HALO: Heterogeneous Admission through Localized Obligations for Safe Agentic Execution

Hwangnam Kim; Kiseok Kim; Kyeonghyun Yoo; Seunghyun Yoo; Taewoo Park

REVIEW 1 major objections 5 minor 11 references

HALO: Heterogeneous Admission through Localized Obligations for Safe Agentic Execution

T0 review · 1 major / 5 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read HALO retains the still-supported components of a mixed agent response while rechecking every exact action at a final dispatch gate.

desk verdict HALO is a genuinely useful runtime layer for heterogeneous agent responses, with an honest trust boundary; the evaluation is conformance-grade rather than external-validation-grade, and that is the one real soft spot. read the letter →

arxiv 2607.27636 v1 pith:WTPVMXGO submitted 2026-07-30 cs.AI cs.ROcs.SE

Taewoo Park , Kyeonghyun Yoo , Kiseok Kim , Seunghyun Yoo , Hwangnam Kim This is my paper · ORCID

classification cs.AIcs.ROcs.SE

keywords agenticAIsafetyruntimesupportdriftcomponent-leveladmissiondependencyclosurefinaldispatchgateone-dispatchtokenfreshscopedrecoveryUAVverification

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

HALO is a runtime protocol for agentic AI responses that arrive as a bundle of different outputs: notices, requests, status messages, and external actions. The paper argues that the components of one response do not stay valid together because the world changes while the model generates or before the response is used, and that neither whole-response rejection nor checking components independently handles this correctly. HALO therefore keeps the largest subset of components whose declared prerequisites still hold, rechecks each exact action immediately before it crosses a controlled interface, and lets a blocked action re-enter only as a fresh candidate with new evidence and authorization. A fair reading is that this creates a distinct runtime layer where useful outputs survive support drift while stale or replayed actions cannot reach the outside world, with all guarantees scoped to declared dependencies and trusted state inputs.

What carries the argument

The load-bearing object is the dependency-closed retained set, computed as the greatest fixed point $A^\star_t = \nu X.\{e\in V : L_{C_t}(e)\land \mathrm{Parents}(e)\subseteq X\}$, which repeatedly removes unsupported components and components whose declared parents were removed. Around it sit three mechanisms: the support footprint $\pi_e(C_t)$ that limits re-evaluation to fields that matter to each component; the action binding $b_e = H(W_e, \mathrm{seq}_e)$ with its one-dispatch token, which ties authority to one canonical action instance; and the localized obligation $o_e$, which records the reason, required refreshed support, recovery route, and replacement scope $S(o_e)$ without granting authority. The final dispatch gate evaluates $e\in A^\star_t$, $\mathrm{DepsReady}_t(e)$, $\mathrm{WitnessOK}_t(W_e)$, and $\mathrm{FreshAuth}_t(e, b_e)$ inside a single critical section, so the exact action instance is rechecked at the moment it crosses the adapter.

What would settle it

Construct a single action-bearing component whose safe use depends on an environmental condition that is not declared as a prerequisite, change that condition between admission and the final gate, and observe whether HALO dispatches the action; the paper's trust model predicts it will, since HALO checks only declared prerequisites and trusted provider inputs. A provider-side test does the same: give a state provider a stale value with a fresh timestamp and see whether the final gate admits it.

Watch

Extended reading notes

Core claim

The central discovery is that safe handling of a heterogeneous agent response separates two decisions that are usually conflated: whether a component may remain in the response, and whether the exact action instance may be dispatched. HALO computes the largest locally supported set closed under declared prerequisites, written $A^\star_t = \nu X.\{e\in V : L_{C_t}(e)\land \mathrm{Parents}(e)\subseteq X\}$, so a dependent is removed when its prerequisite is, while unrelated components survive. Retention is not dispatch authority: every action then passes a final dispatch gate that checks current retention, prerequisite phase readiness, an unchanged admission witness and binding, and an unused one-dispatch token. A blocked action leaves a localized obligation recording what support must be refreshed and which component may be replaced, but discharge grants no authority; a recovered candidate must repeat admission with current evidence, a later generation, a new token, and an unused sequence. The paper reports that this procedure matched all 96 admission expectations and 20 protocol tests, retained 248/248 supported components where a whole-response policy retained 0/248, and blocked every tested stale route across ten cold-start flight-control sessions.

Load-bearing premise

The load-bearing premise is that the domain catalog $\mathcal{K}$ and the agent's declared prerequisite references completely specify what must be true for a component to be safe, and that state providers return truthful current data; the paper itself places undeclared dependencies, provider failures, distributed atomicity, and downstream physical outcomes outside its boundary, so if a real dependency is omitted or a provider reports stale data as fresh, HALO will classify the component as supported and may dispatch a stale action.

Editorial extensions

If this is right

A multi-component response can be partially admitted: independent notices and reports remain available even when an action and its dependent status are withheld.
Removing a prerequisite removes its dependents, so the runtime never emits or dispatches a component whose declared parent was lost.
An action that passes initial admission but goes stale before dispatch is blocked at the final gate, and modified or replayed instances cannot reuse older authority because the binding and one-dispatch token are exact.
A blocked action can only return through fresh readmission with current evidence, a later generation, a new token, and an unused sequence; no recovery path revives the old authority.
If the adapter is called, all gate conditions held at the decision instant, so the protocol gives a gate-boundary guarantee that the tested UAV dispatch checks satisfied in every reported case.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Editorially, the same retention, gate, and recovery pattern should transfer to any typed effect boundary, such as software merges, database writes, or cloud API calls, whenever a domain catalog and honest state providers can be supplied; the paper's supplementary software-boundary check is a first step in that direction.
A natural next step is an automated prerequisite-mining layer that derives dependency references from tool schemas and environment models; without it, the protocol's main residual risk is the completeness of the agent's declared graph.
Because a blocked action must be regenerated by a recovery handler, systems built on HALO will depend heavily on the quality of that handler; one measure of system maturity is how often recovery candidates re-enter admission successfully.
The one-dispatch token and exact action binding double as an audit trail, since each authorized dispatch is tied to one canonical payload and one admission generation; this could make post-hoc accountability for agent actions easier to establish.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Short version: this paper deserves a real referee slot. HALO's combination — dependency-closed partial retention, exact-action binding at a final dispatch gate, and scoped fresh readmission — is new as a package, and for people building agent runtime safety it fills a real gap: deciding what survives inside one response when conditions drift. The theorems are simple, mostly restating the protocol, but they are correct. The implementation evidence is broad: 96 admission cases, 20 protocol cases, 10,000 schedules, PX4/Gazebo, and a physical Crazyflie. The authors also isolate their mechanisms against AgentSpec as the closest comparator, and they do not oversell a richer rule language. The trust model is written out more carefully than most papers in this space. Citation pattern is fine; the self-citation to their earlier UAV recovery work is on-topic, not padding.

The soft spot is the one the stress-test note identifies, and I think it is real but not fatal. The guarantees are relative to catalog K and to the declared prerequisites. "Supported" means the catalog's predicates pass over the footprint. The stale-injection tests label as stale exactly the mutations that violate those predicates. So the impressive numbers — 248/248 retained, 0 stale setpoints, 10/10 Crazyflie holds — establish that the implementation follows its own specification. They do not establish that the specification captures real-world staleness or safety. If a real dependency is missing from the catalog, or a state provider lies, HALO will happily dispatch something semantically stale. The paper says this in the trust model and discussion, so it is a scoping issue, not a hidden contradiction. The headline phrase "Safe Agentic Execution" overpromises; the body's boundary-scoped claims are mostly accurate.

Two smaller notes. The physical and simulated evidence is downstream observation at the PX4 setpoint interface, not safety of flight, and the paper is careful about that. And there is no public artifact link with a commit hash, only a description of an artifact; for a systems paper that is a concrete reproducibility gap.

Who this is for: runtime-safety engineers, agent-platform folks, and anyone building admission or execution layers for tool-calling agents. I would cite it. It should go to peer review; a good referee can ask for an external-ground-truth evaluation and a linked artifact, and the paper would be stronger for it.

Referee Report

1 major / 5 minor

Summary. The paper presents HALO, a runtime admission protocol for agentic AI responses composed of heterogeneous components (notices, requests, handoffs, actions). HALO first computes the greatest subset of response components that are locally supported under a trusted domain catalog K and closed under declared prerequisite references (Eq. (5)); it then rechecks each exact action immediately before dispatch through a final gate that verifies current retention, dependency-phase readiness, unchanged exact-instance witness, and fresh one-dispatch authorization (Eq. (8)). Blocked recoverable actions are represented as localized obligations that record required updates and a replacement scope, and readmission is allowed only for fresh candidates with new authority. The evaluation comprises 96 hand-specified admission cases, 135 exhaustive and 45 independent graph-oracle cases, 20 protocol-transition cases, 10,000 fault-injected schedules, 62-response structured replay, PX4/Gazebo cold-start sessions with injected stale routes, a physical Crazyflie realization, and a supplementary bare-Git cross-domain transfer check. The formal theorems in the supplement are correct but mostly restate the protocol definitions; the main contribution is the coupled runtime process and its layered evaluation.

Significance. If the results transfer beyond the tested UAV instantiation, HALO fills a real gap between output guardrails, workflow transactions, and freshness/shielding mechanisms by providing dependency-consistent partial retention, an exact-instance final dispatch gate, and scoped fresh recovery. The paper ships unusually extensive evidence for a runtime-protocol paper: deterministic conformance checks with independent oracles, ablation-based mechanism necessity, a physical drone realization, and a cross-domain software-boundary instantiation, together with a detailed artifact and reproducibility apparatus. The honest scoping is a strength: the Trust model in Method, Table 15, and the Discussion explicitly list undeclared dependencies, provider failures, distributed atomicity, and downstream physical outcomes as outside the guarantee boundary. The principal caveat is that the safety claim is conditional on the completeness and correctness of catalog K and on faithful state providers; no experiment measures that completeness. Because the paper already states this boundary, I regard this as a framing issue rather than an internal inconsistency.

major comments (1)

[Abstract, Conclusion, Eq. (2), Eq. (5)] The title, abstract, and Conclusion use safety language ('Safe Agentic Execution', 'excluded all tested stale dispatches') without the qualifier 'according to the trusted catalog K.' Since Eq. (2) defines local support as LocalOK_K(e, pi_e(C_t)) and Eq. (5) defines retention over declared prerequisite references, and since the PX4/Gazebo mutations are labeled 'stale' precisely when they violate those catalog predicates, the experiments demonstrate that the implementation enforces HALO's own support model, not that this model corresponds to real-world staleness or safety. If a response omits a genuinely required dependency, or if a physical state not selected by the catalog footprint changes, HALO will retain and dispatch the component while it is semantically stale. The Trust model and Discussion already acknowledge this boundary; please make the conditional nature explicit in the abstract and Conclusion, and add a sentence stating that catalog and dependency completeness is not measured by the evaluation.

minor comments (5)

[Algorithm 1, line 9] The pseudocode condition 'DepsReady_t(e) = 0' should be written as 'DepsReady_t(e) is false' (or '= false'), because DepsReady_t is a predicate, not a count of unmet dependencies; the current notation is confusing.
[Protocol Properties, Proposition 1] Proposition 1 states that if adapter G is called, the four conjuncts hold simultaneously and the token authorizes at most one call; the surrounding paragraph already restricts the result to enforced boundaries, but the proposition itself is unqualified. Adding the qualifier 'under the assumptions stated in this section' would make the conditional status of the guarantee clearer.
[Abstract, RQ1] The abstract's 'ten cold-start PX4/Gazebo sessions' does not mention that these sessions were run in one fixed environment, although the supplement notes this; adding 'in one fixed environment' would prevent over-generalization of the quantitative results.
[PX4/Gazebo Observation Boundary] The text says the status analysis used 'preregistered error and drift limits,' but no registration timestamp or document is cited for these limits; please either cite the artifact registration or replace 'preregistered' with 'pre-specified.'
[Evaluation, RQ1] Table 3(b) reports 240 supported components, 50 stale, 100 prerequisite, and 200 overblocking opportunities in the PX4 panel, but the main text does not define how these counts are derived; a one-sentence derivation (or a pointer to the supplement) would make the table self-contained.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: HALO's claims are protocol-conformance results with an explicit trust boundary, not predictions forced by their own definitions.

full rationale

HALO's derivation chain is self-contained rather than circular. The admission set A*_t (Eq. 5) and DispatchOK_t (Eq. 8) are definitions of the protocol, and Theorems 1-5 prove analytic properties of those definitions; this is specification mathematics, not a fitted prediction. The empirical claims are implementation-conformance checks: the implementation is matched against separate oracles, and the PX4/Crazyflie experiments inject mutations labeled stale by the catalog's own predicates, so the results show the runtime enforces its defined checks. The paper repeatedly scopes its guarantees: 'HALO's claims cover only the declared response graph, trusted current-state inputs, and actions that cross the enforced adapter' and the Discussion lists 'undeclared dependencies, provider failures, distributed atomicity, and downstream physical outcomes' as outside the boundary. Catalog completeness is thus an explicit assumption rather than a hidden circular input. The single self-citation (Park et al. 2026) is used only to delineate a different prior system and is not load-bearing. No fitted parameter is renamed as a prediction, and no uniqueness theorem is imported from the authors' prior work. The headline 'Safe Agentic Execution' is claimed within this stated trust model, and the manuscript honestly flags the boundary, so the appropriate finding is no significant circularity.

Assumptions & free parameters 0 free parameters · 7 assumptions · 4 invented entities

HALO introduces no fitted constants. The domain catalog supplies thresholds (e.g., AoI limits) and recovery routes as inputs, not as parameters fitted to make the derivation work. The timing regressions in RQ4 fit coefficients to measured costs, but those are descriptive and do not support the admission or dispatch claims.

assumptions (7)

domain assumption The trusted domain catalog K correctly defines component types, required prerequisites, support checks, recovery routes, and output paths.
Method > Trust model; if K is wrong, HALO's retentions and blocks are wrong.
domain assumption State providers faithfully report current evidence, authorization, versions, provenance, and operating conditions.
Method > Trust model: 'HALO trusts... faithful state providers'; Discussion lists provider failures as outside the boundary.
domain assumption The adapter G is the sole controlled interface through which actions reach the external system, and it is enforced.
Method > Runtime Overview: 'HALO dispatches an action only through the adapter'; final dispatch gate depends on this.
domain assumption The response graph is finite and acyclic after HALO rejects malformed references and cycles.
Method > Component-Level Admission: malformed references and cycles are rejected before computing the greatest fixed point.
standard math The greatest fixed point of the monotone operator FCt exists on the finite lattice of subsets of V.
Theorem 1 in the supplement uses the standard Knaster-Tarski style fixed-point fact on a finite lattice.
standard math Age of Information is defined as delta_s(t) = t - u_s(t), following Yates et al. (2021).
UAV Instantiation, Eq. (11); the freshness predicate builds on this.
domain assumption Selected FAA Part 107 provisions are used as engineering profiles, not as regulatory compliance.
UAV Instantiation: 'The 410 PX4 profile replays test agreement with these rules, not regulatory compliance.'

invented entities (4)

Localized obligation o_e
purpose: Records why an action was blocked, what support must be refreshed, the permitted recovery route, and the replacement scope S(o_e).
A protocol-internal record; its behavior is tested internally (recovery locality, discharge conditions) and it has no externally falsifiable handle outside the implementation.
One-dispatch token
purpose: Authorizes at most one dispatch of a specific bound action instance; consumed atomically in the final dispatch gate.
Protocol-internal authorization primitive; tested via token-replay controls, but not observable outside the implementation.
Action binding b_e
purpose: Ties one admission witness to one dispatch attempt, preventing modified or replayed payloads from reusing earlier support or authorization.
An internal cryptographic-style binding; its guarantees are verified by protocol-conformance tests, not by external observations.
Support footprint pi_e
purpose: Selects the subset of current runtime state relevant to component e, so irrelevant changes do not invalidate it.
A definitional component of the admission model; not an empirically detectable entity.

how reviews work

0 comments

Cite this review

Pith. "Pith review of HALO: Heterogeneous Admission through Localized Obligations for Safe Agentic Execution." pith.science (2026). https://pith.science/paper/WTPVMXGO

@misc{pith2026260727636,
  author       = {Pith},
  title        = {Pith review of: HALO: Heterogeneous Admission through Localized Obligations for Safe Agentic Execution},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/WTPVMXGO}},
  note         = {Machine review of arXiv:2607.27636}
}

read the original abstract

Recent agentic AI systems may return a heterogeneous response containing notices, requests, handoffs, and actions. Conditions can change before external use, so components from the same response need not remain supported together. Rejecting the whole response discards useful components, whereas checking components independently can leave a dependent without its prerequisite. We present Heterogeneous Admission with Localized Obligations (HALO), a runtime protocol that preserves supported components whose declared prerequisites also remain supported, rechecks each exact action before dispatch, and allows blocked actions to be replaced only by fresh candidates. HALO matched all 96 admission expectations and passed all 20 protocol tests. In structured-response replay, it retained 248/248 supported components, including 128/128 unaffected by unrelated changes, while a whole-response policy retained 0/248. Across ten cold-start PX4/Gazebo sessions, HALO blocked every tested stale route, observed no matching stale setpoint, and completed all fresh recoveries.

Figures

Figures reproduced from arXiv: 2607.27636 by the authors.

**Figure 2.** Physical Crazyflie realization of Figure 1. HALO first retains the forward action, then withholds it after support changes [PITH_FULL_IMAGE:figures/full_fig_p007_2.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

11 extracted references · 8 canonical work pages

[6]

https://modelcontextprotocol.io/specification/2025-06- 18/server/tools

Model Context Protocol Specification, 2025-06-18: Tools. https://modelcontextprotocol.io/specification/2025-06- 18/server/tools. Accessed 2026-07-21. Office of the Federal Register

work page 2025
[7]

https://www.ecfr.gov/current/ title-14/chapter-I/subchapter-F/part-107

14 CFR Part 107: Small Unmanned Aircraft Systems. https://www.ecfr.gov/current/ title-14/chapter-I/subchapter-F/part-107. Current electronic edition;Sections107.19,107.37,107.41,107.49,and107.51; accessed 2026-07-24. OpenAI

work page 2026
[8]

https://developers.openai

Function Calling. https://developers.openai. com/api/docs/guides/function-calling. Online documenta- tion; accessed 2026-07-21. Parasuraman, R.; Sheridan, T. B.; and Wickens, C. D

work page 2026
[10]

InAdvances in Neural Information Processing Systems

Toolformer: Language Models Can Teach Them- selves to Use Tools. InAdvances in Neural Information Processing Systems. Seto,D.;Krogh,B.;Sha,L.;andChutinan,A.1998. TheSim- plex Architecture forSafe On-LineControl SystemUpgrades. InProceedings of the 1998 American Control Conference, volume 6, 3504–3508. IEEE. Wang, H.; Poskitt, C. M.; and Sun, J

work page 1998
[2000]

Park,T.;Yoo,K.;Yoo,S.;andKim,H.2026.SelectiveAgentic Recovery for UAV Autonomy with a Persistent Mission Run- time

A Model for Types and Levels of Human Interaction with Automation.IEEE Transactions on Systems, Man, and Cybernetics–Part A: Systems and Humans, 30(3): 286–297. Park,T.;Yoo,K.;Yoo,S.;andKim,H.2026.SelectiveAgentic Recovery for UAV Autonomy with a Persistent Mission Run- time. arXiv preprint arXiv:2606.14219. arXiv:2606.14219. Rebedea, T.; Dinu, R.; Sreedh...

work page arXiv 2026
[2018]

Safe Reinforcement Learning via Shielding.Proceedings of the AAAI Conference on Artificial Intelligence, 32(1): 2669–2678. Ames, A. D.; Coogan, S.; Egerstedt, M.; Notomista, G.; Sreenath,K.;andTabuada,P.2019.ControlBarrierFunctions: Theory and Applications. In2019 18th European Control Conference (ECC), 3420–3431. IEEE. Chang, E. Y.; Geng, L.; and Chang, E. J

work page 2019
[2019]

InProceedings of the 49th Annual IEEE/IFIP International Conference on Dependable Systems and Networks, 138–150

SOTER: A Runtime Assurance Framework for Programming Safe Robotics Systems. InProceedings of the 49th Annual IEEE/IFIP International Conference on Dependable Systems and Networks, 138–150. Ichter, B.; Brohan, A.; Chebotar, Y.; Finn, C.; Hausman, K.; Herzog, A.; Ho, D.; Ibarz, J.; Irpan, A.; Jang, E.; Julian, R.; Kalashnikov, D.; Levine, S.; Lu, Y.; Parada...

work page 2023
[2021]

Zhan,Q.;Liang,Z.;Ying,Z.;andKang,D.2024

Age of Information: An Intro- duction and Survey.IEEE Journal on Selected Areas in Communications, 39(5): 1183–1210. Zhan,Q.;Liang,Z.;Ying,Z.;andKang,D.2024. InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents. InFindings of the Associa- tionforComputationalLinguistics:ACL2024,10471–10506. Bangkok, Thailand: ...

work page 2024

Show all 11 references

[2023]

arXiv preprint arXiv:2312.06674

Llama Guard: LLM-Based Input-Output Safeguard for Human–AI Conversations. arXiv preprint arXiv:2312.06674. arXiv:2312.06674. Koenig,N.;andHoward,A.2004. DesignandUseParadigms for Gazebo, an Open-Source Multi-Robot Simulator. In2004 IEEE/RSJInternationalConferenceonIntelligentR...

2004 arXiv
[2025]

arXiv preprint arXiv:2506.07564

SAFEFLOW: A Principled Protocol for Trustworthy and Transactional Autonomous Agent Systems. arXiv preprint arXiv:2506.07564. arXiv:2506.07564. Liang, J.; Huang, W.; Xia, F.; Xu, P.; Hausman, K.; Ichter, B.; Florence, P.; and Zeng, A

arXiv
[2026]

arXiv preprint arXiv:2607.00269

Mnemosyne: Agentic Transaction Processing for Validating and Repairing AI-Generated Workflows. arXiv preprint arXiv:2607.00269. arXiv:2607.00269. Desai, A.; Ghosh, S.; Seshia, S. A.; Shankar, N.; and Tiwari, A

arXiv

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.

[1] [6]

https://modelcontextprotocol.io/specification/2025-06- 18/server/tools

Model Context Protocol Specification, 2025-06-18: Tools. https://modelcontextprotocol.io/specification/2025-06- 18/server/tools. Accessed 2026-07-21. Office of the Federal Register

work page 2025

[2] [7]

https://www.ecfr.gov/current/ title-14/chapter-I/subchapter-F/part-107

14 CFR Part 107: Small Unmanned Aircraft Systems. https://www.ecfr.gov/current/ title-14/chapter-I/subchapter-F/part-107. Current electronic edition;Sections107.19,107.37,107.41,107.49,and107.51; accessed 2026-07-24. OpenAI

work page 2026

[3] [8]

https://developers.openai

Function Calling. https://developers.openai. com/api/docs/guides/function-calling. Online documenta- tion; accessed 2026-07-21. Parasuraman, R.; Sheridan, T. B.; and Wickens, C. D

work page 2026

[4] [10]

InAdvances in Neural Information Processing Systems

Toolformer: Language Models Can Teach Them- selves to Use Tools. InAdvances in Neural Information Processing Systems. Seto,D.;Krogh,B.;Sha,L.;andChutinan,A.1998. TheSim- plex Architecture forSafe On-LineControl SystemUpgrades. InProceedings of the 1998 American Control Conference, volume 6, 3504–3508. IEEE. Wang, H.; Poskitt, C. M.; and Sun, J

work page 1998

[5] [2000]

Park,T.;Yoo,K.;Yoo,S.;andKim,H.2026.SelectiveAgentic Recovery for UAV Autonomy with a Persistent Mission Run- time

A Model for Types and Levels of Human Interaction with Automation.IEEE Transactions on Systems, Man, and Cybernetics–Part A: Systems and Humans, 30(3): 286–297. Park,T.;Yoo,K.;Yoo,S.;andKim,H.2026.SelectiveAgentic Recovery for UAV Autonomy with a Persistent Mission Run- time. arXiv preprint arXiv:2606.14219. arXiv:2606.14219. Rebedea, T.; Dinu, R.; Sreedh...

work page arXiv 2026

[6] [2018]

Safe Reinforcement Learning via Shielding.Proceedings of the AAAI Conference on Artificial Intelligence, 32(1): 2669–2678. Ames, A. D.; Coogan, S.; Egerstedt, M.; Notomista, G.; Sreenath,K.;andTabuada,P.2019.ControlBarrierFunctions: Theory and Applications. In2019 18th European Control Conference (ECC), 3420–3431. IEEE. Chang, E. Y.; Geng, L.; and Chang, E. J

work page 2019

[7] [2019]

InProceedings of the 49th Annual IEEE/IFIP International Conference on Dependable Systems and Networks, 138–150

SOTER: A Runtime Assurance Framework for Programming Safe Robotics Systems. InProceedings of the 49th Annual IEEE/IFIP International Conference on Dependable Systems and Networks, 138–150. Ichter, B.; Brohan, A.; Chebotar, Y.; Finn, C.; Hausman, K.; Herzog, A.; Ho, D.; Ibarz, J.; Irpan, A.; Jang, E.; Julian, R.; Kalashnikov, D.; Levine, S.; Lu, Y.; Parada...

work page 2023

[8] [2021]

Zhan,Q.;Liang,Z.;Ying,Z.;andKang,D.2024

Age of Information: An Intro- duction and Survey.IEEE Journal on Selected Areas in Communications, 39(5): 1183–1210. Zhan,Q.;Liang,Z.;Ying,Z.;andKang,D.2024. InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents. InFindings of the Associa- tionforComputationalLinguistics:ACL2024,10471–10506. Bangkok, Thailand: ...

work page 2024