Phantom Guardrails: When Self-Improving Agent Harnesses Fix Failures That Never Happened¶

🕒 Published (v1): 2026-07-13 10:14 UTC · Source: Arxiv · link

Ask a follow-up

Open an assistant pre-loaded with this paper's context.

TL;DR¶

Self-improving agent harnesses that accept scaffold edits based solely on failure-suppression signals can be tricked into adding guardrails for failures that provably never occurred. The authors introduce the Counterfactual Fabrication Lab (CFL), a deterministic micro-benchmark with a byte-exact oracle, and show that LLM proposers enable a "phantom guard" at rate 0.25 on all-legal input—a certified false positive—when three structural conditions coincide. Once the phantom guard enters an add-only accept loop, it becomes an absorbing state that no suppression-only signal can ever remove.

Problem¶

Automated harness-search optimizers (e.g., systems that grow a scaffold via self-preference scoring) are rewarded exclusively by $S(H,D)$, the fraction of episodes with zero firing classes after applying harness $H$. This signal answers "did the failure stop?" but never "was there a real failure?" On an all-legal pool, $S(H,D)=1$ for every harness including the empty one, so a fabricated no-op guard is invisible to suppression-only acceptance—it neither raises nor lowers the proxy. No prior work examined what a suppression-rewarded proposer does when the warranted action is "do nothing."

Method¶

The CFL is a four-stage pipeline built around a deterministic "MiniArena" game:

Pool generation. An agent plays board moves; episodes carry per-move legality tags. Three oracle-separable failure classes exist: syntax (malformed token), bounds (off-board target), and castle (illegal castling). The castle class is the probe: the move generator cannot emit a castling record, so $O_{\text{castle}}(e)=0$ for every $e$ on non-injected pools. A separate injector can plant real castle violations for the congruent (positive control) pool.
Proposer query. Five LLMs (deepseek-v4-pro, deepseek-v4-flash, qwen3.7-max, qwen3.6-max-preview, glm-5.1) receive the pool corpus and a four-hook edit menu $\{P, Q, R, S\}$ and return a harness $H \subseteq \{$g_syntax, g_obs, g_bounds, g_castle$\}$ in one shot.
Oracle scoring. A deterministic byte-exact oracle checks whether any enabled guard is warranted. Fabrication is defined as: $$\text{Fab}(H, D) = \mathbf{1}[\text{g\_castle} \in H]$$ on any pool where $O_{\text{castle}} \equiv 0$.
Mechanism controls. Three isolating arms are crossed: (a) a pretext battery plants four pattern types (repeated square, shared column, fixed diagonal, corner squares) at fixed incidence; (b) a completeness-assured arm prepends one sentence certifying the rule set is exhaustive; (c) a neutral-instruction arm replaces the failure-presupposing system message with a warrant-neutral role.

The accept-loop regime uses a deterministic add-only judge under two acceptance rules: accept-if-not-worse and strict-improvement, to analyze phantom entry and persistence dynamics.

Key Contributions¶

Counterfactual Fabrication Lab: a $0-auditable, fully deterministic instrument with a planted nonexistent-rule guard and byte-exact oracle; the warranted action is known ground truth, not a model judgment.
Empirical characterization of phantom guardrails: 0.25 fabrication rate on all-legal + patterned input vs. 0/60 on featureless input ($z=4.14$, $p<10^{-4}$); effect is hook-specific (only g_castle moves, two real fixers never fire on any all-legal pool).
Three-condition causal decomposition: rule-shaped pattern + uncertified rule set + failure-presupposing instruction; each is a sufficient switch—removing any one drives fabrication to 0/60.
Distinction from reward hacking and over-refusal: the phantom guard is a strict no-op on true return and cannot raise the already-satisfied suppression proxy; it costs only scaffolding, not utility.
Accept-loop absorbing-state result: under accept-if-not-worse, a fabricated no-op enters immediately; under strict-improvement, it piggybacks on a warranted fix; once in, zero suppression signal ever motivates removal.
Warrant-aware acceptance as a fix: replacing suppression-only scoring with a warrant check excludes the phantom entirely.

Results¶

Fabrication rate: 0.25 (15/60) on all-legal + benign-pattern pool vs. 0.00 (0/60) on featureless pool; two-proportion $z = 4.14$.
Detector recall: 1.00 (60/60) on the congruent pool (real castling violation present)—all five proposers fire correctly.
Per-model distribution: glm-5.1 drives most of the effect (11/12); qwen3.7-max 3/12; deepseek-v4-pro 1/12; qwen3.6-max-preview and deepseek-v4-flash 0/12.
Extension roster (3 additional proposers, 8 total): pooled fabrication 17/96 vs. 0/96 on pristine ($z=4.32$); congruent recall 96/96.
Pattern specificity: planted repeated-square reproduces fabrication at 13/60 (0.22); three non-genre patterns (column, diagonal, corners) yield 0/180 combined.
Completeness assurance: drops fabrication from 15/60 to 0/60 ($z=4.14$) with no change to the inert-annotator placebo row (7/60 → 7/60, $z=0.29$).
Neutral instruction: drops fabrication to 0/60 independently of completeness note.
Hook specificity (Table 1): g_bounds and g_syntax enable rates are 0/60 on all all-legal pools; only g_castle varies with the pretext.

Limitations¶

Single synthetic task domain (MiniArena); whether the three-condition gate generalizes to production harnesses with richer failure taxonomies is unverified.
Five-model protocol roster is small; per-model rates are point estimates with high variance (glm-5.1 dominates), and the capability–fabrication relationship is explicitly left as a hypothesis.
The accept-loop model is deliberately simplified (add-only, no pruning); prune-capable loops and self-preference-scored loops (e.g., RHO) are analyzed only analytically, not measured.
The blinded congruent arm addresses only the castle/special-rule lexical leak; other prompt artifacts (iterative wording for a single-shot setting) are flagged but not experimentally isolated.
Oracle certifies fabrication only within the pool-relative scope; no claim is made about the model's behavior on out-of-distribution tasks.

Relevance to Harnesses / Meta-Harnesses¶

This paper directly targets the correctness of meta-harness self-improvement loops—systems where an LLM proposes edits to the scaffold (guardrails, parsers, filters, validators) based on observed failures. The CFL provides the first controlled instrument for measuring whether a harness-optimization proposer hallucinates the failure evidence that motivates a scaffold edit, a threat orthogonal to the well-studied under-fixing and reward-hacking failure modes. The absorbing-state result is particularly consequential for anyone building or evaluating add-only or accept-if-not-worse harness evolution systems: phantom guardrails accumulate silently and cannot be expelled by any suppression-only signal, meaning the scaffold drifts away from warranted coverage even as its metrics look perfect. The three-condition gate (rule-shaped hook, uncertified specification, failure-presupposing instruction) gives harness designers concrete knobs—completeness certification and warrant-aware acceptance—to eliminate the failure mode.