{ "schema_version": 1, "builder_plan": { "scenario": "An agent reads external documents or tool responses that may contain malicious instructions.", "change": "Replay attacks and legitimate lookalikes in an isolated copy of your agent workflow.", "baseline": "Your existing checks with the same tasks, permissions, and tool responses.", "steps": [ "Locate the paper's implementation and check its license, model support, data needs, and hardware requirements. Stop here if you cannot obtain the required artifacts.", "Save a small set of representative product tasks and expected outcomes. Keep evaluation tasks out of any training or tuning, and choose quality and cost limits before running.", "Run the baseline and the proposed change on identical inputs. Keep other settings fixed and repeat paired runs to expose variation.", "Save per-task outputs, failures, timings, and all usage costs. Review regressions before expanding the test." ], "measure": "Successful attacks missed, legitimate actions blocked, detection delay, and review cost.", "decision": "Keep the change only if it meets your preselected quality and latency limits and improves the metric you care about after setup and operating costs. Otherwise retain the baseline. This is an exploration plan, not a validated recommendation." }, "builder_review": null, "arxiv_id": "2610.11030", "title": "NOMOS: Compiling Written Policies into Statically Verified Tool-Call Gates for LLM Agents", "summary": "Replaces hand-written guard rules and per-action LLM verifiers with a four-pass compiler that turns natural-language policy into a deterministic, statically verified tool-call gate, compilable on-premise with an open-weight 26B model. Costs are a one-time compilation pipeline, a transcript-replay validation step, and a domain-dependent benign-utility cost from over-refusal, since a bad binding was observed refusing 95.9% of legitimate task-passing calls. Can fail on attack goals that involve no governable tool call, on bindings verified as weaker than their clause, and in domains where policy clauses cannot be grounded in available tool schemas.", "rationale": "The mechanism is cheap to operate and within constrained infrastructure, but the measured over-refusal risk and domain-dependent utility cost require validation on the reader's own tools and transcripts before production adoption.", "technique": "Policy-compiled deterministic tool-call gates", "family": "seguranca_e_guardrails", "recommendation": "testar", "published": "2026-10-08", "as_of": "2026-10-18", "editorial_status": "indexed", "source_url": "https://arxiv.org/abs/2610.11030", "independent_implementations": 0, "total_implementations": 1, "stars": 10, "citations": 0, "claims": [ { "claim_id": "claim-01", "statement": "Replaces hand-written guard rules and per-action LLM verifiers with a four-pass compiler that turns natural-language policy into a deterministic, statically verified tool-call gate, compilable on-premise with an open-weight 26B model. Costs are a one-time compilation pipeline, a transcript-replay validation step, and a domain-dependent benign-utility cost from over-refusal, since a bad binding was observed refusing 95.9% of legitimate task-passing calls. Can fail on attack goals that involve no governable tool call, on bindings verified as weaker than their clause, and in domains where policy clauses cannot be grounded in available tool schemas.", "basis": "inferred", "result": "", "baseline": "", "conditions": "", "source_url": "https://arxiv.org/abs/2610.11030", "source_page": null, "source_excerpt": "" }, { "claim_id": "claim-02", "statement": "On tau^2-bench, violations of reference-encoded clauses among state-changing calls drop from 66.3% to 2.6% (airline) and 30.8% to 6.9% (retail); zero attack success rate on AgentDojo banking versus shipped defenses, with at most 3.6% ASR on the other three suites; gate decisions take microseconds with no per-action LLM call.", "basis": "inferred", "result": "", "baseline": "", "conditions": "", "source_url": "https://arxiv.org/abs/2610.11030", "source_page": null, "source_excerpt": "" } ], "exposure_map": [ { "dimension": "quality", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "compute", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "latency", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "operations", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "compatibility", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "security", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "data_and_training", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "reproducibility", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" } ], "risks": [], "minimum_test": [], "open_questions": [], "independent_tests": [], "lab_reproductions": [], "report_available": false, "validation_tier": "unknown", "evidence_tier": "unknown", "infrastructure_basis": "unknown", "equations": [], "equations_status": "not_fetched", "core_kind": "", "equations_fetched_at": "", "equations_source_url": "", "equations_source_sha256": "", "exposures_reviewed_at": "", "exposures_source_sha256": "" }