U-Define: Designing User Workflows for Hard and Soft Constraints in LLM-Based Planning

Abstract: LLMs are increasingly used for end-user task planning, yet their black-box nature limits users' ability to ensure reliability and control. While recent systems incorporate verification techniques, it remains unclear how users can effectively apply such rigid constraints to represent intent or adapt to real-world variability. For example, prior work finds that hard-only constraints are too rigid, and numeric flexibility weights confuse users. We investigate how interaction workflows can better support users in applying constraints to guide LLM-generated plans, examining whether abstracting strictness into high-level types (i.e., hard and soft) paired with distinct verification mechanisms helps users more reliably express and align intent. We present U-Define, a system that lets users define constraints in natural language and categorize them as either hard rules that must not be violated or soft preferences that allow flexibility. U-Define verifies these types through complementary methods: formal model checking for hard constraints and LLM-as-judge evaluation for soft ones. Through a technical evaluation and user studies with general and expert participants, we find that user-defined constraint types improve perceived usefulness, performance, and satisfaction while maintaining usability. These findings provide insights for designing flexible yet reliable constraint-based workflows.

• The paper introduces U-Define, a workflow that translates natural-language hard constraints into verifiable LTL and PRISM artifacts while evaluating soft preferences with an LLM judge.
• The system achieved 83.12% similarity for natural-language-to-LTL translation and 97.4% for PRISM plan conversion, supporting template-free constraint specification while exposing predicate-level errors.
• User studies found that mixed hard and soft constraints improved perceived performance, usefulness, and satisfaction, but expert workflows revealed LTL limits, input overhead, and the need for richer verification methods.

Motivation and problem statement

U-Define addresses a specific gap in end-user planning with LLMs: while prior systems such as VeriPlan demonstrated that formal verification can check LLM-generated plans against user constraints, they relied on pre-engineered templates and numeric flexibility sliders that users found difficult to interpret. The authors argue that real-world planning is rarely uniformly strict—users balance non-negotiable requirements (e.g., "a worker can only take one shift at a time") against flexible preferences (e.g., "two consecutive days off")—and that interaction design, not just verification machinery, determines whether users can express this mix of strictness. The paper poses three research questions concerning constraint expression, interaction design with type-specific verification mechanisms, and the effect of constraint types on output quality and user experience.

The design premise rests on two empirical observations from prior work: hard-only constraint interfaces are too rigid to capture nuance, and numeric strictness weights confuse users who cannot map values to enforcement levels. U-Define therefore abstracts strictness into a categorical distinction between hard and soft constraints, each paired with a distinct verification mechanism.

System design

U-Define structures the planning workflow into three stages. In the definition stage, users enter natural-language constraints labeled as hard or soft. Hard constraints pass through a Rule Translator: an LLaMA 7B agent fine-tuned on a natural-language-to-LTL dataset (trained with QLoRA, early-stopped after roughly 1,500 steps at a loss of about 0.75) converts constraints into LTL properties; a prompt-engineered GPT-4 agent then converts these into PRISM-compatible artifacts. Translations are back-converted to natural language for user validation before acceptance.

In the verification stage, an LLM Planner generates three candidate plans. Hard constraints are checked by model checking using PRISM and Stormpy, after a prompt-engineered GPT-4 agent converts each plan into the PRISM modeling language ("PRISM plan conversion"). Soft constraints are evaluated by an LLM-as-Judge agent that assigns a one-to-five-star rating with an explanation. Plans are ranked in the interface solely by the number of hard-constraint violations. In the feedback stage, users refine constraints or plans, and the system re-translates and re-verifies iteratively. All agents use GPT-4 except the fine-tuned Rule Translator.

Relative to VeriPlan, the contributions are threefold: template-free constraint specification via LLM translation, replacement of the numeric flexibility slider with categorical hard/soft types, and an automated translation pipeline into PRISM artifacts without manual encoding or domain-specific templates.

Component-level evaluation

The translators were evaluated against human-produced counterparts created by the first author and validated by a senior author—an important caveat, since the ground truth reflects author interpretation rather than verified correctness. Accuracy was measured by Levenshtein similarity over 36 rules drawn from participant-created hard constraints across three scenarios, and three plans:

Translation task	Model	Similarity	Dominant errors
NL → LTL	Fine-tuned LLaMA 7B	83.12%	Predicate token errors, operator omissions
PRISM plan conversion	Prompt-engineered GPT-4	97.4%	Predicate-level only

Notably, no temporal-operator errors occurred in LTL translation; most errors were predicate tokens (13 instances) whose correction would raise adjusted similarity to 94.32%, under the assumption that such mismatches are trivially fixable by referencing plan tokens—a reasonable but unverified assumption. The high PRISM conversion accuracy suggests that LLM-mediated translation into model-checking artifacts is feasible, which is the technical enabler for removing pre-engineered templates.

Study 1: everyday users

A within-subjects ablation study with 12 participants compared four conditions: C1 (full U-Define), C2 (soft only), C3 (hard only), C4 (none), across vacation, wedding, and multi-recipe planning scenarios, measured with USE, FATE performance, and SUS scales and analyzed with Dunnett's tests against C1.

Key quantitative results: C1 significantly outperformed C4 on perceived performance ($p=.0037$), usefulness ($p=.0003$), satisfaction ($p=.0052$), and required far fewer constraint-fixing iterations ($p<.0001$). Against C3 (hard only), C1 was more useful ($p=.0074$) and satisfying ($p=.0413$)—but involved more iterations ($p=.0008$). Against C2 (soft only), C1 required fewer iterations ($p=.0176$); no other differences were significant. Usability did not degrade despite the added categorization burden.

Three qualitative findings carry design weight. First, participants treated hard rules as foundational structure and soft rules as customizable building blocks, with nine defining hard constraints first. Second, hard-only configurations induced top-down, low-exploration behavior, partly due to model-checking latency of approximately three minutes per verification—and critically, failures of hard-constraint verification caused disproportionate disappointment: because users assumed strict enforcement, even single misses were judged unacceptable ("that was a deal breaker"). Third, soft-only explanations were perceived as verbose, "opinion-like," and unreliable—one participant questioned how a plan violating hard rules could still receive five stars—so soft ratings supported ideation but not final decisions. The implication is asymmetric: hard constraints buy trust when enforced correctly but impose steep penalties on failure, while soft constraints enable exploration without conferring reliability.

Study 2: domain experts

Six experts (higher education, finance, construction management, interior design) applied U-Define to their own professional tasks. Experts valued the hard/soft distinction but relied overwhelmingly on hard constraints, often leaving soft constraints blank, and dismissed soft explanations as "uninvited opinions." Two suggested surfacing hard-rule violations before the generated plan as a sanity check.

Two findings qualify the system's generality. First, expert hard rules frequently exceeded LTL expressiveness: numeric budgets, cardinality requirements, duration-based deadlines, and calendar conditions would require arithmetic checks or richer formalisms such as Simple Temporal Networks or Metric Temporal Logic. This mismatch produced more verification failures than in Study 1 and likely explains why experts rated perceived performance lower than general users. Second, all six experts struggled with context overhead: recalling and entering dozens of hard rules operating on "autopilot," plus unstated domain conventions the LLM lacked (e.g., interpreting "one year" as twelve rather than nine academic months, or scheduling a week for a one-day toilet installation). Four experts simplified their tasks in response, and this overhead was identified as the main factor reducing their usability, usefulness, and satisfaction scores. Participants proposed reusable profiles, semi-automatic templates, and imports from external tools.

Design implications

The discussion derives five implications grounded in the studies: support mixed hard/soft specification with direct user control; treat constraint strictness as a spectrum amenable to adaptive hierarchies rather than binary categories; deploy hard constraints sparingly given heightened expectations and the trust cost of violations; replace generic scalar ratings with explanations that map explicitly to violated rules; assist constraint input through reuse, structured capture, and clarification of hidden domain assumptions; and use LLMs as translators atop sound verifiers, consistent with the LLM-Modulo position that LLMs are poor self-verifiers. The last point is supported by the finding that added LLM translation did not reduce usability.

Limitations and open questions

The authors concede several limitations. The choice of PRISM/Stormpy bounds temporal and logical expressiveness; CTL-capable or otherwise more expressive verifiers remain unexplored. The component evaluation used hand-built datasets of modest size (36 rules, three plans), and the human-authored ground truth is not certified correctness. The combined participant pool is 18, so statistical conclusions rest on small samples, albeit within-subjects designs. Open questions include whether predicate-token grounding against plan vocabularies can realize the projected 94.32% translation accuracy in practice, whether adaptive constraint hierarchies can be learned from task stakes and user behavior, and whether verification coverage indicators can honestly label the portion of expert rules that fall outside LTL.

Conclusion

U-Define demonstrates that letting users—not the system—categorize constraints as hard or soft, and pairing each type with a matching verifier (model checking versus LLM-as-judge), improves perceived performance, usefulness, and satisfaction in LLM-based planning without sacrificing usability. The evidence also shows the limits of this abstraction: expert workflows demand constraint types beyond LTL and impose input overhead the current interface does not address. The paper's lasting contribution is the empirical case that constraint-type control is a user-facing design variable, not merely a backend enforcement detail.