NEXUS: Structured Runtime Safety for Tool-Using LLM Agents
Elias Hossain, Md Mehedi Hasan Nipu, Tasfia Nuzhat Ornee, Rajib Rana, Niloofar Yousefi
Why It Matters
What makes this one worth your time
As LLM agents increasingly perform high-impact actions, ensuring their safe operation is crucial for preventing unintended consequences in real-world applications.
NEXUS enhances runtime safety for LLM agents with structured intervention policies.
Summary
The paper introduces NEXUS, a structured runtime safety monitor for tool-using LLM agents, which uses a combination of deterministic safety rules, argument-level inspection, and a logistic-regression risk score to manage interventions during agent execution. It demonstrates improved performance over rule-only systems on several benchmarks and maintains low latency.
Key contributions
- Development of NEXUS, a structured runtime safety monitor for LLM agents.
- Integration of deterministic safety rules with a logistic-regression risk score for intervention management.
- Public release of code, benchmarks, and a calibrated risk scorer.
Notable insights
- Combining deterministic rules with a logistic-regression risk score allows for graded intervention escalation.
- The approach achieves significant performance improvements over rule-only systems on specific benchmarks.
Possible limitations
- Not stated in the abstract
Abstract
arXiv:2607.19356v1 Announce Type: new Abstract: Tool-using LLM agents increasingly execute high-impact actions, making runtime safety monitoring essential. We present NEXUS (Neural EXecution Utility and Safety), a structured-plan safety monitor that applies a formal intervention policy to select among four actions: allow, block, request confirmation, or request revision. NEXUS combines deterministic safety rules, argument-level inspection, and a calibrated logistic-regression risk score for graded escalation. On a 128-instance synthetic benchmark, NEXUS achieves an F1 score of 0.949 and a 4-class intervention accuracy of 0.6406, outperforming rule-only intervention selection by 27.3 percentage points. It also improves over rule-only on R-Judge (F1 = 0.861 vs. 0.849), matches rule-only on AgentHarm due to threat-model limits, and achieves 0% ASR at 99% control allow on IPI. On the rule-blind NEXUS-Stress benchmark, NEXUS reaches an F1 score of 0.881, highlighting the difficulty of fine-grained intervention routing. With 0.205 ms median latency, NEXUS adds under 0.1% overhead to typical agent loops. Code, benchmarks, and the calibrated risk scorer are publicly released.