Rule-Based Activation Safety

• Rule-Based Activation Safety is a system of explicit, auditable rules and predicates that determine when a system must safely intervene or switch operational modes.
• It employs formal mechanisms like lexicographic rule evaluation and Boolean or continuous predicate monitoring to enforce deterministic safety decisions in real time.
• Empirical evidence shows strong performance metrics such as high accuracy and low latency, though challenges in rule completeness and governance remain.

Rule-Based Activation Safety designates a class of safety mechanisms in which explicit rules, predicates, or safety constraints determine when a system may act, when it must refuse, and when it must switch to a safer mode. In autonomous driving, it appears as rulebooks for path planning, Control Barrier Function constraints, extended Responsibility-Sensitive Safety inequalities, and supervisory switching logic that overrides unsafe learned actions (Collin et al., 2021, Xiao et al., 2021, Lin et al., 2024, Aksjonov et al., 2022). In language and multimodal systems, it appears as rule-governed monitoring or steering over hidden activations, Cognitive Elements, structured reasoning tags, executable safety predicates, or compositional rewards that operate during inference or post-training (Rozenfeld et al., 27 Jan 2026, Rong et al., 17 Nov 2025, In et al., 1 Aug 2025, Wang et al., 24 Dec 2025, Mu et al., 2024). In IoT and retrieval-augmented systems, it appears as verification of trigger-action chains and minimal source-based rules that activate mitigations before unsafe outputs or unsafe state transitions occur (Hsu et al., 2019, Rorseth et al., 11 May 2026).

1. Conceptual scope and defining characteristics

A recurring definition across the literature is that safety is tied to explicit, auditable conditions rather than only to opaque end-to-end policy behavior. In the Rulebooks framework for autonomous vehicles, the specification is scenario-agnostic and implementation-free: developers encode behavioral preferences as a hierarchy of formal rules, each equipped with a violation metric over trajectories, and the pre-ordered set of rules induces a pre-order over candidate motion plans (Collin et al., 2021). In GAVEL, the corresponding unit is the Cognitive Element, a fine-grained, interpretable factor such as “Threaten,” “Payment Tools,” or “Provide/Give,” which is then composed with a transparent rule language over internal activations (Rozenfeld et al., 27 Jan 2026). In RoboSafe, runtime safety is formulated as executable predicate-based safety logic over multimodal observations, actions, and long-short safety memories, with predicates implemented as Python functions evaluated by a Python interpreter (Wang et al., 24 Dec 2025).

A second defining characteristic is deterministic activation of an intervention. In the driving supervisor of the two-controller framework, the Safety controller is prioritized every time, when the Learned one does not meet the safety constraint, and the same shield participates directly in safe Learned controller training (Aksjonov et al., 2022). In safe epsilon-greedy reinforcement learning, the safety component inspects a candidate action in the current state, blocks it if any rule would be violated, and replaces it with a safe alternative (Nikonova et al., 2022). In AutoSpec, a trace is classified unsafe if any rule fires on any event, and firing triggers a deterministic enforcement decision such as deny or stop (Ma et al., 23 Jun 2026).

A third characteristic is traceability. RuleSafe-VL defines moderation safety as the requirement that a moderation outcome be warranted by the specific policy rules a case activates, by the typed interactions among those rules, and by whether the available evidence is sufficient to support a decision at all (Lu et al., 8 May 2026). The neuro-symbolic causal framework goes further by linking every synthesized rule to the originating natural-language goal and legal or safety principle, then verifying syntax, consistency, and invariants before runtime gating (Rehan et al., 30 Apr 2026). SAFECHAIN likewise models the IoT ecosystem as a Finite State Machine and checks whether trigger-action rules can induce privilege escalation or privacy leakage through hidden attack chains (Hsu et al., 2019).

2. Formal structures for rules, predicates, and priorities

One major formal pattern is lexicographic or priority-based rule evaluation. In Rulebooks, the planner considers a set of trajectories $T$ and a set of rules $R = \{r_1,\dots,r_m\}$, where each rule has a violation metric $v_r : T \to \mathbb{R}_{\ge 0}$. A preorder on rules induces a preorder on trajectories, and the decision criterion is lexicographic ordered minimization,

$$t^* = \operatorname*{argmin}_{t \in T} \mathbf{v}(t),$$

with hard rules encoded as constraints or as $v_r(t)=+\infty$ upon violation (Collin et al., 2021). Rule-based optimal control uses an analogous priority structure $\langle R,\sim_p,\le_p\rangle$, but embeds the rules in CLF/CBF or HOCBF inequalities and solves a sequence of QPs that relax lower-priority rules only when necessary (Xiao et al., 2021).

A second pattern is Boolean or continuous rule evaluation over hidden states. GAVEL constructs per-token representations

$$r_t = \mathrm{concat}(\{a_t^{(\ell)}\}_{\ell \in \Lambda}),$$

uses a multi-label detector $g:\mathbb{R}^D \to [0,1]^K$ to compute CE probabilities, thresholds them into Boolean indicators $c_i(t)$, aggregates them into a windowed presence vector $s_t$, and evaluates rules as predicates over $R = \{r_1,\dots,r_m\}$0 or with continuous scores such as

$R = \{r_1,\dots,r_m\}$1

The overall violation function combines all rules with configured precedence or priority, for example $R = \{r_1,\dots,r_m\}$2 under policy precedence (Rozenfeld et al., 27 Jan 2026).

A third pattern is event- or trace-level symbolic logic. AutoSpec defines an execution trace $R = \{r_1,\dots,r_m\}$3, with session labels $R = \{r_1,\dots,r_m\}$4, a predicate library over events, and rules whose bodies are conjunctions, negations, and disjunctive branches. A trace is classified unsafe by a rule set $R = \{r_1,\dots,r_m\}$5 if $R = \{r_1,\dots,r_m\}$6 and some event $R = \{r_1,\dots,r_m\}$7 such that $R = \{r_1,\dots,r_m\}$8 fires on $R = \{r_1,\dots,r_m\}$9; candidate revisions are selected by a lexicographic score

$v_r : T \to \mathbb{R}_{\ge 0}$0

The ILP-guided CEGIS loop then evolves expert-authored rules while keeping the deployed guardrail interpretable (Ma et al., 23 Jun 2026).

A fourth pattern is disjunctive safety logic over context and history. RoboSafe defines contextual safety logic

$v_r : T \to \mathbb{R}_{\ge 0}$1

and temporal safety logic

$v_r : T \to \mathbb{R}_{\ge 0}$2

If $v_r : T \to \mathbb{R}_{\ge 0}$3, the system activates a safety action: block for contextual hazards, or replan for temporal hazards (Wang et al., 24 Dec 2025).

3. Runtime activation mechanisms

The activation step differs by substrate but follows a consistent control logic. In Rulebooks, rules are scenario-agnostic and always “apply,” but their violation metrics become zero when the rule is irrelevant in the current context, so activation thresholds are encoded inside $v_r : T \to \mathbb{R}_{\ge 0}$4 rather than in scenario-specific policies (Collin et al., 2021). In the CLF/CBF framework, a safety rule is “activated” whenever $v_r : T \to \mathbb{R}_{\ge 0}$5 approaches $v_r : T \to \mathbb{R}_{\ge 0}$6; near the boundary, the inequality tightens, forcing the controller to act to keep $v_r : T \to \mathbb{R}_{\ge 0}$7, while lower-priority rules are relaxed only under infeasibility (Xiao et al., 2021). In eRSS-RAMP, activation is defined by explicit inequality triggers for merging and emergency avoidance, and the planner revokes lane changes or falls back from cooperative to non-cooperative rules when the inequalities are not satisfied (Lin et al., 2024).

Activation monitoring in neural systems is more direct. GAVEL monitors selected mid-to-late layers, runs a lightweight detector on 5-token segments, and then executes actions such as stop, refuse, override with canned text, steer, log, or escalate whenever a rule predicate fires (Rozenfeld et al., 27 Jan 2026). LAE applies a simpler rule: edit if and only if two conditions hold, unsafe activation $v_r : T \to \mathbb{R}_{\ge 0}$8 and sufficient context with a history buffer of length $v_r : T \to \mathbb{R}_{\ge 0}$9; otherwise pass through, and reset the buffer on a safe decision (Das et al., 24 Sep 2025). SCANS similarly uses a training-free detector based on hidden state transition and then steers anchored safety-critical layers along a refusal vector or against it, depending on whether the query is assessed as harmful or benign (Cao et al., 2024).

Structured reasoning systems activate safety through mandatory internal checkpoints. R1-Act teaches a three-step chain—problem understanding, harmfulness assessment, and solution reasoning—and imposes a fixed refusal termination sentence for harmful instructions, so that if the assessment is harmful the model stops solving and refuses (In et al., 1 Aug 2025). SafeGRPO turns a related idea into a reward signal by enforcing explicit tags such as <visual_safe>, <text_safe>, and <combined_safe> during “step-guided safety thinking,” then computing a gated reward from format validity, tag correctness, and behavior alignment (Rong et al., 17 Nov 2025). Rule Based Rewards implements an analogous mechanism during RL by activating positive or negative reward components when few-shot LLM graders detect propositions such as refusal, apology, judgmental tone, helpfulness, or disallowed content (Mu et al., 2024).

4. Realizations across technical domains

In autonomous driving, rule-based activation safety is closely tied to functional specification and runtime assurance. Rulebooks provide a functional description required by ISO/PAS 21448 SOTIF, including safety, traffic laws, comfort, local driving culture, and stakeholder needs, and can be used for verification in known scenarios and as test oracles in validation (Collin et al., 2021). Rule-based optimal control encodes safety as CBF or HOCBF constraints and performance as a CLF, then solves real-time QPs with slack penalties reflecting rule priority, while after-the-fact evaluation rejects any trajectory for which a controller can produce a trajectory with less violation at the highest violated level (Xiao et al., 2021). The eRSS-RAMP planner extends Mobileye’s RSS to merging and emergency avoidance with communication-delay-aware safe distances and hard planner constraints, and the Rule-Based Lloyd algorithm reshapes Voronoi cells and weighted Lloyd centroids to guarantee collision avoidance and convergence without inter-robot communication or synchronization (Lin et al., 2024, Boldrer et al., 2023).

In machine learning safety for text and multimodal models, the same design principle is implemented over representations, reasoning traces, or rewards. GAVEL builds rule predicates over Cognitive Elements extracted from hidden activations and uses a human-readable condition syntax similar to Snort/YARA/Sigma (Rozenfeld et al., 27 Jan 2026). SCANS extracts refusal steering vectors, identifies safety-critical layers by vocabulary projection, and steers selected layers to reduce exaggerated safety on benign queries while maintaining defense on harmful queries (Cao et al., 2024). R1-Act uses a compact structured chain to activate latent safety knowledge during reasoning (In et al., 1 Aug 2025). SafeGRPO moves rule activation into multimodal RL by attaching rule-governed self-rewards to format, tag, and behavior checks (Rong et al., 17 Nov 2025). Rule Based Rewards uses a collection of rules for desired or undesired behaviors, along with an LLM grader, so that few-shot graded propositions become direct reward features for PPO (Mu et al., 2024).

For embodied and tool-using agents, the emphasis shifts toward executable runtime guardrails and adaptive rule maintenance. RoboSafe uses contextual predicates over immediate observations and temporal predicates over recent trajectories, combining Forward Predictive Reasoning and Backward Reflective Reasoning on a Hybrid Long-Short Safety Memory (Wang et al., 24 Dec 2025). AutoSpec treats deployed expert rules as a starting point, mines false-positive and false-negative traces, and then uses ILP-guided CEGIS to add conjuncts, exceptions, disjuncts, or relaxations while keeping the resulting guardrail human-readable and deterministic at activation time (Ma et al., 23 Jun 2026).

In infrastructure and evaluation systems, rules become objects of verification or explanation. SAFECHAIN verifies trigger-action automations against privilege-escalation and privacy-leakage properties by model checking a finite-state abstraction and by frequently re-checking the automation rules given the current states (Hsu et al., 2019). RUBEN mines minimal source combinations in retrieval-augmented LLM systems such that, if all sources in $$t^* = \operatorname*{argmin}_{t \in T} \mathbf{v}(t),$$0 are present, a user-defined unsafe output predicate always holds for all supersets of $$t^* = \operatorname*{argmin}_{t \in T} \mathbf{v}(t),$$1, enabling the discovered rules to act as activation-ready safety triggers (Rorseth et al., 11 May 2026). RuleSafe-VL, by contrast, is an evaluation benchmark: it decomposes moderation into activated rules, typed rule relations, decision sufficiency, and context-guided resolution, thereby measuring whether a model actually follows a rule-conditioned decision chain rather than merely matching final labels (Lu et al., 8 May 2026).

5. Empirical evidence, performance, and controversy

Empirical results show that rule-based activation safety can achieve strong performance when the rule substrate is well matched to the domain. GAVEL reports average AUC $$t^* = \operatorname*{argmin}_{t \in T} \mathbf{v}(t),$$2, b-ACC $$t^* = \operatorname*{argmin}_{t \in T} \mathbf{v}(t),$$3, and FPR $$t^* = \operatorname*{argmin}_{t \in T} \mathbf{v}(t),$$4 across nine misuse categories on Mistral-7B, while adding $$t^* = \operatorname*{argmin}_{t \in T} \mathbf{v}(t),$$5 ms/token, less than $$t^* = \operatorname*{argmin}_{t \in T} \mathbf{v}(t),$$6 overhead, on top of a $$t^* = \operatorname*{argmin}_{t \in T} \mathbf{v}(t),$$7 ms/token baseline (Rozenfeld et al., 27 Jan 2026). LAE reduces total collisions from $$t^* = \operatorname*{argmin}_{t \in T} \mathbf{v}(t),$$8 to $$t^* = \operatorname*{argmin}_{t \in T} \mathbf{v}(t),$$9 on $v_r(t)=+\infty$0 challenging configurations, yielding $v_r(t)=+\infty$1 zero-collision trajectories and less than $v_r(t)=+\infty$2 ms latency per step on a Crazyflie microcontroller (Das et al., 24 Sep 2025). AutoSpec raises rule F1 to $v_r(t)=+\infty$3 in code and $v_r(t)=+\infty$4 in embodied domains, achieves up to $v_r(t)=+\infty$5 false positive reduction, and typically converges within $v_r(t)=+\infty$6–$v_r(t)=+\infty$7 iterations (Ma et al., 23 Jun 2026). SafeGRPO reports an Average Jailbreak Defense Safety Score of $v_r(t)=+\infty$8 for Qwen3-VL-8B-Thinking and $v_r(t)=+\infty$9 for Qwen3-VL-4B-Thinking while also improving averages on ScienceQA, IconQA, MathVista, MM-Vet, and POPE (Rong et al., 17 Nov 2025).

The same literature also shows that rule-conditioned evaluation remains difficult. RuleSafe-VL reports that rule-relation recovery is the dominant bottleneck, with best Macro-F1 $\langle R,\sim_p,\le_p\rangle$0 and some safety-oriented models below $\langle R,\sim_p,\le_p\rangle$1 Macro-F1, while decision-state prediction peaks at $\langle R,\sim_p,\le_p\rangle$2 Macro-F1 and Context-Pair Accuracy peaks at $\langle R,\sim_p,\le_p\rangle$3 (Lu et al., 8 May 2026). These figures indicate that correct final labels do not imply correct rule-conditioned reasoning.

A major controversy concerns whether activation-level control is intrinsically safer because it is interpretable. SCANS reports large reductions in false refusals on XSTest-safe and OKTest with only modest impact on harmful-query defense, suggesting that carefully targeted steering can improve the helpfulness-safety trade-off (Cao et al., 2024). QuadA similarly shows that activation approximations can raise ASR on Llama-3.1-8B-Instruct from $\langle R,\sim_p,\le_p\rangle$4 to $\langle R,\sim_p,\le_p\rangle$5 before utility collapses, and that training-time noise injection and activation-geometry regularization can keep ASR near zero across wide noise ranges (Zhang et al., 2 Feb 2025).

By contrast, “The Rogue Scalpel” demonstrates that activation steering systematically breaks model alignment safeguards. Random steering can increase harmful compliance from $\langle R,\sim_p,\le_p\rangle$6 to $\langle R,\sim_p,\le_p\rangle$7–$\langle R,\sim_p,\le_p\rangle$8, benign SAE features add a further $\langle R,\sim_p,\le_p\rangle$9–$$r_t = \mathrm{concat}(\{a_t^{(\ell)}\}_{\ell \in \Lambda}),$$0, $$r_t = \mathrm{concat}(\{a_t^{(\ell)}\}_{\ell \in \Lambda}),$$1 SAE features jailbreak at least five prompts, and averaging $$r_t = \mathrm{concat}(\{a_t^{(\ell)}\}_{\ell \in \Lambda}),$$2 jailbreak vectors produces a universal attack that reaches $$r_t = \mathrm{concat}(\{a_t^{(\ell)}\}_{\ell \in \Lambda}),$$3 harmful compliance on Falcon3-7B (Korznikov et al., 26 Sep 2025). This establishes that interpretable or apparently benign feature directions are not, by themselves, a sufficient basis for safety guarantees.

6. Limitations, governance, and future directions

The literature repeatedly emphasizes that explicit rules do not eliminate engineering burden. Rulebooks require time and effort to author the rule set, violation metrics, and priorities, and they do not prove safety on their own; they must be embedded in the broader SOTIF process (Collin et al., 2021). Rule-based optimal control assumes deterministic ego dynamics and perfect perception, and future work is directed toward robust or stochastic CBF variants and chance constraints (Xiao et al., 2021). eRSS-RAMP evaluates merging and emergency scenarios in simulation and does not cover oncoming traffic or emergency cut-ins (Lin et al., 2024). SAFECHAIN depends on a vulnerability model, policy completeness, and short-lived prediction windows over environmental variables (Hsu et al., 2019).

Coverage and maintenance are equally central in neural and agentic settings. GAVEL notes that the CE library must be expanded to cover novel harms, that rules and thresholds require governance and updates, and that a new threat vector is “CE-level jailbreak” (Rozenfeld et al., 27 Jan 2026). AutoSpec is bounded by annotation quality and predicate library completeness, and offers monotonic local improvement rather than guarantees of optimal rules (Ma et al., 23 Jun 2026). RoboSafe depends on accurate visual attribute extraction and on the quality of the long-term safety memory (Wang et al., 24 Dec 2025). R1-Act is evaluated only in English, and subtle harms or euphemistic instructions may still be missed (In et al., 1 Aug 2025).

A consistent governance theme is versioning, provenance, and community sharing. GAVEL proposes community rule sharing inspired by Snort/YARA/Sigma and supports logging of rule IDs, matched predicates, thresholds, token spans, and timestamps (Rozenfeld et al., 27 Jan 2026). AutoSpec recommends asynchronous periodic updates from deployed annotations and favors deterministic, inspectable predicates (Ma et al., 23 Jun 2026). The neuro-symbolic causal framework formalizes a stricter pipeline in which a Goal/Rule Synthesizer and a Rule Verification Engine iteratively refine a formal rule theory from natural-language goals and legal or safety principles, then gate runtime actions through verified rules and SCM-based counterfactual checks (Rehan et al., 30 Apr 2026). RUBEN adds a complementary direction by discovering minimal rules that subsume all others in retrieval-augmented systems, thereby turning explanation itself into a safety control surface (Rorseth et al., 11 May 2026).

Taken together, these works describe Rule-Based Activation Safety not as a single algorithm, but as a design doctrine: safety-relevant internal states, actions, trajectories, tool invocations, retrieved sources, or moderation decisions are subjected to explicit rule evaluation before or during execution; interventions are activated deterministically when predicates fire; and the resulting behavior is expected to remain interpretable, auditable, and revisable. The strongest results arise when rule semantics, verification machinery, and runtime enforcement are all aligned to the operational substrate; the strongest failures arise when internal control is assumed to be safe merely because it is explicit or interpretable.