VACS: Value-Aligned Compositional Shielding for Multi-Agent Reasoning
Organizations: School of Computing and Information Technology, University of Wollongong, Wollongong, NSW, Australia · CSIRO’s Data61, Clayton, VIC, Australia · School of Computer Science and Information Technology, Adelaide University, Adelaide, SA, Australia
Abstract
Multi-agent reasoning systems in high-stakes domains must be both accurate and safe, yet agents often follow heterogeneous value priorities (e.g., rigor, conciseness, safety), causing conflicting recommendations. Existing methods do not jointly provide: (i) principled inference of each agent's implicit values from behavior, (ii) compositional formal safety guarantees without full online communication, and (iii) value-aware conflict resolution with faithful explanations. We present VACS (Value-Aligned Compositional Shielding), a four-layer framework addressing all three. Layer 1 learns value-dimension rewards from pairwise preferences using Bradley-Terry modeling and infers per-agent value weights via deep MaxEnt IRL. Layer 2 encodes value constraints in a Lean-inspired DSL and synthesizes compositional assume-guarantee shields for runtime safety. Layer 3 resolves disagreement through nucleolus-based credit allocation and Hamiltonian consensus optimization under long-term value constraints. Layer 4 extracts a critical reasoning path from co-state sensitivities and generates formally grounded natural-language explanations. Our contribution is primarily a unified systems design with formalized interfaces and operational guarantees at the verifier-constrained decision level, rather than a complete end-to-end formal proof of all language-model internals. In controlled proof-of-concept evaluations with role-conditioned agent panels on NEJM-AI QA, MathInstruct-Subset, and a cybersecurity incident-response benchmark (CyberSec-Eval), VACS outperforms strong baselines in accuracy (85.4%, 95.0%, and 90.0%) while reducing logical inconsistency rates to near zero.
Figures & tables
| Method | MathInstruct | NEJM-AI QA | CyberSec-Eval | LIR | Faith. |
| Majority Vote | 90.5 | 78.0 | 64.0 | 31.7 | , |
| Weighted Vote | 92.0 | 80.5 | 68.0 | 28.4 | , |
| Informed Voting | 93.5 | 81.8 | 72.0 | 25.0 | , |
| Shield-Only | 94.0 | 78.5 | 82.0 | 7.8 | 0.67 |
| VACS | 95.0 | 85.4 | 90.0 | 0.0 | 1.00 |
| Configuration | Acc. | LIR | Faith. | VP | Cons. Stab. |
| Full VACS (4 layers) | 95.0 | 0.0 | 1.00 | 0.89 | 0.94 |
| w/o Layer 1 (uniform value profiles) | 90.5 | 0.0 | 1.00 | 0.41 | 0.78 |
| w/o Layer 2 (no shields) | 95.0 | 14.7 | 1.00 | 0.89 | 0.81 |
| w/o Layer 3 (majority vote consensus) | 90.5 | 2.0 | 1.00 | 0.89 | 0.63 |
| w/o Layer 4 (no explanation) | 95.0 | 0.0 | 0.00 | 0.89 | 0.94 |
Appendix figures & tables1 asset
Supplementary material from the paper’s appendix.
Appendix
| Method | Expert (1–5) | CF Drop | Suff. | Nec. | Del-AUC | Ins-AUC |
| Random rationale | 1.9 | 0.44 | 1.00 | 0.14 | 0.49 | 0.51 |
| Verifier-only trace | 3.4 | 1.00 | 1.00 | 1.00 | 0.51 | 0.49 |
| Gradient-only saliency | 3.2 | 0.60 | 1.00 | 0.16 | 0.41 | 0.59 |
| VACS Layer 4 (hybrid) | 4.5 | 0.50 | 1.00 | 0.16 | 0.41 | 0.59 |
AI Agent Safety
AI agent safety studies how to prevent and detect harmful actions by autonomous systems that use tools, memory, and multi-step plans.
See all 326 papers