The paper introduces Runtime Assurance Contracts (RAC) as a formal policy framework for high‑risk AI agents, addressing the "assurance‑transition gap" by binding autonomy boundaries, component eligibility, evidence state, transition policy, human‑review capacity, and non‑compensatory gates. RAC allows soft metrics to influence routing while mandating retries, switches, escalations, deferrals, or stops when mandatory gates fail or are unknown, ensuring aggregate performance cannot alone authorize action. The authors define the contract, evidence record, permission rule, and five invariants, and evaluate RAC through deterministic failure‑injection studies, hand‑authored traces, and a prospective synthetic holdout, comparing it to score‑only and restricted protocol baselines.
By Serhii Zabolotnii
arXiv:2609.37501v1 Announce Type: cross
Abstract: We propose RegLLM, a diagnostic harness for bounded autonomy in regulated agentic workflows. It instruments six trustworthiness signals: citation val...
By Dipankar Sarkar
AgentAudit is an open, extensible framework that evaluates the full lifecycle of AI agents, assessing planning, tool selection, execution, memory, and reasoning across ten dimensions such as instruction integrity, security, and alignment. Unlike existing benchmarks that focus on single aspects, AgentAudit analyzes the entire execution trace to attribute failures to specific stages. The framework was tested on five large language models, revealing significant differences in trustworthiness even among models with similar task‑completion performance.
By Shrey Nag, Sachita, Abhishek Kumar Singh, Lipi Goel, Rajeshwar Singh Janwar
The paper introduces a self‑healing harness that enforces admission control over language‑model agents’ self‑modifications. The harness runs a Detect‑Notice‑Heal‑Validate loop, allowing agents to propose rule changes that are only granted persistent authority after demonstrating improvement on a failure case without regressing on protected cases. Across 16 benchmark runs, the harness rejected many locally beneficial proposals that caused collateral regressions, while improving task‑completion scores and reliability.
By Sina Tayebati, Divake Kumar, Nastaran Darabi, Ranganath Krishnan, Amit Ranjan Trivedi
arXiv:2608. 16402v1 Announce Type: new Abstract: Large language model-based agentic frameworks primarily optimize capability: whether an agent can reason, retrieve information, call tools, delegate work, and complete a goal.
By Bhaskar Tripathi, Anurag Kumar, Ramendra Kumar, Bhavesh Gadhe
arXiv:2606. 14923v1 Announce Type: new Abstract: As language-model agents increasingly work in teams, each agent must decide how much to trust its teammates.
By Yujiao Chen
arXiv:2610.18948v1 Announce Type: cross
Abstract: Finite safety assessments cannot exclude an adversary that preserves unattacked behavior until certification and activates afterward. We characterize...
By Inderjeet Singh
arXiv:2606. 02965v1 Announce Type: new Abstract: Benchmarks for autonomous agents measure whether agents complete tasks, yet this framing is systematically blind to whether an agent should have proceeded at all.
By Victor Ojewale, Suresh Venkatasubramanian
The paper "Approve What, Exactly? Effect Binding and Trusted Rendering for Agent Step-Up Authorization" examines how AI agents seek approval before performing actions such as sending money or deleting files. It identifies twelve attack vectors on the approval process and evaluates them against several protocols, finding that many agent runtimes lack verifiable approval records and exhibit binding weaknesses. The authors propose a defense called ASU (Agent Step-Up), which renders a canonical approval card, requires a phone passkey, and enforces single-use execution, demonstrating strong protection against substitution, replay, and grant-stretching attacks in extensive simulations.
By Sai Varun Kodathala, Prashanth Pollishetty, Jaylen Cargill
arXiv:2606. 06529v1 Announce Type: new Abstract: An attacker that strategically chooses when to attack is much harder to catch than one that attacks indiscriminately.
By Catherine Ge-Wang, Tyler Crosse, Benjamin Hadad IV, Joachim Schaeffer, Ram Potham, Tyler Tracy
arXiv:2606. 31023v1 Announce Type: cross Abstract: Hard-constrained sequential decision systems have no certified way to spend the test-time compute of modern AI: executing the multi-step drafts of a learned policy or a frozen LLM forfeits the feasibility guarantee a trusted solver provides, while invoking the solver at every step forfeits the speed the AI offers.
By Chenyu Zhou, Qiliang Jiang, Shuning Wu, Xu Zhou
The paper introduces two measurable preconditions—Verifier Strength and Recoverability—to determine when an agent platform can safely allow unattended self‑improvement. Verifier Strength quantifies how closely an automated verifier (often an LLM judge) aligns with a trusted reference, limiting the extent of permissible changes. Recoverability measures how easily a detrimental change can be undone, requiring that the original version be retained and that rollback restores the prior behavior. The authors implemented these concepts on a platform, demonstrating that unattended edits are viable only when both conditions are met, and highlighted failures in verifier consistency and undo reliability through controlled experiments.
By De Wang, Peng Qi