As tool-using LLM agents increasingly execute high-impact actions, runtime safety monitoring becomes essential. We present NEXUS (Neural EXecution Utility and Safety), a structured-plan safety monitor that utilizes a formal intervention policy to select from four actions: allow, block, request confirmation, or request revision.
NEXUS combines deterministic safety rules, argument-level inspection, and a calibrated logistic-regression risk score for graded escalation. In a 128-instance synthetic benchmark, NEXUS achieves an F1 score of 0.949 and a 4-class intervention accuracy of 0.6406, outperforming rule-only intervention selection by 27.3 percentage points. It also improves upon rule-only methods on R-Judge (F1 = 0.861 vs. 0.849), matches rule-only on AgentHarm due to threat-model limits, and achieves 0% ASR at a 99% control allow rate on IPI. On the rule-blind NEXUS-Stress benchmark, NEXUS reaches an F1 score of 0.881, highlighting challenges in fine-grained intervention routing. With a median latency of 0.205 ms, NEXUS adds under 0.1% overhead to typical agent loops. Code, benchmarks, and the calibrated risk scorer are publicly released.
Blogger's Review: The design of NEXUS effectively addresses the safety of tool-using LLM agents by integrating multiple intervention strategies and risk assessment methods, significantly enhancing intervention accuracy and real-time responsiveness. This advancement not only provides robust support for the safe application of LLMs but also lays a foundation for future research. Its low latency and minimal overhead demonstrate a good balance between efficient execution and safety monitoring.