Yajie Yin

On evidence-sufficiency judgment, a domain with no decidable correctness reward, a boundary-keeping recipe of supervised fine-tuning followed by GRPO on an LLM-judge reward raised spontaneous correct refusal under action pressure from 25% in the instruction-tuned baseline to 100% (40 per arm; Wilson 95% CI lower bound 91.2%, non-overlapping with the baseline interval [14.2%, 40.2%]), while a scrambled-pairing placebo fell to 5%. The same recipe's automatic false refusal on 281 well-formed claims was 1.1% (Wilson upper bound 3.09%), so the effect is boundary-specific rather than blanket refusal; SFT saturates the face, leaving the GRPO increment not separately identifiable, and ratings come from model sessions, not human experts.

On evidence-sufficiency judgment, a domain with no decidable correctness reward, a boundary-keeping recipe of supervised fine-tuning followed by GRPO on an LLM-judge reward raised spontaneous correct refusal under action pressure from 25% in the instruction-tuned baseline to 100% (40 per arm; Wilson 95% CI lower bound 91.2%, non-overlapping with the baseline interval [14.2%, 40.2%]), while a scrambled-pairing placebo fell to 5%. The same recipe's automatic false refusal on 281 well-formed claims was 1.1% (Wilson upper bound 3.09%), so the effect is boundary-specific rather than blanket refusal; SFT saturates the face, leaving the GRPO increment not separately identifiable, and ratings come from model sessions, not human experts.

The authors apply Verification Autonomy Levels (VAL, L0–L5) to 22 LLM-agent security defenses and run an equal-budget comparison of a VAL-guided stack (confirmation gate + schema sandbox) against a mainstream intuition stack (prompt hardening + keyword filter) across 50 scenarios, 12 attack variants, and adaptive/white-box/PAIR escalation, finding the VAL stack holds 0.000 attack success at 1.000 benign success while the intuition stack reaches 0.000 ASR but kills all benign actions, and that across testbeds of rising attack-surface hardness the intuition stack's zero drifts (0→1.9%→6.2%) while the VAL stack holds within its ODD (0→0→0), its only breach a disclosed out-of-ODD password gap (0.5%).

The authors apply Verification Autonomy Levels (VAL, L0–L5) to 22 LLM-agent security defenses and run an equal-budget comparison of a VAL-guided stack (confirmation gate + schema sandbox) against a mainstream intuition stack (prompt hardening + keyword filter) across 50 scenarios, 12 attack variants, and adaptive/white-box/PAIR escalation, finding the VAL stack holds 0.000 attack success at 1.000 benign success while the intuition stack reaches 0.000 ASR but kills all benign actions, and that across testbeds of rising attack-surface hardness the intuition stack's zero drifts (0→1.9%→6.2%) while the VAL stack holds within its ODD (0→0→0), its only breach a disclosed out-of-ODD password gap (0.5%).