runtime protection

Existing runtime enforcement techniques struggle to handle reactive systems with complex continuous dynamics and lack effective mechanisms for intervening in hybrid behaviors. This work proposes the first framework that integrates hybrid automata into runtime enforcement, enabling coordinated discrete event editing and continuous-time monitoring to correct system behavior at any instant by suppressing, delaying, or inserting events. The paper establishes formal enforceability conditions and devises an online strategy synthesis algorithm based on reachability analysis. Evaluation on an adaptive cruise control case study demonstrates that the approach ensures safety properties even when the underlying controller is unsafe, all while incurring minimal computational overhead.

This work addresses the challenge of dynamically enforcing safety constraints and optimizing quantitative objectives at runtime. We propose the “Runtime Advisor” paradigm—a proactive, decision-support mechanism that actively recommends next-step actions during system execution, supporting ω-regular properties and their quantitative semantics while adapting recommendations in real time based on observed execution traces. Methodologically, we integrate ω-automata theory with formal value-function computation to design the first constant-time advisor algorithm. For common verification scenarios, we construct concrete, correct, and efficient implementations tailored to representative quantitative value functions. Experimental evaluation demonstrates effectiveness under both Boolean and quantitative semantics, significantly improving runtime guidance capability and adaptability compared to reactive monitoring approaches.

This work addresses the challenges of model uncertainty and unpredictability in partially observable or black-box systems during runtime by proposing a unified theoretical framework that integrates epistemic logic with temporal logic. Leveraging automata theory, it systematically formalizes core concepts—including specification, diagnosis, opacity, and monitorability—and synthesizes lightweight online monitors through offline analysis. The approach is extended to real-time systems, resolving key issues related to their temporal semantics and algorithmic complexity. Furthermore, the study precisely characterizes the fundamental limits of runtime verification, thereby establishing a constructive and implementable foundation for practical deployment of monitoring mechanisms.

This work addresses the security risks associated with executing industrial control software on unauthorized hardware, a challenge inadequately mitigated by conventional protection mechanisms that often fail to balance security and functional correctness. The authors propose a novel hardware-software binding approach that integrates Physical Unclonable Functions (PUFs) with symbolic execution to enforce program behavior constraints and verify critical security properties. This method ensures that the software operates correctly only on authorized target devices while maintaining secure behavior—even in the presence of unauthorized execution environments or PUF failures. Notably, this study is the first to leverage symbolic execution for preserving software security properties under anomalous execution conditions, thereby achieving a robust combination of strong anti-reverse-engineering capabilities and high reliability.

Rust’s unsafe code may introduce memory-safety vulnerabilities that compromise the entire program. To address this, we propose an in-process, fine-grained isolation mechanism leveraging Memory Protection Keys (MPK), the first to dynamically isolate safe and unsafe code regions in Rust—thereby preventing cross-region propagation of violations such as heap/stack buffer overflows. Our approach integrates lightweight context switching, cross-isolation secure serialization and communication protocols, and application-level fault detection with automatic rollback of safe code segments. Evaluation shows that our mechanism effectively intercepts diverse heap and stack memory violations; incurs low overhead (<5% on average), substantially outperforming process-level isolation; and supports highly automated integration, validated across multiple real-world Rust projects. Our core contributions are: (1) the first MPK-based isolation framework targeting the Rust safe/unsafe boundary, and (2) integrated rollback guarantees for safe code upon unsafe-region failures.

This study addresses the challenge of providing certifiable runtime safety guarantees prior to tool invocation, focusing on three core issues: the representability of policy states, the observability of monitoring evidence, and the impact of interventions on future behavior. To this end, we propose the first formal theoretical framework for runtime safety-executable boundaries, distinguishing among static policy executability, statistical calibration under exogenous legal constraints, and closed-loop intervention effects. Building upon finitely controlled models, we develop a method for closed-loop safety certification that integrates register model identification, Neyman–Pearson hypothesis testing, conformal calibration, and occupancy planning. Empirical validation through static diagnosis, model enumeration, representation rewriting, and closed-loop re-execution experiments demonstrates the efficacy of our approach and exposes the fundamental limitations of static calibration under representation attacks.

This work proposes a novel reflective protocol that enables runtime upward navigation through the semantic tower—a capability absent in existing runtime systems, which are restricted to downward execution along abstraction layers. By formally integrating operational semantics with runtime reflection, the approach introduces the notion of “first-class implementations” and establishes a generalized safe-point mechanism grounded in formal specifications. This mechanism permits observation and dynamic switching of high-level abstractions’ underlying implementations during execution, thereby overcoming the traditional limitation of supporting only downward compilation or interpretation. The study demonstrates, for the first time, the feasibility and effectiveness of deeply integrating semantic theory with runtime system design, enabling adaptive and semantically aware execution environments.

This work addresses the absence of a unified, verifiable runtime safety mechanism in existing MCP-style agents, where security decisions are fragmented across multiple components. To bridge this gap, the paper introduces HCP (Handle-Capability Protocol), a runtime framework that, while fully compatible with MCP workflows, formally defines eight execution-layer safety invariants for the first time. HCP enforces these invariants through a fine-grained access control model grounded in subjects, resources, capabilities, handles, and policies, explicitly ensuring critical properties such as subject binding, capability scoping, and data-flow authorization. Empirical evaluation demonstrates that HCP successfully blocks all attacks across ten benchmark scenarios while preserving auditable evidence, substantially outperforming baseline approaches. Microbenchmark results further indicate that policy operations incur an average latency of less than one millisecond.

Current research on the security of LLM-agent systems remains fragmented, lacking a unified framework to explain the common root causes and propagation mechanisms underlying failures such as prompt injection and tool misuse. This work establishes *isolation* as a first-class principle for system security and introduces a boundary-centric taxonomy comprising five boundary types: user–agent, agent–tool, agent–execution, agent–agent, and system–environment. By systematically modeling failure pathways and defense strategies through structured review and cross-domain analysis, the study reveals that security failures predominantly originate from insufficient isolation and follow distinct cross-boundary attack propagation patterns. The paper thus provides a cohesive theoretical foundation and a construction-oriented research agenda centered on isolation for designing highly secure agent systems.

This work addresses the programming challenges and error-proneness introduced by Arm’s POE2 architecture, which employs a complex spatiotemporal permission mechanism yet lacks a unified security model. We propose the first general-purpose secure programming model tailored for POE2, abstracting away the intricacies of its spatial and temporal indexing and encapsulating hardware features such as memory protection keys, dedicated registers, and table structures. By doing so, our model significantly simplifies permission management while preserving POE2’s strong security guarantees. It naturally supports common intra-process isolation patterns used in software partitioning, enabling developers to construct secure isolated systems more efficiently and with fewer errors.