arXiv cs.AI· Pierre Dantas, Lucas Cordeiro, Ehsan Nowroozi, Norbert Tihanyi·· 13 小时前AI 评分42
面向安全 LLM 智能体：规范、验证与执行综述
Toward Safe LLM Agents: A Survey of Specification, Verification, and Enforcement
AI 导读
一篇 PRISMA 2020 系统综述梳理了 2022-2026 年间 38 项 LLM 智能体规范、验证与执行研究，指出规范是瓶颈：某基准上自然语言转 PDDL 仅 24.8-34.2% 语义正确。
正文 · 原文
Abstract:Large Language Model (LLM) agents take irreversible real-world actions, yet no system gives formally grounded, task-level safety guarantees for their plans. In a PRISMA 2020 systematic review, we searched six databases (20-29 May 2026) for work on LLM agent specification, verification, and enforcement published in 2022-2026. We narratively synthesized 38 studies, assessed risk of bias per study, and graded evidence certainty with GRADE. Three authors independently screened a repeated search to validate the single-reviewer screening (agreement: Fleiss' $\kappa = 0.81$). First, specification is the bottleneck: on one benchmark, only 24.8-34.2% of LLM translations from natural language into Planning Domain Definition Language (PDDL) are semantically correct. Second, runtime monitoring is the most mature enforcement strategy; it reduced unsafe actions by 65.37% in one household-agent study, but its guarantees cover only single steps or short horizons. Third, in one $\tau$-Bench study of transactional tool-use agents, blocking 94% of unsafe actions still left fewer than 5% of tasks completed both safely and correctly in most settings, because agents found other unsafe routes (the verifier tax). Fourth, no approach simultaneously achieves soundness, completeness, scalability, semantic grounding, and utility preservation. For seven of the nine principal claims, GRADE gives the lowest certainty rating (Very Low), meaning further studies are likely to produce substantially different figures; each rests on one or two studies in narrow domains. Two of the open problems we rank highest are translating requirements into formal specifications that keep their meaning and enforcing safety over whole plans rather than single actions. We contribute a three-level taxonomy and an agenda of ten open problems.
| Comments: | 37 pages, 2 figures, 11 tables. Revised version under review at ACM Computing Surveys. Data deposit: this https URL. PRISMA 2020 checklist included as an ancillary file |
| Subjects: | Artificial Intelligence (cs.AI) |
| ACM classes: | A.1; D.2.4; I.2.8 |
| Cite as: | arXiv:2608.14590 [cs.AI] |
| (or arXiv:2608.14590v3 [cs.AI] for this version) | |
| https://doi.org/10.48550/arXiv.2608.14590 arXiv-issued DOI via DataCite |
Submission history
From: Pierre Dantas [view email]
[v1]
Mon, 22 Jun 2026 21:03:26 UTC (88 KB)
[v2]
Sat, 17 Oct 2026 17:11:48 UTC (159 KB)
[v3]
Tue, 20 Oct 2026 18:43:44 UTC (173 KB)
来源：arXiv cs.AI · arxiv.org