NOMOS: Compiling Written Policies into Statically Verified Tool-Call Gates for LLM Agents

Evidence record

Original preprint evaluating deterministic schema-aware action gates on tau2-bench and AgentDojo, with benign-utility costs.

Read the original source ↗

Claim-level citations (5)

• supportsNOMOS reduced forbidden agent tool actions in controlled tests: On tau2-bench, the authors report reducing clause violations among state-changing calls from 66.3% to 2.6% in airline tasks and from 30.8% to 6.9% in retail tasks.

  Abstract, tau2-bench clause violation percentages

• supportsNOMOS reduced forbidden agent tool actions in controlled tests: The NOMOS authors describe a four-pass compiler producing deterministic gates for LLM tool calls, with static schema checks rejecting or repairing 37% of candidate airline rules and 13% of retail rules.

  Abstract, four-pass compiler and 37%/13% repair-or-reject sentence

• supportsNOMOS reduced forbidden agent tool actions in controlled tests: The authors report zero attack success in the evaluated AgentDojo banking suite and at most 3.6% in three other tested suites; these are benchmark-specific rates, not field exploitation measurements.

  Abstract, AgentDojo banking ASR and other suites

• supportsNOMOS reduced forbidden agent tool actions in controlled tests: A development gate flagged by the researchers refused 95.9% of task-passing calls, showing that schema-valid enforcement rules can still overblock authorized behavior.

  Abstract, development binding refused 95.9% of task-passing calls

• supportsNOMOS reduced forbidden agent tool actions in controlled tests: The NOMOS authors attribute the residual attack success in three AgentDojo suites, each at or below 3.6% in their tests, to attacker goals with no tool call for a gate to constrain and to one write operation admitted by a binding weaker than its policy clause.

  Abstract, final evaluation sentences describing other three AgentDojo suites, no tool call to govern and a weaker-than-clause binding