Agent Behavioral Contracts (ABC) brings Design-by-Contract to AI agents: a six-tuple $(\mathcal{P}, \mathcal{I}_{\text{hard}}, \mathcal{I}_{\text{soft}}, \mathcal{G}_{\text{hard}}, \mathcal{G}_{\text{soft}}, \mathcal{R})$ with probabilistic $(p,\delta,k)$-satisfaction, Ornstein–Uhlenbeck drift bounds ($D^* = \alpha/\gamma$), compositionality for multi-agent chains, and <10 ms enforcement overhead across 1,980 sessions.
AI agents operate on natural-language prompts with no formal behavioral specification. Training-time alignment (Constitutional AI, RLHF) shapes general tendencies but cannot enforce deployment-specific invariants. Output-filtering guardrails (NeMo, Guardrails AI) lack session-level state, drift detection, and composability. Wang et al. (2026a) prove the self-evolution trilemma: passive safety is provably insufficient without external intervention. The result: behavioral drift manifests silently over multi-turn interactions until harm occurs.
Contract structure: $\mathcal{C} = (\mathcal{P}, \mathcal{I}_{\text{hard}}, \mathcal{I}_{\text{soft}}, \mathcal{G}_{\text{hard}}, \mathcal{G}_{\text{soft}}, \mathcal{R})$ where hard constraints are safety properties ("bad never happens") and soft constraints with bounded recovery window $k$ encode bounded liveness ("good eventually happens within $k$ steps").
$(p,\delta,k)$-satisfaction: Probabilistic compliance for stochastic LLM agents. Hard guarantee: $\mathbb{P}[C_{\text{hard}}(t) = 1 \;\forall t] \geq p$. Soft guarantee: violations must recover within $k$ steps with probability $\geq p$. Recovery transforms exponential compliance decay ($q^T$) to linear decay ($1 - T(1-q)(1-r)$).
Drift dynamics: Modeled as Ornstein–Uhlenbeck process: $dD(t) = (\alpha - \gamma D(t))dt + \sigma dW(t)$. Stationary distribution $\mathcal{N}(\alpha/\gamma, \sigma^2/(2\gamma))$. The drift score combines compliance drift (lagging indicator) with JSD distributional drift (leading indicator): $D(t) = w_c \cdot D_{\text{compliance}}(t) + w_d \cdot \mathrm{JSD}(P_{\text{obs}}(t) \| P_{\text{ref}})$.
Contract design criterion: To ensure $\mathbb{P}(D > D_{\max}) \leq \varepsilon$: $\gamma \geq \alpha/D_{\max} + \sigma\sqrt{2\ln(1/\varepsilon)}/(2D_{\max})$.
Compositionality: For serial chain $A \to B$, composed contract preserves safety under four conditions (C1–C4). Reliability degrades multiplicatively ($p_{\text{chain}} \geq \prod p_i \cdot \prod p_{h_i}$), drift accumulates additively ($\delta_{\text{chain}} \leq \sum \delta_i + \sum \delta_{h_i}$).
核心技术壁垒: The JSD-based distributional drift component serves as a leading indicator — detecting behavioral shifts before they manifest as constraint violations. This is qualitatively different from all prior approaches that can only detect violations after they occur.
| Metric | Value |
|---|---|
| Soft violations surfaced per session (contracted vs uncontracted) | 5.2–6.8 vs 0.0–0.3 |
| Cohen's $d$ for violation detection | 6.7–33.8 (all $p < 0.0001$) |
| Hard constraint compliance | 88–100% |
| Mean behavioral drift $\bar{D}$ | 0.073–0.154 |
| Max drift $D_{\max}$ | 0.264 (Mistral, 12-turn) |
| Recovery rate (frontier models) | 100% |
| Enforcement overhead | <10 ms per action |
| Models evaluated | 7 (6 vendors), 1,980 sessions |
| Total experimental cost | $3.09 |
The enforcement loop evaluates all constraints per action, updates compliance/drift metrics, and triggers recovery for soft violations within the bounded recovery window.
The paper provides formal proofs for all core theorems:
| Check | Status | Location | ||
|---|---|---|---|---|
| Drift bounds via Lyapunov/Itô calculus | Proven (Theorem 4.3) | §4.2, Appendix A.1 | ||
| Recovery linearizes decay (Lemma 3.10) | Proven | §3.4, Appendix A.2 | ||
| Compositionality theorem (Theorem 4.9) | Proven | §4.3, Appendix A.3 | ||
| Probabilistic compositionality (Theorem 4.11) | Proven | §4.3, Appendix A.4 | ||
| SPRT certification efficiency | Proven (Proposition A.14) | Appendix A.5 | ||
| Runtime complexity $\mathcal{O}(k + | \mathcal{A} | )$ | Proven (Proposition 4.15) | §4.4 |
OU stationary distribution existence proven via Foster–Lyapunov criterion; uniqueness via ergodicity; Gaussian tail bound from the stationary $\mathcal{N}(\alpha/\gamma, \sigma^2/(2\gamma))$.
E1 Transparency Effect (Table 9–10): Contracted agents show lower soft compliance than uncontracted — not regression, but visibility. All 7 models exhibit 5.2–6.8 additional soft violations per session detected by contracts ($p < 0.0001$, Cohen's $d = 6.7$–$33.8$).
E2 Drift Prevention (Table 11): 12-turn sessions. Drift trajectory fits OU mean-reversion (R² = 0.49–0.75). Maximum $D_{\max} = 0.264$ (Mistral), well below alert threshold. Recovery: 100% for GPT-5.2 and Claude Opus; 17% for Mistral Large 3.
E3 Adversarial Stress (Table 12): Hard compliance never drops below 0.911 under prompt injection, conflicting instructions, and social engineering. GPT-5.2 maintains $C_{\text{hard}} = 1.000$ across all stress types.
E4 Ablation (Table 13): Recovery + soft constraints are dominant $\Theta$ contributors (removing either causes $\Delta\Theta \approx -0.2$). The "$\Theta$ paradox": removing measurement components increases the composite score because it eliminates the measurement penalty.
Platform guardrail interference: Azure "DefaultV2" content filter blocks 40–60% of legitimate financial advisory sessions — contracts and platform guardrails operate at complementary abstraction layers.
| Step | Claim | Evidence | Depends on |
|---|---|---|---|
| 1 | AI agents lack formal behavioral specification; passive alignment is provably insufficient | Wang et al. (2026a) self-evolution trilemma; Cartagena & Teixeira (2026) text≠tool safety | — |
| 2 | ABC contract tuple with hard/soft separation formalizes the specification gap | Definition 3.1, mapping to PCTL (Remark 3.9) | Step 1 |
| 3 | Recovery transforms exponential to linear compliance decay | Lemma 3.10, proven | Step 2 |
| 4 | OU drift model bounds behavioral deviation with Gaussian concentration | Theorem 4.3, full proof via Itô/Lyapunov/Foster–Lyapunov | Steps 2, 3 |
| 5 | Contracts compose for multi-agent chains with quantified degradation | Theorem 4.9, 4.11 (C1–C4 conditions) | Step 4 |
| 6 | Transparency effect: contracts make violations measurable, not preventable | E1: 5.2–6.8 violations surfaced, $d = 6.7$–$33.8$ | Steps 2, 3 |
| 7 | Drift bounded in practice: $D^* < 0.27$ over extended sessions | E2: OU fit R² = 0.49–0.75 | Step 4 |
AgentAssert: ~3,000 lines of Python, >95% test coverage. ContractSpec DSL (YAML-based, intentionally not Turing-complete). Available as library with 3 API entry points.
[实现未公开] — No public repository URL provided in the paper.
关键实现细节: