{ "schema_version": 1, "builder_plan": { "scenario": "An agent reads external documents or tool responses that may contain malicious instructions.", "change": "Replay attacks and legitimate lookalikes in an isolated copy of your agent workflow.", "baseline": "Your existing checks with the same tasks, permissions, and tool responses.", "steps": [ "Locate the paper's implementation and check its license, model support, data needs, and hardware requirements. Stop here if you cannot obtain the required artifacts.", "Save a small set of representative product tasks and expected outcomes. Keep evaluation tasks out of any training or tuning, and choose quality and cost limits before running.", "Run the baseline and the proposed change on identical inputs. Keep other settings fixed and repeat paired runs to expose variation.", "Save per-task outputs, failures, timings, and all usage costs. Review regressions before expanding the test." ], "measure": "Successful attacks missed, legitimate actions blocked, detection delay, and review cost.", "decision": "Keep the change only if it meets your preselected quality and latency limits and improves the metric you care about after setup and operating costs. Otherwise retain the baseline. This is an exploration plan, not a validated recommendation." }, "builder_review": null, "arxiv_id": "2609.15134", "title": "HazardAuditor: From Executable Threats to Safer Computer-Use Agents", "summary": "HazardAuditor replaces static prompt-and-response guard models with a generative guard trained on normalized execution events from heterogeneous computer-use agents, using GuardPO to optimize at the sequence level instead of token level. Using the released guard model for inference is feasible on a single 24 GB GPU, but reproducing the training pipeline requires sandboxed execution environments for multiple agent frameworks, event normalization infrastructure, and post-training compute that exceed a constrained budget. The guard can fail on hazard types absent from its execution traces, on agent frameworks whose interaction patterns differ from the four normalized during training, and through false negatives on novel runtime behaviors that static verdicts cannot anticipate.", "rationale": "The released guard model can be evaluated as an inference-only safety layer at small scale, but its value depends on how closely the reader's agent stack and hazard distribution match the training frameworks, so workload-specific validation is required before production adoption.", "technique": "Execution-grounded guard model with GuardPO training", "family": "seguranca_e_guardrails", "recommendation": "testar", "published": "2026-09-14", "as_of": "2026-10-18", "editorial_status": "indexed", "source_url": "https://arxiv.org/abs/2609.15134", "independent_implementations": 0, "total_implementations": 1, "stars": 20, "citations": 0, "claims": [ { "claim_id": "claim-01", "statement": "HazardAuditor replaces static prompt-and-response guard models with a generative guard trained on normalized execution events from heterogeneous computer-use agents, using GuardPO to optimize at the sequence level instead of token level. Using the released guard model for inference is feasible on a single 24 GB GPU, but reproducing the training pipeline requires sandboxed execution environments for multiple agent frameworks, event normalization infrastructure, and post-training compute that exceed a constrained budget. The guard can fail on hazard types absent from its execution traces, on agent frameworks whose interaction patterns differ from the four normalized during training, and through false negatives on novel runtime behaviors that static verdicts cannot anticipate.", "basis": "inferred", "result": "", "baseline": "", "conditions": "", "source_url": "https://arxiv.org/abs/2609.15134", "source_page": null, "source_excerpt": "" }, { "claim_id": "claim-02", "statement": "Improves safety-classification accuracy by up to 16.5 percentage points over the strongest prior guard across multiple benchmarks and heterogeneous computer-use systems.", "basis": "inferred", "result": "", "baseline": "", "conditions": "", "source_url": "https://arxiv.org/abs/2609.15134", "source_page": null, "source_excerpt": "" } ], "exposure_map": [ { "dimension": "quality", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "compute", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "latency", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "operations", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "compatibility", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "security", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "data_and_training", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "reproducibility", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" } ], "risks": [], "minimum_test": [], "open_questions": [], "independent_tests": [], "lab_reproductions": [], "report_available": false, "validation_tier": "unknown", "evidence_tier": "unknown", "infrastructure_basis": "unknown", "equations": [ { "anchor": "S3.E15", "label": "(15)", "section": "III HazardAuditor", "role": "proposed_method", "latex": "\\boxed{\\mathcal{L}_{\\mathrm{GuardPO}}=\\frac{1}{N}\\sum_{i\\in\\mathcal{B}}\\left[M_{i}(\\mathcal{R}_{i})+\\lambda_{\\mathrm{ver}}M_{i}(\\mathcal{V}_{i})\\right].}", "mathml": "ℒGuardPO=1N​∑i∈ℬ[Mi​(ℛi)+λver​Mi​(𝒱i)].", "context": "with Mi​(∅)=0. GuardPO minimizes", "headline": "", "explanation": "", "objective": "", "symbols": {}, "evidence": "", "evidence_url": "", "source_url": "" }, { "anchor": "S3.E9", "label": "(9)", "section": "III HazardAuditor", "role": "baseline", "latex": "\\mathcal{L}_{\\mathrm{token}}=\\frac{\\sum_{i}\\sum_{t=1}^{L_{i}}\\ell_{i,t}}{\\sum_{i}L_{i}},", "mathml": "ℒtoken=∑i∑t=1Liℓi,t∑iLi,", "context": "SFT learns the desired reasoning format and safety policy, but it optimizes token-level imitation rather than the safety decision expressed in the generated response. This mismatch is particularly consequential for generative guards. Under standard token-mean policy optimization,", "headline": "", "explanation": "", "objective": "", "symbols": {}, "evidence": "", "evidence_url": "", "source_url": "" }, { "anchor": "S3.E8", "label": "(8)", "section": "III HazardAuditor", "role": "loss", "latex": "\\mathcal{L}_{\\mathrm{SFT}}=-\\frac{\\sum_{t=1}^{L}w_{t}\\log\\pi_{\\theta}(z^{\\star}_{t}\\mid x,z^{\\star}_{ℒSFT=−∑t=1Lwt​log⁡πθ​(zt⋆∣x,z<t⋆)∑t=1Lwt,", "context": "The loss is computed over assistant tokens exclusively. Because the verdict occupies only a small portion of the response, we upweight the final Kver target tokens:", "headline": "", "explanation": "", "objective": "", "symbols": {}, "evidence": "", "evidence_url": "", "source_url": "" } ], "equations_status": "selected", "core_kind": "formula", "equations_fetched_at": "2026-10-05", "equations_source_url": "", "equations_source_sha256": "", "exposures_reviewed_at": "", "exposures_source_sha256": "" }