一句话：ProbGuard 用从执行轨迹学到的 DTMC 预测 LLM 智能体的安全风险，实现提前预警与干预。
LLM 智能体的随机决策带来难以预判的安全风险，而 AgentSpec 等现有监控依赖反应式规则，仅在违规临近或已发生时才检测，难以处理长时序依赖。ProbGuard 将执行抽象为符号状态，从轨迹学习离散时间马尔可夫链（DTMC）刻画行为动态；运行时估计从当前状态保持安全的概率，低于用户阈值即触发干预。方法在抽象中引入语义有效性约束，并给出 PAC 风格样本复杂度分析。在自动驾驶与具身家务智能体上，无误报阈值下最多提前 15.84 秒预警，严格阈值下达 38.66 秒；re-prompting 使不安全行为降低 65.37% 并保留 80.4% 任务完成率，halting 配置降低 93.60% 但完成率损失更大。系统开源、集成 LangChain 且开销极小。
Large Language Model (LLM) agents increasingly operate across domains such as robotics, virtual assistants, and web automation. However, their stochastic decision-making introduces safety risks that are difficult to anticipate during execution. Existing runtime monitoring frameworks, such as AgentSpec, primarily rely on reactive safety rules that detect violations only when unsafe behavior is imminent or has already occurred, limiting their ability to handle long-horizon dependencies. We present ProbGuard, a proactive runtime monitoring framework for LLM agents that anticipates safety violations through probabilistic risk prediction. ProbGuard abstracts agent executions into symbolic states and learns a Discrete-Time Markov Chain (DTMC) from execution traces to model behavioral dynamics. At runtime, the monitor estimates the probability that execution will remain safe from the current state, and triggers an intervention when this probability falls below a user-defined threshold. To improve robustness, ProbGuard incorporates semantic validity constraints in the abstraction and admits a PAC-style analysis that characterizes the sample complexity required to certify the learned model under standard assumptions. We evaluate ProbGuard in two safety-critical domains: autonomous driving and embodied household agents. Across evaluated scenarios, ProbGuard consistently predicts traffic law violations and collisions in advance, with warnings up to 15.84 seconds at a threshold yielding no false alarms, and up to 38.66 seconds at stricter thresholds. In embodied agent tasks, ProbGuard's re-prompting intervention mode reduces unsafe behavior by 65.37% relative to the unmonitored baseline while retaining 80.4% of the baseline task completion; a stricter halting configuration reduces unsafe behavior by 93.60% at a larger cost in completion. ProbGuard is implemented as an extensible open-source runtime monitor integrated with the LangChain agent framework and introduces minimal runtime overhead.
@inproceedings{paperbot12428,
title = {ProbGuard: Proactive Runtime Monitoring for LLM Agent Safety via Probabilistic Prediction},
author = {Haoyu Wang and Christopher M. Poskitt and Jiali Wei and Jun Sun},
booktitle = {ASE},
year = {2026},
doi = {10.1145/3832783.3837413}
}