Pith. sign in

REVIEW 3 major objections 4 minor 50 references

The paper proves that separately certifying a tool return's discrete and numerical channels does not guarantee joint safety, and presents CAGE, a gate that certifies the joint neighborhood and removes in-budget false allows.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-03 11:56 UTC pith:CX466Z7D

load-bearing objection CAGE gives a clean non-composition result and a careful evaluation, but the abstract overstates what the learned rungs deliver: on Table 5's own numbers, CAGE-Lip still allows witnesses. the 3 major comments →

arxiv 2607.29190 v1 pith:CX466Z7D submitted 2026-07-31 cs.AI

CAGE: Certified Authorization under Typed-Return Uncertainty for Tool-Using Agents

Blaise Delattre , Cong Wang , Yang Cao This is my paper
classification cs.AI
keywords tool-using agentsruntime permission gatecertified robustnessjoint-gap attacknon-composition of certificatestyped tool returnsbounded semantic uncertaintyauthorization certificate
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

This paper targets LLM agents that act on typed tool returns, where a permission gate usually checks the observed return–action pair. The paper argues the correct object of authorization is a declared neighborhood of plausible correctly bound returns: one discrete binding fault plus bounded numerical drift. It proves that certifying the categorical and numerical channels separately does not compose—returns safe under each marginal check can be unsafe under a joint move. CAGE certifies this joint neighborhood directly by enumerating discrete branches exactly and running a sound continuous certificate per branch, and reports zero in-budget false allows across policy-as-code, regulatory, and real-transaction settings while retaining a useful fraction of autonomous decisions. The certificate is explicit about its limits: the budget is calibrated from injected adapter faults and a freshness limit, and field prevalence is not measured.

Core claim

CAGE's central claim is that post-tool-return authorization should be a decision over the joint neighborhood B_{d,ε}(z)—the set of plausible correctly bound returns within d discrete edits and ℓ2 drift ε of the observed record—not over the observed point. The paper proves Theorem 1: two marginal certificates, one over the discrete states and one over the continuous ball, do not imply safety over their Cartesian product; the witness interval has length min(Δ, ε). CAGE-Exact certifies executable affine policies exactly per branch; CAGE-Lip and CAGE-RS certify learned gates under an explicit, measured gate–policy fidelity assumption. Empirically, the paper measures joint-gap witnesses at 3.5–12

What carries the argument

The joint-neighborhood predicate B_{d,ε}(z) is the central object: the set of plausible correctly bound returns within a bounded discrete edit distance d and ℓ2 numerical drift ε from the observed record. CAGE's enumerate-then-certify procedure computes the finite discrete neighborhood N_d(s) exactly, then applies a sound per-branch continuous certificate; an action is allowed only if every branch passes. The non-composition theorem (Theorem 1) establishes that marginal certificates miss exactly the discrete–continuous interaction, and the backend-independent abstention floor (Proposition 3) shows any sound gate must refuse points within ε of the unsafe set.

Load-bearing premise

The certificate's coverage is bounded by the declared envelope B_{d,ε}(z) with d=1 and ε=0.10, calibrated on the authors' injected adapter-fault catalogue and a freshness limit around 10 seconds; if real binding faults are compound, stale, or outside these measured residuals, the 'removes in-budget false allows' claim does not transfer—and the paper states field prevalence is not measured.

What would settle it

A concrete settling observation: deploy the paper's budget-calibration recipe on a production agent pipeline and record binding faults over time. If a substantial fraction of real faults are compound (d≥2) or arrive with staleness beyond the measured freshness limit, the certified false-allow rate will exceed zero. Alternatively, replay the joint-gap attack against CAGE-Exact at the declared budget; if any certified allow is found unsafe against an independent policy oracle, the central claim collapses.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • Any sound runtime gate must evaluate the joint neighborhood, not the observed point; pointwise gates—including exact predicates and LLM judges—admit every joint-gap witness by construction.
  • The certified false-allow rate is bounded by escape from the declared budget, not by point accuracy; the paper measures budget-escape growth with staleness (about 1.8% to 7.1% as the freshness SLA relaxes).
  • When the policy is executable, CAGE-Exact certifies the policy itself with sub-microsecond latency; when the policy is implicit, CAGE-Lip and CAGE-RS certify a learned gate under a measured fidelity assumption, with abstention routing the residual to human review.
  • The certificate transfers across policy engines and regulatory threshold families because the underlying idiom—a source-conditioned numerical threshold with a provenance shift—is a first-class construct in decision tables and policy-as-code engines.
  • Autonomy is preserved: robust-safe coverage stays positive in every evaluated setting, up to 100% on one telemetry policy, so the certificate is not vacuous.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The non-composition result likely extends beyond tool returns to any access-control decision over a typed object with both categorical and numerical attributes; the joint-gap geometry is generic to source-conditioned thresholds.
  • A direct testable extension is to run the paper's budget-calibration recipe on a production agent pipeline to measure real binding-fault prevalence, which the paper explicitly leaves unmeasured; if real faults are compound (d≥2) or stale beyond the ~10-second freshness limit, the declared budget must shrink or the certificate will leak.
  • The 'certify the neighborhood, not the point' principle could apply to other post-hoc validation nodes, such as guarding actions on parsed documents or database rows where provenance and values can be mis-bound.
  • The paper's assumption ladder—policy-certified exact rung, then gate-certified learned rungs with measured fidelity—is a reusable design pattern for certified runtime monitors that separates what is proven from what is operationally assumed.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper formalizes post-tool-return authorization under bounded semantic uncertainty: given a validated typed return z=(s,x) and a candidate action a, the runtime must certify that the action is safe for every plausible correctly bound return in the joint neighborhood B_{d,ε}(z), where the discrete component allows ≤d binding faults and the continuous component allows ℓ2 drift ≤ε. The central theoretical result (Theorem 1) proves that separate categorical and numerical certificates do not compose, and gives the exact witness-interval geometry of length min(Δ,ε). CAGE implements the joint certificate by exact enumeration of the discrete neighborhood and a per-branch continuous backend: CAGE-Exact for executable affine policies, CAGE-Lip (1-Lipschitz margin) and CAGE-RS (randomized smoothing) for learned gates. The evaluation spans synthetic, OPA policy-as-code, OpenFisca, IEEE-CIS, NAB, PSD2/AML, and live k8s/MCP/Marble settings, with detailed calibration of the budget via injected adapter faults and a measured freshness limit.

Significance. If the claims hold as scoped, the paper makes a valuable contribution: it identifies a genuinely underappreciated attack surface (joint-gap witnesses), proves a clean non-composition theorem, and demonstrates a practical enumeration-plus-certification architecture. The empirical discipline is a real strength: Wilson-95% upper bounds on zero cells, held-out f_scale selection, differential validation of CAGE-Exact against OPA on 200,000 returns, and an explicit separation of policy certificates from gate certificates. The measured safety case, including the freshness budget and the admission that field prevalence is unmeasured, is more transparent than is typical for agent-safety papers. However, the headline claim that 'CAGE removes the in-budget false allows' is not supported for the learned backends, and the presentation needs to make the rung-specific scope of the guarantee load-bearing rather than caveated.

major comments (3)
  1. [Abstract; Table 5; Section 5.1] The abstract's blanket claim 'CAGE removes the in-budget false allows that accurate pointwise gates admit' is contradicted by the paper's own Table 5 on the primary real setting (IEEE-CIS + OPA): CAGE-Lip, the default learned backend, allows 1.5±0.4% of the witness set W and has a certified false-allow rate (CFA) of 8.2% of its certified allows. The footnote attributes this to base-gate policy misfit, and Section 5.1 correctly distinguishes policy-certified (rung 1) from gate-certified (rungs 2–3) guarantees. But the abstract, introduction, and Section 6.4's 'every certified allow is oracle-safe' do not carry that distinction. The headline should be rephrased to state that CAGE-Exact removes in-budget false allows on the executable affine fragment, while CAGE-Lip and CAGE-RS certify a learned gate under an explicit, measured gate–policy fidelity assumption, with residual false allows rep
  2. [Section 6.4, Table 7 vs Table 5] The claim 'Across Table 7, every certified allow is oracle-safe, while every setting retains nonzero robust-safe coverage' is misleading because Table 7 omits the CAGE-Lip row from Table 5. The OPA row in Table 7 reports CFA=0, but that row corresponds to a different evaluation track; the primary real-data CAGE-Lip evaluation has CFA=8.2%. As presented, a reader could conclude that the learned rungs have zero policy false allows, which is false in the paper's own primary real setting. Please include the Table 5 CAGE-Lip result in the soundness summary or explicitly state that the default learned backend has nonzero CFA on the primary real setting and explain why the Table 7 rows differ.
  3. [Section 6.5, Figure 4, Tables S35–S36; Section 6.4] The 'removes in-budget false allows' claim is conditional on the declared budget (d=1, ε=0.10) being valid at decision time. Section 6.5 shows that the same-card staleness crosses ε at ≈10 s, and the system false-allow rate grows from 1.8% to 7.1% as the SLA relaxes, while Section 6.4 explicitly states that field prevalence of the fault mechanisms is unmeasured. The abstract and contribution list should condition the central claim on the freshness recompute-in-loop recipe and on the measured budget; otherwise the headline overstates the deployment guarantee. The paper does disclose this in Section 7, but the abstract is not so qualified.
minor comments (4)
  1. [Section 6.1, Table 1] The notation Callow, Uallow, Rallow is used in Section 6.1 but is not defined in Table 1. Please define these conditional allow rates at first use.
  2. [Figure 1 caption] The mathematical typesetting in the Figure 1 caption is garbled ('B ( )d,ε z~' and 'B d,ε'). Please fix the rendering.
  3. [Section 5.1, rung definitions] In the rung-2 definition ('Rung 2 allows iff mins′∈Nd(s) hθ(s′,x,a) > Lcertε'), it would help to state explicitly that hθ is action-indexed and that the Lipschitz constant is with respect to x for each fixed discrete branch; the current notation is compressed.
  4. [Section 6.2, Table 5] The 'budget-aware LLM judge' row reports 44±43%; the large interval is striking and deserves a one-sentence explanation in the main text (the supplementary Table S17 provides it). Please cross-reference.

Circularity Check

0 steps flagged

No circularity: the formal guarantees are derived from explicit assumptions, and the empirical budget is measured separately from the certificate.

full rationale

The paper's derivation chain is self-contained on the points that matter. Theorem 1 (non-composition of marginal certificates) is proved by explicitly constructing two discrete states whose thresholds differ by Δ, giving the witness interval of length min(Δ, ε); this is a genuine existence proof, not an assumption of the conclusion. Propositions 1–7 are direct consequences of the paper's own definitions: Proposition 1 is the elementary observation that a pre-return rule cannot distinguish two returns; Proposition 2 is the standard Lipschitz margin argument applied to the gate; Proposition 3 is a straightforward implication of the definition of m(z,a) and soundness; Propositions 4–7 are union-bound and support-function arguments. None of these steps fits a parameter to the result it is used to claim. The empirical budget (d=1, ε=0.10) is a declared, measured assumption: it is calibrated on injected adapter faults and the paper explicitly states that field prevalence is not measured (Section 6.4), so the 'in-budget' claim is conditional on a stated envelope rather than being manufactured by the certificate. The learned rungs are explicitly gate-certified under a measured fidelity assumption, and the nonzero CFA for CAGE-Lip in Table 5 is disclosed rather than hidden, which is an honesty about scope, not circularity. The only self-citation (Siu et al. 2026 for oracle-function formalization) is background framing and is not load-bearing for any theorem or empirical claim. No step reduces to its own inputs by construction.

Axiom & Free-Parameter Ledger

4 free parameters · 7 axioms · 0 invented entities

The formal core (Theorem 1, Propositions 1–7) is self-contained mathematical argument. Applied claims rest on the declared budget B_{d,ε}, the trusted validation stack, and an explicitly assumed gate–policy fidelity for learned rungs. These are stated assumptions, not hidden fits, but they mean the headline "removes all in-budget false allows" is conditional on operational preconditions.

free parameters (4)
  • ε (continuous perturbation budget) = 0.10
    Declared p95 residual of injected adapter-fault drift; defines the ℓ₂ ball B_ε(x) in normalized feature space. Chosen/calibrated, not a physical constant.
  • d (discrete budget) = 1
    Measured single-fault atomicity (Pr[d=1]=1.000 for covered faults); d=2 recommended against fault-inducing adversaries. Chosen budget parameter.
  • Randomized-smoothing hyperparameters (σ, τ, M) = σ=0.10, τ=0.90, M=2000 (10^4 where stated)
    Fixed across CAGE-RS experiments: smoothing scale, certification threshold, and Monte-Carlo samples per branch. Chosen by hand, not fitted to data.
  • f_scale (numeric-block feature scaling) = 4 (NAB: 6; selected held-out)
    Scaling factor for the Lipschitz gate's continuous block, selected on a disjoint half to keep cert_false_allow=0; affects CAGE-Lip soundness.
axioms (7)
  • domain assumption Correctly bound return z⋆ differs from observed z only within B_{d,ε}(z): ≤d discrete edits and ℓ₂ drift ≤ε; all other corruptions are outside the certificate.
    Section 3.2 defines the threat model; Section 6.5 calibrates but cannot prove the field distribution.
  • domain assumption Typed constructor, schema validation, integrity and freshness checks are trusted (TCB).
    Appendix C; constructor corruption yields 1.7% false allows (Table S34).
  • domain assumption Display text m is architecturally excluded; the gate reads only the typed return z.
    TM1, Section 3.3; this excludes the untrusted text channel by construction.
  • domain assumption Discrete neighborhood N_d(s) is finite and exactly enumerable.
    Section 5, Proposition 4; sizes 8–18 at d=1 (Table S29).
  • domain assumption For learned backends, the gate h_θ is L_cert-Lipschitz and gate–policy fidelity holds (measured).
    Propositions 2/6, Section 5.1; the CAGE-Lip nonzero CFA in Table 5 shows the cost of misfit.
  • domain assumption Fault independence: simultaneous faults in one return-assembly window are excluded.
    Section 3.2/Appendix C; the d≤3 fallback is provided if compounding is realistic.
  • standard math Standard mathematical results: support function of ℓ₂ ball, union bound, Clopper–Pearson bounds, Lipschitz composition.
    Used in Propositions 4, 7 and Appendix D; standard and not disputed.

pith-pipeline@v1.3.0-daily-deepseek · 37614 in / 13218 out tokens · 133265 ms · 2026-08-03T11:56:43.411387+00:00 · methodology

0 comments
read the original abstract

Tool-using LLM agents act on typed tool returns, records pairing provenance and categorical fields with numerical values. Runtime permission gates generally authorize the observed return and action, leaving the decision unprotected against small errors in how the return was bound to its source. We ask whether a candidate action stays authorized over a declared neighborhood of plausible correctly bound returns: one admissible binding fault plus bounded numerical drift. We prove that certifying the categorical and numerical channels separately does not compose: perturbations that are safe on each channel alone can jointly turn the same action unsafe. CAGE certifies this joint neighborhood directly, enumerating the discrete branches exactly and certifying the continuous perturbation within each branch. Across synthetic, policy-as-code, regulatory, and real-transaction settings, CAGE removes the in-budget false allows that accurate pointwise gates admit, while keeping a useful fraction of decisions autonomous. When the policy is executable, CAGE-Exact certifies the policy itself; otherwise CAGE-Lip and CAGE-RS certify a learned gate under an explicit, measured fidelity assumption.

Figures

Figures reproduced from arXiv: 2607.29190 by Blaise Delattre, Cong Wang, Yang Cao.

Figure 1
Figure 1. Figure 1: Post-tool-return authorization boundary. The LLM [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Two axes place the post-tool-return node: [PITH_FULL_IMAGE:figures/full_fig_p002_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Geometry of a joint-gap witness: safe at the point [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Freshness governs the residual. Top: same-entity wall-clock εemp@p95 crosses the declared ε = 0.10 (dashed) at ≈ 10 s staleness (Table S35). Bottom: the system false￾allow grows as the SLA relaxes while certified false-allow stays 0: residual risk is bounded by the measured escape. 100%, locating the deficit in learned margin (Table S6). External validity. A deployed third-party rule carries the threshold … view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

50 extracted references · 9 linked inside Pith

  1. [1]

    Dive into

    Liu, Jiacheng and Zhao, Xiaohan and Shang, Xinyi and Shen, Zhiqiang , journal =. Dive into. 2026 , eprint =

    2026

  2. [2]

    Measuring the Permission Gate: A Stress-Test Evaluation of

    Ji, Zimo and Li, Zongjie and Jiang, Wenyuan and Gao, Yudong and Wang, Shuai , journal =. Measuring the Permission Gate: A Stress-Test Evaluation of. 2026 , eprint =

    2026

  3. [3]

    Proceedings of the 36th International Conference on Machine Learning (ICML 2019) , series =

    Certified Adversarial Robustness via Randomized Smoothing , author =. Proceedings of the 36th International Conference on Machine Learning (ICML 2019) , series =. 2019 , eprint =

    2019

  4. [4]

    Advances in Neural Information Processing Systems 38 (NeurIPS 2025) , year =

    One Sample is Enough to Make Conformal Prediction Robust , author =. Advances in Neural Information Processing Systems 38 (NeurIPS 2025) , year =. 2506.16553 , eprinttype =

    arXiv 2025

  5. [5]

    Not What You've Signed Up For: Compromising Real-World

    Greshake, Kai and Abdelnabi, Sahar and Mishra, Shailesh and Endres, Christoph and Holz, Thorsten and Fritz, Mario , booktitle =. Not What You've Signed Up For: Compromising Real-World. 2023 , publisher =. doi:10.1145/3605764.3623985 , eprint =

    arXiv 2023

  6. [6]

    2024 , eprint =

    Zhan, Qiusi and Liang, Zhixiang and Ying, Zifan and Kang, Daniel , booktitle =. 2024 , eprint =

    2024

  7. [7]

    Advances in Neural Information Processing Systems 37 (NeurIPS 2024), Datasets and Benchmarks Track , year =

    Debenedetti, Edoardo and Zhang, Jie and Balunovi. Advances in Neural Information Processing Systems 37 (NeurIPS 2024), Datasets and Benchmarks Track , year =. 2406.13352 , eprinttype =

    Pith/arXiv arXiv 2024

  8. [8]

    2023 , eprint =

    Yao, Shunyu and Zhao, Jeffrey and Yu, Dian and Du, Nan and Shafran, Izhak and Narasimhan, Karthik and Cao, Yuan , booktitle =. 2023 , eprint =

    2023

  9. [9]

    2025 , eprint =

    Das, Debeshee and Beurer-Kellner, Luca and Fischer, Marc and Baader, Maximilian , journal =. 2025 , eprint =

    2025

  10. [10]

    arXiv preprint arXiv:2403.14720 , year =

    Defending Against Indirect Prompt Injection Attacks With Spotlighting , author =. arXiv preprint arXiv:2403.14720 , year =. 2403.14720 , eprinttype =

    Pith/arXiv arXiv

  11. [11]

    2025 , pages =

    Chen, Sizhe and Piet, Julien and Sitawarin, Chawin and Wagner, David , booktitle =. 2025 , pages =

    2025

  12. [12]

    The Instruction Hierarchy: Training

    Wallace, Eric and Xiao, Kai and Leike, Reimar and Weng, Lilian and Heidecke, Johannes and Beutel, Alex , journal =. The Instruction Hierarchy: Training. 2024 , eprint =

    2024

  13. [13]

    arXiv preprint arXiv:2503.18813 , year =

    Defeating Prompt Injections by Design , author =. arXiv preprint arXiv:2503.18813 , year =. 2503.18813 , eprinttype =

    Pith/arXiv arXiv

  14. [14]

    and Hashimoto, Tatsunori , booktitle =

    Ruan, Yangjun and Dong, Honghua and Wang, Andrew and Pitis, Silviu and Zhou, Yongchao and Ba, Jimmy and Dubois, Yann and Maddison, Chris J. and Hashimoto, Tatsunori , booktitle =. Identifying the Risks of. 2024 , eprint =

    2024

  15. [15]

    2024 , howpublished =

    Model Context Protocol Specification , author =. 2024 , howpublished =

    2024

  16. [16]

    2026 , publisher =

    Wang, Zhiqiang and Gao, Yichao and Wang, Yanting and Liu, Suyuan and Sun, Haifeng and Cheng, Haoran and Shi, Guanquan and Du, Haohua and Li, Xiangyang , booktitle =. 2026 , publisher =. 2508.14925 , eprinttype =

    Pith/arXiv arXiv 2026

  17. [17]

    arXiv preprint arXiv:2510.03992v1 , year =

    Quantifying Distributional Robustness of Agentic Tool-Selection , author =. arXiv preprint arXiv:2510.03992v1 , year =. 2510.03992v1 , eprinttype =

    Pith/arXiv arXiv

  18. [18]

    2024 , howpublished =

    Open Policy Agent , author =. 2024 , howpublished =

    2024

  19. [19]

    2024 , howpublished =

    2024

  20. [20]

    2018 , howpublished =

    Commission Delegated Regulation (EU) 2018/389: Regulatory Technical Standards for Strong Customer Authentication , author =. 2018 , howpublished =

    2018

  21. [21]

    2024 , howpublished =

    Currency Transaction Reporting , author =. 2024 , howpublished =

    2024

  22. [22]

    2024 , howpublished =

    Azure Policy Built-in Definitions for. 2024 , howpublished =

    2024

  23. [23]

    , title =

    Miculicich, Lesly and Parmar, Mihir and Palangi, Hamid and Dvijotham, Krishnamurthy and Montanari, Mirko and Pfister, Tomas and Le, Long T. , title =. arXiv preprint arXiv:2510.05156 , year =

    arXiv

  24. [24]

    and Sun, Jun , title =

    Wang, Haoyu and Poskitt, Christopher M. and Sun, Jun , title =. Proc. 48th IEEE/ACM Int. Conf. on Software Engineering (ICSE) , year =

  25. [25]

    arXiv preprint arXiv:2503.15547 , year =

    Kim, Juhee and Choi, Woohyuk and Lee, Byoungyoung , title =. arXiv preprint arXiv:2503.15547 , year =

    Pith/arXiv arXiv

  26. [26]

    arXiv preprint arXiv:2506.07564 , year =

    Li, Peiran and Zou, Xinkai and Wu, Zhuohang and others , title =. arXiv preprint arXiv:2506.07564 , year =

    Pith/arXiv arXiv

  27. [27]

    arXiv preprint arXiv:2606.10749 , year =

    Ling, Yuchen and Yu, Shengcheng and Chen, Zhenyu and Fang, Chunrong , title =. arXiv preprint arXiv:2606.10749 , year =

    Pith/arXiv arXiv

  28. [28]

    arXiv preprint arXiv:2602.09757 , year =

    Ghitu, Mihnea and Wicker, Matthew , title =. arXiv preprint arXiv:2602.09757 , year =

    arXiv

  29. [29]

    arXiv preprint arXiv:2603.19469 , year =

    Siu, Vincent and He, Jingxuan and Montgomery, Kyle and Wang, Zhun and Gong, Neil and Wang, Chenguang and Song, Dawn , title =. arXiv preprint arXiv:2603.19469 , year =

    arXiv

  30. [30]

    A Coin Flip for Safety:

    Schwinn, Leo and Ladenburger, Moritz and Beyer, Tim and Mofakhami, Mehrnaz and Gidel, Gauthier and G. A Coin Flip for Safety:. arXiv preprint arXiv:2603.06594 , year =

    arXiv

  31. [31]

    14th IEEE International Conference on Machine Learning and Applications (ICMLA) , year =

    Lavin, Alexander and Ahmad, Subutai , title =. 14th IEEE International Conference on Machine Learning and Applications (ICMLA) , year =

  32. [32]

    arXiv preprint arXiv:2312.06674 , year =

    Inan, Hakan and Upasani, Kartikeya and Chi, Jianfeng and Rungta, Rashi and Iyer, Krithika and Mao, Yuning and Tontchev, Michael and Hu, Qing and Fuller, Brian and Testuggine, Davide and Khabsa, Madian , title =. arXiv preprint arXiv:2312.06674 , year =

    Pith/arXiv arXiv

  33. [33]

    Advances in Neural Information Processing Systems (NeurIPS) , year =

    Tsuzuku, Yusuke and Sato, Issei and Sugiyama, Masashi , title =. Advances in Neural Information Processing Systems (NeurIPS) , year =

  34. [34]

    Proceedings of the 36th International Conference on Machine Learning (ICML) , year =

    Anil, Cem and Lucas, James and Grosse, Roger , title =. Proceedings of the 36th International Conference on Machine Learning (ICML) , year =

  35. [35]

    Zico , title =

    Trockman, Asher and Kolter, J. Zico , title =. International Conference on Learning Representations (ICLR) , year =

  36. [36]

    2019 , howpublished =

    2019

  37. [37]

    Advances in Neural Information Processing Systems 31 (NeurIPS) , year =

    Zhang, Huan and Weng, Tsui-Wei and Chen, Pin-Yu and Hsieh, Cho-Jui and Daniel, Luca , title =. Advances in Neural Information Processing Systems 31 (NeurIPS) , year =

  38. [38]

    International Conference on Learning Representations (ICLR) , year =

    Tjeng, Vincent and Xiao, Kai and Tedrake, Russ , title =. International Conference on Learning Representations (ICLR) , year =

  39. [39]

    Qwen2.5 Technical Report , journal =

  40. [40]

    Proceedings of the 42nd International Conference on Machine Learning (ICML 2025), PMLR 267 , year =

    Boissin, Thibaut and Mamalet, Franck and Fel, Thomas and Picard, Agustin Martin and Massena, Thomas and Serrurier, Mathieu , title =. Proceedings of the 42nd International Conference on Machine Learning (ICML 2025), PMLR 267 , year =

    2025

  41. [41]

    and Tschantz, Michael Carl , title =

    Fisler, Kathi and Krishnamurthi, Shriram and Meyerovich, Leo A. and Tschantz, Michael Carl , title =. Proc. 27th International Conference on Software Engineering (ICSE) , year =

  42. [42]

    Safe Reinforcement Learning via Shielding , booktitle =

    Alshiekh, Mohammed and Bloem, Roderick and Ehlers, R. Safe Reinforcement Learning via Shielding , booktitle =

  43. [43]

    Ben-Tal, Aharon and El Ghaoui, Laurent and Nemirovski, Arkadi , title =

  44. [44]

    2024 , howpublished =

    Marble: Open-Source Real-Time Fraud and. 2024 , howpublished =

    2024

  45. [45]

    Tazama: Open-Source Real-Time Transaction Monitoring , year =

  46. [46]

    Certified Robustness to Adversarial Word Substitutions , booktitle =

    Jia, Robin and Raghunathan, Aditi and G. Certified Robustness to Adversarial Word Substitutions , booktitle =

  47. [47]

    Huang, Po-Sen and Stanforth, Robert and Welbl, Johannes and Dyer, Chris and Yogatama, Dani and Gowal, Sven and Dvijotham, Krishnamurthy and Kohli, Pushmeet , title =. Proc. 2019 Conference on Empirical Methods in Natural Language Processing , year =

    2019

  48. [48]

    , title =

    Lee, Guang-He and Yuan, Yang and Chang, Shiyu and Jaakkola, Tommi S. , title =. Advances in Neural Information Processing Systems 32 , year =

  49. [49]

    Efficient Robustness Certificates for Discrete Data: Sparsity-Aware Randomized Smoothing for Graphs, Images and More , booktitle =

    Bojchevski, Aleksandar and Gasteiger, Johannes and G. Efficient Robustness Certificates for Discrete Data: Sparsity-Aware Randomized Smoothing for Graphs, Images and More , booktitle =

  50. [50]

    and Ferraiolo, David and Kuhn, Rick and Schnitzer, Adam and Sandlin, Kenneth and Miller, Robert and Scarfone, Karen , title =

    Hu, Vincent C. and Ferraiolo, David and Kuhn, Rick and Schnitzer, Adam and Sandlin, Kenneth and Miller, Robert and Scarfone, Karen , title =