ReDiR, a generation-time defense for tool-using AI agents, recorded reported attack-success rates of 0.0% to 7.9% in the study's main multi-turn benchmark. Unmodified agents recorded 48.2% to 65.8%, while MAGE recorded 20.3% to 34.2%. ReDiR's reported safe-stop rate ranged from 82.7% to 98.6%.
The figures are descriptive benchmark percentages. No confidence intervals, inferential tests or formal uncertainty estimates were reported.
The document is an arXiv version 1 preprint dated 26 Aug 2026. Its stated questions were whether ReDiR could improve multi-turn safety effectiveness, transfer across tools, preserve benign behavior and improve online efficiency.
What the benchmark measured
The principal MT-AgentRisk set contained 365 harmful tasks. Of 70 Filesystem tasks, 55 were used for supervision and 15 were reserved for evaluation within that domain. A further 295 tasks across eight held-out domains were used to examine cross-tool transfer.
The final optimization set contained 36 trajectory-target pairs drawn from 36 states and 21 tasks. It included 34 full-target examples, two termination-only examples and 20 benign retention pairs, making 56 examples overall.
ReDiR works during action generation. Before each action, it compresses the current trajectory - the sequence of interaction so far - into a latent safety representation, then uses that representation to guide a frozen base model. The representation is learned through same-model cross-view supervision.
The result held on unfamiliar tools
Across the eight held-out domains, reported attack-success rates were 41.0% to 63.4% for unmodified agents, 15.9% to 33.6% for MAGE and 0.0% to 6.8% for ReDiR. ReDiR's safe-stop rate in that transfer test was 85.8% to 98.3%.
Within MT-AgentRisk, ReDiR had the lowest reported attack-success rate across every transformation format and risk carrier tested. On Qwen3.5-9B, its rate was 5.9% for Addition and 4.5% for Decomposition, compared with 26.9% and 35.1% for the strongest competing defense.
A separate AgentDojo evaluation placed ReDiR second-lowest for attack success across all three model families while largely preserving benign utility. MAGE had lower attack success in that comparison, but substantially lower benign utility. The evaluated backbones were Qwen3.5-9B, Ministral-3-8B-Instruct and Gemma-4-E4B.
Reported behavior on benign tasks and system cost
On 50 benign tasks spanning four evaluated domains, ReDiR's task-level false-positive rate was 0.0%, matching the unmodified base agent and ToolShield.
The reported comparison included one safety-encoding pass per action, and ReDiR's average end-to-end latency was 53.3% lower across the three models. Additional GPU memory was reported at 1.328 to 3.250 MiB.
For offline compute, ReDiR used 38.14 GPU-hours versus 60.55 GPU-hours for MAGE. The paper states that ReDiR's figure was 37.0% lower.
Results differed across tested configurations
In a reported design ablation, a backbone-matched safety encoder had 0.0% attack success and 0.0% false-positive rate at K = 8 across three domains. A mismatched 4B encoder had attack-success and false-positive rates of 16.7% and 5.0% at K = 8, and 3.3% and 5.0% at K = 32.
A comparison of training teachers also showed different reported attack-success rates: 0.0% for the same-model teacher, versus 3.3%, 13.3% and 36.7% for the three alternative teachers.
In a fixed test of 30 harmful tasks, the researchers varied benign history across 0, 1, 2, 4 and 8 requests. Overall attack success stayed between 6.7% and 10.0%, while safe-stop rates stayed between 86.7% and 90.0%. Across those tested history lengths, the reported results did not show systematic degradation, but the test covered only fixed tasks in three domains.
The scope remains narrow
These results describe the tested benchmark settings: 365 MT-AgentRisk harmful tasks, eight held-out domains and three evaluated model backbones, alongside an AgentDojo comparison. They do not establish performance beyond the models, tools and tasks evaluated.
The study reports comparisons within benchmark settings, not causal effect estimates. It also reports no run-to-run variability or uncertainty intervals.
Paper data and sources
Original title: Reassembling Distributed Risk: Trajectory-Conditioned Action Generation for Multi-Turn Agent Safety
Authors: Yanbo Dai, Zhenlan Ji, Zongjie Li, Shuai Wang
Journal/Repository: arXiv
Status: Preprint, not yet peer-reviewed
First online: 2026-08-26
DOI: Not available
Original paper · Full text