Why Formal Monitors Fail: Attack Distribution Entropy as a Coverage Bound for LTL-Based LLM Agent Safety

2026-08-02

AI Summary

This study addresses the significant variation in attack interception efficacy of existing LTL/FSA-based safety monitors across different large language model (LLM) architectures, a phenomenon previously lacking theoretical explanation. The work reveals, for the first time, that the distributional entropy of attack trigger-completion patterns is the fundamental determinant of formal monitor coverage. To enable pre-deployment evaluation independent of model architecture, the authors propose an entropy-based testing methodology. Leveraging Shannon entropy and statistical correlation analysis, they establish a theoretical upper bound on the recall of invariant-based monitors. Experiments across eight state-of-the-art LLMs demonstrate a strong negative correlation (r = −0.87) between monitor coverage and attack distribution entropy: GPT-style models achieve 96% coverage with a single pattern, whereas Gemini-style models require multiple clustered strategies yet attain only 6–13% coverage.

Abstract

Runtime safety monitors based on Linear Temporal Logic (LTL) and finite automata (FSA) are increasingly deployed to intercept unsafe tool-call sequences in LLM agents. Yet the same monitor achieves 68-75% attack coverage on some model architectures and near-zero on others, with no explanation from capability scores, training data, or prompt design. We provide the missing theory. We prove that the recall of any fixed-invariant FSA monitor is bounded above by the concentration of the attack distribution: the fraction of attacks covered by the k most frequent trigger-completion patterns. When attacks concentrate (low Shannon entropy), a small fixed invariant set achieves high recall; when they disperse across many structurally distinct patterns (high entropy), no fixed invariant set of tractable size can, regardless of how the invariants were derived. We validate this entropy-coverage bound across eight frontier LLM architectures. GPT-class and DeepSeek backends yield highly concentrated attacks (H ~ 0.24 bits; one pattern covers 96%), explaining 68-75% recall; Gemini variants yield high-entropy distributions (H ~ 2.81 bits; 7 clusters each <= 7%), explaining near-zero recall (6-13%), invariant to architecture-matched retraining. Entropy accounts for 76% of variance in coverage (Pearson r = -0.87, p = 0.005, 95% CI [-0.98, -0.78]), holding under leave-one-out (r in [-0.91, -0.82]). We introduce a pre-deployment entropy test that predicts monitor coverage from a small attack sample, enabling architecture-aware monitor selection before deployment. The bound and test are architecture-agnostic and apply to any FSA-based runtime monitor over discrete action sequences.

Problem

• LTL-based monitoring
• attack distribution entropy
• LLM agent safety
• coverage bound
• finite state automata

Innovation

• attack distribution entropy
• LTL-based monitoring
• FSA recall bound
• LLM agent safety
• pre-deployment entropy test