将AI代理的决策过程提炼为可验证的树状结构，提升安全性和效率。
Traversal-as-Policy: Log-Distilled Gated Behavior Trees as Externalized, Verifiable Policies for Safe, Robust, and Efficient Agents
- 用成功轨迹提取动作宏，构建带门控的可执行行为树作为控制策略。
- 在SWE-bench验证任务中成功率从34.6%提升至73.6%，违规率降至0.2%。
- 适合需要高安全、强鲁棒性的自动化代理应用，如软件修复与网页操作。
自主LLM代理因长期策略隐含于模型权重和对话记录中而失败，且安全性常为事后补救。本文提出Traversal-as-Policy：将沙盒内OpenHands执行日志蒸馏为单一可执行的门控行为树（GBT），以树遍历代替无约束生成作为控制策略。每个节点编码从成功轨迹中挖掘并验证的动作宏；涉及不安全行为的宏附加确定性前置门控，基于结构化工具上下文与有限历史更新，确保已拒绝的不安全情境不可重现。运行时，轻量级遍历器匹配基础模型意图至子宏，逐个执行并在停滞时进行风险感知最短路径恢复至可行成功叶节点；访问路径形成紧凑脊柱记忆，替代原始对话回放。在统一OpenHands沙箱上对15+软件、网页、推理及安全/安全基准评估，GBT显著提升成功率，使违规趋近于零并降低开销。在SWE-bench Verified（协议A，500个问题）上，GBT-SE将成功率从34.6%提升至73.6%，违规率从2.8%降至0.2%，令牌/字符使用量从208k/820k降至126k/490k；相同蒸馏树下，8B执行器在SWE-bench Verified上成功率从14.0%提升至58.8%，在WebArena上从9.1%提升至37.3%。
原文摘要 · Abstract (English)
Autonomous LLM agents fail because long-horizon policy remains implicit in model weights and transcripts, while safety is retrofitted post hoc. We propose Traversal-as-Policy: distill sandboxed OpenHands execution logs into a single executable Gated Behavior Tree (GBT) and treat tree traversal -- rather than unconstrained generation -- as the control policy whenever a task is in coverage. Each node encodes a state-conditioned action macro mined and merge-checked from successful trajectories; macros implicated by unsafe traces attach deterministic pre-execution gates over structured tool context and bounded history, updated under experience-grounded monotonicity so previously rejected unsafe contexts cannot be re-admitted. At runtime, a lightweight traverser matches the base model's intent to child macros, executes one macro at a time under global and node-local gating, and when stalled performs risk-aware shortest-path recovery to a feasible success leaf; the visited path forms a compact spine memory that replaces transcript replay. Evaluated in a unified OpenHands sandbox on 15+ software, web, reasoning, and safety/security benchmarks, GBT improves success while driving violations toward zero and reducing cost. On SWE-bench Verified (Protocol A, 500 issues), GBT-SE raises success from 34.6% to 73.6%, reduces violations from 2.8% to 0.2%, and cuts token/character usage from 208k/820k to 126k/490k; with the same distilled tree, 8B executors more than double success on SWE-bench Verified (14.0%58.8%) and WebArena (9.1%37.3%).
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。