2026· Proceedings of the First Workshop on Structured Understanding, Retrieval, and Generation in the LLM Era (SURGeLLM 2026)· pp. 152-161· 0 citations· 20 references
TL;DR
T AB G UARD is introduced, an agentic framework that resolves semantic heterogeneity, domain-specific validation rules, and enterprise-scale processing through semantic routing and decouples expensive cognitive reasoning from scalable programmatic execution, enabling deployment on enterprise datasets without per-cell inference.
Abstract
Tabular anomaly detection is challenging because real-world tables contain heterogeneous columns, ranging from structured identifiers to free-form text. Existing methods face a fundamental trilemma: rule-based systems require extensive manual configuration and fail on novel schemas; statistical methods scale efficiently but miss semantic errors; and LLM-based approaches understand semantics but incur prohibitive per-cell inference costs. No prior method simultaneously addresses semantic heterogeneity, domain-specific validation rules, and enterprise-scale processing. We introduce T AB G UARD , an agentic framework that resolves this trilemma through semantic routing. Using LLM function calling, the system analyzes a small sample of each column and dynamically selects the most effective validation strategy, routing to a regex-based valida-tor for syntactic patterns, a code-generation val-idator for domain-specific rules (such as Luhn checksums for credit cards), or an embedding-based validator for distributional outliers. This architecture decouples expensive cognitive reasoning ( O ( m ) LLM calls for m columns) from scalable programmatic execution, enabling deployment on enterprise datasets without per-cell inference.
Traditional cloud monitoring often relies on static remediation procedures that are difficult to adapt to dynamic and heterogeneous infrastructures. This paper proposes an agentic LLM-based architecture for adaptive remediation planning from confirmed cloud anomalies. The goal is not to replace anomaly detectors, but to transform confirmed anomaly events into structured, policy-constrained remediation artifacts suitable for human-supervised operational workflows.The proposed workflow combines anomaly intake, contextual validation, playbook retrieval, and constrained playbook generation through a message-driven Multi-Agent System. Retrieval-Augmented Generation is used to correlate current incidents with historical knowledge and existing procedures, while deterministic guardrails enforce schema validation, policy constraints, command allow/deny lists, critical-resource checks, and human approval for high-impact or previously unseen actions.A containerised Proof of Concept demonstrates that confirmed anomalies can be transformed into CACAO-compatible remediation drafts within operationally reasonable time bounds. The evaluation focuses on generating and validating remediation plans under explicit operational constraints, rather than on anomaly detection benchmarking or on production-scale autonomous execution.
Paolo Palmiero, A. Iannaccone, D. Granata et al.· International Conference on...· 0 citations
LLM-MetaAS is proposed, a semantic-statistical framework for AutoML execution policy selection that improves overall AutoML performance and selects policies closer to the oracle than fixed strategies, random selection, and the native Auto-sklearn 2.0 selector.
Zhihuan Peng, Pincheng Liu, Yong Li et al.· Applied Sciences· 0 citations
Large language model (LLM)-assisted energy-management tools can translate natural-language context into structured grid commands, but syntactic validity does not imply physical admissibility. This paper presents TwinGridShield, a model-independent runtime authorization layer that evaluates each proposed action in a deterministic network twin before release. The prototype checks connectivity, branch-flow, generator, and load-shedding invariants and records each decision in a hash-chained log. A controlled IEEE 14-bus study evaluates single-step switching, redispatch, and load-shedding actions using DC power flow and experimentally assigned branch ratings. In the matched-model experiment, a stochastic proposal source configured to select an unsafe action with probability p=0.84 produced 421 unsafe proposals in 500 attacked-condition trials, a realized rate of 84.2%. This value characterizes the configured surrogate and is not an empirical measurement of LLM prompt-injection susceptibility. TwinGridShield produced 0 unsafe releases in those 500 trials. Because action labeling and authorization used the same DC model, system state, branch ratings, and encoded constraints, this result verifies conformance of the implementation to its encoded authorization predicate rather than safety under model error. The principal robustness evaluation therefore introduces model mismatch. Unsafe acceptance reached 5.63% under bounded +20% and -20% per-bus load-measurement error and 30.09% when actual branch ratings were 20% below modeled ratings.
Microservice traces can be structurally anomalous even when every span returns normally -- a payment flow that silently skips a risk check looks fine to any per-span monitor. Sequence models like DeepLog address this by predicting the next event, but they treat each API endpoint as a context-free token: the same endpoint reached through different invocation chains is mapped to the same vocabulary entry, even when its normal behavior differs across contexts. We propose encoding each event as an (endpoint, root-to-span invocation chain) pair instead. This simple change has two consequences: unseen chains are flagged without model inference, and next-event predictions become context-conditional, turning subtle path anomalies into clear outliers. We instantiate this idea in CHAINLSTM, a lightweight dual-task LSTM supporting per-event online detection. On the TrainTicket benchmark, CHAINLSTM achieves 94.3% F1 (+5.3 pp over DeepLog) with comparable latency recall and 99.1\% path recall. Case analysis shows that chain-aware encoding shifts median prediction probability on path anomalies from 0.91 to 0.002, suggesting a wider separation margin for threshold-based detection.
Yiliu Xu, Ziwei Hong, Zhongheng Yang et al.· 3 citations
LLM-based autonomous agents fail in ways that existing observability infrastructure cannot detect. OpenTelemetry’s GenAI semantic conventions cover LLM invocation and tool execution but leave five critical agent orchestration phases—planning, reasoning, safety monitoring, inter-agent delegation, and memory management—without span-level representation. We present AgentTelemetry, an open-source benchmark suite and toolkit for evaluating fault detection in agent systems. The benchmark defines (1) a taxonomy of 14 fault types mapped to 9 agent-specific span kinds, (2) a controlled evaluation harness of 490 fault-detection cells (14 faults × 5 observability conditions × 7 frameworks; enumerated as 2,940 raw configurations across 6 mock-LLM seeds), and (3) a pip-installable library (3,700+ LOC, 78 tests) with adapters for seven frameworks. On the controlled benchmark, the full span taxonomy achieves a Fault Detection Rate (FDR) of 1.000—an upper bound confirming structural completeness—compared to 0.429 for vanilla OpenTelemetry and OTel+GenAI. An ablation study proves all nine span kinds are necessary: removing any one makes at least one fault type undetectable. A case study on 112 SWE-bench Lite instances reveals that 84/112 agent runs (75%) exhausted the 8-iteration limit and are classified as reasoning loops by structural pattern (a definitional partition of the failed-trace population, not a sampling estimate)—a failure mode invisible to vanilla OTel—and a telemetry-guided intervention improves the patch rate by +12.5 pp over a matched control (Fisher’s exact p=0.53, two-sided; demonstrative not statistically significant at n=24). All code, data, and benchmark configurations are open-source for reproducibility.
Filesystem isolation in container ecosystems is often weakened by cross-boundary path misresolution, causing path traversal (PaTra) vulnerabilities. These vulnerabilities stem from insecure host-container interactions and have become increasingly pervasive as cloud systems mount shared resources, such as GPUs and agent workspaces, into containers to support AI workloads. Existing defenses remain inadequate. Kernel-level protections are intrusive, can destabilize system calls, and have therefore not been accepted into the Linux mainline. Detection methods rely on static rule matching or manual code auditing. Static rules can flag path-related functions but fail to capture the semantics needed to determine whether a host-container interaction exists, causing many false positives. Manual review requires domain expertise, making it costly, inefficient, and difficult to scale. To address this threat, we present Bulkhead, an automated framework that integrates large language models (LLMs) with formal methods for semantic vulnerability discovery and remediation. Bulkhead uses a multi-agent system to identify and repair PaTra vulnerabilities through multi-dimensional knowledge patterns generalized from known cases. It first applies high-risk functional patterns to locate entry points for cross-boundary interactions in containerized code, then uses call-chain patterns to recover the corresponding execution paths at suitable depth. The Detection pipeline analyzes these call chains against the application scenarios and threat model, identifying vulnerabilities such as missing security checks and TOCTOU flaws in cross-boundary interactions, and generating proof-of-concept (PoC) exploits for validation. These PoCs then guide patch generation. To ensure remediation correctness, the Patch pipeline performs assertion-driven verification using predefined model-checking templates.