Technical Summary: SafeRun

Problem Statement

Large Language Models (LLMs) have advanced the field of autonomous agents and task planning, yet their inherent probabilistic nature creates a fundamental barrier for deployment in determinism-critical domains. In scenarios where violating safety rules can lead to severe physical consequences, such as running planning, the unpredictability of LLMs renders purely model-driven approaches unacceptably risky. Traditional planning methods, whether relying solely on LLM reasoning or augmenting them with unconstrained external tools (e.g., arbitrary code generation), fail to provide the absolute reliability required to guarantee adherence to strict physiological and safety constraints.

Methodology: SafeRun Framework

To address this, the authors propose SafeRun, a novel framework that enables deterministic LLM-based planning through a decoupled architecture. The core insight is to separate the planning process into two distinct phases:

1. Soft Interpretation (LLM Phase): The LLM acts as a natural-language interface. Its role is restricted to understanding user intent and constructing a pipeline of calls to a predefined deterministic solver. Crucially, the LLM is not allowed to generate arbitrary executable code or directly construct the final plan. Instead, it interacts via a limited set of planning APIs.
2. Hard Enforcement (Deterministic Solver Phase): A formal, deterministic solver executes the pipeline generated by the LLM. This solver is equipped with:
   • Hard Constraints: Explicitly coded safety rules derived from domain expertise (e.g., Daniels' running formula). These include limits on intensity sessions (max 2/week), prohibitions on consecutive intensity days, weekly mileage upper bounds, per-session mileage caps (50% of weekly total), and intensity mileage ratios (max 10% of weekly total).
   • Soft Constraints: Optimization objectives to improve plan quality, such as workout diversity, run/rest balance, and distance uniformity.
   • Predefined Planning APIs: Structured interfaces (e.g., set_day_type, set_day_distance_range) that allow the LLM to specify constraints without manipulating the underlying optimization logic.

The two phases operate in an agent loop: if the solver determines that the LLM's proposed pipeline violates constraints, feedback is returned to the LLM for replanning until a valid solution is found or a maximum iteration limit is reached.

Benchmark Construction

To validate SafeRun, the authors constructed a comprehensive benchmark for running planning:

• Data Curation: 10 human experts curated 100 high-quality, multi-week running planning queries covering diverse training goals and constraints.
• User Profiles: 10 distinct runner profiles were created, varying in physiological conditions (age, gender, BMI) and training levels (beginner to advanced).
• Evaluation Set: By systematically pairing each query with 4 different profiles, the authors generated 400 profile–query combinations to test both natural-language understanding and safety-constrained planning.

Experimental Results

The framework was evaluated across five state-of-the-art LLMs (including GPT-5, GPT-4.1, DeepSeek-V3.2, and Qwen3.5) and compared against two baselines: Prompt Engineering (PE) and CodeAct (a tool-integrated approach allowing general code generation).

• Safety Score: SafeRun achieved a 100% safety score across all models, significantly outperforming the PE average (79.1%) and the CodeAct average (97.6%). Even models with lower baseline safety (e.g., GPT-4.1-mini at 67.8% in PE) achieved full compliance under SafeRun.
• Instruction-Following Score: SafeRun maintained competitive performance (average 81.5%), outperforming PE (69.2%) and slightly exceeding CodeAct (80.3%).
• Success Rate: All methods achieved 100% success in generating valid plans, attributed to the rigorous filtering of the benchmark dataset to ensure feasible solutions existed.

The results indicate that the deterministic solver is the key factor in SafeRun's reliability, effectively bridging the gap between probabilistic generation and the need for absolute safety.

Key Contributions

1. A Novel Framework: SafeRun introduces a decoupled architecture for deterministic LLM planning, separating soft interpretation from hard constraint enforcement.
2. A Comprehensive Benchmark: The paper provides a structured benchmark for running planning under realistic physiological and safety constraints, addressing a gap in existing evaluation datasets.
3. Empirical Validation: Extensive evaluations demonstrate that SafeRun consistently outperforms strong baselines in constraint satisfaction while maintaining high instruction-following capabilities.

Significance and Limitations

The authors claim that SafeRun offers a generalizable approach for deploying LLMs in safety-critical settings by introducing deterministic constraint enforcement. While demonstrated on running plans, the methodology is intended to be applicable to other domains requiring strict adherence to rules.

The paper acknowledges specific limitations:

• The benchmark currently only includes feasible query–profile pairs and does not evaluate the system's handling of infeasible or conflicting requests.
• The deterministic solver relies on manually designed, domain-specific rules and APIs, which may limit immediate generalization to planning domains outside of running without further engineering.

The work emphasizes that SafeRun is designed as a decision-support tool and should not replace professional guidance, highlighting the need for responsible deployment in safety-sensitive applications.