🤖 AI

DeXposure-Claw: An Agentic System for DeFi Risk Supervision

This paper introduces DeXposure-Claw, an agentic system that integrates a graph time-series foundation model with deterministic monitors and confidence gates to generate auditable, regulator-aligned DeFi risk supervision tickets while minimizing false alarms through the DeXposure-Bench evaluation framework.

Original authors: Aijie Shu, Bowei Chen, Wenbin Wu, Cathy Yi-Hsuan Chen, Fengxiang He

Published 2026-06-19

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Aijie Shu, Bowei Chen, Wenbin Wu, Cathy Yi-Hsuan Chen, Fengxiang He

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine the world of Decentralized Finance (DeFi) as a massive, chaotic city where thousands of different banks, exchanges, and loan apps are all lending money to each other. In this city, if one small shop goes bankrupt, it can trigger a domino effect that topples the whole neighborhood.

The problem is that the "city inspectors" (regulators) are trying to watch this city using only a pair of binoculars and a notebook. By the time they see a problem, it's often too late.

Enter DeXposure-Claw, a new "super-assistant" designed to help these inspectors. Here is how it works, broken down into simple parts:

1. The Problem: The "Over-Confident Intern"

The researchers tried a simple idea first: "Let's just ask a smart AI (a Large Language Model) to look at the city's daily transactions and tell us what's wrong."

They found this was dangerous. The AI acted like an over-enthusiastic intern. It would look at a tiny, blurry clue (like a single weird transaction) and confidently say, "This is a disaster! We need to shut down the whole bank!" It was making big, scary recommendations based on weak evidence, causing unnecessary panic.

2. The Solution: The "Detective with a Crystal Ball"

Instead of letting the AI guess based on raw data, the researchers built a four-step assembly line. Think of it as a high-tech detective agency:

Step 1: The Crystal Ball (The Forecaster)
Before the AI speaks, a specialized computer model (called DeXposure-FM) looks at the city's history and predicts what the network will look like in the future (1, 4, 8, or 12 weeks from now). It doesn't just guess; it calculates probabilities. It's like a weather forecast, but for financial risk.
Step 2: The Evidence Board (The Monitors)
The system takes that future prediction and runs it through a series of strict, math-based tests. It asks: "If the weather forecast says a storm is coming, how much damage would it do?" It simulates disasters (like a bridge collapsing or a stablecoin losing its value) and creates a structured "Evidence Board" with specific alerts, numbers, and confidence scores.
Step 3: The Detective (The LLM)
Now, the AI (the LLM) gets to speak. But here's the catch: It can only look at the Evidence Board. It cannot look at the raw, messy data. It sees the crystal ball's prediction and the stress-test results. It then writes a "Supervisory Ticket"—a report saying, "I recommend investigating Protocol X because the crystal ball predicts a 20% loss if the bridge fails."
Step 4: The Safety Gatekeepers
Before the ticket is sent to the human inspector, two "gatekeepers" check it:
1. The Data Health Gate: "Is the data we are looking at fresh and clean?" If the data is old or broken, the system goes into "Safe Mode" and refuses to make a scary recommendation.
2. The Confidence Gate: "Are we sure enough?" If the prediction is shaky, the system won't recommend a high-stakes action.

3. The Results: Better Coverage, Not Perfect Safety

The researchers tested this system over five years of real data. Here is what they found:

It works better than guessing: By forcing the AI to look at the "Crystal Ball" predictions first, the system found 3 times more actual risks than the old methods. It stopped missing the big problems.
It's still not perfect: Even with the crystal ball, the AI still made mistakes. About 37% to 44% of the time, it recommended a high-stakes action that turned out to be unnecessary (a "false alarm").
The Lesson: The AI is great at finding potential problems and explaining why they might happen, but it is not safe enough to make the final decision on its own. The "Safety Gates" and human review are still essential.

The Bottom Line

DeXposure-Claw is like giving a human inspector a super-powered telescope and a weather forecast, rather than just a pair of binoculars. It helps them see risks much earlier and explain them better. However, the researchers are clear: The AI is the assistant, not the boss. It provides the evidence and the draft report, but a human must still pull the trigger on any serious action.

The system is designed to be auditable, meaning every recommendation comes with a full "receipt" showing exactly which numbers and predictions led to the decision, so humans can always double-check the work.

Technical Summary: DeXposure-Claw

Problem Statement

Decentralized finance (DeFi) creates fast-moving, networked credit exposure among lending protocols, decentralized exchanges, stablecoins, and bridges. Recent crises (e.g., Terra/Luna, FTX, SVB/USDC) demonstrate that shocks can propagate through these networks faster than human supervisors can manually inspect raw on-chain data.

The paper argues that applying general-purpose Large Language Model (LLM) agents directly to raw on-chain measurements is unsafe for high-stakes supervision. These agents tend to "over-read" weak, incomplete, or stale evidence, producing plausible rationales that trigger unnecessary high-severity interventions. Furthermore, existing systemic-risk evaluations often rank protocols by fractional exposure changes, which disproportionately highlights small, low-relevance protocols and fails to align with regulator priorities regarding absolute loss. There is a lack of evaluation frameworks that measure false intervention rates against a regulator-aligned ground truth.

Methodology: DeXposure-Claw Pipeline

The authors introduce DeXposure-Claw, a forecast-grounded agentic system designed to route LLM decisions through structured, deterministic evidence rather than raw data. The system operates on a weekly cadence and is decomposed into four distinct layers:

Layer 1: Forecasting (DeXposure-FM)
- A graph time-series foundation model forecasts future exposure networks ( $G_{t+h}$ ) from the current weekly snapshot ( $G_t$ ).
- It outputs a predictive distribution, including edge existence probabilities ( $\pi$ ) and expected edge weights ( $\mu$ ), constructed into an expected-weight predicted graph ( $\hat{G}_{t+h}$ ).
- It generates Monte Carlo samples to quantify predictive uncertainty.
Layer 2: Monitoring & Scenario Analysis
- Deterministic Monitors: Five functional metrics (Top-1 PageRank, HHI concentration, network density, PageRank Gini, Degree Gini) are computed on the predicted graph. Alerts fire when these statistics deviate from a rolling baseline by more than a set number of standard deviations.
- Stress Scenarios: Five standardized shocks (single protocol failure, bridge cluster failure, stablecoin de-peg, sector lending shock, correlated top-10 stress) are applied to the predicted graph and Monte Carlo samples. The system calculates Conditional Value-at-Risk (CVaR) for each scenario.
- Data Health: A scalar score ( $DH_t$ ) is computed based on data freshness, missingness, topology, and discrepancy checks.
- Output: A typed evidence bundle containing alerts, attribution (top-K edges), uncertainty estimates, scenario losses, and data health scores.
Layer 3: Ticket Drafting (LLM)
- The LLM receives only the structured evidence bundle from Layer 2 (not raw transactions).
- It drafts a ranked list of supervisory tickets, assigning a severity level (Monitor, Investigate, Recommend-Reduce, Contingency), a target set of protocols, and a rationale citing specific evidence fields.
- The LLM is constrained to drafting; it does not have release authority.
Layer 4: Safety Gates
- Data-Health Gate: If $DH_t < 0.7$ , the system enters "safe mode," suppressing intervention-level tickets (Recommend-Reduce, Contingency) and releasing only Monitor or Investigate tickets.
- Confidence Gate: If the mean alert confidence is below 0.6, intervention-level tickets are blocked.
- Every released ticket is accompanied by its full evidence bundle and gate states for auditability.

Evaluation Framework: DeXposure-Bench

The authors developed DeXposure-Bench, a six-axis evaluation harness:

b1_forecast: Temporal graph prediction quality.
b2_warning: Streaming early-warning lead time.
b3_calibration: Predictive uncertainty calibration.
b4_stress: Stress-scenario fidelity.
b5_decision: Supervisory ticket quality (Precision, Recall, F1, False Intervention Rate).
b6_robustness: Robustness to degraded data.

Crucially, the decision axis (b5) uses a regulator-aligned absolute-loss ground truth. Instead of fractional changes, the ground truth identifies the top 5% of protocols by absolute exposure loss over a 4-week horizon. This allows for the direct measurement of the False Intervention Rate (FIR).

Key Results

Experiments were conducted on five years of weekly DeFi exposure data (2020–2025), with a frozen test split from 2025.

Forecasting (RQ1): While a simple "persistence" baseline (assuming the graph stays the same) achieved lower Point-estimate MAE on some metrics, it structurally lacked trend signals and calibrated uncertainty. DeXposure-FM provided necessary trend signals and conformal calibration (PI coverage of 0.913 at a 0.90 target) that the agent consumed.
Grounding vs. Raw Data (RQ2): Routing the LLM through forecasted evidence (m6) rather than raw snapshots (m2) increased the ticket F1 score from 0.0184 to 0.0241 (+31%). This improvement was driven by coverage: the forecast-grounded system identified a larger set of stressed protocols at comparable precision.
Over-Intervention: Despite the F1 gain, the LLM over-read the forecaster. The False Intervention Rate (FIR) for the full stack (m6) was 0.448, meaning roughly 45% of intervention-level tickets were incorrect. Using a stronger model (Opus 4.7) did not significantly reduce this rate (FIR 0.437); in fact, it was slightly higher.
Safety Gates (RQ3): The safety gates (Layer 4) were the primary mechanism for controlling risk. Removing the confidence gate caused the FIR to jump to 0.429 on clean data. Under degraded data, the data-health gate suppressed false alarms, driving FIR to 0.000 in safe mode.
Model Efficiency: Replacing the decision model with a cheaper variant (Claude Sonnet 4.6) improved the F1 score (0.0234 to 0.0288) while maintaining a similar FIR, suggesting that model selection is an efficiency choice rather than a safety one.

Significance and Claims

The paper claims that DeXposure-Claw demonstrates that LLM agents should not reason directly over raw on-chain data in high-stakes settings. Without structured evidence and escalation controls, agents over-intervene.

Auditable Recall: The system is positioned as an "auditable recall-and-explanation option" for human-in-the-loop supervision, not a replacement for conservative rule-based systems.
Safety via Gates, Not Models: The study concludes that safe high-severity action comes from data-health and confidence gates and human review, not from the decision model itself. The LLM's role is to draft rationales and expand coverage, but its tendency to over-read evidence is a persistent failure mode that must be gated.
Evaluation Standard: The paper introduces a new standard for evaluating financial agents by using an absolute-loss ground truth and explicitly measuring the False Intervention Rate, addressing a gap in existing benchmarks that often prioritize detection accuracy over regulator-relevant loss priorities.

The authors note limitations, including the single-domain focus (DeFi inter-protocol credit), the weekly resolution (which may miss sub-hourly shocks), and the potential for pretraining data to influence explanation quality on known historical events. They emphasize that the system is a decision support tool, not an autonomous risk agent.