Approved Too Late: Verdict Staleness in LLM-Guarded Self-Adaptive Systems
On the map: LLM safety and security → Prompt injection and agent security
Abstract (arXiv)
A large language model (LLM) guardrail for a self-adaptive system (SAS) may issue an approval that is correct at check time but stale by actuation. This creates an Execute-stage time-of-check to time-of-use (TOCTOU) hazard. We study verdict freshness: whether a guardrail verdict remains valid when used. We distinguish three quantities that answer different questions: all-candidate verdict change under fixed-action replay, oracle-labeled approval expiry on recorded closed-loop trajectories, and judge-conditioned use-time invalidity. Across five reproducible SAS environments, all-candidate verdict-change rates span 5.3-48.4% at a common replay shift of eight simulator steps. We introduce the Freshness-Bounded Shield (FBS), which estimates each approval's validity horizon from its safe-side margin and recent feature volatility, without an explicit plant-dynamics model. Using fixed settings documented in the artifact, FBS reduces oracle-labeled approval-expiry rates from 3.4-24.7% to 0-1.8% at the same shift. A separate audit of four LLM judges finds nonzero judge-conditioned use-time invalidity in every approval stream. We formulate a freshness contract: every approval must be correct at check time and remain valid at use time.
Key facts. No citing papers in the map yet (data through 7 Oct 2026). Placed in Prompt injection and agent security, one of 12 directions in LLM safety and security. Builds on 11 of its 21 references that are in the map. First posted on arXiv 26 Aug 2026.
Builds on
11 of 21 references.
References · 11
- 2023Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversationscited by 1,124
- 2023NeMo Guardrails: A Toolkit for Controllable and Safe LLM Applications with Programmable Railscited by 347
- 2020Age of Information: An Introduction and Surveycited by 64
- 2019Robust Model Predictive Shielding for Safe Reinforcement Learning with Stochastic Dynamicscited by 45
- 2024iLLM-TSC: Integration reinforcement learning and large language model for traffic signal control policy improvementcited by 23
- 2021The Black-Box Simplex Architecture for Runtime Assurance of Autonomous CPScited by 8
- 2024SWITCH: An Exemplar for Evaluating Self-Adaptive ML-Enabled Systemscited by 6
- 2026Atomicity for Agents: Exposing, Exploiting, and Mitigating TOCTOU Vulnerabilities in Browser-Use Agentscited by 6
- 2025Generative AI for Self-Adaptive Systems: State of the Art and Research Roadmapcited by 5
- 2020Improving the Decision-Making Process of Self-Adaptive Systems by Accounting for Tactic Volatilitycited by 2
- 2018mRUBiS: An Exemplar for Model-Based Architectural Self-Healing and Self-Optimizationcited by 1
Built on by
Not cited yet.