Related papers: Safety Invariants for Agents Orchestrating Irreversible State Transitions: A Four-Dimensional Formalism Evaluated on Public Ledgers

Safety Invariants for Agents Orchestrating Irreversible State Transitions: A Four-Dimensional Formalism Evaluated on Public Ledgers

URL: http://arxiv.org/abs/2608.00783v1
Date: Sat, 01 Aug 2026 17:29:42 GMT
Title: Safety Invariants for Agents Orchestrating Irreversible State Transitions: A Four-Dimensional Formalism Evaluated on Public Ledgers
Abstract summary: We use formalism to state and prove a guarantee we call execution fidelity.<n>Seven safety invariants, derived from the fidelity condition rather than enumerated from experience, discharge the guarantee.<n>The system is deployed; 108 production write operations across 8 chains back the failure taxonomy.
Score: 0.0
License: http://creativecommons.org/licenses/by/4.0/
Abstract: Autonomous agents are increasingly asked to produce irreversible effects on external systems - transferring funds, writing to durable storage, actuating hardware. Existing agent frameworks (ReAct, Reflexion, MCP) optimize task success on benchmarks and give little attention to the safety of irreversible side-effects. We formalize one such setting, movement of value across public ledgers, as state transitions in a four-dimensional space indexed by (wallet, chain, address, protocol), and use that formalism to state and prove a guarantee we call execution fidelity: under a fault model admitting planner mis-mapping, ambiguous outcomes, retries, at-least-once delivery, and delegated non-human callers, a session's realized effect on the ledger is either nothing at all or exactly the transition that was rendered to the user, exactly once. The theorem deliberately does not claim that the rendered transition matches the user's intent - no runtime layer can decide that - but it confines that unbounded question to a single predicate over a finite object, which is what makes a preview a sufficient control rather than a formality. Seven safety invariants, derived from the fidelity condition rather than enumerated from experience, discharge the guarantee. Empirically, on a controlled N=60 adversarial suite the stack lifts pass rate by ~74 percentage points over a naive-ReAct baseline on two write-aggressive backing models, but by only ~3 points on a write-cautious one - evidence that single-model evaluations of agent safety stacks are close to unfalsifiable. The system is deployed; 108 production write operations across 8 chains back the failure taxonomy. Although the evaluation setting is public ledgers, the formalism and invariants apply to any probabilistic agent acting on irreversible external state.

Related papers

Context Is Not Authority: Structured Runtime Governance for Financial Market Agents [13.810351865063632]
SAGE-Fin is a finance-specific authority-handoff contract.<n>It compiles proposals into typed, adapter-bound candidates.<n>It requires an exact-artifact receipt whose nominal type matches the consuming response, execution, or policy adapter.
arXiv Detail & Related papers (2026-08-10T02:26:07Z)
What Can Be Enforced? A Theory of Certified Runtime Safety for Tool-Using Agents [0.0]
guardrails act before irreversible tool calls, but their guarantees depend on what policy state is representable.<n>Pearson representation attacks add a margin, so benign calibration alone does not transfer.<n>Experiments target these distinctions through static diagnostics, controlled-model enumeration, representation rewrites, and paired closed-loop reruns.
arXiv Detail & Related papers (2026-07-24T19:14:26Z)
Governed Individuation: Cryptographically Decoupling an Agent's Learning from Its Authority [7.392721604463545]
We show that confinement can be guaranteed as an invariant of the agent's execution architecture.<n>We prove that no amount of learning, skill acquisition, or self-induced governance abstraction can widen the agent's permitted authority.
arXiv Detail & Related papers (2026-07-06T02:42:06Z)
Mnemosyne: Agentic Transaction Processing for Validating and Repairing AI-generated Workflows [0.764671395172401]
Agentic Transaction Processing treats generated actions as untrusted proposals until they pass deterministic admission under a declared, executable constraint set C.<n>We realize ATP in Mnemosyne, a runtime with an append-only transition log, effective-state projection, dependency-safe compensation, and active commitment records.<n>A reproducible artifact rejects the targeted violations across nine falsification tests while still admitting valid work, at under 6% overhead, and local repair edits an order of magnitude fewer operations than global recompute.
arXiv Detail & Related papers (2026-06-30T23:33:16Z)
Converted, Not Equivalent: Benchmarking Codebase Conversion via Observational Equivalence [56.25095230687242]
Coding agents often over-trust their own local validation routines and declare success on artifacts that satisfy surface checks.<n>This problem is especially acute in conversion, where prior evaluation is outcome-driven.<n>Across blind conversion attempts, the best system reaches 26.7--28.9% overall pass rate despite Spec pass rates up to 91.1%.<n>This suggests that failures stem more from contract-misaligned self-validation than from limited budget or backbone strength.
arXiv Detail & Related papers (2026-05-27T19:57:15Z)
Taming "Zombie'' Agents: A Markov State-Aware Framework for Resilient Multi-Agent Evolution [50.50276752935017]
AgentRevive is a Markov state-aware framework for resilient multi-agent evolution.<n>Our approach dynamically manages agent collaboration through soft state transitions.<n>It significantly reduces token consumption through state-aware agent scheduling.
arXiv Detail & Related papers (2026-05-17T09:38:18Z)
On-Policy Self-Evolution via Failure Trajectories for Agentic Safety Alignment [54.30690671490447]
Existing safety-alignment signals are largely response-level or off-policy.<n>FATE transforms verifier-scored failures into repair supervision without expert demonstrations.<n>FATE reduces attack success rate by 33.5%, harmful compliance by 82.6%, and improves external trajectory-safety diagnosis by 6.5%.
arXiv Detail & Related papers (2026-05-12T09:56:28Z)
Taming Actor-Observer Asymmetry in Agents via Dialectical Alignment [59.536125286960186]
Multi-agent frameworks assigning specialized roles are increasingly adopted to enable self-reflection and mutual auditing.<n>We find it simultaneously induces a human-like cognitive bias known as Actor-Observer Asymmetry.<n>ReTAS guides agents to synthesize conflicting viewpoints into an objective consensus.
arXiv Detail & Related papers (2026-04-21T15:05:58Z)
Compiling Activation Steering into Weights via Null-Space Constraints for Stealthy Backdoors [48.881343993730844]
Safety-aligned large language models (LLMs) are increasingly deployed in real-world pipelines.<n> adversaries can distribute backdoored checkpoints that behave normally under standard evaluation but jailbreak when a hidden trigger is present.<n>Recent post-hoc weight-editing methods offer an efficient approach to injecting such backdoors.
arXiv Detail & Related papers (2026-04-14T06:48:33Z)
A Coin Flip for Safety: LLM Judges Fail to Reliably Measure Adversarial Robustness [57.510025257780306]
We show that existing validation protocols fail to account for substantial distribution shifts inherent to red-teaming.<n>We propose ReliableBench, a benchmark of behaviors that remain more consistently judgeable, and JudgeStressTest, a dataset designed to expose judge failures.
arXiv Detail & Related papers (2026-02-04T15:13:35Z)
To Throw a Stone with Six Birds: On Agents and Agenthood [0.0]
Six Birds Theory (SBT) treats macroscopic objects as induced closures rather than primitives.<n>We give a type-correct account of agency within SBT.<n>We operationalize this contract in finite controlled systems using four checkable components.
arXiv Detail & Related papers (2026-02-03T10:46:23Z)

This list is automatically generated from the titles and abstracts of the papers in this site.