PaperlayerView exact revision on arXiv

Source-linked AI summary

Spawn Freely, Act Sparingly: Progressive Risk Vesting for Recursive LLM-Agent Trees

Molly Wang

arXiv:2609.01035v1cs.AIcs.LGmath.PR

TL;DR

Recursive agents need to search broadly without granting every branch irreversible authority. The paper proposes Progressive Risk Vesting, which escrows trajectory risk and charges selected activations under history-conditional certificates. It proves an anytime harm bound and characterizes phase transitions, optimization prices, and synthetic option-value results, while limiting claims to the stated assumptions.

  • Problem

    Recursive branching can improve search but also expands the number of descendants that may receive authority and create irreversible harm.

  • Method

    Progressive Risk Vesting separates sandbox spawning from capability activation, debiting a root risk escrow when selected branches cross an irreversible boundary.

  • Results

    Trajectory harm is linear below authority reproduction rate one, scales as the square root of local risk at one, and retains a positive floor above one.

  • Takeaways & Limitations

    The analysis supports broad sandbox search followed by sparse, risk-charged authority vesting when risk-adjusted continuation value justifies activation.

  • Takeaways & Limitations

    The guarantees require valid certificates conditional on adaptive selection and do not establish safety for deployed systems.

Abstract

from arXiv · show

Recursive LLM agents can broaden their search by spawning specialists. Some branches later request tools that send data or deploy code. When should a branch receive authority to act? We distinguish sandbox spawning, in which external controls prevent the specified harm, from capability activation, in which a selected branch crosses an irreversible-action boundary. Progressive Risk Vesting (PRV) holds a trajectory-level risk budget in escrow and debits it as branches are activated. We prove an anytime harm bound for adaptively generated trees. Branch outcomes may be dependent, but each local certificate needs to remain valid conditional on the full pre-activation history, including the information used to select the request. When activation gates, branch charges, and compute constraints are held fixed, delayed vesting preserves every policy available under irrevocable spawn charging. Marginal risk estimates can still fail after branch selection. In a stylized branching model, trajectory harm changes as the authority reproduction number $\mathcal{R}_A$ crosses one. As local risk $p$ approaches zero, trajectory harm is proportional to $p$ below criticality, proportional to $\sqrt{p}$ at criticality, and retains a positive floor above it. A finite-type occupancy model yields risk and compute shadow prices. For nested fanout modes with decreasing marginal value per unit risk, these prices produce a threshold rule. Branching calculations and a split-sample experiment illustrate the results. These synthetic studies do not estimate safety in deployed agents. The analysis suggests a design rule: search broadly in the sandbox and grant recursive authority sparingly, with an explicit risk charge.

1 Introduction

The paper separates recursive sandbox exploration from granting irreversible authority, proposing Progressive Risk Vesting to preserve search while controlling activation risk. Its guarantees depend on conditional certificates and enforced deployment assumptions.

  • 1.1 The decision hidden inside recursive spawning: Recursive delegation improves search coverage but also expands compute use, authorization exposure, and possible paths to irreversible harm.The paper frames authorization as a separate safety concern from generating reasoning branches.
  • 1.1 The decision hidden inside recursive spawning: Sandboxed branches can explore without consuming risk allowance when external controls prevent the specified catastrophe.Charging sandbox work as if it held production credentials can suppress useful option value.
  • 1.2 Contributions: Progressive Risk Vesting debits a shared risk budget when a selected branch crosses an irreversible boundary, rather than when it is spawned.The approach distinguishes a compute-consuming sandbox tree from an authority tree that consumes risk.
  • 1.2 Contributions: Under fixed gates, charges, and compute limits, delayed vesting preserves every spawn-charging policy and can leave room for better choices.A counterexample shows that marginal calibration can fail when suspicious or difficult branches are selectively escalated.
  • 1.2 Contributions: The paper combines an authority phase-transition analysis with shadow-price optimization and synthetic studies of delayed vesting.The phase transition distinguishes linear, square-root, and nonzero-floor trajectory-harm regimes.
  • 1.2 Contributions: The guarantees apply only when the sandbox, catastrophe definition, and post-selection validity assumptions hold in deployment.They are not universal safety claims.

2 Related Work

Related work covers recursive delegation, authorization, risk-sensitive composition, and branching processes. This paper differs by analyzing online topology growth with parent-selected activations and conditional certificates.

  • Recursive systems: Recent recursive-agent systems create reasoning threads or task-specific agents at runtime, motivating study of their benefits and compute costs.The literature includes THREAD, AgentSpawn, AOrchestra, Recursive Agent Harnesses, WebSwarm, and MaAS.
  • Delegation and compositional risk: Delegation-safety research studies authorization, scope restriction, invalid-action rejection, and resource conservation across chains.These mechanisms address related permission and resource-transfer problems.
  • Delegation and compositional risk: Existing path-risk methods often assume known DAGs or fixed modular trajectories, whereas this paper studies topology unfolding online before branch action.Its response is a conditional certificate at each activation.
  • Propagation and stochastic processes: Branching-process theory informs extinction and total-progeny analysis, while constrained-control occupancy measures allocate compute and risk across authority-bearing branches.The paper separates reproduction of sandbox compute from reproduction of authority.

3 Model

The model treats sandbox generation and authority activation as separate, history-adaptive decisions. A root escrow constrains activation risk, while compute and latency remain separate policy costs.

  • 3.1 Sandbox tree, authority tree, and activation boundary: The system tracks sandboxed exploration, authority assignment order, and a root risk escrow that descendants cannot copy.The sandbox tree may be countable and grows in response to branch discoveries.
  • 3.1 Sandbox tree, authority tree, and activation boundary: A node is sandboxed when external controls make the catastrophe unreachable with its available capabilities.A repository copy without network access is one example; sensitive-data access can instead count as activation.
  • 3.1 Sandbox tree, authority tree, and activation boundary: Activation occurs when a branch proposes a specified harmful action or requests a capability scope that could enable it.A nonrenewable capability lease must cover every use and downstream effect during the lease.
  • 3.1 Sandbox tree, authority tree, and activation boundary: The governor conditions each allowance on the full pre-activation history, including information used to select the request.That history includes the generated tree, requested scope, evidence, and earlier grants and outcomes.
  • 3.1 Sandbox tree, authority tree, and activation boundary: The governor debits the escrow before exposure, while rejected or pre-exposure-cancelled requests incur no debit and exposed retries require new certificates.The escrow constraint is maintained almost surely.
  • 3.2 Decision objective: A policy chooses candidate count, activations, capability scope, and stopping or human-escalation points while trading useful value against compute and latency.The objective keeps trajectory catastrophe probability below the risk budget.
  • 3.2 Decision objective: Sandbox computation uses separate compute and concurrency budgets because the trajectory-level risk constraint is difficult to check online.The escrow supplies a conservative enforceable condition as the tree grows.

4 Analysis

The analysis shows how activation-time risk charging supports adaptive recursive search while preserving trajectory-level harm control. It establishes selection-valid guarantees, option-value dominance over spawn charging, branching phase transitions, and risk–compute threshold policies.

  • Anytime control under adaptive spawning: Adaptive activation remains bounded by a root escrow when each local certificate is valid conditional on the full pre-activation history.The guarantee applies to finite or countable adaptive trees and does not require independent branches or predetermined depth.
  • Why risk should vest at activation: Delayed vesting preserves every spawn-charging policy and can improve choices because discarded spawned branches need not consume catastrophe-risk allowance.The comparison holds fixed the sandbox, activation gate, compute constraints, and branch charges.
  • Why risk should vest at activation: Selection can raise activated-branch risk from the marginal rate r to 2r, so certificates must condition on the information used to select requests.Recursive filtering can repeatedly target higher-risk branches, invalidating marginal calibration after endogenous routing.
  • The authority-reproduction phase transition: Broad sandbox search can remain subcritical when m>1 but ms<1, with expected authority-tree size 1/(1 − R_A).For constant valid charge r, the ex ante union bound is at most r/(1 − R_A), requiring R_A≤1 − r/δ to stay within δ.
  • Risk and compute shadow prices: Finite-type occupancy optimization yields risk and compute shadow prices, and decreasing marginal value per risk produces a fanout threshold rule.The maximizing fanout is the largest k whose marginal value-to-risk ratio is at least λ; tighter risk budgets can increase the risk price.

5 Progressive Risk Vesting Governor

The Progressive Risk Vesting governor keeps descendants sandboxed until a selected request crosses an activation boundary, then applies deterministic checks, conditional certification, and escrow accounting.

  • Progressive Risk Vesting Governor: Sandbox-only capabilities are launched first, separating broad exploration from requests that may cross the activation boundary.The boundary is application-defined and can include secret access, deployment, or execution of a transfer.
  • Progressive Risk Vesting Governor: Each activation request is processed in atomic order, with requester identity, lineage, action, arguments, and capability scope immutably bound before debiting.A branch cannot certify its own request or alter the escrow service.
  • Progressive Risk Vesting Governor: Deterministic policy checks can reject or narrow requests before probabilistic evaluation and certification.Requests exceeding uncommitted lineage escrow are denied or revised.
  • Progressive Risk Vesting Governor: Human approval re-enters the same gate, while each successful pass authorizes one action with fixed arguments and scope.Longer capability leases require certificates covering all uses and downstream effects.
  • Progressive Risk Vesting Governor: Edits, tests, drafts, and other isolated work can remain sandboxed, whereas external effects require escrow.The surrounding system must enforce and log the application-specific boundary.

6 Numerical Results

Two reproducible synthetic studies illustrate the paper’s predictions: authority reproduction produces a phase transition in trajectory harm, while delayed vesting permits broader candidate selection and higher held-out utility in the stylized setting.

  • 6.1 Phase transition: 10^-14 numerical tolerance was used to solve the branching recursion over m∈[0.4, 3] and s∈[0.05, 1].For Poisson candidate counts, authority offspring have mean R_A = ms, with the transition at ms = 1.
  • 6.1 Phase transition: At p = 0.005, trajectory-harm probability is 1.23% for R_A = 0.6, 9.68% at criticality, and 51.86% for R_A = 1.4.The supercritical nonextinction floor is 51.10% as local harm decreases to 10^-5.
  • 6.2 Option value of delayed vesting: 200,000 episodes were split equally between tuning and held-out evaluation for candidate selection under noisy Beta-distributed quality.The study used seed 20260901, trajectory budget 0.05, and a valid single-activation charge of 0.01.
  • 6.2 Option value of delayed vesting: 0.0401 paired utility difference favored progressive vesting, whose held-out mean net utility was 0.7372 versus 0.6971 under spawn charging.The 95% confidence interval for the paired difference was [0.0391, 0.0411].
  • 6.2 Option value of delayed vesting: n = 5 was selected under spawn charging, compared with n = 14 under progressive vesting.Delayed charging leaves more candidate counts feasible when pruning is informative and sandbox compute is charged separately.

7 Scope, Limitations, and Evaluation Roadmap

The paper’s guarantees depend on conditional certificates, enforced sandbox boundaries, and deployment-specific assumptions; its synthetic studies illustrate mechanisms rather than establish safety in deployed systems.

  • Scope and limitations: Conditional certificates must remain valid after adaptive selection, and learned gates require calibration and auditing under the deployment routing policy.Distribution shift, strategic attacks, or a compromised gate can invalidate the guarantee.
  • Scope and limitations: Sandboxed reasoning receives no catastrophe allowance only when external controls make the specified harm unreachable.Sensitive-data access or shared-state modification may cross the boundary, while resource exhaustion remains separate.
  • Scope and limitations: Separate compute and concurrency limits remain necessary because a supercritical sandbox process can consume unbounded compute on nonextinction.Finite-tree safety and catastrophe-risk guarantees do not automatically control resource use.
  • Scope and limitations: Real agent trees may have dependent offspring and correlated failures, so the phase-transition model is diagnostic rather than literal for deployed agents.The conditional escrow result allows dependent branches only when its certificate assumption holds.
  • Evaluation roadmap: A deployment study should compare PRV with unrestricted spawning and spawn charging under matched compute limits, recording gate decisions and capability exposure.Primary outcomes should include catastrophic-action rate and useful task completion with confidence intervals.
  • Evaluation roadmap: Figure 1 reports trajectory-harm probability across subcritical, critical, and supercritical regimes, while Figure 2 reports held-out candidate-selection results.The supplied numerical studies are synthetic and do not estimate safety in deployed agents.
  • Evaluation roadmap: Experiments should keep irreversible actions inside emulators, avoid live credentials, and report both useful autonomy and residual risk.The human operator remains responsible for catastrophe definitions, permission policies, and deployment decisions.

8 Conclusion

Progressive Risk Vesting separates sandbox search from authority delegation by charging the shared risk budget at activation rather than spawn. Under conditional-certificate assumptions, it bounds catastrophic activation in adaptive trees while revealing phase-transition behavior and option value from delayed charging.

  • 8 Conclusion: Progressive Risk Vesting charges the shared risk allowance when a selected branch crosses an irreversible boundary, not when it spawns.This creates separate sandbox and authority trees with different resource costs.
  • 8 Conclusion: Under conditional-certificate assumptions, escrow bounds catastrophic activation probability in adaptively generated trees with dependent branches.The guarantee applies to the stated deployment conditions rather than universally.
  • 8 Conclusion: Trajectory harm is linear in local harm below authority reproduction one, scales with its square root at one, and retains a nonzero floor above one.This phase-transition description concerns the stylized branching benchmark.

A Full Proofs

Progressive vesting preserves the risk accounting needed for spawn-charging policies while charging only activated branches. Because activated branches are a subset of spawned branches, delayed charging weakly expands the feasible policy set.

  • Anytime guarantee: The ledger proof bounds selected debits by the trajectory risk allowance through finite ancestor closures and nonnegative boundary balances.Exhausting the countable activation sequence by finite sets extends the bound to infinitely many activations.
  • Option-value dominance: Activated branches are a subset of spawned branches, so progressive vesting spends no more branch charge than spawn charging.The comparison uses identical sandbox decisions, activation gates, compute constraints, and branch charges.
  • Option-value dominance: Every policy feasible under spawn charging remains feasible under progressive vesting with identical activated actions and harm distribution.The result establishes weak dominance in optimal expected utility, while strict improvement requires additional conditions.

A.3 Branching phase transition

The branching analysis derives trajectory harm from a finite-depth recursion and characterizes its asymptotics across authority reproduction regimes. The occupancy formulation then converts risk-constrained branching decisions into a linear program with shadow prices and threshold policies.

  • Branching phase transition: The no-harm recursion is h_L=(1-p)ψ(h_{L−1}), whose decreasing sequence converges to the largest fixed point.The recursion conditions on the root and offspring, with h_{−1}=1.
  • Branching phase transition: Below criticality, R_A<1, trajectory harm satisfies x=p/(1−R_A)+O(p^2) as local risk p approaches zero.Here x denotes trajectory harm through the fixed-point transformation x=1−h.
  • Branching phase transition: At criticality, R_A=1, trajectory harm scales as x∼√(2p/β).The linear term cancels at the critical point, leaving the quadratic expansion as the leading balance.
  • Branching phase transition: Above criticality, R_A>1, trajectory harm approaches the positive floor 1−ξ, where ξ is the extinction probability.Extinction yields asymptotically harmless finite trees, whereas nonextinction produces harm almost surely for every p>0.
  • Occupancy linear program and duality: Under uniform subcriticality, type occupancies satisfy x=μ+xM_π, and feasible occupancy flows recover an equivalent policy.Finite-dimensional LP duality introduces risk and compute shadow prices; decreasing marginal value per unit risk yields a one-crossing threshold rule.
  • Anytime guarantee: Conditional local harm bounds imply the occupancy risk constraint Σ_i,a y_ia r_ia≤δ, even with adaptive branching and dependent outcomes.The certificates must be valid conditional on the full pre-activation history.

B Numerical Protocol

The numerical protocol combines fixed-point calculations with a split-sample candidate-selection experiment. The experiment compares spawn charging and progressive vesting under controlled candidate quality, score noise, utility cost, and risk allowances.

  • Implementation: The simulation script uses Python, NumPy, and Matplotlib with random seed 20260901 to reproduce plots from accompanying CSV files.The implementation fixes the computational environment described in the protocol.
  • Fixed point: The fixed-point study evaluates 131 m values from 0.4 to 3.0 and 120 s values from 0.05 to 1.0, using local harm 0.005.The asymptotic panel evaluates 121 logarithmically spaced p values from 10^-6 to 10^-1.
  • Candidate selection: The candidate experiment generates 200,000 episodes with 30 candidates each and splits them evenly for selection and held-out evaluation.Using the first n candidates from each episode reduces Monte Carlo noise across n values.
  • Candidate selection: With root allowance 0.05 and charge 0.01, spawn charging permits n≤5, whereas progressive vesting activates the selected candidate and spends 0.01 for every n.Each candidate has an independent Beta(2,2) quality and Gaussian score error with standard deviation 0.15.
Loading 2609.01035v1…