VEPA: Verified Evolving Formal Policy for Lifelong LLM Agent Guardrails
Quick Answer
VEPA introduces a framework for verified evolving formal policies for LLM agents, enhancing safety by adapting guardrails based on deployment feedback.
Quick Take
It outperforms existing methods across benchmarks like ASSEBench-Safety and ASSEBench-Security, ensuring deterministic policy enforcement even under challenging conditions.
Key Points
- VEPA uses to propose policy patches during deployment based on feedback.
- It ensures policies are conflict-free and structurally valid through deterministic verification.
- The framework consistently outperforms baselines across multiple safety and security benchmarks.
- VEPA adapts to new risks without compromising previously correct behaviors.
- It maintains guardrail decisions by requiring sufficient evidence for rule activation.
DeepSignal Analysis
What happened
VEPA is a new framework designed to enhance the safety of LLM agents by implementing verified evolving formal policies. It adapts guardrails based on deployment feedback, ensuring that decisions made by the agents are deterministic and reproducible. The framework has shown superior performance compared to existing methods across various safety and security benchmarks.
Key evidence
- VEPA introduces a formal policy framework that uses executable symbolic rules to enforce decisions for LLM agents, addressing safety and security risks.
- The framework adapts guardrails based on deployment feedback, proposing policy patches to fix newly observed failures while maintaining previously correct behavior.
- VEPA has demonstrated consistent performance improvements over existing methods in benchmarks like ASSEBench-Safety and ASSEBench-Security, even under challenging conditions.
Why it matters
As LLM agents increasingly interact with sensitive information, the need for robust safety mechanisms becomes critical. VEPA's approach to evolving guardrails ensures that agents can adapt to new risks without compromising their decision-making integrity. This is particularly important in environments where safety and security are paramount, as it allows for more reliable and accountable AI behavior.
Paper Resources
📖 Reader Mode
~2 min readAbstract:LLM agents increasingly operate over sensitive resources, such as private documents and mutable system states, which can create serious safety and security risks. Runtime guardrails should therefore make inspectable, reproducible, and deterministic allow or refuse decisions before potentially irreversible agent actions are executed. However, safety and security requirements are rarely complete before deployment, so guardrails need to keep adapting as new risks emerge. Existing adaptive guardrails learn from deployment experience, but they usually apply safety policies through LLM inference, which can lead to inconsistent decisions and ambiguous policy interpretations. Formal guardrails, on the other hand, enforce policies deterministically, but they usually rely on pre-deployment or task-specific policies and have no mechanism to adapt to newly observed risks. We introduce VEPA, a framework for the verified evolution of formal agent guardrails. VEPA represents the guardrail as a formal policy of executable symbolic rules over typed agent events. During deployment, we use an LLM guided by deployment feedback to propose policy patches that fix newly observed failures while preserving previously correct behavior. Then, a deterministic verifier only accepts policies that are structurally valid and conflict-free. Finally, an evidence-aware authority layer activates a verified rule only when it has enough supporting evidence, so uncertain updates cannot directly affect guardrail decisions. Across ASSEBench-Safety, ASSEBench-Security, and ATBench, VEPA consistently outperforms baselines while expanding the scope of deterministic formal-policy enforcement. These gains also hold under more challenging deployment conditions, including mixed streams, corrupted feedback, and longer horizons.
| Comments: | 33 pages, 14 figures |
| Subjects: | Artificial Intelligence (cs.AI); Computation and Language (cs.CL); Cryptography and Security (cs.CR); Machine Learning (cs.LG) |
| Cite as: | arXiv:2610.12813 [cs.AI] |
| (or arXiv:2610.12813v1 [cs.AI] for this version) | |
| https://doi.org/10.48550/arXiv.2610.12813 arXiv-issued DOI via DataCite (pending registration) |
Submission history
From: Duy Nguyen [view email]
[v1]
Thu, 8 Oct 2026 23:49:50 UTC (1,043 KB)
— Originally published at arxiv.org
Want this in your inbox every morning?
Daily brief at your local 8am — bilingual EN/中文, free.
More from arXiv cs.AI
See more →HOBA: Hierarchical On-Policy Bidding Agents for Adaptive Online Advertising
HOBA (Hierarchical On-policy Bidding Agents) is a novel hierarchical reinforcement learning framework that enhances online advertising bidding systems by improving adaptability and reducing hyperparameter tuning costs. It utilizes a for hyperparameter inference, a SARSA agent for expert model selection, and a dynamic expert pool for bid execution, achieving a +3.6% increase in target cost during large-scale deployment and outperforming state-of-the-art baselines on AuctionNet.