{
  "schema_version": 1,
  "builder_plan": {
    "scenario": "An agent reads external documents or tool responses that may contain malicious instructions.",
    "change": "Replay attacks and legitimate lookalikes in an isolated copy of your agent workflow.",
    "baseline": "Your existing checks with the same tasks, permissions, and tool responses.",
    "steps": [
      "Locate the paper's implementation and check its license, model support, data needs, and hardware requirements. Stop here if you cannot obtain the required artifacts.",
      "Save a small set of representative product tasks and expected outcomes. Keep evaluation tasks out of any training or tuning, and choose quality and cost limits before running.",
      "Run the baseline and the proposed change on identical inputs. Keep other settings fixed and repeat paired runs to expose variation.",
      "Save per-task outputs, failures, timings, and all usage costs. Review regressions before expanding the test."
    ],
    "measure": "Successful attacks missed, legitimate actions blocked, detection delay, and review cost.",
    "decision": "Keep the change only if it meets your preselected quality and latency limits and improves the metric you care about after setup and operating costs. Otherwise retain the baseline. This is an exploration plan, not a validated recommendation."
  },
  "builder_review": null,
  "arxiv_id": "2610.31062",
  "title": "SCOPE: Compiling Natural-Language Policies into Neurosymbolic Predicate Programs",
  "summary": "SCOPE replaces fine-tuned guardrail models and LLM-as-a-judge policy evaluation by compiling each policy into an executable program of small neural predicates, deterministic extractors, and explicit compositional logic, optimized against adversarially generated counterexamples. It costs the upfront effort of policy compilation and counterexample-driven optimization, plus maintaining the execution pipeline; claimed benefits are higher accuracy than prompt optimization or workflow generation baselines, transfer to inexpensive small models without re-optimization, and more stable, interpretable verdicts than frontier reasoning models. It can fail on policies that do not decompose cleanly into narrow predicates, when adversarial training data undercovers the policy space, and if the predicate extractors drift against real production traffic.",
  "rationale": "The reader can run small executor models on a 24 GB GPU and gains interpretability plus stability over LLM-as-a-judge, but the abstract provides no quantified gains and the compile-and-optimize pipeline needs validation against the reader's specific policies before production adoption.",
  "technique": "Compiling policies into neurosymbolic predicate programs",
  "family": "seguranca_e_guardrails",
  "recommendation": "testar",
  "published": "2026-10-22",
  "as_of": "2026-10-23",
  "editorial_status": "indexed",
  "source_url": "https://arxiv.org/abs/2610.31062",
  "independent_implementations": 1,
  "total_implementations": 2,
  "stars": 122,
  "citations": null,
  "claims": [
    {
      "claim_id": "claim-01",
      "statement": "SCOPE replaces fine-tuned guardrail models and LLM-as-a-judge policy evaluation by compiling each policy into an executable program of small neural predicates, deterministic extractors, and explicit compositional logic, optimized against adversarially generated counterexamples. It costs the upfront effort of policy compilation and counterexample-driven optimization, plus maintaining the execution pipeline; claimed benefits are higher accuracy than prompt optimization or workflow generation baselines, transfer to inexpensive small models without re-optimization, and more stable, interpretable verdicts than frontier reasoning models. It can fail on policies that do not decompose cleanly into narrow predicates, when adversarial training data undercovers the policy space, and if the predicate extractors drift against real production traffic.",
      "basis": "inferred",
      "result": "",
      "baseline": "",
      "conditions": "",
      "source_url": "https://arxiv.org/abs/2610.31062",
      "source_page": null,
      "source_excerpt": ""
    }
  ],
  "exposure_map": [
    {
      "dimension": "quality",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "compute",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "latency",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "operations",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "compatibility",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "security",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "data_and_training",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "reproducibility",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    }
  ],
  "risks": [],
  "minimum_test": [],
  "open_questions": [],
  "independent_tests": [],
  "lab_reproductions": [],
  "report_available": false,
  "validation_tier": "unknown",
  "evidence_tier": "unknown",
  "infrastructure_basis": "unknown",
  "equations": [],
  "equations_status": "not_fetched",
  "core_kind": "",
  "equations_fetched_at": "",
  "equations_source_url": "",
  "equations_source_sha256": "",
  "exposures_reviewed_at": "",
  "exposures_source_sha256": ""
}