Safe and Adaptive Cloud Healing: Verifying LLM-Generated Recovery Plans with a Neural-Symbolic World Model

Abstract: As the scale and complexity of cloud-based AI systems continue to escalate, ensuring service reliability through rapid fault detection and adaptive recovery has become a critical challenge. While existing approaches integrate LLMs for semantic understanding and Deep Reinforcement Learning (DRL) for policy optimization, they often rely on sequential, loosely coupled architectures that underutilize the generative and reasoning capabilities of LLMs. In this paper, we propose a paradigm shift with PASE, a Planning-Aware Semantic self-healing engine, a novel fault self-healing framework that reconceptualizes recovery as a neuro-symbolic program synthesis task. PASE employs an LLM as a core Plan Synthesis Engine to generate structured recovery plans from a library of semantic primitives. A Neural-Symbolic World Model verifies plan feasibility through simulation, while a Meta-Prompt Optimizer, trained via DRL, learns to generate optimal prompts that guide the LLM's planning process. This tight reason-plan-verify-adapt loop enables dynamic, context-aware recovery strategy generation beyond predefined action spaces. Experiments on a real-world cloud fault injection dataset demonstrate that PASE significantly outperforms state-of-the-art methods, reducing average system recovery time by over 40% and improving fault detection accuracy in unknown fault scenarios. Our framework advances autonomous system management by unifying LLM-based reasoning with model-assisted verification and meta-learned guidance.

• The paper introduces PASE, which leverages LLM-driven plan synthesis paired with neural-symbolic verification to enable adaptive cloud recovery.
• It employs a DRL-based meta-prompt optimizer that improves recovery from 40% to over 80% success within 15 online episodes, reducing recovery latency by over 40%.
• Experimental results on OpenStack show high fault detection accuracy (F1-score 0.94) and robust multi-step recovery planning with effective simulation-based validation.

Safe and Adaptive Cloud Healing via LLM-Driven Plan Synthesis and Neural-Symbolic World Model Verification

Background and Motivation

Cloud-based AI systems increasingly underpin mission-critical services, yet the complexity of their architectures—composed of interdependent microservices, distributed orchestrators, and numerous heterogeneous control planes—renders reliable, adaptive recovery from faults daunting. Faults propagate ambiguously through graphs of dependencies, and mapping system observability data (logs, metrics, alarms) to effective recovery action remains non-bijective and context-dependent. Rule-based triggers and static model-based automation fail to generalize as deployment complexity grows. Emerging approaches integrating LLMs and DRL for self-healing treat LLMs predominantly as passive state interpreters, marginalizing their generative planning capacity and lacking any plan verification before risky cloud actions.

The "Safe and Adaptive Cloud Healing: Verifying LLM-Generated Recovery Plans with a Neural-Symbolic World Model" (2607.01595) paper proposes a new paradigm addressing these challenges, establishing a closed-loop, neuro-symbolic approach, where LLMs not only synthesize adaptive plans but are rigorously verified and meta-optimized.

Figure 1: The conceptual transition from state-action selection without verification to a closed plan-verify-adapt loop with LLM planning, neural-symbolic simulation-based verification, and DRL-based meta-prompt optimization.

PASE: Architecture and Methodology

The Planning-Aware Semantic self-hEaling engine (PASE) reconceptualizes cloud recovery as neuro-symbolic program synthesis. Its core pipeline (Figure 2) features three jointly trained modules:

1. LLM-Based Plan Synthesis Engine (PSE): Rather than mapping observations to actions, the LLM, supplied with a semantic system description and a library of recovery primitives, synthesizes a structured, multi-step recovery plan tailored to each dynamic context.
2. Neural-Symbolic World Model (NSWM): This hybrid model simulates the real-world outcomes of candidate plans at the primitive level. It combines neural network-based pattern learning with symbolic constraints, yielding feasibility scores that balance reliability (low safety violations, accurate prediction) with real-time efficiency.
3. Meta-Prompt Optimizer (MPO): A DRL agent meta-learns to generate continuous prompt embeddings that steer the LLM planner towards more effective, actionable strategies, enabling rapid adaptation to emergent, novel fault scenarios.

The entire PASE decision loop is tightly coupled: semantic observation → meta-prompt embedding → plan synthesis → world model-based simulation → execution, with only verifiably feasible plans enacted.

Figure 2: PASE workflow: Observations are semantically described, prompting is meta-optimized, recovery plans are synthesized, simulator-verified, and executed only when the plan's score exceeds the safety threshold.

Experimental Evaluation

PASE's evaluation leverages a real-world OpenStack cloud fault injection dataset comprising diverse and multi-modal failures. Baselines include the IFSHM (a two-stage LLM+DRL pipeline), state-of-the-art time-series/graph-based detectors, and a rule-based expert system.

Fault Detection and Recovery Performance

PASE achieves F1-scores of 0.94 for fault detection and a mean recovery time of 72s (with a standard deviation of 8s), marking a greater than 40% reduction in recovery latency relative to state-of-the-art baselines. Its multi-modal semantic fusion and end-to-end plan optimization allow for both higher detection fidelity and expedited, context-sensitive recovery.

Figure 3: LLM-based PASE demonstrates superior detection accuracy compared to baselines across fault types.

Figure 4: PASE consistently yields shorter mean time-to-recovery, highlighting gains in both efficacy and efficiency.

Plan Quality and Verification

PASE-generated recovery plans exhibit higher structural complexity and adaptivity—averaging 3.2 distinct recovery primitives per successful plan—enabling composite, causally targeted recovery not feasible in fixed-action pipelines. The NSWM feasibility score has a 92% empirical correlation with actual recovery success, demonstrating that pre-execution simulation is a reliable predictor and disruptor of harmful plan execution.

Figure 5: Ablation reveals PASE’s neural-symbolic world model achieves the best balance of simulation accuracy (Plan Feasibility AUC 0.92, MSE 0.014) and computational efficiency versus alternative architectures.

Rapid Adaptation and Meta-Prompt Optimization

Injecting previously unseen hybrid faults, the DRL-based MPO enables PASE to raise its fault recovery success from 40% to >80% within just 15 online episodes—substantially outperforming baselines in adaptability. SAC-based optimization yields faster, stabler convergence and better generalization than evolutionary strategies, PPO, or direct LLM fine-tuning.

Figure 6: Meta-prompt optimization via SAC converges in the fewest episodes to the highest reward, enabling rapid adaptation to previously unseen failures.

Practical and Theoretical Implications

PASE shifts the cloud recovery paradigm from reaction to reasoned, simulation-backed plan generation and rapid adaptation. Immediate practical implications include improved service SLAs, reduced cost of downtime, and containment of novel cascades in production cloud deployments. Theoretically, PASE demonstrates the value of unifying generative LLM planning, model-based verification, and DRL-based meta-learning in continuous-action controllers.

Several limitations remain: current world model simulation overheads can increase marginally over simpler decision cascades; LLM adaptation relies on offline fine-tuning, limiting instantaneous learning from rare events; and centralized data access may not map to privacy-sensitive or federated contexts.

Future Directions

Further work is warranted in online continual learning for the LLM planner, model compression for lightweight NSWM deployment, and extension to federated/multi-cloud settings with privacy-preserving mechanisms. Improving prompt meta-learning stability and incorporating explicit human feedback for rare catastrophic scenarios are promising avenues. There is also potential in generalizing PASE’s meta-optimization to other high-stakes autonomous planning settings, such as multi-agent collaboration and edge-cloud orchestration.

Conclusion

PASE constitutes a rigorously validated, end-to-end neuro-symbolic self-healing engine for cloud AI systems. By integrating LLM-based plan synthesis, neural-symbolic world model verification, and DRL-based meta-prompt optimization in a closed adaptive loop, it establishes higher fault detection accuracy, faster and more nuanced recovery, and robust, sample-efficient adaptation to novel failure contexts. This architecture substantiates a new template for autonomous, resilient system design, blurring longstanding boundaries between planning, verification, and continual adaptation in AI-driven operations.