Stale Does Not Mean Unsafe: Guard Precision for Tool-Using LLM Agents under Infrastructure State Races

Zihao Zheng; Jiayu Long; Baichuan Li; Junyi Yao

cs.AIAug 25, 2026

Stale Does Not Mean Unsafe: Guard Precision for Tool-Using LLM Agents under Infrastructure State Races

Authors: Zihao Zheng, Jiayu Long, Baichuan Li, Junyi Yao

Organizations: Washington University in St. Louis, St. Louis, Missouri, USA · Southern Methodist University, Dallas, Texas, USA

Abstract

Tool-using language-model agents increasingly mutate schedulers, data pipelines, object stores, and access-control systems. Between an agent's read and its commit, external state can change, but not every change makes the commit unsafe. We separate invalidating races, which break a declared safety predicate, from predicate-preserving and irrelevant races, and ask how precisely runtime guards distinguish them. Our deterministic simulator separates visible from authoritative state and injects five non-atomic failure mechanisms across 16 infrastructure tasks in four domains; frozen agent proposals are replayed counterfactually under every controller without an LLM judge. We evaluate three commit-time guard granularities (global epoch, read-set version, semantic commit predicate), multi-level verification, and model-side gates on three locally hosted quantized model families (Qwen3-4B, Phi-4-mini, Gemma4-8B; 3,456 trajectories on one GPU). All three guards eliminate unsafe commits, but their availability differs sharply: freshness-based guards needlessly block 92-95% of benign races, forfeiting up to 43% of safe task completions, while the complete predicate guard blocks none. That precision is contract-dependent: deleting a single declared clause converts exactly its fault family into unsafe commits (up to 7.9%). Model-side signals do not substitute: verbal confidence is miscalibrated (ECE approximately 0.37), action agreement matches a random gate, a cautionary prompt leaves the direct unsafe rate essentially unchanged, and after a freshness-guard block agents re-commit unsafely from refreshed but still-incomplete reads. Under degraded telemetry a hidden concurrent mutation remains observationally clean, bounding every selective policy. Precise runtime enforcement therefore requires semantic contracts, not freshness heuristics or model self-assessment.

Figures & tables

Race class	Authoritative change before commit	$P(u,s)$	Global epoch	Read-set version	Commit predicate
Invalidating	validation=FAILED ; resource version 2	false	Block	Block	Block
Predicate-preserving	audit_epoch=2 ; resource version 2; promotion conditions unchanged	true	Block	Block	Allow
Irrelevant	Ambiguity metadata records prior_operation_applied=false ; resource version remains 1	true	Block	Allow	Allow

TABLE I: Concrete paired example for snapshot promotion. The visible snapshot is validation=PASSED , promoted=false , policy=ALLOWED , and version 1; the declared predicate requires those three facts plus intact integrity. Allow means the frozen proposal reaches the ordinary executor.

Panel of Figure 2 — Fig. 1: Evaluation and deployment boundary. The agent sees only the visible snapshot and emits one frozen mutation proposal. Counterfactual replay sends that same proposal through every controller; the guard comparison changes only the condition evaluated at the atomic hook. Authoritative state is consumed by the hook and deterministic oracle, never as a controller feature.

Domain	Mutations
Scheduler	restart failed, cancel queued, resume paused, scale overloaded job
Pipeline	rerun stage, promote snapshot, rollback release, migrate schema
Storage	delete orphan, move artifact, publish entry, rotate key
IAM	grant role, revoke role, rotate credential, disable account

TABLE II: Infrastructure task families.

Panel of Figure 4 — Fig. 2: Complementary views of the guard-selection problem. In (a), coarse guards fail rightward through benign interventions, incomplete predicate contracts fail upward through leaked hazards, and the complete predicate guard sits at the origin. Panel (b) shows that all model families are overconfident; panel (c) shows telemetry shift moving selective heuristics away from the zero-risk frontier.

Model	Valid	Abstain	Unsafe	AUROC	ECE
Gemma4-8B	1.000	0.000	0.417	0.572	0.377
Phi-4-mini	1.000	0.148	0.346	0.407	0.367
Qwen3-4B	1.000	0.000	0.417	0.519	0.369

TABLE III: Main proposal metrics. AUROC is confidence predicting correct direct execution.

Controller	Unsafe	Safe succ.	Verify cost
Execute	0.393	0.562	0.00
Fast verify	0.078	0.655	1.00
Strong verify	0.000	0.733	4.00
Confidence gate	0.391	0.563	0.11
Agreement gate	0.307	0.595	1.01
Matched random	0.302	0.597	1.01

TABLE IV: Controller macro-average over the three model families. Cost uses normalized verification units.

Profile	Unsafe	Safe succ.	Verify cost
Canonical	0.000	0.736	1.83
Degraded	0.079	0.730	2.17

TABLE V: Evidence router under telemetry shift (macro-average over models).

Split	Model	Unsafe	Cost	Unsupported
ID template	Gemma4-8B	0.000	1.33	0.000
ID template	Phi-4-mini	0.000	1.33	0.000
ID template	Qwen3-4B	0.000	1.33	0.000
OOD telemetry	Gemma4-8B	0.083	2.67	0.500
OOD telemetry	Phi-4-mini	0.071	2.67	0.500
OOD telemetry	Qwen3-4B	0.083	2.67	0.500

TABLE VI: Learned support-aware router on frozen test splits.

Guard	Block inv	Benign pres	Benign irr
Global epoch	1.000	0.946	0.917
Read-set version	1.000	0.946	0.000
Commit predicate	1.000	0.000	0.000

TABLE VII: Guard precision by race type, pooled over models. Block rates on invalidating races enforce safety; blocks on predicate-preserving or irrelevant races are benign interventions that forfeit the task.

Declared contract	Unsafe	Safe succ.	Leaked hazards
Complete contract	0.000	0.733	–
No integrity clause	0.000	0.733	none (subsumed)
No duplicate clause	0.040	0.693	completed effects
No status clause	0.064	0.733	stale reads
No policy clause	0.080	0.733	concurrent mutation

TABLE VIII: Predicate guard under contract incompleteness (macro-average over models). Each missing clause converts exactly its fault family into unsafe commits without touching availability.

$c_{p}$	Predicate	Version	Strong verify
1	3.674	6.828	6.674
1.5	4.174	6.828	6.674
2	4.674	6.828	6.674
3	5.674	6.828	6.674
4	6.674	6.828	6.674

TABLE IX: Predicate-check cost sensitivity at

\lambda_{U}=100

and

\lambda_{F}=10

(macro-average). Outcomes are fixed; only the normalized semantic-check cost

c_{p}

varies.

Returned evidence	Abstain	Recommit	Recommit unsafe
Fast verify	0.479	0.521	0.360
Strong verify	0.639	0.361	0.192
Guard block + refresh	0.558	0.442	0.319

TABLE X: Layer-B replanning after returned evidence, on the matched population of race decisions where a version guard fires (432 per level, pooled over models). Recommit-unsafe is the unsafe rate among non-abstaining replans.

Model	Abstain		Direct unsafe
	base	aware	base	aware
Gemma4-8B	0.000	0.000	0.417	0.417
Phi-4-mini	0.148	0.266	0.346	0.301
Qwen3-4B	0.000	0.000	0.417	0.417

TABLE XI: Prompt-level caution control: identical scenarios with an explicit instruction to consider staleness, ambiguous commits, and concurrency.

Runtime Enforcement for AI Agents

Runtime enforcement for AI agents checks and constrains actions as they execute, helping prevent unsafe or unauthorized effects.

See all 276 papers

DreamGuard: Efficient Runtime Guardrail for LLM Agents via Risk-Aware World Model
Aug 6, 2026Wenhao Lin, Chenyu Yu, Xingwei Lin +6LLM World Models LLM Guardrails
Zhejiang University · Nanjing University of Posts and Telecommunications · Sun Yat-sen University
Temporary Authority, Permanent Effects: Commit-Time Authorization for LLM Agents
Jul 11, 2026Igor Santos-GrueiroSoftware Security LLM Agent Security
International University of La Rioja
LACUNA: Safe Agents as Recursive Program Holes
May 27, 2026Yaoyu Zhao, Yichen Xu, Oliver Bračevac +3AI Agent Reliability LLM Agents
EPFL, Lausanne, Switzerland

Aug 6, 2026J/K move · Enter open · S save

DreamGuard: Efficient Runtime Guardrail for LLM Agents via Risk-Aware World Model

Wenhao Lin, Chenyu Yu, Xingwei Lin, Sicong Cao+5

Zhejiang University · Nanjing University of Posts and Telecommunications · Sun Yat-sen University

LLM World Models LLM Guardrails World Models Runtime Enforcement for AI Agents LLM Agent Safety Long-Horizon LLM Agents

Open paper AskPDF arXiv

As large language model (LLM) agents increasingly invoke external tools and interact with real-world systems, unsafe actions may cause irreversible consequences on external states, user data, and downstream services. Recent runtime guardrails mitigate such risks by checking proposed actions before execution, but many remain reactive: they primarily assess the apparent safety of the current action, lacking an explicit model of how risk evolves across the trajectory. This limitation creates a critical blind spot for long-horizon risks, where individually benign-looking actions can gradually drift the agent toward hazardous states. In response, we propose DreamGuard, a proactive guardrail for LLM agents built around a risk-aware world model. The world model maintains a compact recurrent latent state over the trajectory and predicts future latent states from which DreamGuard derives immediate-hazard and prefix-risk evidence. It then fuses these multi-horizon signals into intervention decisions before execution. Experiments across four benchmarks and an online guardrail evaluation show that DreamGuard outperforms generic, reactive, and proactive guardrail baselines, achieves the best safety-utility trade-off among evaluated guardrails, and maintains an average end-to-end latency of 25 ms per call.

Abstract

Runtime Enforcement for AI Agents

Explore similar work

DreamGuard: Efficient Runtime Guardrail for LLM Agents via Risk-Aware World Model

Temporary Authority, Permanent Effects: Commit-Time Authorization for LLM Agents

LACUNA: Safe Agents as Recursive Program Holes