@inproceedings{hossain-etal-2026-nexus,
title = "{NEXUS}: Structured Runtime Safety for Tool-Using {LLM} Agent",
author = "Hossain, Elias and
Nipu, Md Mehedi Hasan and
Ornee, Tasfia Nuzhat and
Rana, Rajib and
Yousefi, Niloofar",
editor = "Zhang, Yue and
Xu, Ruifeng and
Purwarianti, Ayu and
Rong, Tong and
Suzuki, Jun",
booktitle = "Findings of the {A}ssociation for {C}omputational {L}inguistics: {IJCNLP}-{AACL} 2026",
month = nov,
year = "2026",
address = "Hengqin, China",
publisher = "Association for Computational Linguistics",
url = "https://aclanthology.org/2026.findings-aacl.112/",
pages = "2203--2232",
ISBN = "979-8-89176-444-6",
abstract = "Tool-using LLM agents increasingly execute high-impact actions, making runtime safety monitoring essential. We present NEXUS (Neural EXecution Utility and Safety), a structured-plan safety monitor that applies a formal intervention policy {\ensuremath{\Pi}} to select among four actions: allow, block, request confirmation, or request revision. NEXUS combines deterministic safety rules, argument-level inspection, and a calibrated logistic-regression risk score for graded escalation. On a 128-instance synthetic benchmark, NEXUS attains F1 = 0.949 and 4-class intervention accuracy of 0.6406, outperforming rule-only intervention selection by +27.3 percentage points. It also improves over rule-only on R-Judge (F1 = 0.861 vs. 0.849), matches rule-only on AgentHarm due to threat-model limits, and achieves 0{\%} ASR at 99{\%} control allow on IPI. On the rule-blind NEXUS-Stress benchmark, NEXUS reaches F1 = 0.897 with REVISE recall of 0.500, highlighting both progress and remaining difficulty in fine-grained intervention routing. With 0.38 ms median latency, NEXUS adds under 0.1{\%} overhead to typical agent loops."
}<?xml version="1.0" encoding="UTF-8"?>
<modsCollection xmlns="http://www.loc.gov/mods/v3">
<mods ID="hossain-etal-2026-nexus">
<titleInfo>
<title>NEXUS: Structured Runtime Safety for Tool-Using LLM Agent</title>
</titleInfo>
<name type="personal">
<namePart type="given">Elias</namePart>
<namePart type="family">Hossain</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Md</namePart>
<namePart type="given">Mehedi</namePart>
<namePart type="given">Hasan</namePart>
<namePart type="family">Nipu</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Tasfia</namePart>
<namePart type="given">Nuzhat</namePart>
<namePart type="family">Ornee</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Rajib</namePart>
<namePart type="family">Rana</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Niloofar</namePart>
<namePart type="family">Yousefi</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<originInfo>
<dateIssued>2026-11</dateIssued>
</originInfo>
<typeOfResource>text</typeOfResource>
<relatedItem type="host">
<titleInfo>
<title>Findings of the Association for Computational Linguistics: IJCNLP-AACL 2026</title>
</titleInfo>
<name type="personal">
<namePart type="given">Yue</namePart>
<namePart type="family">Zhang</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Ruifeng</namePart>
<namePart type="family">Xu</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Ayu</namePart>
<namePart type="family">Purwarianti</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Tong</namePart>
<namePart type="family">Rong</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Jun</namePart>
<namePart type="family">Suzuki</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<originInfo>
<publisher>Association for Computational Linguistics</publisher>
<place>
<placeTerm type="text">Hengqin, China</placeTerm>
</place>
</originInfo>
<genre authority="marcgt">conference publication</genre>
<identifier type="isbn">979-8-89176-444-6</identifier>
</relatedItem>
<abstract>Tool-using LLM agents increasingly execute high-impact actions, making runtime safety monitoring essential. We present NEXUS (Neural EXecution Utility and Safety), a structured-plan safety monitor that applies a formal intervention policy \ensuremathΠ to select among four actions: allow, block, request confirmation, or request revision. NEXUS combines deterministic safety rules, argument-level inspection, and a calibrated logistic-regression risk score for graded escalation. On a 128-instance synthetic benchmark, NEXUS attains F1 = 0.949 and 4-class intervention accuracy of 0.6406, outperforming rule-only intervention selection by +27.3 percentage points. It also improves over rule-only on R-Judge (F1 = 0.861 vs. 0.849), matches rule-only on AgentHarm due to threat-model limits, and achieves 0% ASR at 99% control allow on IPI. On the rule-blind NEXUS-Stress benchmark, NEXUS reaches F1 = 0.897 with REVISE recall of 0.500, highlighting both progress and remaining difficulty in fine-grained intervention routing. With 0.38 ms median latency, NEXUS adds under 0.1% overhead to typical agent loops.</abstract>
<identifier type="citekey">hossain-etal-2026-nexus</identifier>
<location>
<url>https://aclanthology.org/2026.findings-aacl.112/</url>
</location>
<part>
<date>2026-11</date>
<extent unit="page">
<start>2203</start>
<end>2232</end>
</extent>
</part>
</mods>
</modsCollection>
%0 Conference Proceedings
%T NEXUS: Structured Runtime Safety for Tool-Using LLM Agent
%A Hossain, Elias
%A Nipu, Md Mehedi Hasan
%A Ornee, Tasfia Nuzhat
%A Rana, Rajib
%A Yousefi, Niloofar
%Y Zhang, Yue
%Y Xu, Ruifeng
%Y Purwarianti, Ayu
%Y Rong, Tong
%Y Suzuki, Jun
%S Findings of the Association for Computational Linguistics: IJCNLP-AACL 2026
%D 2026
%8 November
%I Association for Computational Linguistics
%C Hengqin, China
%@ 979-8-89176-444-6
%F hossain-etal-2026-nexus
%X Tool-using LLM agents increasingly execute high-impact actions, making runtime safety monitoring essential. We present NEXUS (Neural EXecution Utility and Safety), a structured-plan safety monitor that applies a formal intervention policy \ensuremathΠ to select among four actions: allow, block, request confirmation, or request revision. NEXUS combines deterministic safety rules, argument-level inspection, and a calibrated logistic-regression risk score for graded escalation. On a 128-instance synthetic benchmark, NEXUS attains F1 = 0.949 and 4-class intervention accuracy of 0.6406, outperforming rule-only intervention selection by +27.3 percentage points. It also improves over rule-only on R-Judge (F1 = 0.861 vs. 0.849), matches rule-only on AgentHarm due to threat-model limits, and achieves 0% ASR at 99% control allow on IPI. On the rule-blind NEXUS-Stress benchmark, NEXUS reaches F1 = 0.897 with REVISE recall of 0.500, highlighting both progress and remaining difficulty in fine-grained intervention routing. With 0.38 ms median latency, NEXUS adds under 0.1% overhead to typical agent loops.
%U https://aclanthology.org/2026.findings-aacl.112/
%P 2203-2232
Markdown (Informal)
[NEXUS: Structured Runtime Safety for Tool-Using LLM Agent](https://aclanthology.org/2026.findings-aacl.112/) (Hossain et al., Findings 2026)
ACL
- Elias Hossain, Md Mehedi Hasan Nipu, Tasfia Nuzhat Ornee, Rajib Rana, and Niloofar Yousefi. 2026. NEXUS: Structured Runtime Safety for Tool-Using LLM Agent. In Findings of the Association for Computational Linguistics: IJCNLP-AACL 2026, pages 2203–2232, Hengqin, China. Association for Computational Linguistics.