Approved Too Late: Verdict Staleness in LLM-Guarded Self-Adaptive Systems

A new arXiv study (2608.26306v1) finds that LLM guardrail approvals in self-adaptive systems can become stale between check time and actuation, creating a TOCTOU hazard. Across five reproducible environments, all-candidate verdict-change rates ranged from 5.3% to 48.4% at a replay shift of eight simulator steps. The proposed Freshness-Bounded Shield (FBS) reduced oracle-labeled approval-expiry rates from 3.4-24.7% to 0-1.8% at the same shift, and the authors introduce a freshness contract requiring approvals to remain valid at use time.

arXiv:2608.26306v1 Announce Type: new Abstract: A large language model LLM guardrail for a self-adaptive system SAS may issue an approval that is correct at check time but stale by actuation. This creates an Execute-stage time-of-check to time-of-use TOCTOU hazard. We study verdict freshness: whether a guardrail verdict remains valid when used. We distinguish three quantities that answer different questions: all-candidate verdict change under fixed-action replay, oracle-labeled approval expiry on recorded closed-loop trajectories, and judge-conditioned use-time invalidity. Across five reproducible SAS environments, all-candidate verdict-change rates span 5.3-48.4% at a common replay shift of eight simulator steps. We introduce the Freshness-Bounded Shield FBS , which estimates each approval's validity horizon from its safe-side margin and recent feature volatility, without an explicit plant-dynamics model. Using fixed settings documented in the artifact, FBS reduces oracle-labeled approval-expiry rates from 3.4-24.7% to 0-1.8% at the same shift. A separate audit of four LLM judges finds nonzero judge-conditioned use-time invalidity in every approval stream. We formulate a freshness contract: every approval must be correct at check time and remain valid at use time.