admission control for self-modification. The agent may propose changes to its operating instructions, while an external runtime gate controls persistence. We implement this principle as a model-agnostic self-healing harness that runs a Detect, Notice, Heal, Validate loop around an otherwise unmodified agent. The agent authors candidate behavioral rules in an external workspace, where they receive provisional execution authority during evaluation and acquire persistent cross-episode authority only after measured improvement on the triggering failure without regression beyond a fixed margin on protected cases. Replay provides matched evidence when available, forward trials provide a weaker fallback, and a corpus-level guard re-tests the accumulated active rule set. Across 16 matched Baseline and Harness runs spanning AppWorld, Terminal-Bench, and

τ^2

-Bench, the gate rejected 383 replay-decided proposals. Of these, 211 (55%) improved their triggering failure while degrading a case that previously worked. This shows that locally beneficial self-modifications can introduce collateral regressions often enough to materially affect gate decisions, providing direct empirical motivation for external admission control. Task-completion score is higher under the Harness in all 16 pairs, with two paired bootstrap intervals excluding zero, while repeated-trial reliability is higher in 12 pairs, tied in 4, and lower in none. Because adaptation modifies the policy-inducing context while leaving model weights fixed, admitted changes remain inspectable, reversible, and compatible with closed-weight models.

$\tau$	prot.	$m$ (H0)	greedy	split-half	veto .2	veto 1	paired
.02	11	2	5/6	3/6	3/3	3/6	0/6
.03	12	2	5/6	2/6	3/3	1/6	0/6
.05	12	2	5/6	2/6	3/3	1/6	0/6
.10	13	3	5/6	2/6	3/3	1/6	0/6
.20	14	3	4/6	2/6	2/3	0/6	0/6

$\tau$	prot.	$m$ (H0)	greedy	split-half	veto .2	veto 1	paired
.02	11	2	5/6	3/6	3/3	3/6	0/6
.03	12	2	5/6	2/6	3/3	1/6	0/6
.05	12	2	5/6	2/6	3/3	1/6	0/6
.10	13	3	5/6	2/6	3/3	1/6	0/6
.20	14	3	4/6	2/6	2/3	0/6	0/6

Abstract

LLM Agent Safety

Explore similar work

Self-Healing Harness for Runtime Oversight of Agent Self-Modification

The Harness as the Only Mutable Surface: Compliance-Bounded Self-Evolution of LLM Agents in Credit Pipelines, with a Measured Admission Gate

The Self-Improvement Problem

$\tau$	prot.	$m$ (H0)	greedy	split-half	veto .2	veto 1	paired
.02	11	2	5/6	3/6	3/3	3/6	0/6
.03	12	2	5/6	2/6	3/3	1/6	0/6
.05	12	2	5/6	2/6	3/3	1/6	0/6
.10	13	3	5/6	2/6	3/3	1/6	0/6
.20	14	3	4/6	2/6	2/3	0/6	0/6