Safe-Completions: Ensuring Rigorous Output Safety

• Safe-Completions is a framework that uses output-centric training, runtime admission control, and formal synthesis to enforce safe, correct, and auditable system behaviors.
• It evaluates outputs by combining helpfulness and safety scores in reinforcement learning, discouraging unsafe responses while preserving utility.
• It applies SMT-based protocol synthesis and strict verification gates to ensure safety, liveness, and fairness in multi-agent and distributed system completions.

Safe-Completions refers to a set of formal training paradigms, runtime control mechanisms, and protocol synthesis techniques designed to ensure that system outputs, agent completions, or distributed protocol behaviors satisfy rigorous safety and correctness constraints. The term spans output-centric safety training in LLMs, governed admission control in multi-agent runtimes, and synthesis of distributed systems with provable safety, liveness, and symmetry properties.

1. Output-Centric Safety Training in LLMs

Traditionally, LLMs (e.g., ChatGPT) are safety-trained using a refusal-centric paradigm—models are rewarded for either fully complying with or outright refusing requests, based on inferred user intent. This approach is brittle: in domains with dual-use potential (e.g., cybersecurity, biosciences), intent is ambiguous and minor prompt changes can switch responses between dangerous fulfillment and blanket refusal. Safe-Completions shift the focus from intent-based input filtering to direct evaluation of output safety, training models to always provide the safest permissible response rather than defaulting to hard refusals (Yuan et al., 12 Aug 2025).

Formally, for completion $y_i$ given prompt $x_i$, a safety score $s_i\in[0,1]$ and helpfulness score $h_i\in[0,1]$ are assigned. The reinforcement learning (RL) reward is: $r_i = h_i \cdot s_i$ Unsafe outputs ($s_i=0$) yield zero reward, discouraging policy violations regardless of potential helpfulness. The RL objective is to maximize expected composite reward: $$\max_\theta \; \mathbb{E}_{x\sim \mathcal D}\Bigl[\mathbb{E}_{y\sim \pi_\theta(\cdot|x)}\bigl[h(x,y)\,s(x,y)\bigr]\Bigr]$$ This setup operationalizes safe-completions as maximizing helpfulness under a strict safety constraint, using reward models for $h(x,y)$ and $s(x,y)$. Empirical results on GPT-5 demonstrate increased safe-output rates (up to 9–10 pp gain on dual-use/malicious prompts), reduced severity of residual failures (e.g., reduction of Moderate/High-harm unsafe outputs from 42.7% to 14.7%), and maintained or enhanced helpfulness on all prompt categories (Yuan et al., 12 Aug 2025).

2. Admission Control and Runtime Safe-Completion in Multi-Agent Systems

As multi-agent systems evolve toward persistent, tool-using, stateful collaborations, completion must be explicitly governed at runtime rather than left to agent discretion. In verify-gated admission-control, completion is a claim proposed by an agent but only admitted if a read-only verifier, operating via a strict policy, confirms all requirements are satisfied. Missing packets, weak evidence, or stale context result in fail-closed withholding rather than silent propagation (Nguyen et al., 18 May 2026).

A task-state at time $t$ is

$x_i$0

with $x_i$1 for objective, $x_i$2 for accepted criteria, $x_i$3, $x_i$4 as owner and accountable, $x_i$5 for stage, $x_i$6 for blockers, $x_i$7 for risk, and $x_i$8 for packet lineage. Completion claim $x_i$9 is admitted if all eleven policy predicates $s_i\in[0,1]$0 hold: $s_i\in[0,1]$1 This fail-closed logic guarantees that missing state, ambiguous assignments, or insufficient evidence block unsafe completions at the verifier gate. The mechanism provides an auditable record, explicit failure modes ("blocked," "failed," "skipped," "success"), and recovery/rollback paths.

Empirically, on a large evaluation slice, the event-level verify success rate is 99.5%, with zero false-success among safe-to-proceed predictions and a blocked-precision of 0.39%. The path is designed to be inspectable and to admit only well-formed claims, with limitations in global coverage and real-world rollback effectiveness noted (Nguyen et al., 18 May 2026).

3. Safe-Completion Synthesis in Distributed Protocols

In formal methods, safe-completion refers to synthesis algorithms that complete partially specified distributed protocols—filling in guards or updates—to yield systems that are correct by construction with respect to safety, liveness, symmetry, and fairness (Alur et al., 2015).

Each process is given as an ESM-sketch $s_i\in[0,1]$2 with some guards/updates as unknown functions $s_i\in[0,1]$3. The synthesis loop alternates:

• Phase 1: SMT-based candidate generation (enforcing determinism and symmetry constraints).
• Phase 2: Model checking for safety (no error state), liveness (no fair accepting cycles), and deadlock-freedom.

Counterexamples (for deadlock, safety, or liveness failures) refine constraints on unknowns, eliminating erroneous completions in subsequent iterations. Symmetry is encoded by ensuring all function interpretations commute with system-wide type permutations. The approach is validated on Peterson's mutual exclusion, Dijkstra's self-stabilizing protocols, and cache-coherence subsystems, achieving correct protocol completions across complex, symmetric state spaces (Alur et al., 2015).

4. Metrics, Evaluation, and Comparative Analysis

The three main domains of safe-completion employ different, domain-specific metrics:

Domain	Metric	Representative Value
LLM Safe-Completions	Dual-use Safe-Output Rate Gain	+8–10 pp over refusal
Multi-Agent Admission Control	Invoked-Event Verify Success Rate	99.5%
Distributed Synthesis	Correct Protocol via CEGS Iterations	14–525 (depending on case)

Interpretation varies: In LLMs, safe-completions increase safe/helpful output rate and mitigate high-severity failures without impeding benign helpfulness. In multi-agent systems, the verify gate exhibits near-perfect precision, but coverage and rollback pathways have not been fully validated. In distributed protocols, safe-completion guarantees deadlock-freedom, safety, and liveness under symmetry constraints, with synthesis tractability contingent on constraint space and solver efficiency.

5. Failure Modes, Limitations, and Areas for Future Development

• LLM Safe-Completions: Effectiveness depends on up-to-date, fine-grained policy specifications and calibrated reward models. Provisioning for adversarial jailbreaks and formalizing theoretical safety guarantees remain open research areas (Yuan et al., 12 Aug 2025).
• Admission Control Mechanisms: External validity is limited by single-implementation studies; global coverage metrics and rollback effectiveness require further evaluation. Overly aggressive advisory signals can create false blocks, but mainline gates demonstrate high event-level success and reliability (Nguyen et al., 18 May 2026).
• Protocol Synthesis: Computational complexity and sensitivity to SMT solver nondeterminism present bottlenecks. Tool effectiveness can depend on designer input for tractable search spaces (Alur et al., 2015).

Next directions across these areas include improved task-ID instrumentation for coverage evaluation, finer recovery and blocked-reason taxonomies, empirical comparison of gated and ungated regimes, and generalized integration of safe-completion techniques for adversarial or dynamic environments.

6. Conceptual Implications and Theoretical Synthesis

Safe-Completions denotes a paradigm shift from intent-centric or input-based filtering to rigorous, often formally verified control of outputs and completions. Output-centric training in LLMs relaxes the binary refusal boundary, allowing maximum safe helpfulness and yielding less brittle, more nuanced model behavior. In agentic and distributed systems, admission and synthesis approaches operationalize safe-completion as a composite of policy checking, symmetry enforcement, fairness, and evidence auditability.

A plausible implication is that convergent approaches to safe-completion may underpin general advances in trustworthy AI, agent-based workflows, and distributed protocol engineering, provided that calibration, specification, and coverage limits are systematically addressed.