Stale Does Not Mean Unsafe: Guard Precision for Tool-Using LLM Agents under Infrastructure State Races

Zihao Zheng; Jiayu Long; Baichuan Li; Junyi Yao

cs.AIAug 25, 2026

Stale Does Not Mean Unsafe: Guard Precision for Tool-Using LLM Agents under Infrastructure State Races

Authors: Zihao Zheng, Jiayu Long, Baichuan Li, Junyi Yao

Organizations: Washington University in St. Louis, St. Louis, Missouri, USA · Southern Methodist University, Dallas, Texas, USA

Abstract

Tool-using language-model agents increasingly mutate schedulers, data pipelines, object stores, and access-control systems. Between an agent's read and its commit, external state can change, but not every change makes the commit unsafe. We separate invalidating races, which break a declared safety predicate, from predicate-preserving and irrelevant races, and ask how precisely runtime guards distinguish them. Our deterministic simulator separates visible from authoritative state and injects five non-atomic failure mechanisms across 16 infrastructure tasks in four domains; frozen agent proposals are replayed counterfactually under every controller without an LLM judge. We evaluate three commit-time guard granularities (global epoch, read-set version, semantic commit predicate), multi-level verification, and model-side gates on three locally hosted quantized model families (Qwen3-4B, Phi-4-mini, Gemma4-8B; 3,456 trajectories on one GPU). All three guards eliminate unsafe commits, but their availability differs sharply: freshness-based guards needlessly block 92-95% of benign races, forfeiting up to 43% of safe task completions, while the complete predicate guard blocks none. That precision is contract-dependent: deleting a single declared clause converts exactly its fault family into unsafe commits (up to 7.9%). Model-side signals do not substitute: verbal confidence is miscalibrated (ECE approximately 0.37), action agreement matches a random gate, a cautionary prompt leaves the direct unsafe rate essentially unchanged, and after a freshness-guard block agents re-commit unsafely from refreshed but still-incomplete reads. Under degraded telemetry a hidden concurrent mutation remains observationally clean, bounding every selective policy. Precise runtime enforcement therefore requires semantic contracts, not freshness heuristics or model self-assessment.

Figures & tables

Race class	Authoritative change before commit	$P(u,s)$	Global epoch	Read-set version	Commit predicate
Invalidating	validation=FAILED ; resource version 2	false	Block	Block	Block
Predicate-preserving	audit_epoch=2 ; resource version 2; promotion conditions unchanged	true	Block	Block	Allow
Irrelevant	Ambiguity metadata records prior_operation_applied=false ; resource version remains 1	true	Block	Allow	Allow

TABLE I: Concrete paired example for snapshot promotion. The visible snapshot is validation=PASSED , promoted=false , policy=ALLOWED , and version 1; the declared predicate requires those three facts plus intact integrity. Allow means the frozen proposal reaches the ordinary executor.

Panel of Figure 2 — Fig. 1: Evaluation and deployment boundary. The agent sees only the visible snapshot and emits one frozen mutation proposal. Counterfactual replay sends that same proposal through every controller; the guard comparison changes only the condition evaluated at the atomic hook. Authoritative state is consumed by the hook and deterministic oracle, never as a controller feature.

Domain	Mutations
Scheduler	restart failed, cancel queued, resume paused, scale overloaded job
Pipeline	rerun stage, promote snapshot, rollback release, migrate schema
Storage	delete orphan, move artifact, publish entry, rotate key
IAM	grant role, revoke role, rotate credential, disable account

TABLE II: Infrastructure task families.

Panel of Figure 4 — Fig. 2: Complementary views of the guard-selection problem. In (a), coarse guards fail rightward through benign interventions, incomplete predicate contracts fail upward through leaked hazards, and the complete predicate guard sits at the origin. Panel (b) shows that all model families are overconfident; panel (c) shows telemetry shift moving selective heuristics away from the zero-risk frontier.

Model	Valid	Abstain	Unsafe	AUROC	ECE
Gemma4-8B	1.000	0.000	0.417	0.572	0.377
Phi-4-mini	1.000	0.148	0.346	0.407	0.367
Qwen3-4B	1.000	0.000	0.417	0.519	0.369

TABLE III: Main proposal metrics. AUROC is confidence predicting correct direct execution.

Controller	Unsafe	Safe succ.	Verify cost
Execute	0.393	0.562	0.00
Fast verify	0.078	0.655	1.00
Strong verify	0.000	0.733	4.00
Confidence gate	0.391	0.563	0.11
Agreement gate	0.307	0.595	1.01
Matched random	0.302	0.597	1.01

TABLE IV: Controller macro-average over the three model families. Cost uses normalized verification units.

Profile	Unsafe	Safe succ.	Verify cost
Canonical	0.000	0.736	1.83
Degraded	0.079	0.730	2.17

TABLE V: Evidence router under telemetry shift (macro-average over models).

Split	Model	Unsafe	Cost	Unsupported
ID template	Gemma4-8B	0.000	1.33	0.000
ID template	Phi-4-mini	0.000	1.33	0.000
ID template	Qwen3-4B	0.000	1.33	0.000
OOD telemetry	Gemma4-8B	0.083	2.67	0.500
OOD telemetry	Phi-4-mini	0.071	2.67	0.500
OOD telemetry	Qwen3-4B	0.083	2.67	0.500

TABLE VI: Learned support-aware router on frozen test splits.

Guard	Block inv	Benign pres	Benign irr
Global epoch	1.000	0.946	0.917
Read-set version	1.000	0.946	0.000
Commit predicate	1.000	0.000	0.000

TABLE VII: Guard precision by race type, pooled over models. Block rates on invalidating races enforce safety; blocks on predicate-preserving or irrelevant races are benign interventions that forfeit the task.

Declared contract	Unsafe	Safe succ.	Leaked hazards
Complete contract	0.000	0.733	–
No integrity clause	0.000	0.733	none (subsumed)
No duplicate clause	0.040	0.693	completed effects
No status clause	0.064	0.733	stale reads
No policy clause	0.080	0.733	concurrent mutation

TABLE VIII: Predicate guard under contract incompleteness (macro-average over models). Each missing clause converts exactly its fault family into unsafe commits without touching availability.

$c_{p}$	Predicate	Version	Strong verify
1	3.674	6.828	6.674
1.5	4.174	6.828	6.674
2	4.674	6.828	6.674
3	5.674	6.828	6.674
4	6.674	6.828	6.674

TABLE IX: Predicate-check cost sensitivity at

\lambda_{U}=100

and

\lambda_{F}=10

(macro-average). Outcomes are fixed; only the normalized semantic-check cost

c_{p}

varies.

Returned evidence	Abstain	Recommit	Recommit unsafe
Fast verify	0.479	0.521	0.360
Strong verify	0.639	0.361	0.192
Guard block + refresh	0.558	0.442	0.319

TABLE X: Layer-B replanning after returned evidence, on the matched population of race decisions where a version guard fires (432 per level, pooled over models). Recommit-unsafe is the unsafe rate among non-abstaining replans.

Model	Abstain		Direct unsafe
	base	aware	base	aware
Gemma4-8B	0.000	0.000	0.417	0.417
Phi-4-mini	0.148	0.266	0.346	0.301
Qwen3-4B	0.000	0.000	0.417	0.417

TABLE XI: Prompt-level caution control: identical scenarios with an explicit instruction to consider staleness, ambiguous commits, and concurrency.

Runtime Enforcement for AI Agents

Runtime enforcement for AI agents checks and constrains actions as they execute, helping prevent unsafe or unauthorized effects.

See all 276 papers

Aug 6, 2026

DreamGuard: Efficient Runtime Guardrail for LLM Agents via Risk-Aware World Model

As large language model (LLM) agents increasingly invoke external tools and interact with real-world systems, unsafe actions may cause irreversible consequences on external states, user data, and downstream services. Recent runtime guardrails mitigate such risks by checking proposed actions before execution, but many remain reactive: they primarily assess the apparent safety of the current action, lacking an explicit model of how risk evolves across the trajectory. This limitation creates a critical blind spot for long-horizon risks, where individually benign-looking actions can gradually drift the agent toward hazardous states. In response, we propose DreamGuard, a proactive guardrail for LLM agents built around a risk-aware world model. The world model maintains a compact recurrent latent state over the trajectory and predicts future latent states from which DreamGuard derives immediate-hazard and prefix-risk evidence. It then fuses these multi-horizon signals into intervention decisions before execution. Experiments across four benchmarks and an online guardrail evaluation show that DreamGuard outperforms generic, reactive, and proactive guardrail baselines, achieves the best safety-utility trade-off among evaluated guardrails, and maintains an average end-to-end latency of 25 ms per call.

Wenhao Lin, Chenyu Yu, Xingwei Lin +6

Zhejiang University · Nanjing University of Posts and Telecommunications · Sun Yat-sen University

LLM World Models LLM Guardrails World Models Runtime Enforcement for AI Agents LLM Agent Safety Long-Horizon LLM Agents

Ask PDF

Jul 11, 2026

Temporary Authority, Permanent Effects: Commit-Time Authorization for LLM Agents

LLM agents can commit durable effects from authority evidence that was valid earlier in execution: a DOM snapshot, approval epoch, version witness, branch token, or worker result. We study the commit boundary at which earlier authority evidence no longer authorizes a durable effect. We call this property commit-time authorization: a durable effect is authorized only if the witness that licensed its derived state remains fresh, causally prior, bound to the same effect, and eligible at commit time. We build a controlled-invalidation suite spanning browser, tool/API, and multi-agent workflows. The suite preserves the user goal and payload shape while invalidating the authority relation before durability. In the primary 54-task matrix, endpoint success remains high: 262/270 runs reach the visible result. Only 55/270 are authorized completions; among the 216 invalidating rows, 207 commit after the authorizing path has failed. All 54 clean controls remain authorized, and a separate 54-run authority-preserving check produces no unauthorized commits. We then evaluate mitigation families. Prompt caution and single-condition checks are insufficient because different hazards break different boundary conditions. Defenses work when they refresh, rebind, replan, or refuse at the durability boundary. CommitGuard, a fail-closed boundary monitor, blocks stale durable-effect attempts on protected commit surfaces when runtimes emit witness, dependency, binding, and eligibility signals. The result is a reporting and runtime-design lesson: endpoint success is a utility metric; authorized commit is a security property.

Igor Santos-Grueiro

International University of La Rioja

Software Security LLM Agent Security AI Agent Security Benchmarks Tool Access Control for LLM Agents

Ask PDF

May 27, 2026

LACUNA: Safe Agents as Recursive Program Holes

LLM agents increasingly act by writing code, yet a split persists between the runtime that drives the agent and the code the model writes. The runtime owns the loop, context, and control flow, and the model has little say over any of them. Letting model-written code shape the runtime itself would make agents more expressive, but it would also sharpen safety problems. A model can be diverted by a prompt injection, call the wrong tool, or fail partway and leave an inconsistent state, and each such failure reaches further when the code shapes the runtime than when it expresses a single action. We present LACUNA, a programming model for agents that closes this split while preserving safety. Each agent action is a typed call

\texttt{agent[T](task)}

that the LLM fills with code when execution reaches it, and the code is type-checked against the surrounding program before it runs. Because each action is accepted or rejected as a whole, a rejected one leaves the environment untouched, and its compiler diagnostics drive a retry. The same check also bounds which tools and data an action may use and how they flow. Our primitive expresses ReAct loops, sub-agents, skills, parallel decomposition, and multi-model planning as ordinary control flow. We evaluate LACUNA on a collection of test cases, BrowseComp-Plus, and

τ^2

-bench. On BrowseComp-Plus,

8.6\%

of generations are rejected before execution, with 0.7 retries per query on average, and the agent reaches

27.1\%

accuracy. On

τ^2

-bench, LACUNA solves

76.0\%

392

tasks across four domains with a capable model, on par with the baseline agent.

Yaoyu Zhao, Yichen Xu, Oliver Bračevac +3

EPFL, Lausanne, Switzerland

AI Agent Reliability LLM Agents LLM Agent Safety

Ask PDF

Abstract

Runtime Enforcement for AI Agents

Explore similar work

DreamGuard: Efficient Runtime Guardrail for LLM Agents via Risk-Aware World Model

Temporary Authority, Permanent Effects: Commit-Time Authorization for LLM Agents

LACUNA: Safe Agents as Recursive Program Holes