JANUS trains foresight guards for long-horizon agents
New research pitches JANUS, a training framework that teaches a guard model to predict and block risky agent actions before they fire. By anticipating future steps, the guard cuts attack success rates by 15.9 points over baseline guards and keeps benign task success up, though it relies on simulated data.
Reactive guards watch a Large Language Model (LLM) agent make a mess, then try to mop up. JANUS flips that: it trains a guard to imagine where a partial trajectory is going and stop the breakage before the tool call lands. The guard, called Vanguard, sits in the loop and adjudicates risk on every step using both what it has seen and what it expects to happen next.
What works
The numbers are solid on the tested benchmarks. Vanguard chops average attack success rate (ASR) to 0.071 compared with 0.230 for six guard baselines and 0.397 with no guard. On a long-horizon planning benchmark, it takes ASR from 0.323 for the strongest step-level baseline down to 0.075, which suggests the foresight bit is doing real work. It also avoids the classic overblocking tax: on AgentDojo benign tasks it hits utility 0.680, 5.1 percentage points better than the guard-baseline average and on par with running without a guard.
Mechanically, JANUS trains two coupled heads. One anticipates short, safety-relevant future summaries from a trajectory prefix. The other adjudicates safety labels using both the prefix and that anticipated summary. The training objective, CoAA-RL, rewards forecasts not just for similarity to the eventual continuation but for their usefulness to the safety decision. The ablations back this up: remove anticipation during training and ASR jumps from 0.072 to 0.148; strip out the summary at inference and it rises to 0.123. Hand the adjudicator an oracle future and ASR drops to 0.052, which is a nice upper bound on what better forecasting could buy. Vanguard also gets sharper as it sees more of the prefix, with average ASR falling from 0.280 at 25 percent of the trajectory to 0.072 at full length.
Where it breaks
This is still a guard trained on simulated worlds. If your attack path diverges from those distributions, the foresight can go cross-eyed. The authors call it out: user, environment or agent-originated inputs that don’t look like the training sims are fair game. Environment injection and novel tool behaviours are explicit risk origins in their taxonomy and obvious evasion lanes.
The cleanest play is patience. Push the harmful action just beyond the guard’s anticipation horizon while keeping early steps bland. Or shape environment feedback so the anticipated summary paints a safe future the adjudicator wants to believe. The evaluation does not characterise generalisation to unseen tools or adaptive adversaries, so oddball tool APIs and delayed detonations are exactly where I’d probe.
JANUS is a real improvement over step-only guards, especially for long plans. Whether it holds up against live systems with messy tools and inventive operators is the uncomfortable question left open.
Additional analysis of the original ArXiv paper
📋 Original Paper Title and Abstract
JANUS: Foreseeing Latent Risk for Long-Horizon Agent Safety
🔍 ShortSpan Analysis of the Paper
Problem
The paper studies long-horizon agent safety for tool-using language agents, where harmful outcomes can emerge many steps after early, innocuous-looking behaviour. Reactive guards that judge only observed steps are often too late to prevent operational failures that can delete files, leak data, corrupt environments or disrupt services. The central challenge is recognising unsafe execution states before a high-impact action is executed, by linking early context to delayed consequences.
Approach
JANUS is a foresight-oriented training framework that synthesises diverse, long-horizon agent trajectories via multi-agent simulation and trains a shared guard policy with two coupled tasks. The anticipation task generates short, safety-relevant summaries of likely future continuations from a partial trajectory prefix. The adjudication task predicts a safety label (safe, potential_unsafe, unsafe) conditioned on both the observed prefix and the anticipated summary. Both tasks are jointly optimised with Coupled Anticipation and Adjudication Reinforcement Learning (CoAA-RL), which rewards anticipations by a mix of fidelity to the ground-truth continuation and utility for downstream adjudication. The deployed guard, Vanguard, performs two-stage prediction at each step and blocks actions when the adjudicator outputs unsafe. Training data consists of 75,180 reviewed simulated examples covering user-originated, environment-originated and agent-originated risks, with samples labelled safe, unsafe or potential unsafe.
Key Findings
- Substantial safety gains: Vanguard attains an average attack success rate (ASR) of 0.071 across four benchmarks versus 0.230 for six guard baselines and 0.397 for no guard, translating to a 15.9 percentage point improvement in average protection over guard baselines.
- Preserves benign utility: On AgentDojo benign tasks Vanguard reaches utility 0.680, 5.1 percentage points higher than the guard-baseline average and matching the no-guard reference.
- Long-horizon benefit: Vanguard reduces ASR markedly on long-horizon planning benchmarks, for example lowering ASR on LPS-Bench from 0.323 (strongest step-level baseline) to 0.075, indicating anticipation is important for planning safety.
- Ablations validate design choices: Removing anticipation at training raises average ASR from 0.072 to 0.148 and reduces benign utility. Removing inference-time summary conditioning raises ASR to 0.123. Conditioning on oracle future summaries further lowers ASR to 0.052, showing headroom from more accurate futures.
- Coupled reward matters: Training with only similarity or only adjudication-utility rewards, or decoupling the tasks, substantially worsens ASR and utility; the coupled CoAA-RL objective is needed to align forecasts with decision usefulness.
- Prefix sensitivity: Vanguard can predict risks earlier as more prefix is observed; average ASR falls from 0.280 at 25% prefix to 0.072 at 100% prefix, already outperforming baselines with sparse evidence in some settings.
Limitations
Training data are generated by multi-agent simulation rather than collected from deployed systems, so simulated tool behaviours and environment feedback may not fully match real deployments. Evaluation is limited to a fixed set of agent backbones, tool-use environments and benchmark scenarios, leaving generalisation to unseen tools, novel adversarial adaptations and different safety policies uncharacterised.
Implications
Offensive implications centre on the dependencies of predictive guarding. Because JANUS relies on simulated future trajectories and learned summaries, an attacker could exploit gaps by crafting user-originated, environment-originated or agent-originated inputs that diverge from the simulated distributions, or by designing adaptive attacks that delay harmful actions until after the guard’s anticipation horizon. Environment-injection vectors and novel tool behaviours are explicit risk origins in the training taxonomy and thus natural avenues for adversaries to evade a foresight guard whose training did not cover those behaviours. The evaluation’s limited coverage of unseen tools and adversarial adaptation further suggests attackers may find effective evasions outside the studied benchmarks.
