SCOPE: Compiling Natural-Language Policies into Neurosymbolic Predicate Programs

AI summary

Overview

Research area: AI safety and LLM agent governance — specifically policy enforcement, the task of deciding whether an LLM's output, transcript, or tool-use trajectory complies with a written organizational policy. It sits at the intersection of neurosymbolic AI, program synthesis, and LLM evaluation.

Technical level: Intermediate. The paper assumes familiarity with LLM-as-a-judge setups, prompt optimization, and the idea of decomposing a task into sub-questions, but it explains its own architecture concretely enough to follow without a program-synthesis background.

Scope (one sentence): The paper introduces SCOPE, a method that compiles a natural-language policy into an executable program of small-model "predicates," deterministic extractors, and Python composition code, and shows on a new four-task benchmark that these compiled programs match or beat prompt optimization, workflow generation, and existing decomposition methods while being cheaper, more stable, and more interpretable.

What This Paper Is About

Organizations increasingly need to check whether an LLM agent followed their rules, and modern policies are compound — they bundle conditions, exceptions, counts, and interactions that must be judged together over long multi-turn transcripts or agent traces. Today's two main options each fail in a different way: small fine-tuned guardrail models are cheap but degrade on compound policies, while frontier "LLM-as-a-judge" models are more accurate but expensive and produce unstable verdicts that flip between runs.

SCOPE's goal is to get the accuracy of the strong judge at the cost and repeatability of the weak one, by treating the policy as a specification to compile rather than a prompt to interpret.

Key Contributions

1. A compilation method. SCOPE turns a natural-language policy into an executable neurosymbolic program made of three parts: predicates (narrow natural-language classification questions answered by a weak model), extractors (deterministic functions returning values or spans), and composition code (ordinary Python that decides which predicate is applied to which text, in what order, and how the labels map to a verdict).

2. Joint optimization of program and data. Instead of fitting a symbolic layer to a fixed dataset, the search co-evolves the program with an adversarially grown training pool. Two adversary agents generate counterexamples where the current program departs from the policy — a systemic adversary targeting whole-program drift and a local adversary targeting a single drifted predicate — and a strong teacher labels them by applying the full policy.

3. A new benchmark of four real-world policy-enforcement tasks (Coaching, Escalation, Plan, Tile-match) released on Hugging Face, spanning different input types, lengths (260 to 45k characters average), and label spaces (binary, three-way, and dynamic multi-label).

4. Evidence of transfer, stability, and interpretability. Programs compiled with the weakest executor run unmodified on five open-weight models, reach accuracy comparable to frontier reasoning models at a fraction of the cost, and produce far fewer verdict flips across repeated runs — with every verdict traceable to the predicate outputs behind it.

Main Findings

• Best accuracy in most settings. With gpt-5.4-nano as executor, SCOPE scored 0.85 on Coaching, 0.82 on Escalation, 0.87 on Plan, and 0.78 on Tile-match. It attained the highest accuracy or tied for it in 10 of the 12 task-executor cells; AFlow took the remaining 2.

• The advantage grows as the executor weakens. SCOPE reached 0.85/0.82/0.87/0.78 with the weakest executor, versus 0.60/0.56/0.59/0.38 for direct prompting; on Tile-match the next-best baseline (AFlow) was 0.68.

• Compilation compresses the model-capability gap. Moving from the weakest to the strongest executor bought 0.26 average accuracy under prompt optimization but only 0.09 under SCOPE.

• Weaker executors produce more predicates. The search splits a predicate further when the executor cannot answer it accurately, with the largest increase in predicate count between gpt-5.4-mini and gpt-5.4-nano.

• SCOPE can fall back to plain prompting. The search initializes from the undecomposed task, so a single predicate is always reachable; on Coaching with gemini-3.5-flash it converged to one predicate and accuracy rose from 0.87 to 0.93.

• Programs transfer across models without re-optimization. Decompositions found with gpt-5.4-nano, run by five open-weight models with reasoning disabled, improved over each model's undecomposed run by roughly 0.11 on Coaching, Escalation, and Plan and 0.33 on Tile-match (per-model average gain 0.13 to 0.22). DeepSeek-V4.1-Flash and Qwen3-235B-A22B reached accuracy comparable to undecomposed gpt-5.5 (high reasoning) and gemini-3.1-pro (dynamic thinking).

• Far more stable verdicts. On Tile-match, run five times each, only 5–7% of samples changed prediction at least once for DeepSeek-V4.1-Flash and Qwen3-235B-A22B, versus 37% for gpt-5.5 and 26% for gemini-3.1-pro.

• Adversarial generation matters. Disabling both adversaries dropped Coaching from 0.839 to 0.783 (p=0.033), Plan from 0.865 to 0.813 (p=0.005), and Tile-match from 0.782 to 0.744 (p=0.045), with no effect on Escalation (0.815 vs 0.816). Significance was computed with a one-sided Welch's t-test over five optimization runs.

• Run-to-run consistency. With gpt-5.4-nano, SCOPE's standard deviation was at most 0.03 on every task, a quarter to a third of AFlow's on Plan and Tile-match.

Methodology in Plain English

Starting point. You give SCOPE the policy text and a handful of human-labeled examples. The starting "program" is trivial: one predicate that is just the policy itself, applied to the whole input.

The loop. Each round has two halves. First, the optimizer runs the current program on the training pool and records a trace — the ordered list of every predicate call, the exact text it received, and the label it returned. Because only the final verdict is supervised, an analyzer works backward: it replays the composition code on the recorded labels to find which calls would have had to change to produce the correct answer, and from that decides whether the fault lies in a predicate's wording or in the composition logic. It then proposes grounded revisions — reword or split a predicate, add or remove an extractor, move a condition between predicate and extractor, rewrite the code — and each proposal must cite a clause, definition, or exception of the policy. Fixes justified only by a phrase seen in a sample are rejected as overfitting the pool.

The adversary. Second, two adversary agents hunt for inputs where the program and the policy would disagree: one looks at the whole program and probes omitted or misrouted clauses, the other probes one predicate at a time using its traces. Every generated sample carries an intended label and a justification, and a teacher model independently labels it by applying the full policy without seeing them. The sample is admitted only if both readings agree — so each admitted example reflects two separate interpretations of the policy.

Guardrails on the search. If recent rounds stop improving the score, the search backtracks to the best program so far and forces a substantially different direction, which prevents cycling. The search stops when accuracy on the current pool hits 0.98 or after at most 8 rounds, and it returns the candidate that scores best on the fixed human-labeled seed pool (train-pool scores are not comparable across rounds because the pool grows).

Execution. Predicates are answered during the search by a deliberately weak executor — a sub-frontier model with reasoning disabled, told to return only the label — so a program only scores well if a cheap model can actually run it. Because the executor never sees the policy, each predicate must be self-contained.

Implementation. All core roles (analyzer, decomposer, both adversaries, teacher) were played by Claude Opus 4.8 in an agentic loop with file access, so long records could be read from disk on demand and long samples generated by editing seeds. Baselines were GEPA and MIPROv2 (via DSPy), CheckEval, RLIE, and AFlow, each given the same starting pool and executor where applicable.

Why This Matters

For research. The paper reframes policy enforcement as compilation rather than judgment, and shows that the classical neurosymbolic trade-off — expressiveness versus cost and consistency — can be broken by making the symbolic layer ordinary Python and optimizing it against the policy rather than against a static benchmark. It also combines counterexample-guided synthesis with a model as the verifier instead of a sound solver, trading formal guarantees for applicability to policies no solver would accept.

Real-world applications (all drawn from the paper's benchmark tasks):

• Auditing automated critics and rubric graders — the Coaching task checks a fitness-and-wellness critic's verdict and reasoning against a seven-dimension rubric, returning Pass, Fail, or Bug.
• Customer-support escalation compliance — the Escalation task decides whether an agent escalated correctly when a user re-raised the same unresolved intent at least three times, requiring cross-turn semantic counting.
• Agent plan validation — the Plan task checks that a research agent's plan references only available tools and collaborators and ends with the correct tag, inside traces averaging 45k characters.
• Grounding in ambiguous UI references — the Tile-match task identifies which dashboard tiles a user's last message refers to, one, several, or none.

Industry relevance. Policy enforcement gates every interaction, so its cost is paid on every request. SCOPE makes production deployment plausible on cheap models: no frontier call at inference, deterministic composition, verdicts that don't flip between runs, and an auditable trace for each decision. That combination — cost, stability, and auditability — is what regulated deployments typically demand, and the transfer result means a policy compiled once can be moved to a different (or cheaper) executor without re-running the search.

Future Directions

• Verification remains open. The program is checked against a strong teacher's reading of the policy rather than a formal verifier, so correctness inherits the teacher's interpretation. Building stronger correctness guarantees for compiled policies is stated as an open problem.

• Beyond policy enforcement. The authors note that co-evolving a program with the counterexamples that challenge it is not specific to policy enforcement, and suggest it may carry over to rubric-based LLM evaluation and reward modeling.

• Carrying the method to policies no solver accepts. Because the verifier is a model rather than a sound solver, extending coverage to messier, more open-ended regulatory and organizational policies is a natural next step.

• One-step transfer without any re-optimization. The current transfer result holds for programs compiled with a specific weak executor; whether programs compiled for one executor family should be partially re-optimized for another — and how much that recovers — is left unexamined.

Target Audience

AI safety and trust-and-safety engineers building guardrails for production LLM systems; ML researchers working on neurosymbolic methods, program synthesis with LLMs, or automated prompt and workflow optimization; platform teams who need cheap, auditable, repeatable compliance checks over multi-turn agents and tool-use trajectories; and readers interested in the broader argument that natural-language specifications should be compiled into inspectable programs rather than delegated to a single opaque model call.

Authors’ abstract

Policy enforcement for LLM agents has shifted from single-turn content moderation to compound, application-specific policies evaluated over multi-turn transcripts and tool-call trajectories. Fine-tuned guardrail models are efficient but degrade on compound policies, and while LLM-as-a-judge approaches achieve higher accuracy, they incur high inference cost and tend to produce unstable predictions. Neurosymbolic methods offer a natural alternative, decomposing the policy into narrow neural decisions composed under explicit logic. However, existing symbolic layers lack the required expressiveness and are optimized against fixed data rather than the policy itself. To address this, we introduce SCOPE, which compiles a policy into an executable program of neural predicates executed by small models, deterministic extractors, and code that composes their outputs. The program is optimized jointly with its training data, using adversarial generation of counterexamples that target where the program deviates from the policy. We evaluate SCOPE on a benchmark of real-world policy tasks against prompt optimization, task decomposition, and workflow generation methods, achieving the highest average accuracy across tasks and models. Programs optimized with the weakest executor transfer to other models without further optimization. This allows them to be deployed in production on inexpensive models, where they reach accuracy comparable to frontier reasoning models. Unlike these monolithic models, SCOPE produces substantially more stable predictions, and each verdict is interpretable through the predicate outputs that produced it. Additionally, we validate the key components of our method through an ablation study. SCOPE thus enables reliable, interpretable, and efficient policy enforcement at production scale.