{
  "schema_version": 1,
  "builder_plan": {
    "scenario": "An agent reads external documents or tool responses that may contain malicious instructions.",
    "change": "Replay attacks and legitimate lookalikes in an isolated copy of your agent workflow.",
    "baseline": "Your existing checks with the same tasks, permissions, and tool responses.",
    "steps": [
      "Locate the paper's implementation and check its license, model support, data needs, and hardware requirements. Stop here if you cannot obtain the required artifacts.",
      "Save a small set of representative product tasks and expected outcomes. Keep evaluation tasks out of any training or tuning, and choose quality and cost limits before running.",
      "Run the baseline and the proposed change on identical inputs. Keep other settings fixed and repeat paired runs to expose variation.",
      "Save per-task outputs, failures, timings, and all usage costs. Review regressions before expanding the test."
    ],
    "measure": "Successful attacks missed, legitimate actions blocked, detection delay, and review cost.",
    "decision": "Keep the change only if it meets your preselected quality and latency limits and improves the metric you care about after setup and operating costs. Otherwise retain the baseline. This is an exploration plan, not a validated recommendation."
  },
  "builder_review": null,
  "arxiv_id": "2609.19391",
  "title": "MAGS: Multi-agent Auto-formalization Guarantees Safety for Agentic Outputs",
  "summary": "MAGS replaces fuzz testing, static analysis, and LLM-as-a-Verifier for safety assurance of agent-generated code by translating programs into Dafny, repairing them against verifier feedback, and compiling verified code back to executables. The cost is a multi-agent LLM pipeline plus the Dafny toolchain, human-audited frozen API specifications, and repair-loop latency on every generated artifact. It can fail silently when the auto-formalized specification itself does not capture the intended target behavior, in which case the guarantee is vacuously satisfied.",
  "rationale": "Formal guarantees are valuable for safety-critical generated code, but the framework requires specification engineering, a Dafny toolchain, and domain-specific validation that a small team should pilot on a narrow workload before production adoption.",
  "technique": "Multi-agent auto-formalization with verified Dafny IR",
  "family": "seguranca_e_guardrails",
  "recommendation": "testar",
  "published": "2026-09-16",
  "as_of": "2026-10-18",
  "editorial_status": "indexed",
  "source_url": "https://arxiv.org/abs/2609.19391",
  "independent_implementations": 1,
  "total_implementations": 2,
  "stars": 9,
  "citations": 0,
  "claims": [
    {
      "claim_id": "claim-01",
      "statement": "MAGS replaces fuzz testing, static analysis, and LLM-as-a-Verifier for safety assurance of agent-generated code by translating programs into Dafny, repairing them against verifier feedback, and compiling verified code back to executables. The cost is a multi-agent LLM pipeline plus the Dafny toolchain, human-audited frozen API specifications, and repair-loop latency on every generated artifact. It can fail silently when the auto-formalized specification itself does not capture the intended target behavior, in which case the guarantee is vacuously satisfied.",
      "basis": "inferred",
      "result": "",
      "baseline": "",
      "conditions": "",
      "source_url": "https://arxiv.org/abs/2609.19391",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "claim_id": "claim-02",
      "statement": "100% success rate producing formally verified programs against frozen specifications across 220 tasks (CUDA kernels, terminal scripts, robotic-arm tasks), with failures noted when auto-formalized semantics diverge from intended behavior.",
      "basis": "inferred",
      "result": "",
      "baseline": "",
      "conditions": "",
      "source_url": "https://arxiv.org/abs/2609.19391",
      "source_page": null,
      "source_excerpt": ""
    }
  ],
  "exposure_map": [
    {
      "dimension": "quality",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "compute",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "latency",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "operations",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "compatibility",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "security",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "data_and_training",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "reproducibility",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    }
  ],
  "risks": [],
  "minimum_test": [],
  "open_questions": [],
  "independent_tests": [],
  "lab_reproductions": [],
  "report_available": false,
  "validation_tier": "unknown",
  "evidence_tier": "unknown",
  "infrastructure_basis": "unknown",
  "equations": [],
  "equations_status": "not_fetched",
  "core_kind": "",
  "equations_fetched_at": "",
  "equations_source_url": "",
  "equations_source_sha256": "",
  "exposures_reviewed_at": "",
  "exposures_source_sha256": ""
}