把AI的规矩编译成程序，便宜模型也能守得住
给大模型定规矩这件事，现在越来越像一场军备竞赛：规矩越定越复杂，得看完整场对话、盯住每一步工具调用，才能判断有没有违规。目前两条路都不省心——专门训练的守门模型便宜但一遇复杂规矩就掉链子；让大模型自己当裁判倒是准，可又贵又飘，同一个案子今天判违规明天判没事。这篇论文换了个思路：把规矩本身编译成一段程序，程序里每个环节都是一个小模型或一段确定性代码，各管一段，再用逻辑串起来。关键在训练方式：不是拿固定数据练完就完，而是边练边自动生成“刁钻案例”，专挑程序最容易判错的地方打，逼着它把漏洞补上。结果是用最便宜的模型跑，准确率能追平最贵的推理模型，而且判决稳定、每一步都能解释。它不是你明天就能上手用的工具，但指向了一个更务实的未来：让AI守规矩，不一定非得烧钱请最聪明的模型。
📄 原文摘要(英文)
Policy enforcement for LLM agents has shifted from single-turn content moderation to compound, application-specific policies evaluated over multi-turn transcripts and tool-call trajectories. Fine-tuned guardrail models are efficient but degrade on compound policies, and while LLM-as-a-judge approaches achieve higher accuracy, they incur high inference cost and tend to produce unstable predictions. Neurosymbolic methods offer a natural alternative, decomposing the policy into narrow neural decisions composed under explicit logic. However, existing symbolic layers lack the required expressiveness and are optimized against fixed data rather than the policy itself. To address this, we introduce SCOPE, which compiles a policy into an executable program of neural predicates executed by small models, deterministic extractors, and code that composes their outputs. The program is optimized jointly with its training data, using adversarial generation of counterexamples that target where the program deviates from the policy. We evaluate SCOPE on a benchmark of real-world policy tasks against prompt optimization, task decomposition, and workflow generation methods, achieving the highest average accuracy across tasks and models. Programs optimized with the weakest executor transfer to other models without further optimization. This allows them to be deployed in production on inexpensive models, where they reach accuracy comparable to frontier reasoning models. Unlike these monolithic models, SCOPE produces substantially more stable predictions, and each verdict is interpretable through the predicate outputs that produced it. Additionally, we validate the key components of our method through an ablation study. SCOPE thus enables reliable, interpretable, and efficient policy enforcement at production scale.