LLM-solver loops: researchers find narration gap in LLM+solver

Zunchen Huang and Songgaojun Deng submitted an arXiv paper on 17 Jun 2026 that models the interaction between language models and formal solvers and demonstrates a concrete vulnerability: solver-produced, independently verifiable answers can lose their soundness once the result is turned into the user-facing narration. The authors evaluated five open-sourced models under prompt injection and combined formal analysis with empirical tests to map where the guarantee breaks down.

What is the narration gap?

The narration gap is the loss of the solver’s soundness guarantee in the step that converts a solver verdict into the user answer. The hybrid LLM-solver pipeline the authors describe has three components: formalizing the question, deciding it, and narrating the result. Formal tools such as SAT and SMT solvers produce sound, independently verifiable answers, but the narration step can subvert that soundness when a language model translates the solver’s output into natural language for the user.

The paper contrasts this narration step with chain of thought, where intermediate steps are sampled from the model distribution without formal guarantees, and emphasises that prior work studied formalization and decision but not narration.

How did the authors test it and what did they find?

They model the LLM-solver loop as a verified decision procedure and then run empirical attacks: prompt injection across five open-sourced models. The authors find that certificate gating makes the solver verdict sound, however an adversary can invert a verified conclusion across phrasings and channels. A hardened prompt reduces injection significantly but cannot eliminate it and still suffers under adaptive attack.

Concretely, the study evaluates five open-sourced models under prompt injection. Certificate gating preserves the solver’s verdict at the decision level, but the experiments show the final answer the user reads can be flipped by an adversary who manipulates narration. The authors therefore argue that robustness at the solver output does not automatically reach the narrated answer.

Why it matters

The paper exposes a gap between machine-verifiable correctness and what users actually receive. Systems that embed formal solvers to answer safety or security critical questions may rely on the solver for soundness while overlooking the weaker guarantees of the narration layer. That disconnect lets attackers exploit natural-language channels to present inverted or misleading conclusions, even when the underlying solver verdict is correct.

Designing secure reasoning pipelines requires treating narration as part of the security boundary. The authors’ results show certificate gating and hardened prompts raise the bar, but neither is a full fix, and adaptive attackers can still produce failures.

What to watch

Look for follow-up work that targets the narration step specifically: techniques that bind solver certificates to unforgeable narrated outputs, or rigorous interfaces that prevent cross-phrasing inversion. Also watch for defenses evaluated against adaptive attacks, since the paper finds hardened prompts still fail under that threat model.

The study is available on arXiv as arXiv:2606.19588, submitted 17 Jun 2026, and is authored by Zunchen Huang and Songgaojun Deng. It provides both a formal model of the LLM-solver loop and empirical evidence from five open-sourced models that narration remains a practical weak point.