为工具调用大模型代理设计结构化安全监控，动态决策干预方式。
NEXUS: Structured Runtime Safety for Tool-Using LLM Agents
- 基于规则、论证分析与风险评分三重机制，实现分级安全干预。
- 在合成数据集上F1达0.949，四类干预准确率64.06%，优于纯规则方法27.3个百分点。
- 低延迟（0.205毫秒），适合部署于实时代理系统，开源可用。
工具调用的大语言模型代理执行高影响操作日益频繁，运行时安全监控至关重要。本文提出NEXUS（Neural EXecution Utility and Safety），一种结构化计划安全监控器，通过正式干预策略在四种动作中选择：允许、阻断、请求确认或请求修改。NEXUS结合确定性安全规则、论点级检查和校准的逻辑回归风险评分，实现分级升压。在128个实例的合成基准测试中，NEXUS取得0.949的F1分数和0.6406的四类干预准确率，相比纯规则方法提升27.3个百分点。在R-Judge上表现优于规则方法（F1=0.861 vs. 0.849），在AgentHarm上与规则方法持平（受威胁模型限制），在IPI上实现99%控制允许下0%攻击成功率（ASR）。在规则盲测的NEXUS-Stress基准中，仍达到0.881的F1分数，凸显细粒度干预路由的挑战。中位延迟仅0.205毫秒，对典型代理循环的开销低于0.1%。代码、基准与校准风险评分器均已开源。
原文摘要 · Abstract (English)
Tool-using LLM agents increasingly execute high-impact actions, making runtime safety monitoring essential. We present NEXUS (Neural EXecution Utility and Safety), a structured-plan safety monitor that applies a formal intervention policy to select among four actions: allow, block, request confirmation, or request revision. NEXUS combines deterministic safety rules, argument-level inspection, and a calibrated logistic-regression risk score for graded escalation. On a 128-instance synthetic benchmark, NEXUS achieves an F1 score of 0.949 and a 4-class intervention accuracy of 0.6406, outperforming rule-only intervention selection by 27.3 percentage points. It also improves over rule-only on R-Judge (F1 = 0.861 vs. 0.849), matches rule-only on AgentHarm due to threat-model limits, and achieves 0% ASR at 99% control allow on IPI. On the rule-blind NEXUS-Stress benchmark, NEXUS reaches an F1 score of 0.881, highlighting the difficulty of fine-grained intervention routing. With 0.205 ms median latency, NEXUS adds under 0.1% overhead to typical agent loops. Code, benchmarks, and the calibrated risk scorer are publicly released.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。