LEANGUARD: Lean-Verified Guardrails for Tool-Using Agents
LeanGuard cut direct prompt-injection success from 57.9% to 5.9% on DTap.
The runtime checks every proposed tool call against a Lean4 policy before execution and blocks calls unless the policy admits them. On Tau-Bench, it executed no policy-forbidden calls across five Qwen models; unguarded agents executed at least 33. Giving agents a violated rule and a correction hint left task success statistically unchanged in that benchmark. A separate repair mechanism proved admissible argument edits for 88 of 252 replayed denials, with a median repair time of 2 milliseconds.
HF Daily Papers' note
The runtime checks every proposed tool call against a Lean4 policy before execution and blocks calls unless the policy admits them. On Tau-Bench, it executed no policy-forbidden calls across five Qwen models; unguarded agents executed at least 33. Giving agents a violated rule and a correction hint left task success statistically unchanged in that benchmark. A separate repair mechanism proved admissible argument edits for 88 of 252 replayed denials, with a median repair time of 2 milliseconds.
HF Daily Papers' note
score 5