FormalJudge: A Neuro-Symbolic Paradigm for Agentic Oversight
Open accessAbstract
As LLM-based agents increasingly operate in high-stakes domains with real-world consequences, ensuring their behavioral safety becomes paramount. The dominant oversight paradigm, LLM-as-a-Judge, faces a fundamental dilemma: how can probabilistic systems reliably supervise other probabilistic systems without inheriting their failure modes? We argue that formal verification offers a principled escape from this dilemma, yet its adoption has been hindered by a critical bottleneck: the translation from natural language requirements to formal specifications. This paper bridges this gap by proposing , a neuro-symbolic framework that employs a bidirectional Formal-of-Thought architecture: LLMs serve as specification compilers that top-down decompose high-level human intent into atomic, verifiable constraints, then bottom-up prove compliance using Dafny specifications and Z3 Satisfiability modulo theories solving, which produces mathematical guarantees rather than probabilistic scores. We validate across three benchmarks spanning behavioral safety, multi-domain constraint adherence, and agentic upward deception detection. Experiments on 7 agent models demonstrate that achieves an average improvement of 16.6% over LLM-as-a-Judge baselines, enables weak-to-strong generalization where a 7B judge achieves over 90% accuracy detecting deception from 72B agents, and provides near-linear safety improvement through iterative refinement.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Both FormalJudge and ILION address single-agent oversight rather than multi-agent delegation chains.
“Both address single-agent oversight rather than multi-agent delegation chains.”
From SentinelAgent: Intent-Verified Delegation Chains for Securing Federal Multi-Agent AI Systems (2026) · cites this paper as [23]
FormalJudge applies Z3 SMT solving for neuro-symbolic agent oversight, achieving 16.6% improvement over LLM-as-a-Judge baselines.
“FormalJudge [23] applies Z3 SMT solving for neuro-symbolic agent oversight, achieving 16.6% improvement over LLM-as-a-Judge baselines.”
From SentinelAgent: Intent-Verified Delegation Chains for Securing Federal Multi-Agent AI Systems (2026) · cites this paper as [23]
Cites
Agent-SafetyBench: Evaluating the Safety of LLM Agents
Zhang, Z., Cui, S., Lu, Y., Zhou, J., Yang, J., Wang, H., & Huang, M. (2024) · arXiv · doi:10.48550/arxiv.2412.14470 · Cited by 6 · cited 2× · see citing works
“Agent-SafetyBench (Zhang et al., 2024b) shows that no tested agent scores above 60% on behavioral safety tasks, with agents frequently ignoring constraints or exhibiting excessive trust in tool results.”
Self-citation
Flagged first, then by citations
Cited by
Sorted by citations
- Authors
- Zhou, J., Sheng, Y., Lou, H., Yang, Y., & Fu, J.
- Venue
- arXiv
- Publisher
- arXiv
- Published
- 2026
- ISSN
- 2331-8422 (ISSN-L)
- arXiv
- 2602.11136
- OpenAlex
- W7128692181
- Cited by
- 0
- References
- 1
- Type
- posted content
- Language
- en
- Open access
- green
- arxiv.org
- Locations
- arXiv (Cornell University) (submittedVersion)
- arXiv (Cornell University) (cc-by)
- Topics
- Physical Sciences › Computer Science › Computational Theory and Mathematics › Formal Methods in Verification
- Physical Sciences › Engineering › Safety, Risk, Reliability and Quality › Safety Systems Engineering in Autonomy
- Social Sciences › Safety Research › Ethics and Social Impacts of AI
- Keywords
- LLM-as-a-judge, formal verification, neuro-symbolic reasoning, Dafny, SMT solvers
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review