Safety-Gated Agentic Supervisory Control on a Coupled Distillation Benchmark: Regime Map, Auditable Gate, and Co-Design Findings
Not on the map. Why?
Abstract (arXiv)
An open-weight LLM can write composition setpoints every five minutes. What a plant still needs is a hard check: named constraints, logged margins, and an admit/block decision before the regulatory layer moves. This paper puts that check in a rule-based forked-twin counterfactual gate (nine pinned constraints) and leaves the regulatory layer unchanged. On Skogestad's Column A the ladder is PID-only (C0), linear MPC (C1), ungated agent (C2), and gated agent (C3) under one contract: identical level closure (M_D, M_B), scenarios, and seeds; C2/C3 share the linear-MPC backend. The split is not subtle. Off-nominal target acquisition: the agent beats Pareto-tuned linear MPC in the strong band (C2/C1 IAE ratio 0.361 at the upper CI). Disturbance rejection on the same 16-point grid inverts by 16.03 at the upper CI (10.18 at the point estimate), where an ungated LLM supervisor does not belong. The gate compresses a specification-abandonment attractor into a bounded offset (d approx. -1.4; P95 cell IAE 11.5 to 0.77). A one-line prompt fix removes the attractor at source (6/10 to 0/10; sensitivity only, not a new headline). In a 250-cell statistical pass, 534 of 590 gate interventions are spec-on-bound geometry: the operating specification sits on a safety limit, so a well-behaved OP becomes inoperable while misbehaving ones are only contained; 318 blocks still correct actively harmful proposals. Headlines are single-column and model-conditional on DeepSeek-V4-Flash. A second-family sweep (NVIDIA Nemotron-3-Super) keeps the disturbance-rejection fails band and plant-side failure geography; magnitudes and protocol operability stay model-conditional, and Super target-acquisition strong cells are survivors only (not confirmation). Transfer means twin, constraint envelope, and setpoint interface, not a second plant class measured here.
Key facts. No citing papers in the map yet (data through 7 Oct 2026). Builds on 8 of its 35 references that are in the map. First posted on arXiv 30 Jul 2026.
Builds on
8 of 35 references.
References · 8
- 2023ChemCrow: Augmenting large-language models with chemistry toolscited by 609
- 2017Safe Reinforcement Learning via Shieldingcited by 427
- 2023Towards autonomous system: flexible modular production system enhanced with large language model agentscited by 38
- 2021Run Time Assurance for Safety-Critical Systems: An Introduction to Safety Filtering Approaches for Complex Control Systemscited by 25
- 2024ControlAgent: Automating Control System Design via Novel Integration of LLM Agents and Domain Expertisecited by 20
- 2025Leveraging LLM Agents and Digital Twins for Fault Handling in Process Plantscited by 9
- 2025Autonomous Control Leveraging LLMs: An Agentic Framework for Next-Generation Industrial Automationcited by 8
- 2026A Systematic Approach to Multi-Agent AI from Advanced Regulatory Control Theory: Safe and Auditable LLM Operator Agents for Process Controlcited by 4
Built on by
Not cited yet.
Similar, not cited
Close in wording, no citation either way
- 2026A Tutorial on Autonomous Fault-Tolerant Control Using Knowledge-Grounded LLM Agents
- 2026Reason Less, Verify More: Deterministic Gates Recover a Silent Policy-Violation Failure Mode in Tool-Using LLM Agents
- 2026From Detection to Action: Using LLM Agents for Fault-Tolerant Control
- 2025Evaluating LLM Agent Adherence to Hierarchical Safety Principles: A Lightweight Benchmark for Probing Foundational Controllability Components
- 2026Context Assembly as the Controlled Variable: A Control-Theoretic View of Harness Policies for Frozen LLM Agents
- 2025Safe Deployment of Offline Reinforcement Learning via Input Convex Action Correction
- 2026Falsifiable Release Gates for Self-Improving Systems: Standing Invariants at Scale
- 2026Operational Reframing and Approval-Framed Delegation in Multi-Agent LLM Safety