What is deterministic vs probabilistic safety for AI agents?

When building safety for AI agents, there are two fundamentally different approaches: deterministic and probabilistic. Understanding the difference is critical for building systems that actually work under attack.

Probabilistic safety

Probabilistic safety uses the language model itself to make safety decisions. Common examples:

• System prompt instructions: "Never execute destructive shell commands"
• LLM-as-judge: Sending the proposed action to another LLM to evaluate whether it is safe
• Self-reflection: Asking the agent to evaluate its own proposed action

These approaches are probabilistic because the model's output is not guaranteed. The same input can produce different outputs. Under adversarial conditions (prompt injection), the model can be convinced to override its safety instructions.

Deterministic safety

Deterministic safety uses code-based rules that run outside the language model. A policy engine evaluates the tool call against declared rules. The same input always produces the same decision. The language model cannot influence the evaluation.

// Deterministic: always blocks this pattern
if (toolName === 'shell.execute' && /rm -rf/.test(args.command)) {
  return { action: 'block' };
}

This code will block rm -rf regardless of what the model says, what the prompt contains, or how creative the injection is. The decision happens in JavaScript, not in the model.

Comparison

| Property | Probabilistic | Deterministic | |----------|--------------|---------------| | Consistency | Variable | Same input = same output | | Attack resistance | Can be bypassed | Cannot be bypassed by model | | Coverage | Can handle novel cases | Only handles declared rules | | Speed | Slow (LLM inference) | Fast (microseconds) | | Testability | Difficult | Unit-testable | | Auditability | Nondeterministic | Fully auditable |

Use both

Deterministic safety handles known threats with certainty. Probabilistic safety can reason about novel situations. The right architecture uses both:

1. Deterministic layer first: Policy engine evaluates every action against hard rules. Known dangerous patterns are always blocked.
2. Probabilistic layer second: For actions that pass the policy engine, an LLM-as-judge can evaluate context-dependent risks that are hard to express in rules.

The deterministic layer is the floor. It guarantees a minimum level of safety. The probabilistic layer adds nuance above that floor.

Why deterministic is the foundation

When you are under attack, you need guarantees, not probabilities. A prompt injection that bypasses system prompt instructions will not bypass a policy engine running in code. This is why deterministic enforcement is the foundation of any production safety system.

Build the deterministic rules first. Add probabilistic analysis as an enhancement, not a replacement.