An AI safety system stopped every unsafe action using two checks together — but can anyone tell which check did the work?
Which of the two authorization components carries the zero percent Unsafe Action Rate?
This explores whether the corpus can say which of the two authorization components (the signed token or the policy check) is responsible for the zero percent Unsafe Action Rate, and the corpus says it can't be isolated from what's available.
This explores whether the corpus can say which of the two authorization components is responsible for the zero percent Unsafe Action Rate. It can't: the evaluation doesn't separate them. The paper compares both authorization checks switched on against both switched off. With both on, unsafe actions hit zero. With both off, a poisoned validator approves every unsafe action. There is no run with only one component enabled, and the component-level ablation the paper promises isn't in the text we have. Which authorization component achieves the zero percent unsafe rate? Can a poisoned validator still approve unsafe actions?
What the corpus does say is what the authorization layer is made of and what it does. The layer combines "task-bound signed tokens" with a "separately verified policy oracle". The excerpt doesn't explain who issues the tokens, what binds them, or how verification works. It also doesn't say whether the attacks were positioned to reach either component. So even the question of which piece "carries" the result assumes more design detail than the source gives. How does the authorization layer stay outside the poisoned path?
The layer's behavior is clearer than its internals. Memory poisoning bypassed the Validator in every trial, both with and without authorization. The layer never repaired the compromised judgment. It only blocked execution downstream of it. That's why the zero is best read as a property of the whole layer sitting outside the poisoned path, not of any one part. Can memory poisoning compromise decision-making even with authorization layers?
Two related notes explain why the missing ablation matters. The pipeline reports a 100% Judgment Bypass Rate alongside the 0% Unsafe Action Rate. Once Unsafe Action Rate reaches zero, it stops telling you whether an attack was contained or never took hold. Can action-level metrics alone expose contained attacks? The same problem shows up in the paper's explicit-boundary result. Its clear rules and its restricted tools are bundled together, so zero protected-test modifications can't be credited to either one. Do authorization rules or restricted tools prevent test modifications? A related note finds that a bare zero can hide very different behaviors underneath, such as silent stopping, escalation, refusal, or failing to terminate. What behaviors hide behind a zero crossing rate?
The honest answer is that the corpus has the zero but not its source. If you want to know whether the token, the policy oracle, or their combination does the work, the missing piece is a run with each component enabled alone.
Sources 7 notes
The reported evaluation compares both authorization checks enabled versus both disabled, showing zero percent unsafe action rate with both on, but the excerpt provides no single-component ablation. The full paper's promised component-level ablation is not included in the available text.
In a four-agent LangGraph system with authorization disabled, a validator that reads poisoned shared memory forges approvals in every trial, leading to execution of unsafe actions. The validator's position as final authority before action execution, combined with its access to corrupted evidence, made it ineffective as a boundary.
The paper reports zero unsafe actions when authorization is enabled, but the excerpt supplies only two phrases—"task-bound signed tokens" and "separately verified policy oracle"—without explaining who issues tokens, what binds them, how verification works, or whether attacks were positioned to reach these components.
Memory poisoning still bypassed the Validator in every trial, but a separate authorization layer using signed tokens and policy verification prevented any unsafe action from executing. The layer blocked execution without fixing the compromised judgment itself.
The Judgment Bypass Rate measures compromise at the attacked agent rather than at the final action. When the Unsafe Action Rate hits zero across defended conditions, it stops discriminating between attacks that were contained and those that never took hold, making the agent-level reading essential for diagnosis.
Show all 7 sources
The abstract bundles clear authorization rules with restricted tools and reports zero protected-test modifications, but no single-factor ablation distinguishes whether the result comes from unavailable crossings, unchosen crossings, or both. The pipeline's own data elsewhere (100% Judgment Bypass Rate with 0% Unsafe Action Rate) shows the distinction matters.
In the explicit-boundary regime, all four policies—silent stopping, escalation, refusal, and failure to terminate—leave the crossing counter at zero, yet place operators in fundamentally different positions. A single metric is too coarse to characterize what an agent actually did when the authorized route closed.
Papers this line draws on 8
The research behind the notes this line reads — ranked by how closely each paper relates.
- The Troy Moment of AI: Why Some Will Cheat and Some Will Follow?
- Trust propagation and structural containment in Multi-agent LLM pipelines
- EvoSafeHarness: Evolving Model- and Domain-Specific Harnesses for Securing Agents
- PACT: Can Enterprise AI Assistants Be Trusted Under Pressure?
- SoK: When Safe Agents Fail Together: The Security of Multi Agent LLM Systems
- Cyber-Capable AI Agents: Vulnerabilities, Evaluation Containment, and Defensive Response
- Securing Agentic AI: From Per-Action Checks to Trajectory Assurance
- Counter-Swarm Doctrine: Containing Coordinated Agent Intrusions