Certifying Trajectory-Level Risk in Modular LLM Security Agents

A recent paper on arXiv (2608.05199) tackles the issue of certifying trajectory-level risk in security agents based on modular LLMs. These agents function through staged pipelines, such as identifying network traffic and linking attacks to particular techniques. Although split conformal prediction ensures finite-sample coverage at each stage, a comprehensive guarantee across the entire pipeline is necessary, which doesn't automatically occur when stages are trained and calibrated independently. The authors point out that while Bonferroni allocation is distribution-free, it is overly cautious with correlated errors. They also reveal that extending pairwise correlation to three or more stages is flawed, leading to a lower bound instead of an upper one, and propose a valid spanning-tree alternative. The paper differentiates between dependent stages and the adequacy of audit sample size for certifying that dependence, providing corresponding upper and information-theoretic lower bounds on sample complexity. Furthermore, they illustrate that a coarse-to-fine label selection can achieve near-perfect measured correlation, impacting certification. This research is crucial for implementing AI-driven security systems, delivering robust statistical assurances for multi-stage processes.