arXiv cs.CL· Duy Nguyen, Lesly Miculicich, Bhavana Dalvi Mishra, Shuo Li, Krishnamurthy Dj Dvijotham, Mohit Bansal, Tomas Pfister, Long T. Le·· 6 天前AI 评分31
VEPA：面向终身 LLM 智能体的可验证演化形式化策略护栏
VEPA: Verified Evolving Formal Policy for Lifelong LLM Agent Guardrails
AI 导读
VEPA 是一个面向 LLM 智能体护栏的形式化策略可验证演化框架，将护栏表示为基于类型化智能体事件的可执行符号规则，由 LLM 依据部署反馈提出策略补丁，再经确定性验证器只接受结构有效且无冲突的策略。在 ASSEBench-Safety、ASSEBench-Security 和 ATBench 上，VEPA 持续优于基线，并在混合流、损坏反馈和更长周期等更严苛部署条件下保持优势。
正文 · 原文
Abstract:LLM agents increasingly operate over sensitive resources, such as private documents and mutable system states, which can create serious safety and security risks. Runtime guardrails should therefore make inspectable, reproducible, and deterministic allow or refuse decisions before potentially irreversible agent actions are executed. However, safety and security requirements are rarely complete before deployment, so guardrails need to keep adapting as new risks emerge. Existing adaptive guardrails learn from deployment experience, but they usually apply safety policies through LLM inference, which can lead to inconsistent decisions and ambiguous policy interpretations. Formal guardrails, on the other hand, enforce policies deterministically, but they usually rely on pre-deployment or task-specific policies and have no mechanism to adapt to newly observed risks. We introduce VEPA, a framework for the verified evolution of formal agent guardrails. VEPA represents the guardrail as a formal policy of executable symbolic rules over typed agent events. During deployment, we use an LLM guided by deployment feedback to propose policy patches that fix newly observed failures while preserving previously correct behavior. Then, a deterministic verifier only accepts policies that are structurally valid and conflict-free. Finally, an evidence-aware authority layer activates a verified rule only when it has enough supporting evidence, so uncertain updates cannot directly affect guardrail decisions. Across ASSEBench-Safety, ASSEBench-Security, and ATBench, VEPA consistently outperforms baselines while expanding the scope of deterministic formal-policy enforcement. These gains also hold under more challenging deployment conditions, including mixed streams, corrupted feedback, and longer horizons.
| Comments: | 33 pages, 14 figures |
| Subjects: | Artificial Intelligence (cs.AI); Computation and Language (cs.CL); Cryptography and Security (cs.CR); Machine Learning (cs.LG) |
| Cite as: | arXiv:2610.12813 [cs.AI] |
| (or arXiv:2610.12813v1 [cs.AI] for this version) | |
| https://doi.org/10.48550/arXiv.2610.12813 arXiv-issued DOI via DataCite (pending registration) |
Submission history
From: Duy Nguyen [view email]
[v1]
Thu, 8 Oct 2026 23:49:50 UTC (1,043 KB)
来源：arXiv cs.CL · arxiv.org