arXiv:2606.24245cs.SEcs.AI2026-06

用逻辑编程自动优化大模型代理的安全规则,兼顾准确与可解释性。

AutoSpec: Safety Rule Evolution for LLM Agents via Inductive Logic Programming

  • 基于反例引导的归纳逻辑编程,自动改进安全规则
  • 在两个领域将规则F1提升至0.98和0.93,误报降低94%
  • 生成的规则可读可审计,适用于高安全要求场景

大型语言模型(LLM)代理通过整合语言模型与外部工具及环境,日益自动化复杂任务。然而其自主性带来显著安全风险:可能执行破坏性指令、泄露敏感数据或违反领域约束。现有安全方法存在根本权衡:人工设计规则可解释但脆弱,保守规则导致过多误报,宽松规则则漏检危险行为;神经分类器缺乏可解释性,不适用于安全关键部署。本文提出AutoSpec框架,通过归纳逻辑编程(ILP)引导的反例引导归纳合成(CEGIS),从专家规则和用户标注的安全部/不安全轨迹中自动演化安全规则。从初始规则和标注轨迹出发,AutoSpec迭代评估规则,挖掘误报与漏报反例,利用ILP识别区分两类反例的关键谓词,生成候选规则修改,并验证筛选最优修订。核心洞察在于,ILP能高效定位在误报中罕见但在漏报中频繁出现(或反之)的谓词,极大压缩规则修改的指数搜索空间。该过程持续至收敛,生成兼具精度与召回的可解释规则。我们在291条跨代码执行与具身代理领域的执行轨迹上评估,AutoSpec使规则F1分别达0.98与0.93,误报降低最高94%的同时保持高召回率,4-5轮内完成收敛。相比启发式CEGIS,ILP引导方法最高提升4.8倍F1。所学规则具有人类可读性、可审计性,并可泛化至未见场景。

原文摘要 · Abstract (English)

Large language model (LLM) agents increasingly automate complex tasks by integrating language models with external tools and environments. However, their autonomy poses significant safety risks: agents may execute destructive commands, leak sensitive data, or violate domain constraints. Existing safety approaches face a fundamental tradeoff: hand-crafted rules are interpretable but brittle, with overly conservative rules blocking safe operations (high false positives) while permissive rules miss unsafe behaviors (high false negatives). Neural classifiers lack the interpretability required for safety-critical deployments. We present AutoSpec, a framework that automatically evolves deployed expert-designed safety rules from user safe/unsafe annotations through counterexample-guided inductive synthesis (CEGIS) guided by inductive logic programming (ILP). Starting from the expert rules and a stream of annotated traces, AutoSpec iteratively evaluates rules, mines false-positive and false-negative counterexamples, uses ILP to learn which predicates discriminate them, generates candidate rule edits, and verifies candidates to select the best revision. The key insight is that ILP efficiently identifies predicates that appear frequently in false negatives but rarely in false positives (or vice versa), dramatically pruning the exponential search space of rule edits. This continues until convergence, producing interpretable rules that balance precision and recall. We evaluate AutoSpec on 291 execution traces spanning code execution and embodied agent domains. AutoSpec raises rule F1 to 0.98 and 0.93 across the two domains, achieving up to 94% false positive reduction while maintaining high recall, and converges within 4-5 iterations. The ILP-guided approach achieves up to 4.8x higher F1 than heuristic CEGIS. The learned rules are human-readable, auditable, and generalize to unseen scenarios.

安全规则逻辑编程LLM代理可解释性

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。