将企业操作规程编译为可执行代码，提升大模型安全执行能力。
Compile, Then Page: Executable SOP Programs and a Capability-Gated Runtime for Procedural LLM Agents
- 把SOP规程转为可执行伪代码，用程序引导栈机运行。
- 强模型在6个任务上性能提升16.0分，弱模型反而受损。
- 仅对有纪律的模型启用页面调度，可显著提高拒绝正确率。
企业级智能体需遵循长周期、条件性、高安全性的标准操作流程（SOP）。本文将机器可读的SOP约束编译为可执行伪代码，并通过程序引导（PG）栈机运行，该机制在大模型进行语义执行时按需分页激活帧。六模型三臂SOPBench实验表明：编译文本不会损害性能，且在官方原文表现不佳时最高提升16.0分；运行时指导具有能力门槛——两个强模型在七个领域均显示正向对比（58:19和75:31差异对），而弱模型则受负面影响。全程序光标消融实验（先激活当前帧，保留完整程序）恢复了强模型的拒绝收益，选择性可见性带来小幅改进。配对探针与审计测量显示，该差异源于自发的状态纪律，而非重构能力。在Bank任务中，三个主组得分从70.4升至86.4再达92.8，拒绝正确率达100%。实践建议：优先编译，仅在模型具备层级纪律后启用主动帧分页。
原文摘要 · Abstract (English)
Enterprise agents must follow long-horizon, conditional, safety-critical standard operating procedures (SOPs). We compile machine-readable SOP constraints into executable pseudo-code and run them with a program-guided (PG) stack machine that pages the active frame while an LLM performs semantic execution. A three-arm SOPBench study across six models separates representation from runtime: compiled text never significantly hurts and gains up to 16.0 points where official prose underperforms. Runtime guidance is capability-gated. Two strong models independently show positive seven-domain PG contrasts (58:19 and 75:31 discordant pairs), whereas weak models are harmed. A full-program cursor ablation (active frame first, complete program retained) recovers much of the strong-model refusal gain; selective visibility adds a smaller improvement. Paired probe and audit measurements track this divide to spontaneous state discipline rather than reconstruction ability. On Bank the three primary arms rise from 70.4 to 86.4 to 92.8, with 100% refusal correctness. Practical guidance: compile first; enable active-frame paging only after a model-level discipline check.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。