When a large language model (LLM) guardrail is employed in a self‑adaptive system (SAS), the guardrail may issue an approval that is correct at the moment of checking but becomes stale by the time of actuation, creating a check‑to‑use (TOCTOU) hazard. This paper studies verdict freshness—whether a guardrail’s approval remains valid when it is actually used.
We distinguish three freshness metrics:
- All‑candidate verdict‑change rate – under fixed‑action replay, how often any possible approval would differ across time;
- Oracle‑labeled approval‑expiry rate – on recorded closed‑loop trajectories, which approvals are marked as expired;
- Judge‑conditioned use‑time invalidity – given different LLM judges, how often an approval becomes invalid at use time.
Across five reproducible SAS environments, with a common replay shift of eight simulator steps, the all‑candidate verdict‑change rates range from 5.3%‑48.4%. To address this, we introduce the Freshness‑Bounded Shield (FBS), which estimates each approval’s validity horizon from its safe‑side margin and recent feature volatility, without requiring an explicit plant‑dynamics model.
Under the same shift, FBS reduces oracle‑labeled approval‑expiry rates from 3.4%‑24.7% down to 0‑1.8%. An independent audit of four LLM judges reveals non‑zero judge‑conditioned use‑time invalidity in every approval stream.
From these findings we formulate a freshness contract: every approval must be correct at check time and remain valid at use time.
Blogger's Review: The study spotlights a critical timing weakness of LLM‑based guardrails and offers a lightweight, model‑free mitigation, making it highly relevant for real‑world deployments.