ReDiR compresses the whole trajectory into a latent safety signal, holding decomposition attacks below 8%.

The target is attacks where a harmful objective is split across individually plausible requests and tool calls, so the harm is only visible in the accumulated trajectory. Existing defenses either pay for auxiliary online reasoning or judge actions after generation, which ties them to a specific runtime action representation (arXiv 2608.25711). ReDiR injects a compact latent safety representation into the frozen base model at generation time, learned via same-model cross-view supervision, and holds attack success below 8% across two agent-safety benchmarks, three model families and eight held-out tool domains.