SafeEvolve Framework for Agent Safety
SafeEvolve: Harness-Policy Co-Evolution from Agent Experience for Safety Alignment
Developers can implement SafeEvolve to improve agent safety without sacrificing utility, achieving better safety-utility tradeoffs than existing methods.
SafeEvolve is a self-evolving framework for LLM-based agent safety alignment. It harnesses experience from on-policy trajectories to drive harness-policy co-evolution. The framework converts safety evidence into bounded, component-level updates across safety prompts and hierarchical skills. For Qwen3.5-4B, it achieves a 3× ASR reduction on AgentDojo while improving benign utility from 59.79% to 61.86%.
SafeEvolve: Harness-Policy Co-Evolution from Agent Experience for Safety Alignment
The performance of LLM-based agents is jointly shaped by the base model and the harness used when interacting with the environment. This exposes them to safety risks in both harmful final responses and multi-step execution trajectories. Existing safety alignment mechanisms often rely on either external harness updates or policy optimization, yet applying either paradigm in isolation fails to bridge runtime control with intrinsic safety. We propose SafeEvolve, an experience-driven self-evolving framework for agent safety alignment. SafeEvolve leverages safety experience from completed on-policy trajectories to drive a continual loop of harness-policy co-evolution. On the harness side, SafeEvolve converts trajectory-level safety evidence into bounded, component-level updates across safety prompt and hierarchical skills, yielding auditable and reversible harness artifacts. On the policy side, SafeEvolve follows a two-stage SFT-RL paradigm, where harness-use SFT bootstraps the policy to actively leverage evolved harness artifacts, and harness-augmented RL further shapes autonomous safety behaviors during multi-step exploration via verifier-decomposed rewards. Through harness-policy co-evolution, SafeEvolve converts safety experience into an evolved runtime harness and improved policy behavior. Experiments on agentic safety benchmarks show that SafeEvolve achieves a stronger safety-utility tradeoff than existing baselines. For Qwen3.5-4B, SafeEvolve achieves a $3\times$ ASR reduction on AgentDojo while improving benign utility from 59.79% to 61.86%.
