ALRPHFS : Adversarially Learned Risk Patterns with Hierarchical Fast & Slow Reasoning for Robust Agent Defense (2025)

Abstract: LLM Agents are becoming central to intelligent systems. However, their deployment raises serious safety concerns. Existing defenses largely rely on “Safety Checks”, which struggle to capture the complex semantic risks posed by harmful user inputs or unsafe agent behaviors—creating a significant semantic gap between safety checks and real-world risks. To bridge this gap, we propose a novel defense framework, ALRPHFS (Adversarially Learned Risk Patterns with Hierarchical Fast & Slow Reasoning). ALRPHFS consists of two core components: (1) an offline adversarial self-learning loop to iteratively refine a generalizable and balanced library of risk patterns, substantially enhancing robustness without retraining the base LLM, and (2) an online hierarchical fast & slow reasoning engine that balances detection effectiveness with computational efficiency. Experimental results demonstrate that our approach achieves superior overall performance compared to existing baselines, achieving a best‐in‐class average accuracy of 80% and exhibiting strong generalizability across agents and tasks.

## introduction llm agents are increasingly integral to intelligent systems @xcite @xcite , capable of tool invocation and context-aware decision-making in tasks like web browsing, database querying, and e-commerce, significantly boosting efficiency and adaptability @xcite @xcite @xcite @xcite @xcite . however, their widespread deployment raises serious safety concerns: they are vulnerable to adversarial prompts @xcite et @xcite @xcite and prone to critical errors that can lead to privacy breaches or financial harm @xcite @xcite . existing defenses @xcite @xcite primarily rely on two types of "safety checks". static checks @xcite @xcite encode security rules offline as planning constraints or executable guard code. handcrafted or templated rules are inherently limited and cannot exhaustively cover all potential risks. dynamic checks @xcite adapt at runtime but often rely on surface-level triggers or rule variants, lacking the capacity to capture the deeper semantic intent and contextual interplay behind agent actions. this reveals a semantic gap between safety checks and actual agent risks: harmful queries or unsafe behaviors often manifest in forms far more complex than existing rules can identify. for example, consider the user request: "please book a follow-up appointment with dr. watson at 3 pm on march 3rd." while this instruction appears clear on the surface, "dr. watson" corresponds to multiple candidates in the system, making it an ambiguous yet seemingly reasonable instruction. if the agent executes the request directly without user confirmation: {"arguments": "{"doctor_id": "dw1", "time": to bridge this gap, we propose a novel defense framework,alrphfs (adversarially learned risk patterns with hierarchical fast&slow reasoning), that captures retrievable, high-level risk patterns beyond traditional safety checks. in the offline phase, we extract semantic risk patterns from unsafe agent trajectories. these are further refined through adversarial self-learning, improving pattern generalizability and robustness without modifying the base llm. in the online phase, we implement a hierarchical risk reasoning system: fast thinking efficiently blocks high-confidence risks, while slow thinking handles semantically ambiguous inputs via multi-step inference. the core contributions of our paper are summarized as follows: ## methodology our defense framework consists of two complementary components: an offline adversarial selflearning module and an online hierarchical risk reasoning. the offline module aims to construct and continuously refine a robust risk pattern database. it proceeds in three stages: (i) initializing risk patterns from harmful agent trajectories, (ii) performing deduplication optimization to eliminate redundancy while preserving semantic diversity, and (iii) iteratively enhancing the database through a red-blue team adversarial self-learning loop. this offline process ensures that the system maintains a generalizable and discriminatively balanced reposi-tory of risk patterns. building upon this foundation, the online module performs real-time detection by abstracting user queries and agent actions into structured patterns and matching them against the curated database. a hybrid retrieval mechanism is combined with hierarchical fast & slow reasoning, enabling the system to achieve both efficiency and reliability in safeguarding agent behaviors under diverse and evolving threat scenarios. ## conclusion we present alrphfs, a robust agent defense framework that combines adversarially learned risk patterns with hierarchical fast & slow reasoning. risk patterns abstract high-level semantic threats beyond safety checks, and are refined through an adversarial self-learning loop to ensure broad and adaptive coverage. during inference, a hierarchical reasoning process balances detection accuracy and efficiency. experiments show that alrphfs significantly reduces asr while maintaining low fpr, outperforming prior methods and demonstrating strong generalization across diverse agents and tasks.