Technical Summary: Safactory – A Scalable Agentic Infrastructure for Training Trustworthy Autonomous Intelligence

1. Problem Statement

As large language models (LLMs) transition from conversational assistants to autonomous agents, safety risks have evolved beyond static, single-turn outputs. The paper identifies that agent risks accumulate progressively through long-horizon decision chains involving perception, planning, tool invocation, and environmental interaction. These risks manifest as tool misuse, state drift, process loss of control, and cascading errors, which are difficult to detect via traditional static benchmarks.

The authors argue that existing agentic infrastructure is fragmented across three foundational dimensions, preventing a continuous closed loop for safety improvement:

1. Evaluation Limitations: Current systems rely on static, single-turn adversarial examples or fixed task sets. They fail to capture risks emerging from multi-step tool usage, dynamic environmental states, and long-horizon decision branches.
2. Data Limitations: Trajectories, reward signals, and failure contexts are often treated as ephemeral byproducts (stored in memory or temporary files) rather than structured, auditable data assets. This hinders cross-task retrieval, reuse, and systematic feedback into model optimization.
3. Evolution Limitations: Training, evaluation, and deployment remain disconnected. Issues identified during evaluation are not promptly converted into training samples, and reinforcement learning (RL) frameworks often lack the orchestration to support complex, asynchronous, multi-environment training loops with trajectory staleness control.

2. Methodology: The Safactory Framework

Safactory is proposed as a scalable, unified infrastructure designed to close the loop between risk discovery, data accumulation, and capability repair. It integrates three tightly coupled platforms:

A. Parallel Simulation Platform

This platform addresses the efficiency and coverage bottlenecks of agent evaluation.

• Architecture: It utilizes a "pre-warming—pooled scheduling—asynchronous persistence" mechanism. Sandbox environments are pre-warmed, and an ActorPool manages concurrent agent instances to eliminate cold-start latency.
• Backtracking Sandbox: A version management system (similar to Git) allows agents to roll back to "safety anchor points" (checkpoints) during execution. This enables branch-based exploration around high-risk nodes without restarting the entire task, facilitating systematic exposure of failure modes in multi-path decision trees.
• Support: It supports diverse environments including QA, OS (Ubuntu desktop), Android, Embodied (RoboTrust, ALFRED), and Tool-use (OpenClaw) scenarios via a unified interaction protocol.
• Attack Injection: It supports dynamic injection of red-team attacks and perturbations during execution to test robustness boundaries.

B. Trustworthy Data Platform

This platform transforms raw interaction logs into structured, high-value data assets.

• DataElf Engine: An intent-driven intelligent execution engine that orchestrates complex data tasks (cleaning, scoring, auditing) via natural language. It operates within isolated sandboxes to ensure data is "usable but invisible" (privacy-preserving).
• Toolset: Includes specialized tools for:
  • Data Value Assessment: Uses a composite scoring strategy (DataElf) fusing multiple metrics (e.g., IFD, DEITA, PPL) to select diverse, high-quality subsets.
  • Scientific Data Processing: Handles domain-specific data (bioinformatics, EEG, chemistry) via standardized operators.
  • Security Auditing: A pluggable architecture with 23 checkers (rule-based, LLM-as-a-Judge, model-based, heuristic) to detect 13 risk types, including backdoors, jailbreaks, and factual inconsistencies.
  • Trajectory Analysis: Distills step-level interactions into reusable "skill" units for experience injection.
• Storage: Built on a serverless LanceDB architecture for PB-scale, multi-modal data lakehouse capabilities with tiered caching for low-latency retrieval.

C. Autonomous Evolution Platform

This platform orchestrates the continuous improvement of agent policies.

• Asynchronous RL System: Decouples the rollout (sampling) and training processes. A Buffer Server manages trajectory data, while a Bridge module handles asynchronous control and unified inference entry.
• Trajectory Transformation: Converts raw interaction logs into trainable samples via semantic alignment, masking, and packing, ensuring data consistency.
• On-Policy Distillation (OPD): An optional plugin that distills policies from a teacher model to the student model during asynchronous rollouts. It uses token-level log probabilities and reverse-KL regularization to stabilize training and mitigate distribution shifts caused by policy lag.
• Staleness Control: Implements a "trajectory staleness" mechanism to filter samples based on the version difference between the generating policy and the current training policy, balancing on-policy and off-policy data usage.

D. DeepLink Computing Technology

To support large-scale domestic deployment, Safactory leverages DeepLink for:

• Large-scale pooled inference on heterogeneous hardware (e.g., Ascend Atlas).
• Distributed hierarchical data storage for PB-scale risk data.
• Domestic heterogeneous training toolchains optimized for Kunpeng chips and Linux containers, reducing memory usage and increasing parallel scale.

3. Key Contributions

1. Unified Evolutionary Pipeline: Safactory is presented as the first framework to propose a unified pipeline for next-generation trustworthy autonomous intelligence, integrating evaluation, data management, and model evolution into a single closed loop.
2. Scalable Parallel Simulation: Introduces a backtracking sandbox mechanism and pre-warmed environment pools to enable high-concurrency, multi-path safety evaluation in executable environments (OS, Android, Embodied).
3. Intent-Driven Data Engine: Proposes DataElf, which moves data services from static pipelines to autonomous, intent-driven continuous evolution, capable of deriving new tools and auditing data for safety risks.
4. Asynchronous RL Orchestration: Demonstrates a system architecture that effectively decouples rollout and training, utilizing trajectory staleness control and on-policy distillation to handle complex agent training scenarios.
5. SATraj Datasets: The framework generates and open-sources high-quality trajectory datasets (e.g., SATraj-OS) containing GUI interaction trajectories for both capability and safety training.

4. Experimental Results

The paper reports experiments across multiple benchmarks and environments:

• Safety Evaluation (QA, OS, Android, Embodied, OpenClaw):
  • In QA Gym, leading models showed high safety rates (e.g., Claude Opus 4.6 at 90.0%), but significant gaps remained, and no model achieved absolute safety.
  • In OS Gym, a trade-off was observed: models with aggressive strategies achieved higher task completion but lower safety, while safer models had lower completion rates.
  • In Android Gym, capability and safety showed a positive correlation, suggesting stronger interface understanding aids safety.
  • In Embodied Gym, models clustered in a low-completion/low-safety region, indicating a joint bottleneck in perception, planning, and execution.
  • In OpenClaw, high task completion did not translate to high safety, highlighting the need for execution-time monitoring.
• Data Value Assessment: Fine-tuning Qwen2.5-7B on a 9,000-sample subset selected by the DataElf scorer achieved an average benchmark score of 98.7, significantly outperforming single-axis scorers (e.g., Ask LLM dropped to 14.5) and the full-data baseline (18.1).
• Security Auditing: The DataElf auditing tool achieved an average recall of 80.46% across 13 risk types, substantially outperforming specialized safety models (e.g., LLaMA-Guard, WildGuard) and general frameworks like DeepEval (48.62%), particularly on data poisoning risks like label flipping and backdoors.
• Experience Injection: Injecting distilled skills from the trajectory analysis tool into the kimi-k2.5 model increased its safety rate on RiOSWorld from 32.17% to 71.08% without modifying model parameters.
• RL Training Efficiency: Compared to slime-native, Safactory's asynchronous architecture generated 2.49x more trajectories per step (1277.78 vs. 512) by eliminating inference-side idling, while maintaining similar training speeds.

5. Significance and Claims

The paper claims that Safactory shifts the paradigm of agent safety from a "one-time check" to a continuous infrastructure capability.

• System View: The primary contribution is not a single algorithm or benchmark, but a system view where risk discovery, data deposition, capability repair, and re-validation are designed as a continuous process.
• Bridging Gaps: It aims to bridge the long-standing gap between evaluation, data, and training, providing a practical foundation for building safer agents in OS, mobile, and embodied environments.
• Modesty: The authors acknowledge that Safactory is a "starting point rather than a finished solution." They note remaining challenges, including the need to expand environment coverage to high-stakes domains, improve metrics for judging long-horizon safety, and better handle asynchronous sampling and distribution shifts in training.

The work is positioned as a foundational infrastructure to enable the "discovering risks through execution, consolidating evidence through data, completing repairs through evolution, and verifying effectiveness through re-execution" cycle.