Certified Speculative Execution for Untrusted AI Agents

2026-06-29

AI Summary

This work addresses the challenge of safely and efficiently leveraging the reasoning capabilities of untrusted AI agents in hard-constrained sequential decision-making. It introduces Certificate-Gated Prefix Acceptance (CGPA), the first mechanism to provide provably safe certification for speculative execution by untrusted AI. By integrating a trusted verifier, conformal-calibrated value bounds, regret-budget control, and solver fallback, CGPA decouples safety, regret guarantees, and execution speed, enabling secure acceleration with arbitrarily capable but untrusted proposal sources. Evaluated on unit commitment tasks, a frozen 8B-parameter LLM achieves a 2.96× speedup with only 2.1% regret, while six heterogeneous LLMs all incur zero constraint violations and exhibit average regret three orders of magnitude lower than unprotected baselines.

Abstract

Hard-constrained sequential decision systems have no certified way to spend the test-time compute of modern AI: executing the multi-step drafts of a learned policy or a frozen LLM forfeits the feasibility guarantee a trusted solver provides, while invoking the solver at every step forfeits the speed the AI offers. Certificate-Gated Prefix Acceptance (CGPA) closes this gap with a certified speculative-execution contract for untrusted AI agents: a trusted verifier rejects constraint-violating transitions exactly, a conformally calibrated value boundary gates the longest low-cost prefix within a per-segment regret budget, and the rest defers to the solver, so safety, regret, and speed decouple by construction. The contract drives every untrusted proposal source - adversarial drafters and six heterogeneous frozen LLMs (including a 12B model that violates constraints in 98% of direct rollouts) - to zero applied violations; a certificate-aware learned boundary, conformally calibrated, drives mean regret three orders of magnitude below unguarded acceptance, to within sampling noise of the stepwise oracle (95% CI spanning zero), and under calendar shift a learned proposal source overtakes it on 15 of 18 held-out days. On a deployment-scale unit-commitment instance it turns a frozen 8B LLM into a 2.96x per-episode wall-clock speedup at 2.1% regret, outpacing the domain heuristic (1.79x) and a safe receding-horizon baseline (1.07x): the more capable the untrusted source, the faster the certified system, at guarantees that never change.

Problem

• speculative execution
• hard-constrained decision making
• untrusted AI agents
• safety certification
• computational efficiency

Innovation

• speculative execution
• certified AI
• conformal calibration
• sequential decision-making
• constraint satisfaction