ReDiR compresses the whole trajectory into a latent safety signal before each action, cutting multi-turn decomposition attacks below 8%

arXiv·medium signalXBlueskyLinkedInCopy link

arXiv 2608.25711 (26 Aug) targets attacks where a harmful objective is split across individually plausible requests and tool calls, so the harm is only visible in the accumulated trajectory. Existing defenses either pay for auxiliary online reasoning to recover long-horizon evidence or judge actions after generation, which ties them to a specific runtime action representation. ReDiR instead compresses the trajectory into a compact latent safety representation injected into the frozen base model at generation time, learned via same-model cross-view supervision. It holds attack success below 8% across two agent-safety benchmarks, three model families and eight held-out tool domains.