Regressions, Cost, and Safety
Even improvement on unseen tasks and in another environment is not sufficient for acceptance. A revision that solves ten new cases may still be unacceptable if it breaks one previously solved critical task, doubles the cost of every run, or bypasses a tool-permission check. This chapter measures existing capabilities, cost, and safety separately and fixes the acceptance conditions in advance.
Defining Regressions
Compare a candidate and the incumbent on the same instances, and report newly fixed, newly broken, and the fraction of tasks previously solved by the incumbent that the candidate breaks. A mean score or net gain can hide the loss of a single important prior task.
Building a Preservation Set
Regression testing does not mean rerunning every development task each time. Version a preservation set that includes at least the following.
- Representative tasks solved by previous releases
- Failures that have recurred in the past
- Interface contracts for tools, memory, and validators
- Low-frequency but severe safety cases
- Upper-bound cases for cost and latency
- Major versions of the target model and environment
Separate the targeted failure set \(F_t\) from the preservation set \(P_t\). Even if a candidate fixes \(F_t\), do not promote it when it falls below the baseline on \(P_t\).
AgentSquare includes the parent among the candidates in each search phase, making it less likely to select a candidate that performs worse than the parent on the same Eval_d (Shang et al. 2025). GEPA retains specialists for individual validation instances in a Pareto archive (Agrawal et al. 2026). DGM preserves ancestor code in an archive (Jenny Zhang et al. 2026). These mechanisms are useful for rollback and search diversity, but none guarantees regression-free deployment across the full task distribution.
Forgetting Across Repeated Updates
When a harness is updated over multiple rounds, an optimizer that uses only the latest failures may undo earlier improvements. Even if old versions remain in an archive, regressions are not prevented unless the promotion rule examines old tasks.
Do Agent Optimizers Compound? uses a two-phase task stream on Terminal-Bench 2.0 and reports that only a method that incorporated regression control into the search loop achieved both positive transfer and continued improvement (Wang et al. 2026). This is early evidence from a technical report on a single benchmark, but it indicates that continual optimization should use preservation during search rather than only as a final check.
Search Cost and Deployment Cost
There are at least four kinds of cost.
| Cost | When It Occurs | Example |
|---|---|---|
| Search cost | Candidate generation and search | Optimizer tokens, candidate rollouts |
| Verification cost | Before promotion | Compilation, promotion validation, regression tests, safety evaluation |
| Final-reporting cost | After the campaign closes | Repeated evaluation on the sealed test |
| Deployment cost | Every run after adoption | Target tokens, tool calls, latency, retries |
A harness may incur a high one-time search cost while reducing deployment cost. Conversely, a workflow that is cheap to discover but runs multiple agents every time after adoption has a high long-term cost.
Total cost adds the one-time search, verification, and final-reporting costs to deployment cost multiplied by the number of uses. When a study reports only the final workflow’s inference cost, as in AFlow’s cost figure, interpret it separately from the cost of the entire search (Jiayi Zhang et al. 2025). The break-even point depends on the difference from the incumbent and the expected number of uses.
Aligning Evaluation Units
“100 evaluations” means very different things depending on whether it denotes 100 candidates or 100 case-runs. Distinguish proposals, candidates, full validation passes, case-runs, target- and optimizer-model tokens, tool actions, wall time, and concurrency.
AgentSquare and MIPRO can reduce the number of full rollouts by using surrogates, but the accounting should include predictor inference cost and final direct evaluations (Shang et al. 2025; Opsahl-Ong et al. 2024). Do not exclude costs spent on invalid candidates.
Invalid Candidates
The broader the edit surface, the more likely a candidate is to fail before execution.
| Invalidity | Check |
|---|---|
| Syntax / parse | Parser, formatter |
| Type / schema | Type checker, JSON schema |
| Interface | Contract test, required hook |
| Runtime | Sandbox, timeout, resource limit |
| Permission | File, network, tool allowlist |
| Semantic | Unit test, task evaluator |
Report the invalid rate by dividing the number of invalid candidates by the total number of proposals. Reporting performance only for valid candidates overestimates the search efficiency of a broad surface.
Harness-R1 rejects invalid patches using a patch compiler and sandbox (Shao et al. 2026). DGM also executes candidate code before adding it to the archive. Successful compilation, however, does not imply task correctness or safety.
Safety Regressions
A harness changes a model’s permissions and information flow. Safety includes at least the following.
- Expansion of tool permissions
- Compliance with prompt injection
- Inclusion of secrets or private data in context
- Removal or bypass of validators
- Unsafe retries or fallbacks
- Duplicate external side effects
- Modification of evaluators or tests
- Data-retention violations through logging
GEPA’s PUPA experiment is a limited example that addresses personally identifiable information (PII) leakage and task quality together (Agrawal et al. 2026). In contrast, ProTeGi’s “Jailbreak” is a task for classifying jailbreak inputs, not an experiment that measures whether a runtime harness remains safe under attack (Pryzant et al. 2023).
AgentDojo provides a dynamic environment for indirect prompt injection against tool-using agents and measures utility separately from attack success (Debenedetti et al. 2024). Harness safety evaluations should include this kind of untrusted tool output in the regression suite.
Separating Containment from Safety Evidence
Sandboxes, read-only paths, and hook schemas are mechanisms for limiting the scope of damage. They are distinct from evidence that
- Attack success decreased
- No permission violation occurred
- No secret was exposed
- Quality was preserved under adversarial input
The use of sandboxes by DGM and Harness-R1 is important for safely testing candidate code. It does not, however, demonstrate the semantic safety of the generated harness. A safety claim requires attack tasks, a threat model, an evaluator, and results.
Evaluator Overfitting
Because the optimizer maximizes the evaluator score, it can exploit evaluator imperfections. Research on reward overoptimization shows that stronger optimization of a reward model can reduce true performance outside the proxy (Gao et al. 2023).
In harness optimization, this can take the following forms.
- Generate verbose answers preferred by the judge
- Add a hard-coded branch that passes only the unit tests
- Return an incomplete answer immediately before the timeout
- Avoid keywords used by the safety evaluator
- Treat evaluator failure as success
When a large language model (LLM) is also used as the optimizer’s judge, consider self-preference. Research shows that LLM evaluators tend to prefer their own generations (Panickssery et al. 2024). Separating the proposal and judge models does not necessarily eliminate this bias.
As countermeasures, combine executable verifiers, blind human evaluation, multiple independent evaluators, and adversarial audits. Report evaluator disagreement as well.
Acceptance Rule
Fix the promotion contract before viewing the results.
| Gate | Example |
|---|---|
| Quality | Promotion-validation improvement meets the threshold |
| Preservation | Newly broken count and regression rate remain below their limits |
| Cost and latency | Deployment budget and tail latency remain within limits |
| Validity | Invalid rate is reported and the finalist is executable |
| Safety | Zero critical violations |
If a confidence interval crosses a threshold, do not force acceptance or rejection. Mark the result as inconclusive. Treat critical safety tasks as hard gates rather than including them in an average.
Rollback
Some regressions are discovered only after promotion. Rollback capability is part of artifact persistence.
Preserve the incumbent, candidate diff and parent, schema migration, environment compatibility, evaluation record, and rollback trigger together.
A candidate that changes a memory schema or database state cannot be rolled back by reverting code alone. Prepare a backward migration or shadow write.
In a canary deployment, route only part of the traffic to the candidate and compare quality, cost, latency, and safety events against the incumbent in paired observations. Separate human incident response from automatic optimization before using the online evaluator as feedback for the next optimizer update.
Variance and Severe Failures
Agent execution has a long tail. Report median and 95th / 99th percentile latency, timeouts, retries, variance across seeds, worst cases by task family, and the number of catastrophic failures in addition to the mean.
Pairing candidate evaluations with the same seeds can reduce variance, but it should not hide the diversity of sampling in deployment. In the final evaluation, use multiple seeds and compare the candidate and incumbent on the same environment snapshot.
Key Points
Measure improvement on targeted failures separately from preservation of existing capabilities. Separate search, verification, and deployment costs, and include invalid candidates in the budget. A sandbox provides containment, not safety evidence. Adopt only candidates that pass a predefined promotion contract for quality, regressions, cost, latency, and safety.