From Refusal to Recovery
A Control-Theoretic Approach to Generative AI Guardrails
Traditional AI guardrails detect and block unsafe actions, but simply refusing to act isn't always safe. We introduce Recovery Guardrail (ReGuard), a control-theoretic guardrail that anticipates the downstream consequences of an AI agent's actions and proactively intervenes with safe alternatives to prevent harmful outcomes.
We introduce a control-theoretic framework for predictive generative AI guardrails that treats safety as a sequential decision-making problem. By reasoning about the downstream consequences of an agent's actions, our framework extends traditional safety filters to language-based AI agents, enabling guardrails that both detect unsafe actions and prescribe safe alternatives.
We develop a scalable safety-centric reinforcement learning approach for jointly learning a predictive safety monitor and recovery policy in the agent's latent representation of the world. The resulting guardrail is model-agnostic and can safeguard different underlying LLM agents without requiring access to their weights or training data.
We demonstrate the effectiveness of predictive guardrails across three simulated agentic environments: autonomous driving, e-commerce, and AI-assisted driving. Our experiments show that ReGuard improves safety and task performance compared to conventional guardrails that rely on one-step safety classification or refusal.
Contributions
Results
Agentic Driving
Experiment: An LLM controls a vehicle by selecting steering actions based on textual descriptions of its surroundings. The agent must navigate toward a goal while avoiding collisions with obstacles and road boundaries.
Tests whether ReGuard can learn safety reasoning from textual observations when the AI directly controls a physical system.
Agentic Commerce
Experiment: An LLM manages a virtual shopping cart, removing items to satisfy a user's budget constraint before checkout. The agent must reason about the consequences of its decisions over multiple steps.
Tests whether the approach generalizes to environments with long-horizon constraints.
AI-Assisted Driving
Experiment: An LLM provides natural-language driving advice to a simulated human driver. Unlike the other environments, the AI does not directly control the vehicle, but must influence the driver's behavior to maintain safety.
Tests whether ReGuard can influence safety when the AI only indirectly affects the world through a human.
Across these environments, we evaluate whether ReGuard can learn to identify unsafe actions and generate recovery strategies, improve safety and task performance when shielding different LLM agents, and adapt its recovery behavior when AI actions indirectly influence the environment.
Finding 1: ReGaurd learns to detect and recover from unsafe actions
ReGuard achieves higher task success and fewer failures than non-privileged baselines in agentic driving, while matching GPT-4o's performance in agentic commerce.
Finding 2: A single guardrail can safeguard different LLM agents.
The same ReGuard model improves task success across three different LLM agents without requiring retraining, demonstrating its model-agnostic capabilities.
Finding 3: ReGuard adapts its recovery behavior to different users.
In AI-assisted driving, ReGuard generates context-dependent safety advice, improving task success even when its actions influence the environment indirectly through a simulated human driver.
Citation
@inproceedings{pandya2026refusal,
title = {{From Refusal to Recovery: A Control-Theoretic Approach to Generative AI Guardrails}},
author = {Pandya, Ravi and Bland, Madison and Nguyen, Duy P. and Liu, Changliu and Fisac, Jaime Fern{\'a}ndez and Bajcsy, Andrea},
booktitle = {Proceedings of the International Association for Safe and Ethical AI (IASEAI) Conference},
volume = {2},
number = {1},
pages = {513--526},
year = {2026},
doi = {10.1609/iaseai.v2i1.43048},
url = {https://doi.org/10.1609/iaseai.v2i1.43048}
}
Authors
