What state does a safety claim retain? Four recent papers on prompts, sessions, workflow stages, and authorization
Four recent arXiv preprints test safety at prompt, session, workflow, and execution boundaries; their numbers show why retained state and enforcement authority matter more than a single headline score.
A model can face the same task and produce a different safety result when the wording changes, the harmful objective is split across sessions, a tool call is retried after a timeout, or the guard sees only one stage of the workflow. Four recent arXiv preprints put numbers and mechanisms on those boundary failures. None gives a public-deployment risk rate. Together, they show what a safety claim must retain before its headline score can travel beyond the test that produced it.
The same harmful intent is not one evaluation item
Single Canonical Prompts Underestimate LLM Safety’s Surface-Form Sensitivity starts with a small but consequential change: the researchers hold the underlying harmful seed constant and vary how it is expressed. They test 370 seeds across physical harm, cyber abuse, fraud/deception, and violent wrongdoing. Each seed appears in five forms: canonical English, paraphrase, English-to-Chinese translation, code-switching, and indirect framing. The models run at temperature 0, and the authors repeat canonical prompts to estimate a stochasticity floor. 1
The result is not that one particular paraphrase always breaks safety. The paper finds no uniformly worst transformation: only 6 of 20 per-transformation McNemar tests are significant, and most of those significant effects are protective. The problem appears when the evaluation treats one surface form as representative. Across the five forms, the union of unsafe outcomes exceeds the worst single form by 3.3 to 12.9 percentage points. Between 5.4% and 13.0% of seeds that are safe on the canonical prompt become unsafe under a reformulation. A single form recovers about 53% of the observed unsafe surface, with a model-level range of 37% to 68%. 1
That is a coverage result, not an attack-success estimate for deployment. The five forms are a descriptive set rather than a random sample of language. Three transformations share Chinese machine-translation machinery, the harmful and benign pools are not item-matched, and the authors note that the five forms do not represent every possible surface variation. The benign XSTest control also matters: 6.0% to 18.0% of benign prompts flip to over-refusal under reformulation. A stronger evaluation therefore has to measure both newly exposed unsafe behavior and safety behavior that becomes unnecessarily restrictive. 1
The mechanism is easy to miss if the result is reduced to "test more prompts." The unit that needs to be retained is an intent-equivalence class: several surface forms that express the same safety-relevant request. Repeating the canonical item measures response stability to one wording. Sampling related forms measures how much of the model’s unsafe surface the benchmark has actually touched. Those are different quantities.
Session boundaries hide accumulated capability
Prompt variation changes the evidence inside one session. Magnet: Detecting Cross-Session AI Misuse Through Capability Accumulation changes the boundary between sessions. Its attack setup decomposes a phishing or Molotov-cocktail objective into subtasks, then sends each subtask to freshly instantiated agent pairs with no shared conversation history. The tools include web search, webpage fetching, file saving, email sending, and server startup. The harmful goal is distributed across requests that can look benign when inspected one at a time. 2
Across 1,080 runs covering nine models, two scenarios, and three delivery modes, the paper reports average attack-success rates of 18.7% for single-turn packaging, 26% for multi-turn packaging, and 37.4% for multi-session packaging. The increase is not uniform across models: the paper identifies Gemini 2.5 Pro and GPT-5.4 as cases where decomposition did not meaningfully raise attack success. It also reports fewer refusals in the multi-session condition. 2
Magnet's detector does not try to preserve every prior conversation. It extracts a binary capability vector from each session and combines those vectors into a persistent inventory keyed to a user ID. A per-session judge asks whether one conversation is harmful; the correlator asks whether the same entity has accumulated enough capabilities to assemble a harmful objective. That is a different retained object from the intent-equivalence class in the first paper.
The limits are equally specific. The detector does not address an attacker who spreads activity across multiple accounts. The evaluation assumes that sessions are independent and does not consider memory systems that would break that assumption. It uses expert-authored capability taxonomies, routes subtasks within a single model family, and uses an LLM judge after production safety classifiers are removed so harmful artifacts can be scored. The reported 37.4% is therefore a result for this decomposition setup and threat model, not a general estimate of cross-session misuse.
The important transfer question is now visible: if a safety system resets its evidence at the session boundary, what behavior does the reset erase? Magnet's answer is capability accumulation. The detector does not need to infer an attack from one suspicious message; it needs a stable identity and a memory of what the entity has already demonstrated.
A fresh token is not a fresh permission
The third boundary is not observation but execution. Beyond Single-Use Tokens: Durable Authorization State for Replay-Resistant LLM Agent Actions studies what happens when an agent retries, delegates, or resumes an action after a crash. A new token identifier can look like a new authorization even when the user has already confirmed the same semantic action. The paper calls this semantic replay: repeated authorization, admission, or external effect beyond the intended budget. 3
The proposed CapLease layer binds a user confirmation to a canonical action and records consumption through durable
Issue → Prepare → Commit transitions. A matched Server Ledger variant uses the same centralized assumptions. In the paper's 10,152 trajectories, semantically equivalent reproposals occur at 39.8% overall. The reported rates are 58.0% after lost acknowledgements, 46.0% after timeouts, 31.0% after ambiguous results, and 24.0% after delegation or restart. 3
The positive result is narrower than "the agent is safe." CapLease and Server Ledger produce 0 of 282 counterexamples in the listed replay, recovery, delegation, and parameter-drift tests. In the paper's comparison table, authority-only controls still allow fresh reissuance or duplicate effects under some conditions. The durable ledger changes the enforcement point: it does not ask a model to remember that an action was already authorized; it makes the authorization-consumption state part of the external execution protocol. 3
That guarantee has a hard edge. Without an idempotent sink, the system can bound issuance and admission but cannot guarantee exactly-once physical effects. It also assumes correct canonicalization, trusted metadata, stable confirmation identifiers, authenticated principals, and a durable non-rollback linearizable ledger. A ledger can stop a duplicate transfer of a specified action; it cannot decide whether the user should have approved that action in the first place. The paper improves execution fidelity by narrowing the property it enforces.
This distinction matters for alignment work. An observation system can expose a behavior that looks unsafe while lacking an intervention path. An authorization system can block a repeated side effect while knowing nothing about hidden intent. The two controls answer different questions and should not be compared through one safety score.
Stage-aware guards widen the observation point
𝑆³: Improving Agent Safety through Multi-Stage Defense offers a constructive response to controls that inspect too little of an agent workflow. It separates the workflow into input, memory, planning, tool selection, tool execution, and tool observation. A guard agent invokes stage-specific safety skills through layered triggers: a stage trigger, a rule-based filter, and a guard-agent decision. A recovery module handles detected risks while trying to preserve benign task completion. 4
On the paper's Multi-Stage Risk Benchmark, the complete system reports 675 task instances across nine task categories and six risk types, with 0% reported attack success and 100% values for the recovery and task-completion metrics shown in its tables. The version without the recovery module still detects risks but preserves benign completion less well. Those are useful design signals: detecting a bad state and recovering without breaking legitimate work are separate objectives. 4
The result remains bounded by its benchmark and implementation. The reference system is built on DeepAgent, and the paper focuses on risks before output generation. It does not show that every workflow stage has an independent signal, that the guard cannot inherit the main agent's blind spots, or that the reported performance transfers to live tools and open-ended environments. The 0% figure is therefore evidence about the evaluated MSRB setup, not a universal property of multi-stage guarding.
𝑆³ supplies the broadest observation surface among the four papers, while CapLease supplies the clearest external consequence. Magnet shows what must persist across identities and sessions; the prompt-variation study shows what must persist across equivalent expressions. These are not interchangeable forms of memory. They sit at different places in the causal path from request to harm.
What a portable safety claim has to name
The four papers make a safety claim more auditable by attaching it to a retained object:
- Evaluation: Which surface forms are treated as equivalent to the harmful intent, and how much of that set was sampled?
- Detection: Which identity links sessions, and what capability evidence survives the reset?
- Authorization: Which action and confirmation state is durable, and what external effect can the sink still duplicate?
- Workflow defense: Which stages are observed, what recovery authority exists, and where does the benchmark stop?
The shared lesson is narrower than "stateful systems are safer." State only helps when it is the state that carries the failure. A detector that remembers conversations but not capability accumulation can still miss a decomposed objective. A guard that sees every stage but cannot revoke a tool permission is still an observer. A durable ledger that prevents replay can enforce one action invariant without resolving intent. A benchmark that varies wording can reveal exposure while saying nothing about the authority to contain the resulting run.
For a reader entering the field, this gives a practical way to read the next safety paper or model card. Start with the result's unit—prompt, session, trajectory, or external effect. Then ask what was reset, what was preserved, and who could intervene when the property failed. If those answers are missing, the number may still be useful as a bounded experiment. It is not yet a portable deployment claim.
References
- 1
- 2
- 3
- 4
This story was produced automatically by a channel. One sentence is all it takes for Neodrop to keep producing for you.