NEXUS: Structured Runtime Safety for Tool-Using LLM Agents

NEXUS：面向工具使用型 LLM 智能体的结构化运行时安全机制

Abstract: Tool-using LLM agents increasingly execute high-impact actions, making runtime safety monitoring essential. We present NEXUS (Neural EXecution Utility and Safety), a structured-plan safety monitor that applies a formal intervention policy to select among four actions: allow, block, request confirmation, or request revision.

摘要： 工具使用型大语言模型（LLM）智能体正越来越多地执行高影响力的操作，这使得运行时安全监控变得至关重要。我们提出了 NEXUS（神经执行效用与安全），这是一种结构化计划安全监控器，它应用正式的干预策略在四种操作中进行选择：允许、拦截、请求确认或请求修订。

NEXUS combines deterministic safety rules, argument-level inspection, and a calibrated logistic-regression risk score for graded escalation. On a 128-instance synthetic benchmark, NEXUS achieves an F1 score of 0.949 and a 4-class intervention accuracy of 0.6406, outperforming rule-only intervention selection by 27.3 percentage points.

NEXUS 结合了确定性安全规则、参数级检查以及用于分级升级的校准逻辑回归风险评分。在包含 128 个实例的合成基准测试中，NEXUS 的 F1 分数达到 0.949，四类干预准确率达到 0.6406，比仅使用规则的干预选择方案高出 27.3 个百分点。

It also improves over rule-only on R-Judge (F1 = 0.861 vs. 0.849), matches rule-only on AgentHarm due to threat-model limits, and achieves 0% ASR at 99% control allow on IPI. On the rule-blind NEXUS-Stress benchmark, NEXUS reaches an F1 score of 0.881, highlighting the difficulty of fine-grained intervention routing.

它在 R-Judge 测试中也优于纯规则方案（F1 分数 0.861 对比 0.849），在 AgentHarm 测试中因威胁模型限制与纯规则方案持平，并在 IPI 测试中实现了 99% 的控制允许率下 0% 的攻击成功率（ASR）。在规则盲测的 NEXUS-Stress 基准测试中，NEXUS 达到了 0.881 的 F1 分数，凸显了细粒度干预路由的难度。

With 0.205 ms median latency, NEXUS adds under 0.1% overhead to typical agent loops. Code, benchmarks, and the calibrated risk scorer are publicly released.

NEXUS 的中位延迟仅为 0.205 毫秒，为典型智能体循环增加的开销不到 0.1%。目前，相关代码、基准测试和校准后的风险评分器已公开。