Certified Speculative Execution for Untrusted AI Agents Chenyu Zhou1*† , Qiliang Jiang2* , Shuning Wu3 , Xu Zhou3† 1
School of Engineering, Institute of Science Tokyo, Japan College of Control Science and Engineering, Zhejiang University, China 3 Department of Electrical and Computer Engineering, National University of Singapore, Singapore [email protected], [email protected], [email protected], zhouxu [email protected] * Equal contribution. † Corresponding authors.
arXiv:2606.31023v1 [cs.CR] 30 Jun 2026
2
Abstract Hard-constrained sequential decision systems have no certified way to spend the test-time compute of modern AI: executing the multi-step drafts of a learned policy or a frozen LLM forfeits the feasibility guarantee a trusted solver provides, while invoking the solver at every step forfeits the speed the AI offers. Certificate-Gated Prefix Acceptance (CGPA) closes this gap with a certified speculative-execution contract for untrusted AI agents: a trusted verifier rejects constraint-violating transitions exactly, a conformally calibrated value boundary gates the longest low-cost prefix within a per-segment regret budget, and the rest defers to the solver — so safety, regret, and speed decouple by construction. The contract drives every untrusted proposal source — adversarial drafters and six heterogeneous frozen LLMs (including a 12B model that violates constraints in 98% of direct rollouts) — to zero applied violations; a certificate-aware learned boundary, conformally calibrated, drives mean regret three orders of magnitude below unguarded acceptance, to within sampling noise of the stepwise oracle (95% CI spanning zero), and under calendar shift a learned proposal source overtakes it on 15 of 18 held-out days. On a deploymentscale unit-commitment instance it turns a frozen 8B LLM into a 2.96× per-episode wall-clock speedup at 2.1% regret, outpacing the domain heuristic (1.79×) and a safe recedinghorizon baseline (1.07×): the more capable the untrusted source, the faster the certified system, at guarantees that never change.
Keywords: certified prefix acceptance, untrusted AI agents, speculative execution, conformal calibration, scalable oversight
1
Introduction
Modern AI can draft sequences of decisions at low computational cost — a learned policy rolling out actions, a frozen large language model proposing a plan. Acting on those drafts directly in hard-constrained settings, however, forfeits safety: a learned or LLM policy carries no feasibility guarantee — a frozen 12B-parameter LLM proposes constraint-violating battery actions in 98% of episodes, and an end-to-end reinforcement learner replacing the trusted module pays about 7× its regret. The reliable alternative delegates every step to an expensive trusted solver — an LP/MILP optimizer, a model-predictive planner, a shield — that certifies feasibility and supplies a safe repair on demand.
But per-step delegation pins the most expensive component to the critical path even when short-horizon action sequences are largely predictable. Safely deploying untrusted AI therefore needs a certified layer that uses AI drafts without trusting them — one in which a thin trusted core owns every guarantee. The missing layer has a precise shape: intelligence and guarantees must come from different owners. Drafts must come from a source that is free to be arbitrarily capable — and arbitrarily wrong — while every guarantee is owned by a thin trusted core that never depends on the source. This separation has one mature precedent: speculative decoding, where a cheap drafter proposes tokens and the target model verifies a prefix and accepts it in one pass (Leviathan, Kalman, and Matias 2023; Chen et al. 2023). But a token draft is checked against a probability distribution; a control draft must be checked against hard feasibility and against decision quality, and these two checks cannot be the same object, because a constraint-safe action prefix can still be economically poor. What verification means for executed decisions — and what acceptance is worth — has to be rebuilt from the ground up. We make this precise as Certificate-Gated Prefix Acceptance (CGPA), a single certified speculative-execution contract for untrusted AI agents. An untrusted proposal source — a rule, a learned policy, or a frozen LLM — proposes a length-K action prefix; a trusted verifier rejects any unsafe transition, a trusted value boundary truncates prefixes that are safe but costly, and CGPA commits the longest certified prefix and defers the rest to the oracle. This contract’s three parts are structurally necessary: remove any one and it collapses onto a known weaker baseline (Section 2). Any layer that turns untrusted test-time compute into safe solver amortization must own feasibility exactly, or the proposal source inherits a path to violations (Proposition 2); must budget excess cost per accepted segment, or acceptance has no auditable price (Certificate 2); and must calibrate the one quantity it estimates, or that budget is an assumption rather than a measurement (Proposition 4). The contract is one object — a certified prefix-acceptance operator — whose regret certificate charges the valueboundary error ϵ once per accepted segment, not per step (Section 2). This single accounting identity organizes the paper: safety never queries ϵ (Section 3.2); learning ϵ down
shrinks regret three orders of magnitude (Section 3.3); a heterogeneous source moves only which prefixes are accepted (Section 3.4); and each accepted segment skips its oracle solves, yielding a 2.96× wall-clock speedup on deploymentscale unit commitment (Section 3.5).
2 2.1
Certified Speculative Execution
Problem Setup
We consider finite-horizon decision control with state st , action at , transition st+1 = f (st , at ), non-negative stage cost c(st , at ) ≥ 0, and hard feasibility constraints. The remaining horizon is encoded in st , so the oracle cost-to-go V (st ) is written without a time subscript. A trusted oracle policy πF returns feasible actions; the reference baseline invokes πF at every step and applies only the first action of each receding-horizon oracle solve, defining JF (s0 ) =
T −1 X
c(st , πF (st )).
(1)
t=0
For a CGPAP rollout with applied actions aCGPA , t JCGPA (s0 ) = t c(st , aCGPA ), and we report the fallbackt relative normalized regret used in every table, JCGPA (s0 ) − JF (s0 ) Rrel = . max(|JF (s0 )|, 10−12 )
(2)
CGPA preserves the oracle’s safety within an auditable regret budget while moving it off the per-step critical path.
2.2
The Accept/Defer Contract
Definition 1 (Certified prefix-acceptance operator). A CGPA controller is a tuple (D, Verify, V̂ , πF ) — an untrusted proposal source, a trusted per-transition feasibility check, a lightweight value boundary, and a trusted oracle policy — read as a single certified prefix-acceptance operator C over the trusted core (Verify, V̂ , πF ), parameterized by the untrusted source D (Figure 1): at each state it commits the longest verified-safe proposed prefix admitted by the value guard (3), and otherwise defers to a single verified oracle repair. Only Verify, V̂ , πF are trusted; the proposal source D is untrusted and may be adversarial, and every guarantee below depends only on Verify, V̂ , πF , never on D. C maintains two invariants at every executed step: (I1) viability, every executed transition lies in the verifieradmissible set; and (I2) value descent, every accepted segment obeys the local descent condition (4) on V̂ . The proposal source occupies the untrusted slot and enters neither invariant. At state st , the proposal source proposes K actions u0:K−1 = D(st , K). A trusted verifier simulates the prefix and stops at the first unsafe transition. Among the verifiedsafe prefix lengths, CGPA selects the longest prefix satisfying g(st , u0:k−1 ) + V̂ (st+k ) ≤ V̂ (st ) + τ |V̂ (st )|,
(3)
where g(st , u0:k−1 ) is the verified prefix cost and τ is the value tolerance (the absolute value enables scaling with the
boundary magnitude). If k > 0 the controller executes the accepted prefix; if k = 0 it defers, applying one verified oracle repair. Equation (3) is the boundary-estimated form of a persegment regret budget: it asks that the realized prefix cost not exceed the drop in cost-to-go V̂ (st ) − V̂ (st+k ) by more than a fraction τ of the local value scale — exactly the condition that telescopes into a bounded episode-level certificate (Section 2.4). For non-negative prefix cost it is, after rearrangement, a local value-descent condition V̂ (st+k )−V̂ (st ) ≤ − g(st , u0:k−1 )+σt ,
σt := τ |V̂ (st )|, (4) read in the cost-to-go convention V̂ ≥ 0 (so −g ≤ 0, σt ≥ 0). The value boundary may be precomputed, learned, or forecast-based, provided its online query cost is small relative to the oracle solve. The guarantees rest on three assumptions separating trusted from untrusted components. Assumption 1 (Trusted oracle). At every reachable state s, πF returns a feasible action that the verifier admits. A safe repair is always available. Assumption 2 (Bounded boundary error). The value boundary satisfies |V̂ (s) − V (s)| ≤ ϵ at the endpoint states of accepted segments. This is a reachable-set bound we audit empirically over the accepted-segment endpoints reached under CGPA (Section 2.5); the exact-boundary results take ϵ = 0. Assumption 3 (Arbitrary proposal source). The proposal source D is unconstrained and may be rule-based, forecastbased, learned, or LLM-based. CGPA makes no safety or optimality assumption on D; every guarantee derives from Verify, V̂ , and πF .
2.3
Safety Holds for Any Proposal Source
CGPA never applies a proposed transition the trusted verifier has not accepted. When the verifier rejects at length zero, the oracle supplies a repair, which is itself verified before execution. Proposition 1 (Applied safety). Under Assumption 1, every transition applied by CGPA is feasible, for any proposal source (Assumption 3). Proof. A proposed action is applied only if the verifier admits it; on rejection at length zero, the controller applies an oracle repair, which Assumption 1 guarantees exists and is verified first. No unverified transition is ever applied, regardless of D. The next proposition shows the decoupling is necessary, not stylistic: the feasibility gate cannot be folded into the learned value boundary. Proposition 2 (Exact feasibility gating). If feasibility is decided by an exact, oracle-owned gate, then applied safety (Proposition 1) holds for every proposal source and every boundary error ϵ, because that argument never queries V̂ .
trusted core K-step prefix
source D
accept (k ≥ 1)
value guard V,̂ τ
exact verifier
commit k steps
defer
commit 1 step
oracle πF boundary error (2+τmax )ε charged once per accepted segment ||; savings accrue at every accepted step
Figure 1: The certified prefix-acceptance operator (Definition 1). An untrusted source drafts a K-step prefix; a thin trusted core (exact verifier, certificate-aware value boundary, fallback oracle) commits the longest certified prefix and defers the rest. Safety never queries the source; boundary error is charged once per accepted segment while savings accrue at every accepted step. If feasibility is instead decided by a non-conservative ϵaccurate surrogate, then applied safety need not be independent of the boundary error: take a state with feasible u1 and infeasible u2 thresholded at level θ; if the true score of u2 is θ −δ with 0 < δ < ϵ, the surrogate may admit u2 while an exact test rejects it for every ϵ. Hence the learned value boundary cannot double as the feasibility gate.
2.4
Regret Certificate
Let V (s) = V πF (s) be the finite-horizon oracle cost-to-go, terminal value zero. Definition 2 (Accepted and repair segments). A CGPA rollout partitions into consecutive segments whose end state is the next start state. An accepted segment i starts at si , executes ki ≥ 1 verified actions admitted by (3), incurs cost gi , ends at si+1 , and uses tolerance τi (all reported experiments fix τi = τ ; the bound is stated for general τi ). A repair segment j is a single oracle action applied on deferral, with cost fj from sj to sj+1 . The accepted and repair sets are A and R. For an exact value V , (3) specializes to admitting a segment when gi + V (si+1 ) ≤ V (si ) + τi |V (si )|. Lemma 1 (Per-segment value decomposition). Each accepted segment obeys gi ≤ V (si ) − V (si+1 ) + τi |V (si )|; each repair segment obeys fj ≤ V (sj ) − V (sj+1 ) + ρj , where ρj ≥ 0 is the realized repair slack defined by fj + V (sj+1 ) ≤ V (sj ) + ρj . Certificate 1 (Exact-boundary fallback-relative bound). Under Assumption 1, if every accepted segment satisfies the exact guard, the episode excess cost satisfies X X JCGPA (s0 ) − JF (s0 ) ≤ τi |V (si )| + ρj . (5) i∈A
j∈R
Summing Lemma 1 over all segments telescopes to V (s0 ); dividing by |JF | recovers the normalized regret (2)
(full proof in the appendix). The deployed controller runs (3) with V̂ , not V . The next result propagates the boundary error through the same argument. Certificate 2 (Approximate-boundary fallback-relative bound). Under Assumptions 1 and 2 with τmax = maxi τi , if every accepted segment satisfies the deployed rule (3), then X JCGPA (s0 ) − JF (s0 ) ≤ τi |V (si )| i∈A
+ (2 + τmax )ϵ|A| +
X
(6) ρj .
j∈R
The boundary error enters once per accepted segment and adds (2+τmax )ϵ|A| (full proof in the supplementary material). Proposition 3 (Boundary error is charged per accepted segment). The substitution proving Certificate 2 introduces boundary error only at accepted-segment endpoints — interior states telescope and cancel — so ϵ enters once per accepted segment, giving the O(ϵ|A|) term. The error cost thus scales with the number of trusted-boundary crossings |A|, not the interior steps a segment spans: each charge stands in for the whole run of stepwise oracle solves the segment covers, amortized over strictly more eliminated solves whenever a segment spans multiple steps. A single operator (Definition 1) forces these components together once safety, bounded regret, and a learnable boundary are required; remove any one and CGPA collapses onto a known weaker baseline (Proposition 2). Section 3 tests these structural consequences one by one.
2.5
Certificate-Aware Learning of the Value Boundary
We instantiate V̂ with a learned five-quantile MLP that outputs levels {V̂0.1 , V̂0.3 , V̂0.5 , V̂0.7 , V̂0.9 } — a calibrated cen-
tral band with tail levels for the error spread. The median drives the value guard (3) and the spread V̂0.9 − V̂0.1 supplies a state-dependent estimate of the ϵ in Certificate 2. The training objective is certificate-driven: the only boundarydependent term of Certificate 2 is (2 + τmax )ϵ|A|, and calibration (Proposition 4) makes ϵ(s) a fixed multiple of the quantile spread V̂0.9 (s) − V̂0.1 (s), so we add a mean-spread penalty on top of the coverage loss: (7) L = Lpinball + λ · Es V̂0.9 (s) − V̂0.1 (s) , | {z } {z } | coverage
mean ϵ estimate
the pinball term (Koenker and Bassett 1978) preserving quantile coverage and the spread penalty shrinking Certificate 2’s ϵ term. The penalty is essential: removing it (λ=0) inflates EMS regret by 1.46× at matched call reduction (we use λ = 0.05; full sweep in the appendix). Because V̂ enters only the value guard, a poor boundary inflates regret but cannot induce a violation (Propositions 1–2); learning is thus free to optimize the frontier with no safety risk. To instantiate the ϵ of Assumption 2 as a measured quantity, we apply split-conformal calibration (Vovk, Gammerman, and Shafer 2005; Lei et al. 2018; Angelopoulos and Bates 2023) to the quantile-spread estimate on heldout oracle rollouts, with non-conformity score ri = |yi − V̂0.5 (si )|/(V̂0.9 (si ) − V̂0.1 (si )), where yi = V (si ) is the realized oracle cost-to-go at calibration state si . This yields a state-dependent band [V̂0.5 (s) ± α (V̂0.9 (s) − V̂0.1 (s))], calibrated to 80% and 90% targets and attaining 0.816–0.853 and 0.900–0.917 empirical coverage across domains (appendix). The calibrated multiplier α then defines a statedependent error band ϵ(s) = α (V̂0.9 (s) − V̂0.1 (s)) that instantiates the certificate’s ϵ — so the conformal band and the certificate’s error term are one quantity, and the spread penalty of Eq. (7) shrinks precisely this band. Deployed as a gate, the band enters the value guard pessimistically at both endpoints: a prefix is admitted only if g(st , u0:k−1 ) + V̂0.5 (st+k ) + ϵ(st+k ) ≤ V̂0.5 (st ) − ϵ(st ) + τ |V̂0.5 (st )|,
(8)
the band-gate operating points of Sections 3.3 and 3.5, yielding a forward, high-probability guarantee. Proposition 4 (Conformal forward regret bound). Let the calibration set be exchangeable with the deployed boundary states, and choose the band multiplier α at miscoverage level δ/(T +1), so that Pr[ |V̂0.5 (s) − V (s)| ≤ ϵ(s) ] ≥ 1 − δ/(T +1) at each reachable boundary state. Write ϵ̄i = max{ϵ(si ), ϵ(si+1 )} for the endpoint band of accepted segment i. Then, under Assumption 1, with probability at least 1 − δ, X X JCGPA (s0 ) − JF (s0 ) ≤ τi |V (si )| + ρj i∈A
+ (2 + τmax )
j∈R
X
(9)
ϵ̄i .
i∈A
A union bound at level δ/(T +1) over the ≤ T +1 boundary states makes |V̂0.5 (s) − V (s)| ≤ ϵ(s) hold jointly with
probability ≥ 1 − δ; the Certificate 2 substitution then applies with the endpoint bands (full proof in the appendix). The regret certificate is a realized-reference audit needing no exchangeability assumption; the conformal band calibrates ϵ before deployment.
3 3.1
Experiments
Setup
We evaluate CGPA across three sequential-decision settings spanning a spectrum of oracle cost: a fast LP-backed battery energy management (EMS) problem on UCI household loads (Hébrail and Bérard 2012) (the primary mechanism testbed), the real-data CityLearn 2022 multi-building HVAC benchmark (Vázquez-Canteli et al. 2019) (a realcalendar distribution shift, appendix), and a MILP-backed deployment-scale unit commitment (UC) instance (Brown, Hörsch, and Schlachtberger 2018) (an expensive oracle). The contract is held fixed; the untrusted proposal slot is the variable we sweep, to test the invariance of the certificate’s guarantees. Across the study the proposal slot is filled by a deterministic forecast, a learned MLP policy, an end-to-end reinforcement learner, adversarial drafters, and six frozen LLMs (Qwen3-1.7B/4B/8B; Gemma-4-E2B/E4B/12B), exercising the arbitrariness of Assumption 3. Unless stated otherwise EMS episodes use a 24-step horizon and prefix length K=4, and the value tolerance τ — the per-segment regret-budget parameter of Certificate 2 — is held fixed within a setting; its regret–call-reduction response is smooth and monotone (appendix), so it directly selects the operating point. Throughout, violations count applied constraint breaches, regret is Rrel of Eq. (2) (p95: its 95th percentile), and call reduction is the relative drop in trusted-oracle invocations versus stepwise fallback. The learned boundary is the five-quantile certificate-aware value boundary of Section 2.5, run via per-state online CPU inference inside the timed loop; confidence intervals are nonparametric episode-level bootstrap. The experiments share one design, controlled frontier slicing: each table fixes all but one part of the accept/defer system (value boundary, acceptance mechanism, proposal source, or fallback oracle), so it slices a different term of Certificate 2.
3.2
The Contract Neutralizes Arbitrary Proposal Sources
Safety is the |A| → 0 limit of the certificate: it never queries ϵ (Proposition 2), so the contract drives any untrusted source to zero applied violations — a guarantee no direct AI replacement provides. We fill the EMS proposal slot with adversarial hand-built drafters, an end-to-end learner, and frozen LLMs, comparing direct execution against the same source wrapped by CGPA (appendix). The pattern is uniform. Adversarial drafters and the two larger Gemma models produce parseable but constraintviolating actions in 98–100% of episodes when executed directly; the contract admits none of those unsafe transitions and defers, reaching zero applied violations while collapsing regret by orders of magnitude — the empirical counterpart of Proposition 1, where safety is owned by the verifier/oracle
pair regardless of how proposals are generated. The regret bound also holds: a low-quality source has few prefixes accepted, so |A| — and the certificate’s (2+τmax )ϵ|A| term — shrinks toward zero and CGPA reverts to stepwise fallback at unchanged guarantees. The end-to-end learner makes the converse point: replacing the oracle with a trained policy removes oracle calls but pays 0.503 mean regret — about 7× the same learner used as a proposal source inside the contract (0.074). Direct AI replacement is not a substitute for the contract; it forfeits either safety or regret.
Table 1: Out-of-distribution learned proposal generalization on EMS (18 held-out calendar-shifted days, five seeds, 90 paired day–seed runs); deltas are paired with 95% bootstrap CIs. Negative regret means the accepted prefixes outperform the oracle’s stepwise plan; “days < oracle” counts held-out days on which the contract beats the stepwise oracle’s own cost. Zero violations throughout; τ =0.12.
Safety survives intentional misuse. A white-box adaptive adversary — one that re-plans every step with full knowledge of the verifier, value boundary, dynamics, and cost to maximize constraint violations — drives raw execution to a breach in every episode on both EMS and unit commitment, yet CGPA admits none: it defers at every step, so the attack is absorbed by lost amortization (call reduction falls to zero), never by an applied violation (appendix). The feasibility gate never queries the value boundary the adversary attacks, so safety is owned by the verifier, not the proposal source, however adversarial. The same holds against a learned attacker: a white-box MLP that optimizes feasible high-cost prefixes against the contract drives feasible-cost regret above the forecast drafter, yet the frozen contract still holds it to zero applied violations with regret inside the certificate (appendix).
∆ (L−F) 95% CI
3.3
Distribution shift: the stepwise oracle is overtaken. The learned boundary generalizes beyond its training distribution. We swap in a learned MLP drafter as an out-ofdistribution (OOD) proposal source under calendar shift: it is trained on one season and deployed on 18 held-out OOD days, against the forecast drafter on the same days (five training seeds), with the certified contract unchanged. Table 1 reports the result. The learned proposal source raises mean call reduction by +18.8pp (day-clustered 95% CI [+14.9, +22.1], bootstrapped over held-out days) while lowering mean regret by 0.055, at zero violations across all 90 day–seed runs. The sign is decisive: the accepted prefixes beat the stepwise oracle’s own cost on 15 of 18 days (72 of 90 day–seed runs; supplementary material), while in distribution they win exactly 50% — the expected rate against a matched reference. Under shift the contract overtakes it by committing multi-step prefixes its myopic per-step replanning cannot.
Learned Value Boundaries Lift the Risk–Cost Frontier
Quality has one structural source: the certificate is onesided. It prices the boundary error of accepted coverage at (2 + τmax )ϵ per segment, bounds only the excess over the fallback, and never references oracle optimality (Assumption 1). With safety owned by the verifier, ϵ is a free optimization target: learning the boundary down shrinks the price of coverage, and a capable source pushes accepted quality past the stepwise reference. We trace the EMS risk– cost frontier under a fixed forecast proposal source (n=100), changing only the value boundary (appendix). Plain prefix acceptance — a multi-step safe filter with no value guard — accepts everything and pays 0.4450 mean regret, identically at every draft length K (appendix); end-to-end RL replacement pays 0.503 (appendix). The certificate-aware learned guard cuts this to 0.0063 at 60.4% call reduction, and its conformally calibrated band gate drives mean regret to 0.0002 — three orders of magnitude below unguarded acceptance, within sampling noise of the stepwise oracle (95% CI [−0.005, 0.006], spanning zero) — the lowest mean regret and best p95 across the EMS value-boundary sweep at τ =0.04. It also outperforms non-learned boundaries and reproduces on the real-data CityLearn benchmark (0.0104 mean regret, zero violations; appendix). This is the certificate’s (2 + τmax )ϵ|A| term made small, and the realizedreference audit confirms it: the envelope covers 93–100% of accepted segments, at zero applied violations throughout. Certified acceptance versus full-plan approximation. The next slice fixes boundary and source and varies the ac-
Proposal source
Call red.
Mean reg.
Days < oracle
Viol.
Forecast (OOD) Learned (OOD)
57.4% 76.2%
−0.082 −0.137
12/18 15/18
0 0
+18.8pp [+14.9, +22.1]
−0.055 [−0.098, −0.012]
— —
0 —
ceptance mechanism. We route an imitation network trained on oracle sequences — the safety-augmented neural MPC baseline of Hose et al. (2023) — through two controllers. Full-plan acceptance commits the whole sequence as one accept/reject decision and repairs to a safe candidate on infeasibility, paying 0.0227 mean regret; CGPA’s certified prefix acceptance, on the same network, truncates at the value boundary and cuts regret to 0.0081 (2.8×) at 86.6% call reduction, or holds a 98.0% high-amortization point at a fraction of the verifier load (appendix). This gap is the persegment (2 + τmax )ϵ pricing of Certificate 2 at fixed boundary and source.
3.4
One Contract, Six Heterogeneous LLM Proposal Sources
Frozen LLMs are the most heterogeneous proposal sources available — varying in scale, family, and decoding behavior with no domain-specific training. Because the certificate charges per accepted segment, such a source moves only which prefixes are accepted, not the contract’s guarantees. Table 2 fills the EMS proposal slot with six of them (sameseed n=50, deterministic decoding, τ =0.08). Two regimes appear, and the contract absorbs both. The Qwen models and Gemma-4-E2B are feasible but costly un-
Table 2: Six heterogeneous frozen LLM proposal sources on battery EMS (same-seed n=50, τ =0.08, deterministic decoding). The same certified contract absorbs every model at zero applied violations with one shared prompt template. Bracketed values are 95% bootstrap CIs over the 50 episodes; the ratio is omitted where direct execution is violation-dominated. Model Qwen3-1.7B Qwen3-4B Qwen3-8B Gemma-4-E2B Gemma-4-E4B Gemma-4-12B
Direct reg. [CI]
CGPA reg. [CI]
Ratio
CGPA call red. [CI]
Direct viol.
CGPA viol.
0.421 [0.408, 0.435] 0.353 [0.341, 0.366] 0.349 [0.337, 0.362] 0.362 [0.344, 0.383] 200.0 [195.9, 204.4] 20.38 [19.09, 21.46]
0.068 [0.053, 0.083] 0.061 [0.048, 0.074] 0.032 [0.021, 0.045] 0.094 [0.082, 0.107] 0.020 [0.014, 0.027] 0.032 [0.022, 0.041]
6.23× 5.80× 10.94× 3.84× — —
68.1% [66.3, 69.8] 69.8% [67.8, 71.8] 65.5% [63.5, 67.5] 61.5% [58.8, 64.3] 53.4% [51.2, 55.7] 66.7% [65.2, 68.3]
0 0 0 0 1.00 0.98
0 0 0 0 0 0
end-to-end speedup (×)
3.0
Table 3: Deployment-scale unit commitment (48-step horizon, n=50). MPC rows report each window’s strongest trigger configuration; call reduction applies to accept/defer controllers; speedup CIs are episode-level bootstrap. The hold drafter uses τ =0.04, the Qwen drafter τ =0.15.
2.5
2.0
Controller
1.5
CGPA (learned guard) CGPA (conformal band)
event-triggered move-blocking
1.0 0
50
100
200
CGPA — Qwen3-8B CGPA — hold Event-trig. MPC (24) Event-trig. MPC (48)
Speedup [CI]
Call red.
Reg.
Viol.
2.96 × [2.01, 4.31] 1.79 × [1.77, 1.82] 1.07 × [0.997, 1.15] 0.84 × [0.79, 0.88]
64.3% 63.6% — —
0.021 0.015 0.012 0.012
0 0 0 0
added oracle cost per call (ms)
Figure 2: Amortization is structural: counterfactually scaling the per-call oracle cost on EMS lifts CGPA’s end-to-end speedup from 1.63× to 2.67× (conformal band gate: 1.18× to 1.65×), while event-triggered and move-blocking controllers are pinned near 1.0× once the oracle carries any real cost; zero violations throughout. Shaded bands: 95% bootstrap CIs (n=100).
der direct execution; the contract sharpens them, cutting regret 3.8–10.9× at 62–70% call reduction. Gemma-4-E4B and Gemma-4-12B violate constraints in nearly every direct rollout; the contract rejects those transitions and defers to zero violations at low regret. One contract thus delivers the same guarantee across a 1.7B and a 12B model alike: the proposal source determines which prefixes are accepted — certified throughput tracks proposal quality, not parameter count — never whether the system is safe. A controlled quality sweep makes this explicit: as a controlled knob moves the source from random toward oracle, EMS call reduction rises monotonically (24% → 90%, Spearman 1.0) at zero violations throughout, and the same quality–throughput ordering holds on UC at matched tolerance (appendix). The same contract that absorbs all six frozen LLMs at zero violations is next evaluated on an oracle expensive enough that each skipped call yields measurable wall-clock savings.
3.5
Deployment-Scale Wall-Clock Amortization
Wall-clock savings scale with skipped oracle solves: scaling per-call oracle cost on EMS lifts CGPA’s speedup from 1.63× to 2.67×, while event-triggered and move-blocking controllers stay near 1.0× (Figure 2). On a deployment-
scale 48-step UC MILP, Table 3 reports a hold-commitment drafter and a frozen Qwen3-8B proposing commitment changes against an event-triggered receding-horizon controller that re-solves on deviation (n=50), both CGPA rows using the same learned boundary of Section 2.5. The frozen LLM, with no UC-specific training, achieves the highest speedup: its commitment changes admit prefixes the deterministic heuristic does not propose, and the contract converts them into a 2.96× per-episode mean speedup (2.02× in aggregate wall-clock, every one of the 50 episodes faster than fallback) at 2.1% regret — aggregate amortization the hold drafter (1.79×) does not reach — while the contract, not the proposal source, owns the unchanged zeroviolation guarantee. Trigger-scheduled replanning achieves at most 1.07×; warm-starting reaches 0.91×. The MILP fallback dominates online time (97.96–99.98%); a matchedτ rerun and a second instance (2.09×) confirm the ordering (appendix).
4
Related Work
AI control and scalable oversight. A parallel safety agenda wraps a capable but untrusted policy in a trusted protocol and measures safety under adversarial control evaluation (Greenblatt et al. 2024), as do weak-to-strong generalization (Burns et al. 2023) and debate (Irving, Christiano, and Amodei 2018), which separate a strong untrusted generator from a weaker trusted overseer under the asymmetry that verification is cheaper than generation. CGPA is the certified, sequential-control instance of this separation — intelligence and guarantees come from different owners — but its trusted core gives a deterministic feasibility guarantee and an auditable per-segment regret price rather than a mon-
itored probability of subversion, accepting the source by exact verification and a calibrated value certificate rather than a learned monitor. Speculative decoding. CGPA shares the draft–verify– accept skeleton of speculative decoding (Leviathan, Kalman, and Matias 2023; Chen et al. 2023; Cai et al. 2024; Li et al. 2024) but changes the verified object from a token distribution to hard transition safety plus a certified fallback-relative cost, and the proposal source from a draft model to an arbitrary AI policy or LLM. Recent production variants add a calibrated confidence head and a load-adaptive verification schedule (DeepSeek-AI 2026), yet acceptance stays lossless — calibrated to preserve the target token distribution — whereas CGPA calibrates an analogous value boundary to certify decision cost under a hard-feasibility verifier. Speculative execution has also cut agentic latency by predicting actions and committing on match (Ye et al. 2026); CGPA instead accepts deviations from the oracle within a certified regret budget, under hard feasibility rather than equivalence checking. Selective prediction and learning to defer. The accept/defer boundary is a learning-to-defer mechanism for the control loop — acceptance is coverage, deferral is abstention to a trusted expert, and the certificate bounds the cost of coverage (Geifman and El-Yaniv 2017; Mozannar and Sontag 2020; Madras, Pitassi, and Zemel 2018). Unlike sequencelevel deferral for token and span abstention (Rayan and Tewari 2025), CGPA defers executed control prefixes under a hard-feasibility verifier and a fallback-relative regret certificate. Conformal risk control. The calibrated band places CGPA within conformal risk control (Vovk, Gammerman, and Shafer 2005; Angelopoulos and Bates 2023; Angelopoulos et al. 2024; Prinster et al. 2026): the controlled risk is the per-segment excess cost the certificate charges, making ϵ measured rather than assumed. Safe control and safe AI execution. Shielding and predictive safety filters (Alshiekh et al. 2018; Wabersich and Zeilinger 2021; Leeman et al. 2023; Ames et al. 2017) correct a single action per online solve; intervention controllers pair a learned proposer with a trusted backup (Wagener, Boots, and Cheng 2021; Fulton and Platzer 2018); safetyaugmented neural MPC falls back on infeasibility (Hose et al. 2023); other lines accelerate or repair the trusted controller rather than skip it (Yu, Zikelic, and Henzinger 2025; Tabuada 2007; Gondhalekar and Imura 2010; Diehl et al. 2002; Amos et al. 2018; Bertsekas, Tsitsiklis, and Wu 1997). CGPA admits an arbitrary source, separates exact feasibility from a learned value boundary, and attaches a calibrated telescoping regret certificate.
5
Conclusion
CGPA is a certified speculative-execution contract: a thin trusted core owns every guarantee while an arbitrarily capable untrusted source is admitted only through it. The same contract drives adversarial drafters and six frozen LLMs
to zero applied violations, holds regret within sampling noise of the stepwise oracle, and on deployment-scale unit commitment turns a frozen LLM into a 2.96× wall-clock speedup — turning heterogeneous untrusted AI agents into a safe, low-regret, oracle-amortizing execution layer whose throughput grows with the capability of the untrusted source, at guarantees that never change.
References Alshiekh, M.; Bloem, R.; Ehlers, R.; Koenighofer, B.; Niekum, S.; and Topcu, U. 2018. Safe Reinforcement Learning via Shielding. Proceedings of the AAAI Conference on Artificial Intelligence, 32(1). Ames, A. D.; Xu, X.; Grizzle, J. W.; and Tabuada, P. 2017. Control Barrier Function Based Quadratic Programs for Safety Critical Systems. IEEE Transactions on Automatic Control, 62(8): 3861–3876. Amos, B.; Rodriguez, I. D. J.; Sacks, J.; Boots, B.; and Kolter, J. Z. 2018. Differentiable MPC for End-to-end Planning and Control. In Advances in Neural Information Processing Systems, volume 31. Angelopoulos, A. N.; and Bates, S. 2023. A Gentle Introduction to Conformal Prediction and Distribution-Free Uncertainty Quantification. Foundations and Trends in Machine Learning, 16(4): 494–591. Angelopoulos, A. N.; Bates, S.; Fisch, A.; Lei, L.; and Schuster, T. 2024. Conformal Risk Control. In International Conference on Learning Representations (ICLR). Bertsekas, D. P.; Tsitsiklis, J. N.; and Wu, C. 1997. Rollout Algorithms for Combinatorial Optimization. Journal of Heuristics, 3(3): 245–262. Brown, T.; Hörsch, J.; and Schlachtberger, D. 2018. PyPSA: Python for Power System Analysis. Journal of Open Research Software, 6(1): 4. Burns, C.; Izmailov, P.; Kirchner, J. H.; Baker, B.; Gao, L.; Aschenbrenner, L.; Chen, Y.; Ecoffet, A.; Joglekar, M.; Leike, J.; Sutskever, I.; and Wu, J. 2023. Weak-to-Strong Generalization: Eliciting Strong Capabilities With Weak Supervision. arXiv preprint arXiv:2312.09390. Cai, T.; Li, Y.; Geng, Z.; Peng, H.; Lee, J. D.; Chen, D.; and Dao, T. 2024. Medusa: Simple LLM Inference Acceleration Framework with Multiple Decoding Heads. arXiv preprint arXiv:2401.10774. Chen, C.; Borgeaud, S.; Irving, G.; Lespiau, J.-B.; Sifre, L.; and Jumper, J. 2023. Accelerating Large Language Model Decoding with Speculative Sampling. arXiv preprint arXiv:2302.01318. DeepSeek-AI. 2026. DSpark: Confidence-Scheduled Speculative Decoding with Semi-Autoregressive Generation. Diehl, M.; Bock, H. G.; Schlöder, J. P.; Findeisen, R.; Nagy, Z.; and Allgöwer, F. 2002. Real-Time Iteration Scheme for Nonlinear Optimization in Optimal Feedback Control. SIAM Journal on Control and Optimization, 41(4): 1101–1116. Fulton, N.; and Platzer, A. 2018. Safe Reinforcement Learning via Formal Methods: Toward Safe Control Through Proof and Learning. In Proceedings of the AAAI Conference on Artificial Intelligence.
Geifman, Y.; and El-Yaniv, R. 2017. Selective Classification for Deep Neural Networks. In Advances in Neural Information Processing Systems (NeurIPS). Gondhalekar, R.; and Imura, J.-i. 2010. Least-Restrictive Move-Blocking Model Predictive Control. Automatica, 46(7): 1234–1240. Greenblatt, R.; Shlegeris, B.; Sachan, K.; and Roger, F. 2024. AI Control: Improving Safety Despite Intentional Subversion. In International Conference on Machine Learning (ICML). Hébrail, G.; and Bérard, A. 2012. Individual Household Electric Power Consumption Data Set. Hose, H.; Köhler, J.; Zeilinger, M. N.; and Trimpe, S. 2023. Approximate Non-Linear Model Predictive Control with Safety-Augmented Neural Networks. arXiv preprint arXiv:2304.09575. Irving, G.; Christiano, P.; and Amodei, D. 2018. AI Safety via Debate. arXiv preprint arXiv:1805.00899. Koenker, R.; and Bassett, G. 1978. Regression Quantiles. Econometrica, 46(1): 33–50. Leeman, A.; Koehler, J.; Bennani, S.; and Zeilinger, M. 2023. Predictive Safety Filter Using System Level Synthesis. In Matni, N.; Morari, M.; and Pappas, G. J., eds., Proceedings of The 5th Annual Learning for Dynamics and Control Conference, volume 211 of Proceedings of Machine Learning Research, 1180–1192. PMLR. Lei, J.; G’Sell, M.; Rinaldo, A.; Tibshirani, R. J.; and Wasserman, L. 2018. Distribution-Free Predictive Inference for Regression. Journal of the American Statistical Association, 113(523): 1094–1111. Leviathan, Y.; Kalman, M.; and Matias, Y. 2023. Fast Inference from Transformers via Speculative Decoding. In Krause, A.; Brunskill, E.; Cho, K.; Engelhardt, B.; Sabato, S.; and Scarlett, J., eds., Proceedings of the 40th International Conference on Machine Learning, volume 202 of Proceedings of Machine Learning Research, 19274–19286. PMLR. Li, Y.; Wei, F.; Zhang, C.; and Zhang, H. 2024. EAGLE: Speculative Sampling Requires Rethinking Feature Uncertainty. arXiv preprint arXiv:2401.15077. Madras, D.; Pitassi, T.; and Zemel, R. 2018. Predict Responsibly: Improving Fairness and Accuracy by Learning to Defer. In Advances in Neural Information Processing Systems (NeurIPS). Mozannar, H.; and Sontag, D. 2020. Consistent Estimators for Learning to Defer to an Expert. In International Conference on Machine Learning (ICML). Prinster, D.; Fannjiang, C.; Park, J. W.; Cho, K.; Liu, A.; Saria, S.; and Stanton, S. 2026. Conformal Policy Control. arXiv preprint arXiv:2603.02196. Rayan, S.; and Tewari, A. 2025. Learning to Partially Defer for Sequences. arXiv preprint arXiv:2502.01459. Tabuada, P. 2007. Event-Triggered Real-Time Scheduling of Stabilizing Control Tasks. IEEE Transactions on Automatic Control, 52(9): 1680–1685.
Vázquez-Canteli, J. R.; Kämpf, J.; Henze, G.; and Nagy, Z. 2019. CityLearn v1.0: An OpenAI Gym Environment for Demand Response with Deep Reinforcement Learning. In Proceedings of the 6th ACM International Conference on Systems for Energy-Efficient Buildings, Cities, and Transportation (BuildSys), 356–357. Vovk, V.; Gammerman, A.; and Shafer, G. 2005. Algorithmic Learning in a Random World. Springer. Wabersich, K. P.; and Zeilinger, M. N. 2021. A Predictive Safety Filter for Learning-Based Control of Constrained Nonlinear Dynamical Systems. Automatica, 129: 109597. Wagener, N.; Boots, B.; and Cheng, C.-A. 2021. Safe Reinforcement Learning Using Advantage-Based Intervention. In International Conference on Machine Learning (ICML). Ye, N.; Ahuja, A.; Liargkovas, G.; Lu, Y.; Kaffes, K.; and Peng, T. 2026. Speculative Actions: A Lossless Framework for Faster Agentic Systems. In International Conference on Learning Representations (ICLR). Yu, E.; Zikelic, D.; and Henzinger, T. A. 2025. Neural Control and Certificate Repair via Runtime Monitoring. In Proceedings of the AAAI Conference on Artificial Intelligence. ArXiv:2412.12996.
A
Notation
Table 4 collects the symbols used throughout the main paper and this appendix.
B
Certificate-Aware Loss Sweep
This section reports the full λ sweep referenced in Section 2.5. The spread penalty is essential: at matched call reduction, λ = 0.05 reduces EMS mean regret from 0.0531 to 0.0364.
C
Conformal Calibration
This section reports the calibration quantities supporting the coverage statement in Section 2.5. Calibration and test states are seed-disjoint fallback-reachable rollout-state visits (ncal =ntest =408 per domain). The nonconformity score is |yi − V̂0.5 (si )| ri = , V̂0.9 (si ) − V̂0.1 (si ) and the deployed band is [V̂0.5 (s)±α(V̂0.9 (s)− V̂0.1 (s))]. At this calibration size both domains meet their 80% and 90% targets.
D
Tolerance Frontier
This section reports the τ frontier referenced in Section 3.1. Increasing τ selects longer accepted prefixes and higher call reduction with zero applied violations across the reported sweep.
E
Certified Execution over Untrusted Proposal Sources
This section gives the per-source safety/regret table referenced in Section 3.2. Direct executes the proposed actions raw; CGPA (Certificate-Gated Prefix Acceptance) wraps the same source in the accept/defer contract (the RL Direct column is end-to-end oracle replacement). Adversarial drafters and the frozen Gemma-4-12B and Gemma-4-E4B models violate constraints in nearly every episode under direct execution; the contract drives all of them to zero applied violations and collapses regret by three to four orders of magnitude, the worst adversarial source landing at the oracle’s own cost. Violations are the per-episode applied-breach rate; adversarial/RL rows use 30 EMS episodes, LLM rows 50 same-seed episodes (τ =0.08); the full six-LLM comparison appears in the main paper.
F
EMS Value-Boundary Frontier
This section gives the EMS risk–cost frontier referenced in Section 3.3, under a fixed forecast proposal source (n=100) with only the value boundary changed (τ =0.04). The certificate-aware learned guard cuts mean regret from 0.4450 (unguarded prefix acceptance) to 0.0063 at 60.4% call reduction, and its conformally calibrated band gate reaches 0.0002 (95% CI [−0.005, 0.006], spanning zero) — three orders of magnitude below unguarded acceptance, within sampling noise of the stepwise oracle — at the best regret tail, all at zero applied violations.
G
Full-Plan Neural MPC Comparison
This section reports the certified-acceptance-versus-fullplan comparison referenced in Section 3.3. The same imitation network (a safety-augmented neural MPC inputsequence approximator) is routed through full-plan acceptance — which commits the whole predicted sequence as one accept/reject decision and repairs to a safe candidate on infeasibility — and through CGPA certified prefix acceptance, with only the acceptance mechanism changed (EMS, n=100, zero violations throughout). CGPA prefix acceptance cuts mean regret from 0.0227 to 0.0081 (2.8×) at 86.6% call reduction, and trades regret for amortization at higher τ .
H
CityLearn Real-Calendar Shift
This section gives the real-calendar CityLearn result referenced in Sections 3.1 and 3.3. The same accept/defer contract is evaluated under the calendar shift with τ = 0.04.
I
Oracle-Cost Amortization Sweep
This section reports the full oracle-cost sweep supporting the deployment-amortization statement in Section 3.5. Increasing the per-call oracle cost demonstrates the structural advantage of certified multi-step acceptance over controllers that still call the oracle every step. Timing follows the percomponent online accounting (draft, verification, boundary inference, trusted-oracle calls). The event-triggered controller replans when its queued plan is exhausted or when the next queued action fails one-step verification; because that plan is itself built from per-step trusted-oracle calls, its oracle-call count is unreduced under the target-oracle accounting used throughout.
J
UC Per-Episode Speedup
All 50 Qwen3-8B CGPA episodes behind the UC speedup statement in Section 3.5 is faster than stepwise fallback, with a minimum per-episode speedup of 1.51×, a per-episode mean of 2.96×, and a total-wall ratio of 2.02×, all at zero applied violations.
K
Proposal Quality and Matched-τ Throughput
This section supports the claim that certified throughput grows with proposal quality, not raw model size. On the sixLLM EMS suite (same-seed n=50), the verifier-accepted prefix length and the CGPA call reduction are perfectly rankcorrelated across models (Spearman ρ=1.000), whereas parameter count and call reduction are not (ρ= − 0.058): the capability axis that predicts throughput is the quality of the proposed prefixes, not the number of parameters. The same ordering holds at deployment scale once the value tolerance is controlled. Table 13 re-runs the UC endto-end comparison with the hold and Qwen3-8B drafters at identical τ (the main-paper rows use τ =0.04 for hold and τ =0.15 for Qwen). At every matched τ the frozen LLM exceeds the deterministic heuristic on mean and total-wall
Table 4: Notation. Symbol
Meaning
st , at f, c πF V =V πF D(s, K) V̂ τ, τi ϵ ϵ̄i gi fj , ρj A, R JF , JCGPA Rrel
state and applied action at step t transition map st+1 =f (st , at ) and stage cost trusted fallback (oracle) policy finite-horizon fallback cost-to-go (terminal value 0) untrusted source proposing a length-K action prefix cheap value boundary (precomputed or learned), queried in the value guard value tolerance (global; on accepted segment i) boundary-error bound |V̂ (s) − V (s)| ≤ ϵ at accepted endpoints per-segment boundary error: max of ϵ over the segment endpoints realized cost of accepted segment i cost and realized slack of fallback repair segment j sets of accepted and fallback-repair segments stepwise-fallback and CGPA episode cost fallback-relative normalized regret
Table 5: λ sweep for the certificate-aware boundary (EMS K=4, τ =0.12; CityLearn K=6, τ =0.04). Regret and call reduction are reported as mean ± standard deviation over ten seeds. Domain
λ
Seeds
Regret
Call red.
Viol.
EMS CityLearn EMS CityLearn EMS CityLearn
0 0 0.05 0.05 0.30 0.30
10 10 10 10 10 10
0.0531 ± 0.0246 0.0250 ± 0.0024 0.0364 ± 0.0116 0.0246 ± 0.0030 −0.0023 ± 0.0033 0.0161 ± 0.0030
69.3 ± 1.3% 88.0 ± 4.0% 68.9 ± 0.8% 85.0 ± 3.3% 40.1 ± 5.2% 13.0 ± 5.0%
0 0 0 0 0 0
speedup at zero violations: the capability–throughput ordering holds at matched tolerance. A controlled quality knob isolates the same axis without changing the model: at each step a synthetic EMS drafter takes the oracle/fallback action with probability q and a random feasible action otherwise, sweeping q from random (0) to near-oracle (1) with the trusted core (boundary, verifier, τ , K, fallback) frozen at its deployment setting; q=1 reads a precomputed oracle trajectory and serves as the controlled upper-bound endpoint. As proposal quality rises, call reduction increases monotonically (24% → 90%, Spearman ρ=1.0) and mean regret decreases monotonically (0.031 → 0.002), at zero applied violations throughout (Table 14): certified throughput tracks proposal quality directly, consistent with parameter count being non-predictive across the six-LLM suite (ρ=−0.058).
L
UC Second-Instance Replication
This section reports the second unit-commitment instance referenced in Section 3.5: 100 generators, demand-peak fraction 0.66, 48-step horizon, hold-commitment drafter, and a certificate-aware value boundary trained on this instance (40 training episodes; 50 evaluation episodes on heldout seeds, τ =0.04). Every episode is faster than stepwise fallback, and the trusted oracle accounts for 99.99% of online time.
M
Certificate Audit Components
This section reports the audit quantities used in Sections 3.3 and 3.5. The ledger counts accepted steps separately from error-charged accepted segments.
N
LLM Proposal Protocol
This section records the proposal protocol used by the frozen LLMs. The prompt template, parser, and deterministic decoding settings are shared across models; the verifier and fallback contract remain unchanged across proposal sources. EMS action proposal. The EMS prompt presents the current hour, the battery state of charge, the running peak import, the allowed discrete action set, the battery and grid feasibility limits, and the K-step load/PV/price forecast, and asks for one discrete battery action per hour (positive discharges, negative charges), returned as a JSON list of K actions drawn from the allowed set. UC commitment-change proposal. The UC prompt presents the current commitment vector, the per-generator minimum and maximum output, the marginal costs, the units currently locked on or off by minimum up/down times, and the K-step demand forecast, and asks — for each of the next K steps — for the set of generators to toggle relative to the previous step, returned as a JSON list of K index sets. It requests the smallest commitment change that keeps each step’s committed capacity able to meet demand without toggling locked units.
O
UC Timing Breakdown
This section reports the per-decision timing breakdown referenced in Section 3.5. The trusted MILP oracle dominates online time; drafting, verification, and boundary inference together consume at most 2.04% of per-decision time (Table 19). For the warm-start comparison referenced in Section 3.5, warm-starting the MILP with the same proposal (instead of skipping it) reaches only 0.91× end-to-end speedup on the same n=50 UC run set: it still pays the full per-step solve, so warm-starting cannot substitute for skipping the oracle.
Table 6: Split-conformal calibration of the value-boundary band on seed-disjoint rollout states (ncal =ntest =408). The two target miscoverage levels instantiate the 80% and 90% bands. Domain
Calib.
Test
δ80
α80
Cov.80
δ90
α90
Cov.90
EMS CityLearn
408 408
408 408
0.20 0.20
4.104 1.444
0.816 0.853
0.10 0.10
4.318 1.777
0.900 0.917
Table 7: τ frontier for EMS and CityLearn. Call reduction and regret are medians over ten seeds; mean prefix length reports the accepted-prefix operating point. Domain
τ
Seeds
Call red.
Regret
Prefix
Viol.
EMS EMS EMS EMS EMS EMS CityLearn CityLearn CityLearn CityLearn CityLearn CityLearn
0.01 0.02 0.04 0.08 0.12 0.20 0.01 0.02 0.04 0.08 0.12 0.20
10 10 10 10 10 10 10 10 10 10 10 10
46.1% 52.6% 60.0% 66.1% 68.8% 83.0% 81.4% 83.5% 85.6% 88.0% 89.6% 90.9%
−0.0044 −0.0027 0.0060 0.0129 0.0315 0.2065 0.0239 0.0240 0.0242 0.0246 0.0252 0.0265
0.83 1.00 1.20 1.38 1.47 2.33 3.29 3.47 3.72 3.99 4.16 4.33
0 0 0 0 0 0 0 0 0 0 0 0
Table 8: Certified execution over untrusted proposal sources on battery EMS. Direct executes the proposed actions raw; CGPA wraps the same source in the accept/defer contract. Direct Viol.
Regret
Viol.
Regret
Adversarial (always-infeasible) Adversarial (always-charge) Adversarial (anti-forecast) Adversarial (random) End-to-end RL Frozen LLM Gemma-4-12B Frozen LLM Gemma-4-E4B
1.00 1.00 1.00 1.00 0 0.98 1.00
246.9 247.9 247.1 189.7 0.503 20.38 200.0
0 0 0 0 0 0 0
−0.0001 0.119 0.042 0.114 0.074 0.032 0.020
Verifier-Error Robustness
This section reports the verifier-robustness sweep referenced in Section 3.2 (EMS, n=100, τ =0.04). The verifier screens prefixes against a next-state estimate corrupted by bounded uniform noise (a fraction of the state range), while the executed trajectory uses the true dynamics; applied violations are measured on the true trajectory. Across the full noise range, no corrupted prefix is ever admitted (false-accept count zero at every level): violations stay at zero and the verifier instead defers more, so error is absorbed as reduced amortization rather than reduced safety.
Q
Value boundary
Call red.
Reg.
p95 reg.
Viol.
Unguarded prefix Learned guard (cert-aware) + conformal band gate
100.0% 60.4% 37.2%
0.4450 0.0063 0.0002
0.5817 0.0953 0.0465
0 0 0
Table 10: Same neural proposal source (an imitation network), EMS n=100: certified prefix acceptance versus fullplan approximation, with only the acceptance mechanism changed. Call reduction is relative to stepwise fallback; regret is Rrel ; zero violations throughout. Acceptance mechanism
Call red.
Regret
Verifier calls
Full-plan accept (neural MPC) CGPA prefix (τ =0.04) CGPA prefix (τ =0.40)
100.0% 86.6% 98.0%
0.0227 0.0081 0.0304
48.0 11.4 6.9
CGPA
Proposal source
P
Table 9: EMS selective accept/defer risk–cost frontier under a fixed forecast proposal source (n=100); only the value boundary changes. Call reduction is the relative drop in trusted-oracle invocations versus stepwise fallback; regret is Rrel ; τ =0.04.
White-Box Adaptive Adversary
We stress the proposal slot with white-box adaptive adversaries that re-plan at every decision with full knowledge of the verifier, value boundary, dynamics, stage cost, and fallback oracle; they may craft any proposal but cannot modify
the trusted core. One adversary maximizes true constraintviolation severity; a second maximizes the realized cost of accepted prefixes. Both are evaluated on EMS (n=100) and deployment-scale UC (n=50) under the same boundary, exact verifier, and fallback as the main runs. The violation-maximizing adversary drives raw (unwrapped) execution to a constraint breach in every episode on both domains (Direct), yet CGPA admits none (Table 21): it defers at every step, so amortization collapses to the trusted oracle floor (call reduction 0) while applied violations stay at zero. A cost-maximizing adversary that keeps proposals feasible likewise causes zero applied violations. An adversary can erase CGPA’s amortization but cannot breach its safety, because the feasibility gate never queries the value boundary the adversary attacks. Cost degrades with attack strength; safety does not. The cost-maximizing adversaries refine this picture. On UC a cost-budgeted adversary — bounded to local cost envelopes — leaves the regret certificate fully covered (coverage 1.0) and, within this adversary harness, attains both lower regret and higher call reduction than the hold heuristic (0.014 vs 0.026 mean regret, 98% vs 93% call reduction; paired 95% CIs exclude zero), while an unbounded cost-maximizer exhausts the nominal envelope (coverage 0) at still-zero violations. On EMS the bounded adversary matches the forecast drafter’s own envelope (matching its
Table 11: CityLearn real-calendar shift. The learned conformal band delivers the lowest mean regret at zero violations under the fixed contract. τ
n
Prefix
Call red.
Mean reg.
p95 reg.
Viol.
0.04 0.04
30 30
3.39 1.23
81.0% 57.5%
0.0156 0.0104
0.0848 0.0848
0 0
Boundary Learned boundary Learned conformal band
Table 12: Oracle-cost amortization sweep on EMS (n=100). CGPA reduces oracle calls and its speedup rises with oracle cost; event-triggered and move-blocking controllers are pinned at 1.00× once oracle cost dominates. Controller CGPA learned guard CGPA conformal band Event-triggered Move-blocking CGPA learned guard CGPA conformal band Event-triggered Move-blocking CGPA learned guard CGPA conformal band Event-triggered Move-blocking CGPA learned guard CGPA conformal band Event-triggered Move-blocking
Delay ms
n
Speedup
CI
Oracle call red.
Mean reg.
Viol.
0 0 0 0 50 50 50 50 100 100 100 100 200 200 200 200
100 100 100 100 100 100 100 100 100 100 100 100 100 100 100 100
1.63× 1.18× 1.01× 1.00× 2.61× 1.63× 1.00× 1.00× 2.65× 1.65× 1.00× 1.00× 2.67× 1.65× 1.00× 1.00×
[1.56, 1.69]× [1.13, 1.24]× [0.99, 1.03]× [0.99, 1.02]× [2.49, 2.72]× [1.56, 1.70]× [1.00, 1.00]× [1.00, 1.00]× [2.53, 2.77]× [1.58, 1.72]× [1.00, 1.00]× [1.00, 1.00]× [2.55, 2.78]× [1.59, 1.73]× [1.00, 1.00]× [1.00, 1.00]×
60.4% 37.2% 0.0% 0.0% 60.4% 37.2% 0.0% 0.0% 60.4% 37.2% 0.0% 0.0% 60.4% 37.2% 0.0% 0.0%
0.0063 0.0002 0.0000 0.0000 0.0063 0.0002 0.0000 0.0000 0.0063 0.0002 0.0000 0.0000 0.0063 0.0002 0.0000 0.0000
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
Table 13: UC end-to-end speedup with the hold and Qwen38B drafters at matched τ (n=50 per row, zero violations throughout). The Hold and Qwen3-8B columns are totalwall (aggregate) speedups; the last column is the per-episode mean difference (episode-bootstrap 95% CI). Both favor Qwen3-8B at every matched tolerance. τ 0.04 0.08 0.15
Hold
Qwen3-8B
Qwen−hold mean ∆ [95% CI]
1.79× 1.78× 1.79×
1.85× 2.03× 2.02×
+0.59 [0.002, 1.63] +1.60 [0.45, 3.12] +1.16 [0.21, 2.53]
regret) at zero violations. Across attack strengths, applied violations never leave zero. An adversary buys reduced amortization or paid regret, never an unsafe transition. A learned adversary fares no better. We also train a learned white-box attacker — an MLP that optimizes feasible high-cost prefixes directly against the frozen contract (n=100) — in place of the hand-crafted search. Its feasible (un-wrapped) mean regret reaches 0.570, the highest of any feasible proposal source we evaluate and above the forecast drafter (0.439). The same frozen contract still holds it to zero applied violations at certificate coverage 0.99 and mean/p95 regret 0.014/0.022, as the value guard defers its aggressive prefixes (call reduction 33%). A learned attacker can raise feasible cost but cannot convert proposal control into an unsafe transition.
Table 14: Controlled EMS proposal-quality sweep (q from random to near-oracle; q=1 is a controlled oracle upper bound; n=100, zero applied violations throughout). Call reduction rises and mean regret falls monotonically with proposal quality. q
Call red.
Regret
0.0 0.2 0.4 0.6 0.8 1.0
24% 38% 50% 63% 75% 90%
0.031 0.025 0.024 0.016 0.007 0.002
R
Out-of-Distribution Day Expansion and Win Rate Against the Stepwise Oracle
This section reports the day-level statistics behind the distribution-shift result of Section 3.3 (18 held-out calendarshifted days × 5 learned-drafter seeds, 90 paired day–seed runs). A win counts a run whose total cost is below the stepwise oracle reference on the same day. Mean regret is −0.137 [−0.166, −0.110] for the learned source and −0.082 [−0.121, −0.044] for the forecast source; the in-distribution learned-guard win rate is 0.50.
S
Full Proofs
This section expands the proof sketches of the main paper. Statement numbering refers to the main paper; V = V πF
Table 15: Second UC instance (100 generators, n=50). The certified hold-drafter acceleration replicates at zero violations. Metric
Value 2.09 × [2.03, 2.17] 67.8% [67.2, 68.3] 0.0136 [0.0129, 0.0143] 0.0181 / 0.0206 11.12 0
Wall speedup [CI] Call reduction [CI] Mean regret [CI] p95 / max regret Mean accepted prefix Violations
is the oracle cost-to-go with terminal value V (sT ) = 0, so V (s0 ) = JF (s0 ) by definition. Lemma 1 (Per-segment value decomposition). An accepted segment i is admitted by the exact guard only if gi + V (si+1 ) ≤ V (si ) + τi |V (si )|; rearranging gives gi ≤ V (si ) − V (si+1 ) + τi |V (si )|. For a repair segment j, define the realized repair slack ρj := max{0, fj + V (sj+1 ) − V (sj )} ≥ 0; then fj ≤ V (sj ) − V (sj+1 ) + ρj holds by construction. If the repair applies πF with the same remaining horizon, the Bellman recursion V (sj ) = fj + V (sj+1 ) gives ρj = 0. □ Certificate 1 (Exact-boundary bound). The rollout partitions into consecutive segments whose end state is the next start state: s0 = z0 , z1 , . . . , zM = sT . Summing the Lemma 1 inequalities over all segments, X X JCGPA (s0 ) = gi + fj i∈A
≤
M −1 X
j∈R
V (zm ) − V (zm+1 )
m=0
+
X i∈A
τi |V (si )| +
X
ρj .
j∈R
The first sum telescopes to V (s0 ) − V (sT ) = V (s0 ) = JF (s0 ). Subtracting JF (s0 ) yields the bound; dividing by max(|JF (s0 )|, 10−12 ) recovers the normalized regret of Eq. (2). □ Certificate 2 (Approximate-boundary bound). An accepted segment satisfies the deployed rule gi + V̂ (si+1 ) ≤ V̂ (si )+τi |V̂ (si )|, so gi ≤ V̂ (si )− V̂ (si+1 )+τi |V̂ (si )|. Assumption 2 at the two endpoints gives V̂ (si ) ≤ V (si ) + ϵ, −V̂ (si+1 ) ≤ −V (si+1 ) + ϵ, and |V̂ (si )| ≤ |V (si )| + ϵ, hence gi ≤ V (si ) − V (si+1 ) + τi |V (si )| + (2 + τi )ϵ ≤ V (si ) − V (si+1 ) + τi |V (si )| + (2 + τmax )ϵ. Repair segments are unchanged from Lemma 1, and the telescoping argument of Certificate 1 applies verbatim; the boundary error enters once per accepted segment, contributing (2 + τmax )ϵ|A| in total. □
Proposition 4 (Conformal forward regret bound). A rollout has at most T +1 segment-boundary states. Splitconformal validity under the stated exchangeability gives, for each boundary state s, Pr[ |V̂0.5 (s) − V (s)| ≤ ϵ(s) ] ≥ 1−δ/(T +1) when the multiplier α is the conformal quantile of the calibration scores at miscoverage δ/(T +1). A union bound over the boundary states makes the inequalities hold jointly with probability at least 1 − δ. On this event, the Certificate 2 substitution applies with the endpoint-specific bands: gi ≤ V (si ) − V (si+1 ) + τi |V (si )| + (1 + τi )ϵ(si ) + ϵ(si+1 ) ≤ V (si ) − V (si+1 ) + τi |V (si )| + (2 + τmax )ϵ̄i , with ϵ̄i = max{ϵ(si ), ϵ(si+1 )}. Summing and telescoping as in Certificate 1 completes the proof. □
T
Non-Learned Value Boundaries and Unguarded Shields
This section reports the baseline-boundary comparison referenced in Section 3.3, run on a common n=100 EMS episode draw across the four boundaries (τ =0.04). The unguarded shield executes the verified proposal at every draft length and pays its full regret — the executed trajectories are identical across K ∈ {1, 2, 4, 8}, so the result is insensitive to draft length. The learned boundary answers per-state queries in milliseconds without online construction.
U
Conceptual Positioning
Table 24 positions CGPA against the neighbouring lines of work discussed in the main paper’s Related Work. CGPA is closest to speculative decoding in invocation pattern and to safety filters in the trusted-runtime contract, but its accepted object is a verified multi-step control prefix gated by a value boundary, and the proposal source is arbitrary.
Table 16: EMS certificate audit components. The band gate reduces realized excess while maintaining complete segment coverage. Row
n
|A|
P
ki
Mean k
τ budget
Error
Envelope
Realized
Bound/real.
Coverage
Learned boundary Learned band gate
30 30
5.13 3.20
14.53 9.00
2.83 2.81
0.796 0.591
0.000 0.320
0.796 0.910
0.490 0.068
1.62× 13.45×
93.3% 100.0%
Table 17: UC n=50 certificate audit envelope. The hold and Qwen rows keep zero violations while the accepted-step ledger substantially exceeds the number of error-charged segments. The τ coverage column is the fraction of accepted segments within the nominal τ -budget; the conformally calibrated per-segment error charge (p95 error) prices the small residual, so realized regret stays bounded. Row
n
τ
Segments
Steps
τ coverage
Mean reg.
p95 reg.
Max reg.
p95 error
Hold-commitment CGPA Qwen3-8B CGPA
50 50
0.04 0.15
102 316
1526 1543
100.0% 98.0%
0.0145 0.0211
0.0173 0.0712
0.0179 0.1552
0.0066 0.0041
Table 18: LLM decoding and parsing protocol. The same settings are used across Qwen3-1.7B/4B/8B and Gemma-4E2B/E4B/12B. Item
Protocol
Decoding
Greedy decoding with temperature 0, top-p = 1, and a fixed 1500-token generation cap. The model’s standard chat template, with reasoning output disabled where supported. A deterministic parser reads the first JSON object and extracts its proposed action list (EMS) or commitment-change list (UC). Unparseable responses defer immediately to the trusted oracle. The LLM never applies actions directly; every proposed prefix is transition-checked and value-checked before execution.
Chat format JSON extraction
Invalid output Safety owner
Table 19: UC n=50 per-decision timing. Shares are computed from measured component times over the formal n=50 runs. Row
Oracle ms
Draft ms
Verify ms
Boundary ms
Oracle share
Other share
Hold-commitment CGPA Qwen3-8B CGPA
27838.5 11387.2
0.027 234.446
0.432 0.269
3.976 2.965
99.98% 97.96%
0.02% 2.04%
Table 20: Verifier-error robustness on EMS (n=100, a separate verifier-perturbation harness; the noise=0 row is this harness’s own reference). Noise is the bounded uniform error injected into the verifier’s next-state estimate, as a fraction of the state range. Violations stay zero throughout; call reduction degrades gracefully. Verifier noise
Call red.
Mean reg.
Viol.
0.0 0.005 0.01 0.02 0.05 0.10 0.20
63.5% 63.0% 62.8% 60.2% 55.7% 51.5% 44.5%
0.0077 0.0081 0.0122 0.0129 0.0159 0.0200 0.0188
0 0 0 0 0 0 0
Table 21: White-box adaptive violation-maximizing adversary: per-episode applied violation rate (raw execution versus CGPA) and CGPA call reduction. The adversary re-plans each step to breach constraints; CGPA holds applied violations at zero and absorbs the attack as lost amortization (call reduction falls to the oracle floor). Domain EMS (n=100) UC (n=50)
Direct viol.
CGPA viol.
CGPA call red.
1.00 1.00
0 0
0% 0%
Table 22: CGPA win rates against the stepwise oracle under calendar shift. Wilson 95% intervals; zero violations in every run. Scope Learned, day level Forecast, day level Learned, day–seed level Forecast, day–seed level
Wins
n
Rate
Wilson 95%
15 12 72 60
18 18 90 90
0.83 0.67 0.80 0.67
[0.61, 0.94] [0.44, 0.84] [0.71, 0.87] [0.56, 0.76]
Table 23: Value-boundary baselines on a common EMS episode set (n=100, a separate draw from Table 9; the four boundaries share this draw to isolate the boundary effect). The learned boundary attains the lowest mean regret and the best tail among deployable boundaries. Boundary
Mean reg. [CI]
p95 Call red. Viol.
Unguarded shield (K=1–8) 0.4450 [0.4319, 0.4579] 0.5817 100.0% Forecast value table 0.0153 [0.0086, 0.0223] 0.0804 61.7% Oracle-rollout value table 0.0261 [0.0174, 0.0349] 0.1124 64.3% Learned boundary 0.0048 [−0.0006, 0.0110] 0.0710 63.1%
0 0 0 0
Table 24: Conceptual positioning of CGPA against neighbouring lines of work. Line of work
Verified object
Trusted work timing
Speculative decoding
token prefix distribution
Selective prediction / learning to defer Shields and safety layers
per-instance abstention
target model verifies a draft batch defer to a trusted expert on low confidence correction at unsafe or risky actions
Predictive safety filters / CBFs
candidate control input
Eventtriggered control
controller update condition
Moveblocking MPC and rollout CGPA
optimized or evaluated lookahead
no transition constraints or fallback-relative cost certificate single-step abstention, not a value-gated multi-step executed prefix safety correction without committing a value-gated future prefix online can serve as projection or fallback/verifier; do not constrained amortize accepted solve prefixes recompute state-error reuse rather when trigger than fires prefix-cost-bounded multi-step commit solver or rollout reduce variables or remains central improve actions, not trusted invocations
verified action prefix from an arbitrary source
solver only on rejection or repair
one proposed action
Difference from CGPA
exact safety plus a cheap value gate and an auditable per-segment regret certificate