SiLR: Structure-Preserving Admission and Process Reward for LLM Tool Agents

A new arXiv paper (2609.04629v1) introduces SiLR, a structure-preserving admission and process reward mechanism for LLM tool agents, which recovers 21/21 multi-action episodes on Gym-ANM scenarios versus 0/21 for terminal and 9/21 for the best scalar gate. The authors prove that no scalar surrogate is sound for the product order over branch-level violation states, and show that SiLR outperforms scalar projections across three model families and in CityLearn, including containing a magnitude-redistribution attack that defeats scalar and support-only baselines.

arXiv:2609.04629v1 Announce Type: new Abstract: A runtime gate for an LLM tool agent is usually cast as a filter. In a ReAct loop a rejected proposal is followed by another at the same state, so the gate is a search operator over the proposal stream whose admission criterion shapes which trajectories are reachable. We study post-violation recovery admission, where progress must be admitted while the system is still in violation, and identify the scalar projection trap: an aggregate-score gate accepts a locally improving proposal and commits the trajectory to a plateau. SiLR instead shadow-executes each proposal and admits it under a product order over the branch-level violation state overloaded-branch support and per-branch severity . We prove that no scalar surrogate is sound for this order, so the failure is representational, not a matter of threshold tuning. On mined Gym-ANM scenarios, SiLR recovers 21/21 multi-action episodes against 0/21 for terminal and 9/21 for the best scalar gate, significant across the full 24-scenario benchmark. The terminal-versus-structured dichotomy holds across three model families and in CityLearn. Because admission rests on deterministic simulation, the LLM lies outside the trust boundary: a magnitude-redistribution attack that defeats both scalar and support-only baselines is contained only by the full per-branch predicate. With two constraint families active, every tested scalar projection admits physically unsafe actions; support-only admits the largest fraction 63.2% of 42,410; product order 0 . In the hardest dual-family traces, scalar gates recover only through that unsafe class. Reused as a GRPO process reward, it outperforms its count projection in every mined scenario and is the only tested reward whose ungated policy exceeds the untrained base 0.844 vs. 0.778 . Scalar projection loses the violation geometry at both design points; only the full product order is structurally sufficient.