Human-Guided Harm Recovery for Computer Use Agents

🕒 Published (v1): 2026-04-20 21:12 UTC · Source: Arxiv · link

Why this paper was selected

Formalizes human-guided harm recovery for computer-use agents after prevention fails

Ask a follow-up

Open an assistant pre-loaded with this paper's context.

💬 Ask ChatGPT✦ Ask Claude

TL;DR

Computer-use agents can cause irreversible harm even when every individual action appears safe; existing safety work focuses almost entirely on pre-execution prevention and ignores remediation. This paper formalizes harm recovery — steering an agent from a harmful system state back to a safe one in alignment with human preferences — and delivers a rubric, a 1,130-judgment preference dataset, a reward-model-based scaffold, and BACKBENCH, a 50-task evaluation suite built on OSWorld.

Problem

Pre-execution safeguards (classifiers, refusal, constitutional AI) assume harm can always be intercepted; in practice agents fail silently (e.g., installing a compromised update that joins a botnet). No formal treatment or benchmark exists for post-execution recovery, and naive recovery (reaching any safe state) ignores context-dependent human preferences over trade-offs like speed vs. comprehensiveness vs. side-harm avoidance.

Method

The system is a generate-and-verify scaffold that decouples plan generation from evaluation:

1. Rubric extraction. A formative study (20 annotators, 40 A/B comparisons) drives thematic analysis under Braun & Clarke's six-phase methodology, yielding an 8-dimension Likert rubric: Comprehensiveness, Focus, Likelihood of Success, Speed, Long-Term Resolution, Side Harms, Communication, Autonomy.

2. Preference dataset. 230 annotators rate 1,130 pairwise plan comparisons (130 pairs double-annotated; Cohen's \(\kappa = 0.15\), reflecting genuine normative disagreement). A 10-topic LDA model + logistic regression with interaction terms (\(\gamma_i\)) quantifies how topic context modulates each attribute's weight: $\(\text{logit}\, P(\text{choose A}) = \beta_0 + \beta_{\text{attr}}(\Delta\text{Attr}) + \sum_{i=1}^{10}\beta_{t_i}t_i + \sum_{i=1}^{10}\gamma_i(t_i \times \Delta\text{Attr})\)$

3. Two verifier variants. (a) Rubric-based: frozen LM performs exhaustive pairwise A/B judgments over \(N\) candidate plans, aggregated by majority wins. (b) Reward model: LM fine-tuned on \(\{(\tau_i, \tau_j, y_{ij})\}\) preference pairs to learn \(R_\phi(\tau) \to \mathbb{R}\); scores all candidates and selects \(\tau^* = \arg\max R_\phi\).

4. BACKBENCH. 50 Ubuntu/GUI recovery scenarios (built on OSWorld) spanning 5 harm categories (data exposure, file corruption, malicious processes, access violations, sensitive disclosures); evaluated by human raters.

Key Contributions

• Formal definition of harm recovery as an optimization problem \(\pi^* = \arg\max_\pi \mathbb{E}_{\tau\sim\pi}[R(\tau)]\) subject to \(s_T \in S_\text{safe}\)
• 8-dimension natural-language rubric derived from structured human annotation
• Dataset of 1,130 pairwise annotated recovery plans with multi-attribute ratings revealing context-dependent attribute importance
• BACKBENCH: 50-task post-execution recovery benchmark on real Ubuntu environments
• Reward-model generate-and-verify scaffold that reranks \(N\) LM-generated candidate plans at test time without modifying the base policy

Results

• Reward model scaffold outperforms the rubric-based scaffold by 45 Elo points and the base agent by 120 Elo points on BACKBENCH (human evaluation)
• Gains hold on top of Claude Sonnet 4.5, Anthropic's most safety-aligned model, showing domain-specific preference alignment adds value beyond general safety tuning
• Context moderation: technical/infrastructure scenarios amplify Focus and Likelihood of Success; sensitive-user contexts (mental health, access provisioning) heighten Autonomy and Communication; urgent contexts (urban routing) foreground Speed; Comprehensiveness and Side Harms show no reliable context moderation

Limitations

• BACKBENCH contains only 50 tasks; coverage of harm categories is necessarily incomplete
• Cohen's \(\kappa = 0.15\) reflects low inter-annotator agreement, suggesting the reward model captures a consensus signal rather than individual preferences — personalized recovery alignment is left as future work
• Full trajectory annotation is prohibitively expensive; the scaffold operates on natural-language plan proxies rather than executable GUI trajectories, creating a gap between evaluated and executed behavior
• Harm detection is assumed (oracle harm classifier); the system does not address detection failures
• Fine-tuning the base policy for recovery behavior is infeasible for proprietary frontier models used as the GUI executor

Relevance to Harnesses / Meta-Harnesses

The paper's core technical contribution is a meta-harness pattern: a generate-and-verify outer loop that wraps an underlying agent, spawning \(N\) candidate recovery plans and routing them through a learned reranker before committing to execution — a textbook scaffold/orchestrator architecture. The reward model functions as a meta-level policy selector, directly analogous to how meta-harnesses use a judge or verifier module to adjudicate between parallel sub-agent outputs. BACKBENCH is itself a harness-evaluation substrate (OSWorld-based environment management + human scoring pipeline), making this paper relevant both to harness design patterns (generate-and-verify, sub-policy delegation) and to harness evaluation methodology (how to benchmark recovery behavior in agentic pipelines).