LEANGUARD: Lean-Verified Guardrails for Tool-Using Agents
READ THE ORIGINAL SOURCEOpen original sourcehuggingface.co · Opens in a new tabLeanGuard is a runtime that checks each proposed tool call from a language-model agent against a policy written in Lean4 before execution. Policies combine state predicates with scoped past-time temporal operators, evaluation is fail-closed, and the decision procedure is proved equivalent to a LeanLTL semantics. Denied calls can be corrected via agent feedback or via proof-guided repair, which searches for a nearby admissible call without the model. Reported results on Tau-Bench, DTap, and a telecom setting are presented.
One primary source; other links are context, not independent corroboration.
- Primary sourceHugging Face Daily Papers
- Discovery linkHugging Face
- Linked in sourceView arXiv page
- Linked in sourceView PDF
The paper page is linked. Peer review and findings have not been independently checked by AINewsIQ.
Open full article view →- Original paper+45
- Fetched source page+30
- No editor link review+0
- Original non-discussion link+5
This measures the stored source trail and editorial steps. It does not certify accuracy, peer review, or independent corroboration. Popularity adds no points.
View full scoring →Read the scoring rubric →What the source says
LeanGuard is a runtime that checks each proposed tool call from a language-model agent against a policy written in Lean4 before execution. Policies combine state predicates with scoped past-time temporal operators, evaluation is fail-closed, and the decision procedure is proved equivalent to a LeanLTL semantics. Denied calls can be corrected via agent feedback or via proof-guided repair, which searches for a nearby admissible call without the model. Reported results on Tau-Bench, DTap, and a telecom setting are presented.
A READER'S EVIDENCE CHECKHow to read this signalSix questions about claims, sources, risks, and open checks
This is a signal-level guide until claim-level evidence is available. “Not recorded” means the evidence has not been assessed here; it does not mean a result is false. How we check AI news →
- 01Who is making each claim?
The claimant and whether each claim was measured or asserted are not recorded in this public brief.
- 02What was actually tested?
Not recorded per claim. Check the source for sample size, tasks, model and benchmark versions, and reproducibility.
- 03Where are the sources?
Original link: huggingface.co. Brief basis: fetched source page. Primary page date and quote locations are not established in this panel.
- 04What could mislead?
Source claims not independently checked; results cover specific benchmarks and five Qwen models, and policies must be written in Lean4 by hand.
- 05What is at risk if wrong?
Not assessed per claim. Consider safety, privacy, cost, and adoption decisions before relying on the result.
- 06What would change the view?
No claim-specific check is recorded. An inspectable primary method or independent replication could change the assessment.
Key findings from the stored brief
- On Tau-Bench with five Qwen models, unguarded agents executed at least 33 forbidden calls; LeanGuard executed none.
- On DTap, direct prompt-injection success dropped from 57.9% to 5.9%.
- Feedback reduced repeated blocked calls and raised task success for four of five models over a bare denial.
- Proof-guided repair found an admissible edit for 88 of 252 argument-value denials, with a median of 2ms.
Source claims not independently checked; results cover specific benchmarks and five Qwen models, and policies must be written in Lean4 by hand.
This is a source-based abstract, not independent validation of the source's claims.
Evidence & sources
These links show where the signal came from and what the source page linked to. A linked page is context, not independent corroboration.
Related archive coverage
These relationships record a citation or topic overlap, not confirmation of the finding.
The paper page is linked. Peer review and findings have not been independently checked by AINewsIQ.
Timeline & updates
- Signal dated by source or discovery feed
This timestamp places the signal in the radar. It may be the discovery post date rather than the primary page's first publication date.
- Shared brief stored
AINewsIQ prepared one abstract from fetched source page.
A publication revision history is not stored for this signal. New engagement snapshots do not mean the source itself changed.
Why this may matter
It proposes a formally grounded enforcement layer for agent tool calls, shifting policy checks from model behavior to verified rules. This could reduce policy-violating actions and prompt-injection risk in tool-using systems.
Limits and open questions
Source claims not independently checked; results cover specific benchmarks and five Qwen models, and policies must be written in Lean4 by hand.
Organization-specific financial, security, and operational effects require the organization's own context and review.
Discussion
Comments are reviewed before publication. Discuss the evidence, not the person.
No published comments yet.
Reader discussion opens with accounts. You can read the original source and published comments now.