SafeEvolve: Harness-Policy Co-Evolution from Agent Experience for Safety Alignment
Qinghua Mao, Dongrui Liu and colleagues (Shanghai AI Laboratory, SJTU, Fudan, HKUST) present SafeEvolve, which treats agent safety as a joint property of the model and the harness and co-evolves both from completed on-policy trajectories.
Ask this paper
Harness and policy are one system: The framing is that agent behavior is shaped by the base model and by the harness it runs inside, so aligning only one of them leaves the other as the attack surface.
Auditable, reversible harness updates: Trajectory-level safety evidence is converted into bounded component-level edits to the safety prompt and hierarchical skills, producing harness artifacts you can inspect and roll back. That reversibility is the part most self-evolving systems skip.
Two-stage policy side: Harness-use SFT teaches the policy to actually invoke the evolved artifacts, then harness-augmented RL with verifier-decomposed rewards shapes autonomous safety behavior across multi-step exploration.
Safety and utility both move: On Qwen3.5-4B, a 3x attack success rate reduction on AgentDojo while benign utility rises from 59.79 to 61.86 percent.
Why it matters: Most safety work assumes the scaffold is fixed. This says the scaffold is a learnable, versioned artifact, which matches how production agents are actually maintained.
Abstract
The performance of LLM-based agents is jointly shaped by the base model and the harness used when interacting with the environment. This exposes them to safety risks in both harmful final responses and multi-step execution trajectories. Existing safety alignment mechanisms often rely on either external harness updates or policy optimization, yet applying either paradigm in isolation fails to bridge runtime control with intrinsic safety. We propose SafeEvolve, an experience-driven self-evolving framework for agent safety alignment. SafeEvolve leverages safety experience from completed on-policy trajectories to drive a continual loop of harness-policy co-evolution. On the harness side, SafeEvolve converts trajectory-level safety evidence into bounded, component-level updates across safety prompt and hierarchical skills, yielding auditable and reversible harness artifacts. On the policy side, SafeEvolve follows a two-stage SFT-RL paradigm, where harness-use SFT bootstraps the policy to actively leverage evolved harness artifacts, and harness-augmented RL further shapes autonomous safety behaviors during multi-step exploration via verifier-decomposed rewards. Through harness-policy co-evolution, SafeEvolve converts safety experience into an evolved runtime harness and improved policy behavior. Experiments on agentic safety benchmarks show that SafeEvolve achieves a stronger safety-utility tradeoff than existing baselines. For Qwen3.5-4B, SafeEvolve achieves a $3\times$ ASR reduction on AgentDojo while improving benign utility from 59.79% to 61.86%.