Safety-gated LLM control beats MPC on distillation — but only with guardrails
Ungated LLM supervision fails 16x on disturbance rejection; a rule-based gate fixes it
A new preprint from independent researcher Christian Rosenthal tackles a critical question in industrial AI: can an LLM safely act as a supervisory controller for a chemical process? The answer is a qualified yes, but only with a hard, auditable safety layer. Using Skogestad's Column A — a benchmark coupled distillation column — Rosenthal tested four configurations: PID-only, linear MPC, an ungated LLM agent, and an LLM gated by a rule-based "forked-twin counterfactual" check that enforces nine named constraints before any setpoint reaches the regulatory layer.
The results are stark and split by task. For off-nominal target acquisition, the gated LLM supervisor (running DeepSeek-V4-Flash on a 5-minute cadence) beat Pareto-tuned linear MPC, with an IAE ratio of 0.361 at the upper confidence interval. But for disturbance rejection on the same 16-point grid, the ungated agent was catastrophically worse — 16.03x at the upper CI (10.18 at the point estimate). The gate converted a specification-abandonment "attractor" into a bounded offset, reducing peak cell IAE from 11.5 to 0.77, and correctly blocked 318 actively harmful proposals. However, a 250-cell statistical pass revealed a subtle pathology: 534 of 590 gate interventions were "spec-on-bound geometry," meaning the operating spec sat exactly on a safety limit, causing the gate to block well-behaved setpoints while only containing (not eliminating) misbehaving ones. A one-line prompt fix removed the attractor at the source, but Rosenthal calls that sensitivity analysis, not a headline result.
The work is deliberately conditional. Performance is model-specific — a second sweep with NVIDIA Nemotron-3-Super confirmed the disturbance-rejection failure band and plant-side failure geography, but not the target-acquisition strong cells. Transfer means the same twin, constraint envelope, and setpoint interface, not a new plant class. The paper (31 pages, code and data public) is a blueprint for making agentic control safe: keep the regulatory layer untouched, add a deterministic gate, and log every margin for audit.
- Gated DeepSeek-V4-Flash supervisor beats linear MPC on target acquisition with IAE ratio 0.361 (upper CI)
- Ungated LLM disturbance rejection fails 16.03x worse (upper CI); the rule-based gate cuts peak cell IAE from 11.5 to 0.77
- 534 of 590 gate interventions were spec-on-bound geometry, flagging a safety-design tension; 318 blocks stopped actively harmful proposals
Why It Matters
A deterministic safety gate is the missing layer for trustworthy LLM process control, turning a risky agent into an auditable industrial tool.