🤖 AI

SafeHarbor: Defining Precise Decision Boundaries via Hierarchical Memory-Augmented Guardrail for LLM Agent Safety

SafeHarbor is a novel, training-free framework that enhances LLM agent safety by utilizing a hierarchical memory system and information entropy-based self-evolution to dynamically inject context-aware guardrails, effectively balancing high benign utility with robust defense against malicious attacks.

Original authors: Zhe Liu, Zonghao Ying, Wenxin Zhang, Quanchen Zou, Deyue Zhang, Dongdong Yang, Xiangzheng Zhang, Hao Peng

Published 2026-07-24

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Zhe Liu, Zonghao Ying, Wenxin Zhang, Quanchen Zou, Deyue Zhang, Dongdong Yang, Xiangzheng Zhang, Hao Peng

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you've just handed a super-smart robot a set of keys to your entire digital life. This isn't just a chatbot that answers questions; it's an autonomous agent, a digital assistant that can actually do things. It can read your emails, check your bank statements, or even send files to a server. This is the exciting new world of AI agents, where computers don't just talk—they act. But here's the catch: if a clever hacker tricks the robot, it might not just say something rude; it could delete your important files or steal your secrets.

To stop this, we usually put up "guardrails." Think of these like a bouncer at a club. Traditionally, this bouncer is a bit too strict. If you try to bring in a sandwich that looks slightly like a weapon (maybe it's wrapped in foil), the bouncer might ban you from the club entirely, even though you just wanted lunch. This is called "over-refusal," where the robot blocks good, helpful requests because they look a little risky. The big question scientists are asking is: How do we make a bouncer that is smart enough to know the difference between a harmless sandwich and a real bomb, without being a jerk about it?

This is where a new framework called SafeHarbor comes in. The researchers behind it realized that instead of using a rigid, one-size-fits-all rulebook, we need a system that learns and adapts, much like a security guard who keeps a detailed, evolving notebook of what's actually dangerous.

SafeHarbor works by building a special "memory tree" for the AI. Instead of just memorizing a list of bad words, this system creates a dynamic map of safety rules. Here's how it plays out:

First, the system has a "training phase" where it acts like a curious (and slightly mischievous) student. It uses an automated generator to create thousands of tricky, fake attack scenarios. It tries to trick the AI in every way possible—by breaking a bad request into small, innocent-looking steps, or by pretending to be an important boss giving an order. This helps the system learn exactly where the line between "safe" and "dangerous" really is.

Once the system has learned these patterns, it stores them in a hierarchical memory. Imagine this as a giant, organized filing cabinet. The top drawers hold broad categories like "Cyber Attacks" or "Fraud." As you go deeper into the folders, the rules get more specific. The coolest part is that this filing cabinet is alive. If the system encounters a new type of trick that doesn't fit in any existing folder, it automatically creates a new folder for it. If two folders become too similar, it merges them. This "self-evolution" means the system gets smarter over time without needing to be retrained from scratch.

When a user asks the AI to do something, SafeHarbor doesn't just guess. It uses a two-step check. First, it runs a quick, lightweight scan. If the request is clearly safe (like "send an email to my mom"), it lets it pass instantly. If the request is clearly dangerous (like "delete all my files"), it blocks it immediately. But if the request is in the "gray area"—maybe it looks a bit suspicious but could be legitimate—it pulls out the detailed rules from its memory tree. It compares the request against specific "prohibitions" (what you can't do) and "exemptions" (what you can do even if it looks risky).

The results are impressive. In their tests, SafeHarbor managed to block over 93% of harmful requests, which is a very high success rate. But the real magic is that it didn't get in the way of good requests. On a powerful AI model called GPT-4o, it allowed 63.6% of legitimate, complex tasks to go through. This is a huge improvement over older methods, which often blocked too many good requests just to be safe.

The authors suggest that this approach offers a much better balance than current methods. While other systems might require heavy, slow software to check every request, or might be too strict and block everything, SafeHarbor uses this smart, memory-based system to make precise decisions quickly. It proves that you can have a security guard that is both tough on bad guys and friendly to good guys, keeping our digital agents safe without turning them into useless, over-cautious robots.

Technical Summary: SafeHarbor

Problem Statement

The evolution of Large Language Models (LLMs) from passive conversationalists to autonomous agents capable of tool execution and complex reasoning has introduced severe security vulnerabilities. While early adversarial attacks focused on eliciting toxic text generation, agent-based attacks now pose risks of actionable harm in real-world digital environments, such as unauthorized file deletion, privilege escalation, and phishing.

Existing defense strategies face a critical trade-off between safety and utility. Current approaches generally fall into two categories:

Intrinsic Alignment: Fine-tuning models on safety datasets (e.g., AgentAlign), which incurs high retraining costs and risks "over-alignment," leading to the refusal of benign requests.
External Guardrails: Deploying auxiliary agents or static classifiers (e.g., Llama-Guard, GuardAgent) to monitor interactions. These often suffer from boundary ambiguity, operating as static linear classifiers that fail to adapt to contextual nuances. This results in "over-refusal," where legitimate complex workflows are indiscriminately blocked, or conversely, "under-defensiveness" where subtle threats are missed. Furthermore, many external solutions introduce prohibitive latency due to resource-intensive proxies or real-time code execution.

The core challenge is establishing precise, adaptive decision boundaries that distinguish between benign and malicious intents without compromising inference efficiency or requiring extensive model retraining.

Methodology

The authors propose SAFEHARBOR, a framework designed to define precise decision boundaries via a hierarchical, memory-augmented guardrail system. The framework operates through three coordinated stages:

1. Adversarial Rule Generation (Offline Phase)

Instead of relying on static guidelines, SAFEHARBOR employs an automated pipeline to synthesize robust safety rules.

Attack Enhancement: An attack generator transforms static harmful seeds into diverse, execution-oriented attack vectors using three social engineering paradigms: Goal Decomposition (atomizing harmful intents into benign steps), Privilege Escalation (masquerading as high-priority debugging), and Contextual Reframing (wrapping directives in educational narratives).
Rule Synthesis: The system generates a diverse spectrum of safety policies, maximizing the information entropy of injected rules to ensure the memory captures latent vulnerabilities rather than redundant patterns.

2. Dual Knowledge Storage & Memory Evolution

The framework utilizes a Dynamic Hierarchical Memory Tree ( $M$ ) to organize safety knowledge, distinguishing it from static storage or simple retrieval.

Node Structure: The memory tree consists of internal routing nodes and leaf nodes. Crucially, each leaf node $N_i$ contains a dual-policy unit $\Pi_i = \{R_{harm}, E_{benign}\}$ , comprising a prohibition rule derived from harmful trajectories and a corresponding exemption rule synthesized from benign trajectories. This explicit coupling defines a precise decision boundary.
Self-Evolution Mechanism: The system uses an Information Gain metric based on Shannon entropy to dynamically manage the tree topology. When a new query embedding is introduced:
- If the information gain is high (indicating a novel threat pattern), a new leaf node is created.
- If the gain is low (indicating a refinement of existing patterns), the system performs a merge operation to refine the specific rule boundaries.
- This allows the memory to scale and adapt without model retraining.

3. Online Inference & Retrieval

To balance latency and precision, SAFEHARBOR employs a Two-Stage Inference Pipeline regulated by a gating mechanism.

Safety Projector: A lightweight, two-layer MLP maps queries to a latent space anchored by learnable global prototypes for benign ( $w_B$ ) and harmful ( $w_H$ ) centers. It is trained using a hybrid objective combining binary cross-entropy and a margin-based contrastive loss to ensure a compact, structurally meaningful latent space.
Dual-Scoring Gating:
- Fast Path: For queries with low harmful probability and high benign similarity, the system bypasses heavy verification, ensuring minimal latency for standard usage.
- LLM Judgment: For ambiguous or risky queries, the system invokes the base LLM (via in-context learning) to evaluate whether the query violates prohibitions or falls under exemptions. This avoids the need for fine-tuning a separate guardrail model.
Centroid-Based Retrieval: The system retrieves relevant prohibition and exemption rules from the memory tree based on semantic similarity to construct the local safety context.

Key Contributions

Automated Adversarial Rule Generation: A framework that synthesizes robust safety rules by applying adversarial enhancement to harmful trajectories and utilizing an adaptive clustering process.
Contrastive Safety Projector: A projection mechanism that mitigates over-refusal by jointly assessing semantic and contextual risks through a geometry-aware metric space.
Self-Organizing Hierarchical Memory: A memory structure featuring adaptive leaf splitting and merging, enabling scalable rule management and high-speed retrieval without model retraining.
State-of-the-Art Performance: The framework achieves a peak benign utility of 63.6% on GPT-4o while maintaining a harmful refusal rate exceeding 93%, effectively balancing safety robustness and inference efficiency.

Experimental Results

The authors evaluated SAFEHARBOR against baselines including Rule Traverse, A-Mem, RAG, Llama-Guard-3, GuardAgent, and AgentAlign across three backbone models (GPT-4o, Mistral-8B, Qwen2.5-7B) and two benchmarks (AgentHarm, AgentSafetyBench).

AgentHarm (Complex Agentic Attacks): SAFEHARBOR consistently outperformed competitors in preserving utility on benign tasks. On the Qwen2.5-7B backbone, it reduced the benign refusal rate to 9.1%, a significant improvement over LlamaGuard's 22.7%, while maintaining a harmful refusal rate of 89.2%. It avoided the "over-defensive" behavior of static classifiers and the "under-defensive" failures of rule-based prompting.
AgentSafetyBench (General Robustness): The framework achieved state-of-the-art performance in environment-based interaction scenarios. On GPT-4o, it attained a Refusal-Env score of 62.05%, surpassing A-Mem by 14.7% and RAG by 16.0%.
Ablation Studies: Removing components such as the Memory Tree or the Benign Rule significantly degraded performance (e.g., benign refusal rates increased to 37.3% and 25.0% respectively), confirming the necessity of the hierarchical memory and dual-policy structure.

Significance

The paper claims that SAFEHARBOR addresses the fundamental limitation of current defenses: the inability to delineate precise decision boundaries between benign and malicious intents in ambiguous scenarios. By transforming the abstract concept of an adaptive boundary into a concrete, real-time defense pipeline, SAFEHARBOR offers a training-free, efficient, and plug-and-play solution.

The significance lies in its ability to:

Resolve the Safety-Utility Trade-off: It achieves high safety compliance without the severe over-refusal typical of static guardrails or the high computational costs of heavy external agents.
Enable Dynamic Adaptation: Through its self-evolving memory structure, the system can continuously optimize its defense boundaries against emerging attack vectors without requiring expensive model retraining.
Provide Granular Control: The dual-policy mechanism (prohibition + exemption) allows for precise differentiation even in edge cases, ensuring that legitimate complex workflows are not blocked by rigid safety margins.

The authors conclude that SAFEHARBOR represents a shift from coarse-grained, static filtering to precise, context-aware, and rule-based safety enforcement for autonomous LLM agents.