PaperlayerView exact revision on arXiv

Source-linked AI summary

LiSA: Lifelong Safety Adaptation via Conservative Policy Induction

Minbeom Kim, Lesly Miculicich, Bhavana Dalvi Mishra, Mihir Parmar, Phillip Wallis, Bharath Chandrasekhar, Kyomin Jung, Tomas Pfister, Long T. Le

arXiv:2605.14454v1cs.LGcs.CLcs.CR

TL;DR

Deployed guardrails must adapt to contextual, organization-specific safety expectations despite sparse and noisy feedback, without repeated fine-tuning. LiSA uses structured policy memory with conflict-aware local rules and confidence-gated reuse, achieving the strongest performance across three benchmarks while remaining robust to noisy feedback and improving the latency–performance frontier beyond base-model scaling.

  • Problem

    Guardrails need to adapt to contextual, organization-specific safety expectations despite sparse, noisy feedback and impractical repeated fine-tuning.

  • Method

    LiSA adapts a fixed guardrail through broad policy abstractions, conflict-aware local rules, and evidence-aware confidence-gated memory reuse.

  • Results

    LiSA achieves the strongest performance across PrivacyLens+, ConFaide+, and AgentHarm, with robust performance under noisy feedback and gains over strong memory-based baselines.

  • Takeaways & Limitations

    LiSA indicates that calibrated reuse of deployment experiences can improve guardrails without fine-tuning or larger models while extending the latency–performance frontier.

  • Takeaways & Limitations

    Evaluation uses controlled benchmark simulations rather than live deployment logs and is limited to English-language privacy- and safety-sensitive decisions.

Abstract

from arXiv · show

As AI agents move from chat interfaces to systems that read private data, call tools, and execute multi-step workflows, guardrails become a last line of defense against concrete deployment harms. In these settings, guardrail failures are no longer merely answer-quality errors: they can leak secrets, authorize unsafe actions, or block legitimate work. The hardest failures are often contextual: whether an action is acceptable depends on local privacy norms, organizational policies, and user expectations that resist pre-deployment specification. This creates a practical gap: guardrails must adapt to their own operating environments, yet deployment feedback is typically limited to sparse, noisy user-reported failures, and repeated fine-tuning is often impractical. To address this gap, we propose LiSA (Lifelong Safety Adaptation), a conservative policy induction framework that improves a fixed base guardrail through structured memory. LiSA converts occasional failures into reusable policy abstractions so that sparse reports can generalize beyond individual cases, adds conflict-aware local rules to prevent overgeneralization in mixed-label contexts, and applies evidence-aware confidence gating via a posterior lower bound, so that memory reuse scales with accumulated evidence rather than empirical accuracy alone. Across PrivacyLens+, ConFaide+, and AgentHarm, LiSA consistently outperforms strong memory-based baselines under sparse feedback, remains robust under noisy user feedback even at 20% label-flip rates, and pushes the latency--performance frontier beyond backbone model scaling. Ultimately, LiSA offers a practical path to secure AI agents against the unpredictable long tail of real-world edge risks.

1. Introduction

Deployed AI-agent guardrails face contextual safety boundaries, sparse and noisy feedback, and escalating harms from incorrect allow or refusal decisions. LiSA addresses this gap with structured policy memory, conflict-aware local refinement, and evidence-aware confidence gating instead of repeated fine-tuning.

  • Motivation: AI agents’ access to private data, privileged tools, and multi-step workflows raises guardrail errors from answer-quality mistakes to concrete deployment harms.Incorrect allow decisions can leak private information or authorize unsafe actions, while incorrect refusals can block legitimate work.
  • Problem: Static, general-purpose harm definitions fail because acceptable safety and privacy boundaries are shaped by local deployment contexts.The passage identifies existing refusal prompts, safety classifiers, rule-based validators, and runtime monitors as relying on pre-deployment definitions of harm.
  • Problem: Deployment-time adaptation must learn from occasional user corrections under sparse supervision, noisy feedback, and practical constraints against repeated fine-tuning.These constraints distinguish lifelong guardrail adaptation from standard supervised updating.
  • Method: LiSA improves a fixed base guardrail through an online–offline structured-memory loop that abstracts sparse failures into broad policies, preserves mixed-label distinctions with local rules, and gates reuse by accumulated evidence.The framework is described as conservative policy induction rather than repeated base-guardrail fine-tuning.
  • Evaluation: Across PrivacyLens+, ConFaide+, and AgentHarm, LiSA consistently outperforms the fixed base guardrail and strong memory-based baselines under simulated sparse-feedback deployment streams.The evaluation uses two lightweight online guardrails; ablations report that local policies drive the most substantial gains.

2. Related works

Prior work spans diverse guardrailing mechanisms and memory-based adaptation, but guardrail memory faces contextual, user-specific labels and unusually costly errors. Existing adaptive approaches therefore leave unresolved the need for fine-grained, confidence-aware learning from sparse case-level feedback.

  • Guardrailing mechanisms include safety classifiers, toxicity detectors, refusal safeguards, agent-trajectory monitors, and defenses against indirect prompt manipulation.
  • LLM agents accumulate experience by retrieving past trajectories or inducing reusable policies, codes, and reflections, primarily for reasoning and planning.
  • Guardrail labels are contextual and often user- or organization-specific, while a single weakly supported memory reuse can cause privacy leaks or unsafe allow decisions.These properties make broad abstraction useful but naive retrieval substantially more brittle than in task-oriented memory systems.
  • AGrail uses an updatable safety checklist, whereas personalized guardrails condition decisions on user profiles rather than learning from sparse case-level feedback.Checklist adaptation has limited resolution in mixed-label regions and does not explicitly calibrate memory reuse by confidence.

3. LiSA guardrails

LiSA adapts a fixed guardrail through alternating online deployment and offline memory refresh, converting sparse reports into reusable broad policies and targeted local refinements. Confidence gating controls broad-policy reuse according to accumulated evidence, while local rules address mixed-label boundaries.

  • Broad policy memory: Broad policy items abstract reported failures into reusable natural-language statements with labels and metadata, merging semantically overlapping candidates across refreshes.Metadata includes provenance, examples, and runtime support or contradiction statistics.
  • Confidence-gated reuse: Broad-memory confidence uses a posterior lower quantile of support and contradiction evidence, preventing weakly tested items from surfacing too early.A policy with one support and no contradiction has empirical accuracy 1.0 but limited evidence, motivating conservative gating.
  • Inference-time retrieval: At inference, LiSA retrieves semantically similar broad and local candidates, filters broad items with label-sensitive thresholds, and falls back to the base guardrail when no memory applies.Separate refusal and allow thresholds let deployments adjust conservatism without changing the base guardrail.
  • Conflict-aware local policies: LiSA induces narrower, label-specific local policies only in mixed-label regions where broad reuse may cross local decision boundaries.For example, sharing may be allowed for routine coworker coordination but refused for client insurance information lacking need-to-know authorization.
  • Online–offline adaptation: LiSA alternates online guarding with offline refreshes that rebuild broad policies, regenerate local policies, update confidence statistics, and redeploy memory without repeated fine-tuning.The base guardrail remains fixed while accumulated user reports drive continual adaptation.

4. Experimental setting

The experiments test whether a fixed guardrail can improve through sparse deployment feedback and structured memory, while evaluating LiSA’s conservative mechanisms, robustness to noisy labels, and cost–performance trade-offs. Evaluation spans three binary guardrailing benchmarks, simulated multi-day deployment, multiple baselines, and two lightweight online models.

  • Experimental design: LiSA keeps the base guardrail fixed, learns only from misclassified inputs, and periodically refreshes structured memory instead of repeatedly fine-tuning.The setup examines sparse adaptation, local refinement in mixed-label regions, and evidence-gated broad reuse.
  • Datasets: Three binary benchmarks—PrivacyLens+, ConFaide+, and AgentHarm—cover contextual privacy boundaries and harmful agent behavior in a shared binary decision space.The “+” privacy variants include ambiguous contextual cases, enabling evaluation of local decision boundaries under subtle contextual differences.
  • Deployment simulation: During N-day deployment simulations, adaptive methods receive feedback only for daily misclassifications, update memory before the next day, and are evaluated after each update on a fixed held-out test set.Noisy-feedback experiments independently flip reported failure labels.
  • Baselines: LiSA is compared with Pure Prediction, AGrail, Synapse, and ReasoningBank, spanning no adaptation, checklists, corrected-case retrieval, and reusable natural-language memories.ReasoningBank functions as a broad-policy baseline in this setting.
  • Implementation details: Online guardrailing uses Gemini-3.1-flash-lite and Claude-Haiku-4.5, while policy induction and retrieval use fixed Gemini-3.1-pro and Gemini-embedding-001 components.Accuracy and macro-F1 are reported on the same held-out split and averaged over five seeds.

5. Empirical results

LiSA delivers the strongest performance across all three benchmarks and both online guardrail models, while its local rules and confidence gating address distinct failure modes of broad policy reuse. Under noisy feedback, evidence-aware gating preserves transfer benefits and memory-based adaptation improves the latency–performance frontier beyond backbone scaling.

  • Overall performance: LiSA achieves the strongest performance across all three benchmarks and both online guardrail models, with a moderate but consistent gain over ReasoningBank.ReasoningBank outperforms AGrail and Synapse, indicating that broad policy abstraction transfers more reusable signal than checklist summaries or isolated case reuse.
  • Ablation study: Removing local rules causes the largest mean performance drop, while removing confidence gating has a smaller mean effect but increases seed variance.The ablation supports local refinement as the source of boundary-level F1 gains and confidence gating as the stabilizer, especially under noisy labels.
  • Noise robustness: Under noisy feedback, LiSA retains most of its clean-feedback gain by requiring broad policies to accumulate evidence before reuse and lowering confidence when contradictions appear.Broad abstraction transfers well at 𝜌= 0% but can spread mislabeled guidance, whereas direct retrieval localizes errors and degrades more gradually.
  • Confidence measurement: At 𝜌=20%, the Beta lower quantile is the most stable reuse rule because it blocks weakly tested policies while allowing repeatedly validated policies to surface.Empirical-accuracy gating ignores evidence volume, treating one support and many supports identically when both have accuracy 1.0.
  • Latency–performance trade-off: Memory-based adaptation shifts the latency–F1 frontier upward beyond static backbone scaling, while offline refresh amortizes its cost across later decisions.AGrail remains below the scaling frontier because checklist reasoning adds latency without commensurate sparse-feedback gains; LiSA is closest to the oracle.

6. Conclusion

The conclusion argues that effective lifelong safety adaptation requires calibrated reuse of deployment experiences rather than fine-tuning or larger models. LiSA provides this conservative middle ground through structured policy memory and evidence-calibrated adaptation to local norms and evolving user expectations.

  • Conclusion: LiSA improves guardrail performance through structured policy memory that generalizes sparse failures, preserves boundary cues, and gates weakly supported memory.Its design combines abstractions, local rules, and confidence gating to prevent over-generalization.
  • Conclusion: Effective adaptation does not require fine-tuning or larger models, but does require calibrated reuse of deployment experiences.This conclusion follows LiSA’s results under sparse, noisy user-reported failures.
  • Conclusion: Conservative policy induction enables guardrails to learn from deployment environments while preserving evidence-grounded caution against over-refusal and unsafe permission.The approach addresses the tension between static guardrails and unconstrained adaptation to local norms and evolving user expectations.

A. Limitations and practical implications

LiSA’s evidence comes from controlled benchmark deployment simulations rather than live guardrail logs, and its formal results support individual memory operations rather than end-to-end guarantees. Practical deployment requires calibrating thresholds to application risks and feedback quality, with asymmetric trade-off control not demonstrated here.

  • Benchmark simulation as a controlled deployment proxy: LiSA is evaluated in controlled benchmark deployment simulations, preserving sparse feedback, self-error corrections, periodic memory refresh, and held-out adaptation.The simulations enable controlled, reproducible comparisons but cannot capture all properties of live deployment.
  • Threshold calibration as practical guidance: The recommended starting point is τ_refuse = τ_allow = 0.55, applied to the lower 5% posterior quantile for broad policy items.This threshold is conservative because broad policies with no contradictions require about five contradiction-free supports before surfacing.
  • Threshold calibration as practical guidance: The symmetric threshold blocks one-off broad memories and weakly supported broad policies while permitting adaptation after modest evidence accumulates.A support-count example given in the passage is (15, 5) to pass.
  • Asymmetric thresholds as a deployment interface: LiSA supports asymmetric refusal- and allow-oriented thresholds, but this work does not demonstrate calibrated control of the false-accept/false-refuse trade-off.In benchmark simulations, surviving broad policy items often became high-confidence after sufficient evidence, limiting the informativeness of threshold sweeps.
  • Scope of formal results: The formal results provide component-level design support: local refinement targets mixed-label regions, while confidence-gated broad reuse supplies evidence-sensitive surfacing.Neither proposition models the full prompted guardrail, retrieval dynamics, or closed online–offline feedback loop; empirical gains reflect the joint memory-and-inference system.

B. Formal results and proofs

The formal results show that conflict mass identifies where refinement can reduce Bayes risk, while posterior lower-bound gating controls the reliability of surfaced memory. These guarantees are conditional on stated refinement assumptions and accumulated evidence, with scope limits for deployed prompt-level behavior and selection dynamics.

  • B.1. Notation: The coarse reuse state is a measurable coarsening of the conflict-aware local state, with corresponding conditional positive-label posteriors defined on each representation.The notation specifies 𝜙𝐵 = T◦𝜙𝐵𝐿 and defines 𝜂𝐵(𝑧) and 𝜂𝐵𝐿(𝑢).
  • B.2. Conflict mass bound on refinement gain: Conflict mass bounds the attainable Bayes 0–1 risk reduction from refining any broad state, with zero gain on pure states.The bound is paired with the condition Δ(𝑧) = 0 when 𝜂𝐵(𝑧) ∈ {0, 1}.
  • B.2. Conflict mass bound on refinement gain: Under independent unit-cost refinements, ranking broad states by conflict mass maximizes the attainable upper bound on total risk reduction.This follows by selecting the top B nonnegative summands, but it is a ranking criterion rather than an absolute guarantee when refinements are coupled.
  • B.3. Corollary: standard refinement inequality: Refinement recovers the classical risk inequality, with strict improvement exactly when a positive-measure broad state is split across the Bayes boundary 1/2.The proposition localizes the classical refinement gain to conflict mass at the broad-state level.
  • B.4. Posterior surfacing guarantee: For gating threshold 𝜏, every surfaced broad item has posterior failure probability at most 𝛿 and expected failure at most (1 − 𝜏) + 𝛿.The guarantee applies when Conf(𝑞) ≥ 𝜏 and uses a lower 𝛿-quantile of the Beta posterior.
  • B.6. Adaptive tightness: Beta vs. Hoeffding: The Beta lower bound adapts to empirical variance, separating clearly reliable or unreliable items faster than Hoeffding while remaining cautious near empirical reliability 1/2.Its variance term shrinks as ˆ𝜃ₙ approaches 0 or 1, whereas Hoeffding uses worst-case variance 1/4.
  • B.7. Monotonicity and scope: With equal empirical means, greater accumulated evidence produces a tighter lower bound because the confidence score is nondecreasing in successes and nonincreasing in failures.This compares broad items with identical empirical means but different total evidence.
  • B.7. Monotonicity and scope: The propositions do not model deployed prompt-level inference behavior or full-memory selection dynamics, and the surfacing guarantee is conditional on accumulated evidence.Earlier broad-memory gating decisions affect post-surfacing evidence, limiting the scope of the guarantee.

B.5. Corollary: label-sensitive thresholds as separate error budgets … C.4. LiSA offline refresh

LiSA separates refusal- and allow-oriented posterior error budgets through label-specific thresholds, while its offline refresh converts sparse reported failures into broad policies and conflict-aware local rules. Experiments use deployment streams with misclassification-only feedback, fixed held-out evaluation, specified model/retrieval settings, and controlled label noise.

  • B.5. Corollary: label-sensitive thresholds as separate error budgets: Label-specific thresholds allocate independent posterior error budgets to broad refusal-oriented and allow-oriented memory.The refusal-oriented bound uses 1 −𝜏refuse, while the allow-oriented bound analogously uses 1 −𝜏allow.
  • B.5. Corollary: label-sensitive thresholds as separate error budgets: Operators can raise 𝜏refuse to reduce over-refusal or 𝜏allow to reduce over-acceptance, with the two budgets set independently.The corresponding surfaced-memory posterior expected error is bounded by 1 −𝜏refuse or 1 −𝜏allow, respectively.
  • C.1. Deployment simulation and splits: Experiments evaluate PrivacyLens+, ConFaide+, and AgentHarm in a shared allow/refuse label space using group-preserving splits.The “+” datasets expand the originals with additional ambiguous-context variants, and derived rows from one base scenario remain grouped.
  • C.1. Deployment simulation and splits: Each deployment day provides streamed queries for prediction, then only misclassified cases with reported labels for adaptation; a fixed held-out set is evaluated after every update.Held-out examples are never used for adaptation, and results are averaged over five seeds unless otherwise stated.
  • C.2. Model and retrieval configuration: The online guardrail is Gemini-3.1-flash-lite or Claude-Haiku-4.5, while offline reflection and policy induction use Gemini-3.1-pro with Gemini-embedding-001 retrieval.Generation uses temperature 0, and retrieval is bounded to at most five similar cases and two policy-like memory items per memory type.
  • C.3. Policy gating and noise construction: LiSA uses Beta lower-credible-bound gating with prior Beta(1, 1), 𝛿= 0.05, and default thresholds 𝜏refuse = 𝜏allow = 0.55.If no local rule or threshold-passing broad policy is retrieved, LiSA falls back to the base guardrail; noisy feedback flips reported labels with probability 𝜌, not held-out labels.
  • C.4. LiSA offline refresh: At day end, LiSA induces broad preventive items from newly reported failures and rebuilds conflict-aware local rules from accumulated case memory.Broad items are grouped and merged by embedding similarity, while local rules preserve mixed-label neighborhoods and capture narrow boundary cues.
  • C.4. LiSA offline refresh: Local rules are generated only from semantic neighborhoods containing both labels, whereas broad policies provide reusable default guidance and are confidence-filtered before serialization.Retrieved local rules are serialized directly as narrow warning or exception cues, and broad-policy evidence is updated through support and contradiction counts.

C.5. Baselines implementation … D. Additional discussion and case study

The paper compares memory-based guardrails through a controlled ablation hierarchy and specifies LiSA’s inference, induction, and deterministic local-rule procedures. Experiments use publicly available assets and commercial API models under their applicable licenses and terms.

  • C.5. Baselines implementation: All baselines share the binary decision task and JSON label interface, while differing primarily in the memory objects they maintain and retrieve.Pure Prediction uses only the base prompt; AGrail retrieves checklist notes, and Synapse retrieves similar decision records.
  • C.5. Baselines implementation: The adapted baselines form an ablation hierarchy from no memory, to raw case reuse, to broad policy abstraction, and finally LiSA’s added local and confidence mechanisms.LiSA isolates the contributions of conflict-aware local memory and conservative confidence-gated broad-policy reuse.
  • C.6. LiSA prompt templates: LiSA uses fixed templates, while confidence updates, policy merging, and local-rule construction are handled through exact label counts and deterministic procedures rather than separate update prompts.New failures are converted into structured items, and the Beta lower credible bound is recomputed after feedback.
  • C.6. LiSA prompt templates: LiSA’s inference template combines the current scenario with retrieved cases, local rules, and confidence-filtered broad policies, falling back to the base guardrail when no memory survives filtering.The system explicitly checks each retrieved item as apply, skip, override, or uncertain before deciding.
  • C.6. LiSA prompt templates: The offline induction template converts day-end failures into compact, reusable preventive memories, while local rules are regenerated separately from mixed-label neighborhoods.Induced items include a risk pattern, preventive rule, decisive boundary, deferral condition, label, and rule type.
  • C.6. LiSA prompt templates: Conflict-aware local rules are rendered deterministically as narrow exception cues grounded in support, nearby contradictions, and decisive pivots.The rendering instructs the system to apply a local rule only when the current case matches the same local pattern.
  • C.7. Existing assets and licenses: The study uses publicly available datasets and commercial API models according to their released licenses or API terms of service.Claude-Haiku-4.5 is accessed through Google Vertex AI, and AgentHarm use is described as consistent with its research safety restriction.

D.1. Offline adaptation cost · D.2. Impact of offline manager quality

LiSA shifts adaptation expense off the critical serving path: sparse failures trigger offline policy induction, whose cost is amortized across later guarded decisions. Offline manager quality materially affects performance because sparse feedback allows weak abstractions to persist and influence future inferences.

  • D.1. Offline adaptation cost: LiSA performs offline memory refresh when accumulated user-reported failures trigger adaptation, while runtime latency remains the deployment-critical cost.Offline refresh is not on the critical inference path.
  • D.1. Offline adaptation cost: 427 input tokens and 2300 output tokens are consumed on average per reported failure during offline policy induction.The reported cost is measured per failure rather than per guarded decision.
  • D.1. Offline adaptation cost: Unlike base-model scaling, LiSA pays adaptation cost only for sparse reported failures and reuses induced policies across many later inputs.This cost structure motivates comparing cost with runtime serving cost in the main cost–F1 analysis.
  • D.2. Impact of offline manager quality: Runtime latency is incurred on every guarded input, whereas the offline manager runs only when sparse failures accumulate and memory is refreshed.The two mechanisms therefore affect different cost axes.
  • D.2. Impact of offline manager quality: 0.962 to 0.915 final-day macro-F1 is the performance drop after replacing the default offline manager with a weaker model while fixing the online guardrail.The result indicates that offline abstraction quality contributes materially to final performance.
  • D.2. Impact of offline manager quality: Offline managers must generalize broad policies from few reports and identify boundary-sensitive local refinements in mixed-label regions.They perform substantive abstraction rather than merely formatting failures into memory entries.
  • D.2. Impact of offline manager quality: Sparse, periodic feedback allows a single low-quality abstraction to persist and affect many future inferences.Dense feedback could instead support rapid online correction, while offline refresh remains outside the critical serving path.

D.3. Examples of generated policies

LiSA generates broad policies from sparse reports and conflict-aware local rules for mixed-label boundaries. The examples include general guidance on sharing non-sensitive information and distinguishing public information from confidential secrets.

  • Broad General Policy: LiSA’s broad policy permits sharing general, publicly available, or non-sensitive information when protected personal or proprietary data is not disclosed.The policy is recommended as appropriate, with Support = 170, Contradictions = 2, and Confidence: 0.964.
  • Broad General Policy: LiSA’s second general policy says to isolate the information being shared rather than infer inappropriateness from a related confidential secret.It treats public advocacy, volunteer work, event attendance, and general opinions as appropriate when the secret itself is not disclosed.
  • Conflict-Aware Local Rules: LiSA uses complementary local rules to resolve a boundary-heavy region where cases split between appropriate and inappropriate contexts.The rules address the region ‘sharing Ben attended a public lecture...’ with opposing classifications.
  • Conflict-Aware Local Rules: The local rules distinguish cases using information type and sharing reason, contrasting public lectures and interfaith dialogue with fringe groups and differing emotional motivations.Appropriate cases involved Emily expressing concern, while inappropriate cases involved Sarah sharing her growing fears.
Loading 2605.14454v1…