Pro2Guard: Proactive Runtime Safety

• Pro2Guard is a proactive runtime enforcement framework that monitors LLM agent trajectories to anticipate and mitigate safety violations.
• It uses discrete-time Markov chains to abstract behaviors and applies probabilistic model checking for risk-based interventions.
• Empirical evaluations in embodied and autonomous driving contexts show reduced unsafe outcomes while balancing task completion.

Searching arXiv for the Pro2Guard paper and closely related guardrail/runtime safety papers. Pro2Guard is a runtime enforcement framework for LLM agents that performs proactive safety monitoring through probabilistic model checking. Rather than waiting until an unsafe action is imminent, it learns a Discrete-Time Markov Chain (DTMC) over symbolic, safety-relevant states extracted from execution traces, estimates the probability of eventually reaching an unsafe state from the current abstract state, and intervenes whenever that probability exceeds a user-defined threshold (Wang et al., 1 Aug 2025). The framework is evaluated in two safety-critical settings—embodied household agents and autonomous driving—and is presented as a response to the limitations of reactive rule-based systems that struggle with stochastic behavior, long-horizon dependencies, and distribution shift (Wang et al., 1 Aug 2025).

1. Conceptual basis and problem setting

Pro2Guard targets LLM agents operating in domains such as robotics, virtual assistants, and web or driving automation, where safety violations arise at the trajectory level rather than solely at the level of individual actions (Wang et al., 1 Aug 2025). Its central claim is that existing rule-based enforcement systems, exemplified in the paper by AgentSpec, are reactive: they typically intervene only when unsafe behavior is imminent or already unfolding, and therefore lack foresight over long-horizon stochastic execution (Wang et al., 1 Aug 2025).

The framework treats the agent and environment as a stochastic process. It models the probability that a current symbolic state will eventually transition into an unsafe region of the state space, and uses that probability as the basis for runtime intervention (Wang et al., 1 Aug 2025). This makes Pro2Guard explicitly risk-thresholded rather than purely rule-triggered. A safety policy is therefore expressed not only as a symbolic unsafe condition, but also as a probabilistic admissibility bound of the form

$$P_{\le \theta}\big[\,\mathbf{F}\; \varphi_{\text{unsafe}}\,\big],$$

where $\theta$ is a user-configured tolerance and $\mathbf{F}$ denotes eventual reachability (Wang et al., 1 Aug 2025).

The motivating example in the embodied domain illustrates the intended distinction between proactive and reactive enforcement. A sequence such as picking up a fork, opening a microwave, placing the fork inside, closing the microwave, and turning the microwave on is hazardous because the unsafe condition is the configuration “metal inside microwave and microwave on,” not any single early action in isolation (Wang et al., 1 Aug 2025). This suggests that Pro2Guard is designed for settings in which benign-looking intermediate states accumulate into hazardous end states.

2. Symbolic abstraction and state semantics

Pro2Guard abstracts concrete agent-environment behavior into symbolic states defined by Boolean predicates. Given a predicate set $\mathcal{P} = \{\psi_1,\dots,\psi_k\}$ over concrete variables, each concrete state $s$ is mapped to a bitvector

$$\alpha_\mathcal{P}(s) = \big(\llbracket \psi_1\rrbracket_s,\dots,\llbracket \psi_k\rrbracket_s\big) \in \{0,1\}^k.$$

This abstraction is domain-specific and encodes only safety-relevant semantics (Wang et al., 1 Aug 2025).

In the embodied setting, the paper uses predicates such as whether an object is inside another object and whether an appliance is toggled on. In the autonomous driving setting, predicates include traffic-light state, proximity to a stop line, vehicle speed thresholds, presence of a priority non-player vehicle, and collision occurrence (Wang et al., 1 Aug 2025). Unsafe states are themselves defined symbolically. One example is

$$\varphi_{\text{unsafe}} \equiv \mathit{is\_inside}(\mathit{fork}, \mathit{microwave}) \land \mathit{is\_toggled}(\mathit{microwave}),$$

which captures the microwave hazard discussed above (Wang et al., 1 Aug 2025).

A notable feature of the framework is its use of semantic validity checks. The abstraction layer defines both is_valid_state and is_valid_transition, which constrain the symbolic model to coherent configurations and plausible dynamics (Wang et al., 1 Aug 2025). Invalid states and transitions are not merely ignored informally; they are excluded from the learned probabilistic model. This suggests that Pro2Guard is not intended as a generic latent-state learner, but as a domain-engineered abstraction pipeline in which symbolic semantics remain explicit.

The formalization of an LLM agent is given as

$$(\mathcal{S}, \mathcal{A}, \mathcal{E}, Per, \Delta),$$

where $\mathcal{S}$ is the state space, $\mathcal{A}$ the action space, $\theta$0 the environment state space, $\theta$1 the perception map, and $\theta$2 the policy mapping from instruction and state to action (Wang et al., 1 Aug 2025). Trajectories are represented as

$\theta$3

Pro2Guard does not alter this agent formalization directly; instead, it monitors the abstracted trajectory induced by it (Wang et al., 1 Aug 2025).

3. DTMC learning and probabilistic verification

The learned behavioral model in Pro2Guard is a DTMC

$\theta$4

where $\theta$5 is the finite set of abstract symbolic states and $\theta$6 is the transition matrix satisfying

$\theta$7

The DTMC is learned from execution traces collected by repeatedly running the agent over sampled tasks and environments (Wang et al., 1 Aug 2025).

The trace set is written as

$\theta$8

and each trajectory is abstracted into a symbolic trace through $\theta$9 (Wang et al., 1 Aug 2025). Transition counts are then accumulated only for valid abstract transitions. Pro2Guard applies validity-aware Laplace smoothing:

$\mathbf{F}$0

followed by row normalization

$\mathbf{F}$1

This preserves smoothing over semantically admissible but unobserved successors while preventing probability mass from being assigned to impossible transitions (Wang et al., 1 Aug 2025).

Verification uses PCTL. The paper defines state formulas

$\mathbf{F}$2

and path formulas

$\mathbf{F}$3

with standard abbreviations such as $\mathbf{F}$4 (Wang et al., 1 Aug 2025). Runtime safety queries are therefore phrased as reachability properties over the learned DTMC, most importantly the probability of eventually entering an unsafe state from the current symbolic state.

The paper further grounds this learned model in PAC-style guarantees. A learned DTMC $\mathbf{F}$5 is said to be $\mathbf{F}$6-PAC-correct if

$\mathbf{F}$7

where $\mathbf{F}$8 is the probability over sampled traces (Wang et al., 1 Aug 2025). The paper also gives a state-wise sample complexity condition:

$\mathbf{F}$9

with $\mathcal{P} = \{\psi_1,\dots,\psi_k\}$0 and $\mathcal{P} = \{\psi_1,\dots,\psi_k\}$1 (Wang et al., 1 Aug 2025). This is presented as a principled stopping condition for data collection and a statistical reliability criterion for the resulting reachability estimates.

4. Runtime enforcement and intervention policies

At runtime, Pro2Guard continuously observes the agent’s perceived state, maps it into the symbolic abstraction, and consults the learned DTMC to estimate the probability of eventually reaching an unsafe state (Wang et al., 1 Aug 2025). The core operational rule is threshold-based: if the current state violates the PCTL specification $\mathcal{P} = \{\psi_1,\dots,\psi_k\}$2, intervention is triggered (Wang et al., 1 Aug 2025).

The framework supports multiple enforcement modes. One is a stop-style intervention, described as invoke_action or stop, in which a predefined safety action is taken immediately once the predicted risk exceeds the threshold (Wang et al., 1 Aug 2025). Another is a reflection-based mode, llm_self_examine or reflect, in which the LLM is asked to reconsider and revise its behavior given the current context and predicted risk (Wang et al., 1 Aug 2025). A third mode, user_inspection, delegates the decision to a human (Wang et al., 1 Aug 2025). These modes make the framework configurable along the safety–availability axis rather than committing to a single enforcement policy.

The paper emphasizes that Pro2Guard is implemented as an external runtime wrapper rather than as a retraining method for the base agent (Wang et al., 1 Aug 2025). This places it conceptually closer to safety monitors and shields than to alignment-by-fine-tuning. A plausible implication is that the framework is intended to be agent-agnostic so long as the deployment environment provides access to the predicates required by the abstraction.

For efficiency, the paper notes that raw on-the-fly model checking would be too slow for repeated runtime use, and therefore reachability probabilities are cached after offline computation (Wang et al., 1 Aug 2025). Reported runtime costs are approximately 430 ms per decision without caching, and about 5–8 ms for small abstractions, about 13 ms for 8 states, and about 28 ms for 16 states with caching (Wang et al., 1 Aug 2025). This suggests that Pro2Guard is positioned for high-level decision monitoring rather than low-level control loops.

5. Empirical performance across embodied agents and autonomous driving

Pro2Guard is evaluated in embodied household tasks and autonomous driving scenarios (Wang et al., 1 Aug 2025). In the embodied domain, the baseline with no enforcement yields 40.63% unsafe runs and 59.38% task completion (Wang et al., 1 Aug 2025). AgentSpec reduces unsafe runs to 19.79% while leaving completion unchanged at 59.38% (Wang et al., 1 Aug 2025). Under Pro2Guard, the outcomes depend strongly on the risk threshold and intervention mode.

With Pro²Guard^0.1_stop, unsafe runs fall to 2.60% and task completion to 10.42% (Wang et al., 1 Aug 2025). The paper characterizes this as enforcing safety early on up to 93.6% of unsafe tasks using a low threshold (Wang et al., 1 Aug 2025). With Pro²Guard^0.3_stop, unsafe runs are 5.20% and completion is 20.31%; with Pro²Guard^0.5_stop, unsafe runs are 21.35% and completion is 41.14%; with Pro²Guard^0.7_stop, unsafe runs are 29.17% and completion is 48.96% (Wang et al., 1 Aug 2025). In reflection mode, Pro²Guard^0.1_reflect achieves 14.07% unsafe runs with 47.74% completion (Wang et al., 1 Aug 2025). The paper also reports that configurable modes such as reflect can maintain up to 80.4% task completion in broader settings while still enforcing safety on unsafe tasks (Wang et al., 1 Aug 2025).

A secondary embodied-domain result concerns efficiency: Pro2Guard in stop mode uses fewer LLM tokens than AgentSpec, with average token savings of 12.05% (Wang et al., 1 Aug 2025). The interpretation given in the paper is that proactive intervention can terminate unsafe trajectories earlier than reactive rule checks, reducing downstream reasoning cost.

In autonomous driving, Pro2Guard is evaluated on Apollo-based scenarios derived from μDrive and LawBreaker (Wang et al., 1 Aug 2025). The framework predicts both traffic-law violations and collisions. At threshold $\mathcal{P} = \{\psi_1,\dots,\psi_k\}$3, the prediction rate is 100% across all seven reported scenarios for both law violations and collisions, with prediction horizons ranging from around 13 to 21 seconds for traffic-law violations and up to 38.66 seconds for collisions (Wang et al., 1 Aug 2025). At threshold $\mathcal{P} = \{\psi_1,\dots,\psi_k\}$4, prediction remains 100% in the reported scenarios but occurs much closer to the violation, sometimes as low as 0.01–6 seconds ahead (Wang et al., 1 Aug 2025). At $\mathcal{P} = \{\psi_1,\dots,\psi_k\}$5, several scenarios drop to 0% prediction, though at least one collision scenario remains at 100% with a 0.35-second lead time (Wang et al., 1 Aug 2025). These results support the paper’s claim that lower thresholds trade later precision for earlier and more comprehensive anticipation.

The paper also provides a state-level example of probabilistic explanation in the driving setting. In one scenario, a state with no priority non-player vehicle ahead and speed below 0.5 km/h has a collision probability of 47.15%; a state with no priority vehicle and speed at or above 0.5 km/h has 41.58%; a state with a priority non-player vehicle ahead and speed at or above 0.5 km/h has 56.78%; a collision state has 100%; and a destination-reached state has 0% (Wang et al., 1 Aug 2025). This indicates that Pro2Guard’s output is not only a binary enforcement signal but also a calibrated risk estimate over abstract states.

6. Position within the guardrail literature, limitations, and implications

Pro2Guard is presented in contrast to reactive enforcement frameworks such as AgentSpec, and more broadly as a distinct line of work from content moderation guardrails (Wang et al., 1 Aug 2025). This distinction is significant. Systems such as PolicyGuard address dialogue-grounded policy adherence by inserting a verifier between an agent and mutating tool calls, with full-conversation reasoning and remediation (Kang et al., 28 Jun 2026). Systems such as $\mathcal{P} = \{\psi_1,\dots,\psi_k\}$6-Guard encode safety-category correlations in probabilistic graphical models for text moderation (Kang et al., 2024). GuardReasoner-Omni and ProGuard extend multimodal safety moderation through reasoning-based or proactive classification over text, image, and video (Zhu et al., 3 Feb 2026, Yu et al., 29 Dec 2025). By contrast, Pro2Guard is not a moderation classifier over content categories; it is a runtime reachability monitor over symbolic agent states (Wang et al., 1 Aug 2025). This suggests that it belongs more directly to runtime verification and shielding than to conventional input/output safety filtering.

The framework has several explicit limitations. It assumes that the abstraction is sufficiently Markovian once expressed in the chosen predicates, that the learned DTMC remains stable across deployment, and that sufficient trace coverage is available to satisfy the PAC-style bounds or at least make them informative (Wang et al., 1 Aug 2025). It also inherits the usual state-space growth of predicate abstractions: increasing predicate coverage increases symbolic fidelity but can cause combinatorial expansion in the number of abstract states (Wang et al., 1 Aug 2025).

The paper further notes that time-bounded temporal laws, especially in autonomous driving, are not natively handled in full richness by the DTMC-PCTL layer. Instead, original STL-style traffic rules are converted into derived predicates such as law_violation over sliding windows, and runtime verification then reduces to probabilistic reachability of those predicates (Wang et al., 1 Aug 2025). This suggests that Pro2Guard’s temporal expressivity is partly mediated by preprocessing and feature design rather than by a richer underlying probabilistic temporal model.

A further limitation is that the current implementation often learns separate DTMCs per task or scenario, which constrains generalization (Wang et al., 1 Aug 2025). The paper identifies as future work the unification of multiple DTMCs into a Markov Decision Process and the extension to time-aware probabilistic models for more direct support of temporally bounded constraints (Wang et al., 1 Aug 2025).

Within the broader safety literature, a plausible implication is that Pro2Guard complements rather than replaces content-centric or policy-centric guardrails. Content moderation systems can classify whether a prompt, response, or multimodal interaction is harmful (Zhu et al., 3 Feb 2026, Yu et al., 29 Dec 2025), while dialogue-grounded verifiers can enforce organization-specific procedures over tool use (Kang et al., 28 Jun 2026). Pro2Guard adds a different capability: symbolic, probabilistic anticipation of downstream unsafe states in stochastic agent trajectories (Wang et al., 1 Aug 2025). As a result, it is best understood as a proactive runtime safety wrapper for agent behavior rather than as a general-purpose moderation model.