monitor design

This paper addresses the fundamental limitation in runtime monitoring that branching-time properties—such as those expressible in modal μ-calculus—are inherently unmonitorable over a single execution trace. To overcome this, we propose a novel multi-round execution monitoring paradigm. Integrating monitoring theory, formal semantics, and game theory, we establish—for the first time—a precise theoretical characterization linking the syntactic structure of branching-time formulas to the minimum number of execution rounds required for monitoring, and rigorously prove that multi-round monitoring strictly extends classical monitorability boundaries. Our main contributions are: (1) a systematic characterization of observational power in multi-round monitoring; (2) tight upper and lower bounds on the minimal round complexity; and (3) confirmation that several canonical branching-time properties—including key safety and liveness specifications—become effectively monitorable within two or three rounds. This work provides both a theoretical foundation and a practical methodology for dynamic verification of complex concurrent and interactive behaviors.

This paper addresses the problem of optimally composing multiple runtime monitors under an average cost constraint to maximize the safety intervention probability (i.e., recall) against AI misaligned outputs. The proposed method introduces a Neyman–Pearson lemma–based optimization framework that unifies monitor invocation timing, selection, and intervention decisions into a likelihood-ratio–driven sequential decision problem. Pareto-optimal solutions are identified via exhaustive search, enabling principled trade-offs between performance and computational cost. Empirical evaluation on code review tasks demonstrates that the approach significantly improves multi-monitor coordination efficiency, achieving over 100% recall improvement relative to baseline methods. These results validate both the theoretical soundness and practical efficacy of the framework in resource-constrained real-world deployment scenarios.

This work addresses the challenges of model uncertainty and unpredictability in partially observable or black-box systems during runtime by proposing a unified theoretical framework that integrates epistemic logic with temporal logic. Leveraging automata theory, it systematically formalizes core concepts—including specification, diagnosis, opacity, and monitorability—and synthesizes lightweight online monitors through offline analysis. The approach is extended to real-time systems, resolving key issues related to their temporal semantics and algorithmic complexity. Furthermore, the study precisely characterizes the fundamental limits of runtime verification, thereby establishing a constructive and implementable foundation for practical deployment of monitoring mechanisms.

Existing runtime monitors support only Boolean specification verification, making it infeasible to progressively approximate quantitative properties—such as average response time—over infinite traces. Method: This paper establishes the first unified formal framework for quantitative approximate monitoring, introducing quantitative monitors whose estimates monotonically improve as observation prefixes grow, and rigorously modeling the trade-off between estimation accuracy and resource consumption (specifically, register count). Contribution/Results: We prove that register count strictly determines the theoretical upper bound on achievable accuracy; moreover, each additional register strictly increases the attainable precision—demonstrating an irreducible, non-compensatory relationship between resources and accuracy. Our framework conservatively extends classical Boolean monitoring theory while ensuring soundness. The proposed approach provides provably optimal, resource-bounded approximate monitoring for critical performance metrics, enabling verifiable, deployment-aware runtime assurance.

This work addresses the unreliability of Chain-of-Thought (CoT) monitors in detecting undesirable behaviors—such as test-time exploitation—often stemming from insufficient information extraction or poor approximation of the monitoring function. For the first time, it formalizes CoT monitorability from an information-theoretic perspective, establishing that non-zero mutual information between the CoT and the output is necessary but insufficient for effective monitoring. The study identifies two key error sources: information gaps and steering errors. To mitigate these, it proposes a novel label-free joint optimization framework that combines conditional mutual information maximization with oracle-guided reinforcement training to systematically enhance monitor performance. Experiments demonstrate that this approach significantly improves monitoring accuracy across diverse settings, effectively suppresses CoT degradation, and alleviates reward hacking even under imperfect reward signals.

This study investigates the reliability of frozen safety activation monitors—originally trained on base language models—after the models undergo common post-training updates such as quantization, full fine-tuning, or LoRA-based adaptation. Through systematic evaluation across multiple open-source large language models and architectures, the work reveals distinct impacts of these update strategies on monitor performance: quantization (e.g., NF4) has minimal effect, whereas fine-tuning—particularly QLoRA—frequently compromises monitor efficacy, with privacy-related probes being most vulnerable and compliance-based refusal monitors relatively robust. The paper further introduces a method to predict monitor degradation based on pre-deployment model characteristics, enabling efficient prioritization of revalidation efforts and enhancing the safety and efficiency of model deployment.

This work addresses the lack of a unified framework for runtime monitoring in safety-critical machine learning systems, which hinders systematic design and evaluation. The authors propose a general runtime monitoring framework that, for the first time, systematically categorizes monitoring mechanisms into three complementary dimensions: Operational Design Domain (ODD) compliance checking, out-of-distribution (OOD) detection, and out-of-model-scope (OMS) anomaly analysis. They further establish a safety-oriented, unified evaluation methodology grounded in this tripartite structure. Demonstrated on a vision-based aircraft runway detection task, the framework significantly enhances the identification of unsafe inputs and anomalous model behaviors, enables fair cross-method comparison and integration, and thereby advances the trustworthy deployment of safety-critical AI systems.

This study addresses the challenge of providing certifiable runtime safety guarantees prior to tool invocation, focusing on three core issues: the representability of policy states, the observability of monitoring evidence, and the impact of interventions on future behavior. To this end, we propose the first formal theoretical framework for runtime safety-executable boundaries, distinguishing among static policy executability, statistical calibration under exogenous legal constraints, and closed-loop intervention effects. Building upon finitely controlled models, we develop a method for closed-loop safety certification that integrates register model identification, Neyman–Pearson hypothesis testing, conformal calibration, and occupancy planning. Empirical validation through static diagnosis, model enumeration, representation rewriting, and closed-loop re-execution experiments demonstrates the efficacy of our approach and exposes the fundamental limitations of static calibration under representation attacks.

This work proposes a reusable runtime monitoring approach for the certified verification of past-time Signal Temporal Logic (ptSTL) specifications from visual observations in partially observable environments, offering finite-sample guarantees. The key innovation lies in introducing a semantic basis—defined as a vector of atomic robustness scores—as a unified prediction target, coupled with a rolling prediction mechanism that online reconstructs temporal histories. A single conformal calibration suffices to cover entire logical fragments, eliminating the need for formula-specific retraining. The semantic-basis monitor achieves up to fourfold higher accuracy over long horizons, while the rolling-prediction monitor yields tighter bounds in short-term settings. Evaluated on both a pedestrian-crossing benchmark and real-world Waymo driving data, both monitors empirically satisfy conformal coverage and deliver superior certified performance across varying time scales.

Large language models (LLMs) can still generate unsafe outputs in deployment, necessitating efficient real-time monitoring. This work proposes a lightweight online safety monitoring mechanism that integrates signals from an external verification model, threshold-based decision rules, and risk control theory to produce reliable alerts through calibrated thresholds. The approach features a simple architecture that avoids computationally intensive procedures yet achieves detection performance on par with state-of-the-art sequential hypothesis testing methods across mathematical reasoning and red-teaming benchmarks. By combining practical efficiency with theoretical guarantees, the proposed method offers a viable solution for real-world LLM safety monitoring.