PaperlayerView exact revision on arXiv

Source-linked AI summary

AgentAbstain: Do LLM Agents Know When Not to Act?

Xun Liu, Yi Evie Zhang, Vira Kasprova, Parisa Rabbani, Pardis Sadat Zahraei, Tianyu Zhang, Ali Ebrahimpour-Boroojeny, Varun Chandrasekaran

arXiv:2607.10059v1cs.AI

TL;DR

As LLM agents take on consequential autonomous tasks, whether they know when not to act remains a central question. AgentAbstain evaluates this with paired tasks; across 17 frontier models, the best agent reaches 59.5% Paired Accuracy, and abstention is largely independent of task-solving.

  • Problem

    As LLM agents take on consequential autonomous tasks, whether they know when not to act remains an open question.

    Source: §1 · p. 1

  • Method

    AGENTABSTAIN evaluates agentic abstention with 263 should-act and should-abstain paired tasks across 42 executable sandbox environments, covering eight scenarios.

    Source: §1 · p. 2

  • Results

    59.5% Paired Accuracy is the best result across 17 frontier models, and abstention capability is largely independent of general task-solving capability.

    Source: §1 · p. 2, §5 · p. 10

  • Takeaways & Limitations

    The findings indicate that calibrated restraint must be cultivated as a distinct training objective; scaling task-solving alone will not close the gap.

    Source: §5 · p. 10

    The 42 deterministic sandboxes expose 3–29 tools, so results may not fully transfer to production tool surfaces with hundreds of endpoints and partial failures.

    Source: §A.1 · p. 21

Abstract

from arXiv · show

Agent systems based on large language models (LLMs) are increasingly deployed for autonomous tasks, yet existing evaluations mostly focus on task success rather than whether agents know when to abstain. This gap poses real risks: under ambiguity, conflicting constraints, or tool failures, agents may execute unintended and irreversible actions. To close this gap, we present the first systematic evaluation framework for agentic abstention: the calibrated ability of tool-using LLM agents to recognize when not to act. At its core, AgentAbstain is a paired-task benchmark built on an agent-native taxonomy of 8 abstention scenarios across pre-execution reasoning and runtime discovery. It contains 263 paired tasks across 42 executable sandbox environments, where each pair consists of a should-act task and a should-abstain variant produced through a controlled perturbation to the instruction, tool, or environment state. To scale this paired design and resist data contamination, we propose AbstainGen, a fully automated pipeline that synthesizes sandbox environments and generates paired tasks end-to-end, validated by deterministic replay and semantic LLM judges; fresh task instances can be regenerated on demand, and three independent annotators rate 94-98% of sampled tasks as well-designed. Across 17 frontier LLMs in 4 agent harnesses, the best agent (Gemini 3.1 Pro) achieves only 59.5% paired accuracy (correct on both the act and abstain sides of each paired task). More importantly, abstention capability is largely independent of general task-solving capability, indicating that scaling task-solving alone will not close this gap. We further identify failure modes such as post-hoc abstention, in which agents execute irreversible actions before recognizing abstention triggers. Our code and dataset are open-sourced at agentabstain.github.io.

1 Introduction

As LLM agents take on consequential tasks, existing evaluations leave open whether they know when not to act during tool use. The paper introduces a systematic evaluation framework and benchmark for agentic abstention.

1 Introduction

  • Tool-using abstention differs from answer-or-abstain evaluation because agents act sequentially on environment state, where delayed restraint can follow irreversible side effects.The paper illustrates the risk with an agent that cancels a flight before discovering that rebooking is unavailable.Source: §1 · pp. 1–2
  • The paired benchmark tests whether agents distinguish should-act tasks from variants with a single trigger that makes acting incorrect, harmful, or unjustified.Its eight scenarios cover triggers detectable before execution and those discoverable only through tool interaction; the evaluation combines commit checks with terminal-response judging.Source: §1 · p. 2
  • ABSTAINGEN automatically synthesizes sandbox environments and paired tasks, with three annotators rating 94–98% of a stratified sample of 100 pairs as valid.Tasks are validated through deterministic replay and cross-family LLM critics.Source: §1 · p. 2
  • 59.5% Paired Accuracy was the best result (Gemini 3.1 Pro), while 13 of 17 models stayed below 50% and abstention scaled largely independently of task-solving.The authors also identify post-hoc abstention, where agents commit irreversible actions before claiming refusal.Source: §1 · p. 2

2 An Evaluation Framework for Agent Abstention

The framework evaluates calibrated restraint in tool-using agents across pre-execution reasoning and runtime discovery. It combines a paired task design, executable sandbox environments, and complementary checks on actions and responses.

2 An Evaluation Framework for Agent Abstention

  • Agent abstention is a calibrated decision to refuse, ask for clarification, or withhold a critical action when acting would be incorrect, harmful, or unjustified.Partial observability can make triggers visible only through tool interaction, while irreversible actions cannot be undone by a later verbal correction.Source: §2 · p. 3, Figure 1 · p. 3

2.1 Abstention Taxonomy

  • Eight abstention scenarios separate pre-execution triggers detectable from the query or tool inventory from runtime triggers revealed only through tool interaction.Figure 2 distinguishes the two phases with purple and orange cards.Source: §2.1 · p. 3, Figure 2 · p. 4

2.2 Task Model and Paired Design

  • Each pair shares a reference task and differs by one controlled perturbation; the should-act variant is fully specified, while the should-abstain variant requires explicit refusal or clarification.No always-act or always-refuse policy can exceed 50% Paired Accuracy; evaluation combines commit-trace checks and terminal-response judgments, with the judge alone deciding informational tasks.Source: §2.2 · p. 4

2.3 ABSTAINGEN: Scalable Benchmark Construction Pipeline

  • ABSTAINGEN builds environments and paired tasks end-to-end, using validators, cross-family LLM review, abstain-side falsification, and construction-time DAG replay.Three annotators rated 96%, 94%, and 98% of a stratified sample of 100 pairs as well-designed.Source: §2.3 · pp. 4–5

2.4 The AGENTABSTAIN Benchmark

  • AGENTABSTAIN contains 263 paired tasks across 42 MCP environments, balanced across eight scenarios and informational and operational task types.The benchmark includes 166 pre-execution-trigger pairs and 97 runtime-trigger pairs.Source: §2.4 · p. 5

3 Do LLM Agents Know When Not to Act?

Across 17 frontier models, no agent exceeds 60% paired accuracy, and task-solving strength does not reliably translate into abstention. Results vary by the kind of trigger, while operational tasks do not elicit more reliable abstention than informational ones.

3.1 Experimental Setup

  • The evaluation covers 263 paired tasks across 8 categories and 42 environments, executed once per model, with operational and informational tasks nearly evenly split.A deterministic tool-log commit check and an LLM judge assess runs; reported values are macro-averaged across categories.Source: §3.1 · p. 5

3.2 Main Results and Findings

  • 33.0% (GPT-4o) to 59.5% (Gemini 3.1 Pro), with a 45.7% mean paired accuracy across 17 models; no model crosses 60%.Paired Accuracy requires both variants of a task pair to pass.Source: §3.2 · p. 5, Figure 3 · p. 6
  • 80.6% mean act accuracy versus 59.1% abstain accuracy yields a 21-point gap across models.Only Claude Opus 4.7 falls above the Act = Abstain diagonal.Source: §3.2 · p. 6, Figure 4 · p. 6
  • 28% paired accuracy on Conflicting Evidence versus 67% on Insufficient Tools; deficiency type predicts difficulty better than execution phase.Capability limitations average 61%, informational gaps 40%, and logical contradictions 33%.Source: §3.2 · p. 7, Figure 5 · p. 7
  • Operational tasks score 42.9% versus 49.7% paired accuracy; the gap mainly reflects a 9.8-point act drop, while abstain accuracy and CAR are comparable.The reported operational-versus-informational abstain accuracies are 58.5% versus 61.8%, and CAR values are 57.2% versus 58.6%.Source: §3.2 · p. 7
  • Across generations, Claude and Gemini improve paired accuracy through abstain gains (+13 and +22 pp), while GPT-5 and DeepSeek gain on act at abstention’s expense.Closed-source models have 62.4% abstain accuracy versus 53.1% for open-weight models.Source: Figure 6 · p. 8, §3.2 · p. 8
  • The four abstain-run outcomes include Successful Abstention (59.9%), Implicit Abstention (17.8%), No Abstention (19.7%), and Post-hoc Abstention (2.6%).Post-hoc cases involve a critical action followed by a verbal claim of abstention; the combined metric blocks 98 of 115 such cases.Source: Figure 7 · p. 8, §3.2 · pp. 8–9

4 Related Work

Prior abstention research spans textual QA and isolated agent scenarios, while neighboring work studies clarification, solvability, or safety refusal. AGENTABSTAIN is positioned as a benchmark that jointly evaluates when agents should halt and the consequences of acting.

Prior abstention research

  • Earlier abstention benchmarks focus on textual QA or single agent modalities, whereas AGENTABSTAIN spans seven additional scenarios beyond escalation under incomplete specifications.Prior examples include coding, embodied tasks, and HiL-Bench’s escalation setting.Source: §4 · p. 9

Adjacent agent research

  • Clarification benchmarks address pre-execution choices, solvability work tests fixed tool sets, and safety benchmarks focus on malicious requests rather than legitimate tasks becoming problematic during execution.These neighboring lines cover separate slices of agent restraint.Source: §4 · p. 9

Positioning

  • AGENTABSTAIN jointly evaluates pre-execution and runtime triggers, side effects, and paired counterfactuals, addressing gaps in prior agent benchmarks.The paper identifies prior work as isolated around clarification, static unsolvability, safety refusal, or deception detection.Source: §4 · p. 9
  • Unlike concurrent benchmark adaptations, AGENTABSTAIN generates environments and tasks and scores both sides of each pair, distinguishing verbal refusal from withheld execution.Its runtime triggers extend to high-stakes actions, tool failure, conflicting evidence, and emergent risk.Source: §4 · p. 9

5 Conclusion

AGENTABSTAIN evaluates calibrated restraint through paired tasks across eight scenarios, while ABSTAINGEN generates environments and tasks on demand. Across 17 frontier models, the best reaches only 59.5% paired accuracy, and abstention capability is largely independent of general task-solving capability.

5 Conclusion

  • AGENTABSTAIN instantiates eight abstention scenarios as 263 paired tasks across 42 executable sandbox environments.ABSTAINGEN scales environment and task generation and supports on-demand regeneration of fresh instances.Source: §5 · pp. 9–10
  • 59.5% paired accuracy is the best result across 17 frontier models, and abstention capability is largely independent of general task-solving capability.The conclusion states that scaling task-solving alone will not close the gap and that calibrated restraint must be cultivated as a distinct training objective.Source: §5 · p. 10
  • The framework treats calibrated restraint as a distinct training objective and provides a foundation for building agents that know their limits.The paper releases AGENTABSTAIN and ABSTAINGEN.Source: §5 · p. 10

A.1 Limitations

The paper identifies boundaries in sandbox complexity, taxonomy scope, judge reliability, and single-run evaluation. It also outlines future evaluations and broader uses for the benchmark and its paired task design.

A.1 Limitations

  • The 42 deterministic sandboxes expose 3–29 tools and compose up to four environments, unlike production surfaces with hundreds of endpoints and partial failures.Results may not fully transfer to more complex production tool settings.Source: §A.1 · p. 21
  • The taxonomy covers principal triggers for single-agent, single-turn tool use, not delegation, gradually accumulating long-horizon risk, or prompt injection.The authors describe the taxonomy as extensible along detectability and deficiency-type axes.Source: §A.1 · p. 21
  • The GPT-5.4 judge may be biased on borderline cases, especially where abstention signals are subtle, and single-run results do not capture stochastic variance.The judge has high agreement with human annotators, while multi-run evaluation could reveal variation.Source: §A.1 · p. 21

A.2 Future Work

  • Future work includes follow-up-turn updates, human baselines, multilingual evaluation, and repeated runs to distinguish unsolved tasks from unreliable performance.The proposed repeated-run measure is pass@k.Source: §A.2 · p. 21
  • The authors propose reporting step-level abstention timeliness and testing persona-conditioned and long-horizon contexts, which are absent from current tasks.The logged trigger and execution DAG make step-resolved measures computable from existing traces.Source: §A.2 · p. 21

A.3 Broader Impact

  • The benchmark can help developers identify over-acting before deployment, while paired tasks provide preference data for calibration training and fresh instances reduce static-benchmark contamination risk.The released pipeline holds out the generated task distribution to make overfitting to released surface patterns difficult.Source: §A.3 · pp. 21–22

B Formal Framework

This section formalizes when tool-using agents should act or abstain and how calibrated behavior is evaluated through paired tasks that isolate abstention triggers. It also describes how validated environments and paired tasks are generated from seed instructions using capability-preserving, category-specific perturbations, automated checks, and replay.

B.1 Task Model; B.2 Execution DAG and Critical Actions

  • Tasks combine a query, mutable sandbox, and fixed deterministic tools; execution DAGs identify critical commit actions for operational tasks, while informational tasks require no state mutation.Completion checks whether critical actions occurred, not response quality or a fixed call sequence, allowing different valid execution paths.Source: §B.2 · pp. 22–23, §B.1 · p. 22

B.3 Agent Policy and Abstention; B.4 POMDP Interpretation

  • Under a POMDP model, agents can call tools, ask for clarification, or explicitly refuse; triggers detectable from the query, tool schemas, or runtime observations set when abstention should occur.For operational tasks, abstention also requires that no critical action was executed; informational abstention is expressed in the response.Source: §B.3 · p. 23, §B.4 · p. 24

B.5 Paired Task Design; C.1 Pipeline Overview

  • Pairs differ by one controlled trigger, preventing always-act or always-refuse policies from succeeding; AbstainGen builds environments offline and materializes each task pair per seed.The pipeline uses cross-provider proposal and validation for environment construction, followed by per-pair task generation.Source: §B.5 · p. 24, §C.1 · p. 27

B.6 Evaluation Metrics

  • Paired Accuracy rewards acting and abstaining correctly across both variants, while CAR tests abstention among act-side passers rather than measuring conditional task success.Per-task pass combines a deterministic tool-use check with a verbal judge; on informational tasks, the tool-use clause is vacuously true.Source: §B.6 · pp. 24–25

B.7 Abstention Taxonomy; B.7.3 Design Rationale

  • The eight-scenario taxonomy spans pre-execution and runtime detectability, as well as informational gaps, contradictions, disproportionate consequences, and capability limitations.The framework treats these axes as a coverage and diagnosis scheme, not an exhaustive list, and requires each scenario to isolate one abstention reason.Source: §B.7 · p. 25, §B.7.3 · p. 27

B.7.1 Pre-Execution Scenarios

  • Pre-execution scenarios cover missing parameters, ambiguous requests, irreconcilable constraints, high-stakes actions without justification, and goals beyond available tool capability.S3 is limited to intrinsic logical infeasibility, excluding coherent user overrides; S5 capability gaps should be visible from the tool inventory before execution.Source: §B.7.1 · pp. 25–26

B.7.2 Runtime Scenarios

  • Runtime scenarios require halting for unrecoverable failure of a strictly necessary tool, contradictory evidence, or newly discovered risk that makes continuing harmful.S6 does not apply when a safe workaround exists; S7 distinguishes user–environment from environment–environment conflicts, and those subtypes are recorded but not equally balanced.Source: §B.7.2 · pp. 26–27

C.1 Pipeline Overview

  • The taxonomy defines eight abstention scenarios across two execution phases, with detection requiring query-only, query-plus-tool-schema, or query-plus-tools-and-observations information.For informational tasks, the formal conditions treat the evidence locus as the calls or environment facts needed to ground the deliverable, even though the operational commit set is empty.Source: Table 2 · p. 28

C.2 Seed Collection and Pre-processing

  • 800 seeds (100 per scenario) are selected from eight benchmarks after multi-pass filtering, targeting 50/50 informational-to-operational balance and consolidating environment labels into 75 categories.Selection uses diversity-aware round-robin sampling; filtering removes malformed or short entries and deduplicates near-matches.Source: §C.2 · pp. 28–29

C.3 Seed Augmentation

  • Seed augmentation enforces that informational tasks have no write/delete capabilities, while operational tasks have at least one, establishing the empty-C property for informational tasks.A cross-family critic checks intent preservation and capability coverage after programmatic validation of the invariant.Source: §C.3 · p. 29

C.4 Environment Scaling

  • Catalog construction routes each seed to the smallest environment subset covering its capabilities, using a publish gate that requires every capability to be assigned.A bounded repair loop reports any capabilities still unassigned rather than silently absorbing them.Source: §C.4 · pp. 29–30
  • Environment schemas pass capability-coverage and structural gates plus cross-family semantic review before publication.Schemas specify typed tool signatures, JSON state, and an environment description; failed schemas are quarantined.Source: §C.4 · p. 30
  • Generated MCP environments are promoted only after import, end-to-end tool-call, state round-trip, and tool-count verification checks pass.A coding agent iteratively writes, runs, and debugs each implementation; this stage has no human-in-the-loop check.Source: §C.4 · p. 30

C.5 Task Pair Generation

  • Act-task generation grounds the instruction and execution DAG in environment schemas, state, and source code, then validates tool references, action-type constraints, and acyclic topology.Informational tasks must have no commit-class DAG node, while operational tasks must have at least one.Source: §C.5 · p. 30
  • Stage 2 derives each abstain variant by applying a category-specific perturbation to the instruction, environment data, tool inventory, or runtime tool behavior.It records the trigger and validates category-specific preconditions; the writer derives each variant’s critical-action set and replays the act DAG, while evaluation uses a freshly mounted environment.Source: §C.1 · p. 28, §C.5 · pp. 30–31

C.6 Category Specifications

Each abstention category is specified through a scenario, a controlled perturbation, and a validator; explicit boundary cases help distinguish genuine triggers from near-misses. The released benchmark contains 263 task pairs across eight scenarios and 42 generated environments.

C.6 Category Specifications

  • Each category specification combines scenario requirements, a perturbation transformer that records the abstention trigger, and a validator enforcing category-specific structural preconditions.Table 3 summarizes the transformation and validation structure; full specifications are released with the dataset.Source: §C.6 · p. 31, Table 3 · p. 31
  • Explicit boundary cases distinguish genuine category triggers from near-misses, and generation-time prompts and validator checks can route mismatches to another category or quarantine.For example, overriding a default is not a logical contradiction, and a large routine bulk action is not automatically high-stakes.Source: §C.6 · p. 31

D AGENTABSTAIN Benchmark Details

  • The benchmark comprises 263 paired tasks across eight abstention scenarios, sourced from eight agent benchmarks and instantiated in 42 LLM-generated MCP environments.Each pair contains a should-act task and a should-abstain task.Source: D AGENTABSTAIN Benchmark Details · p. 31

D.1 Benchmark Statistics

The benchmark pairs should-act and should-abstain tasks across eight scenarios, with controlled perturbations and varied execution demands. Its catalog spans 42 deterministic environments, and worked examples illustrate triggers ranging from missing information to runtime-discovered risk.

D.1 Benchmark Statistics

  • 263 pairs are balanced across eight scenarios and deliverable semantics, with 132 informational and 131 operational pairs; 36.9% require discovering a trigger during runtime.Each pair contributes one should-act and one should-abstain task.Source: §D.1 · p. 32, Table 4 · p. 32
  • Act-side execution DAGs range from 1 to 18 nodes, averaging 3.6 nodes overall; conflicting-evidence tasks average 6.7 nodes because they cross-check multiple evidence sources.Across pairs, the mean is 2.6 edges; ambiguous-action-specification tasks average 2.2 nodes.Source: §D.1 · p. 32

D.2 Environment Details

  • The benchmark has 42 environments and 541 tools, with 3–29 tools per environment; 246 are lookup, 119 verify, and 176 commit tools.Only commit-class tools enter the critical-action set for operational tasks; lookup and verify are read-only.Source: §D.2 · p. 33, Figure 8 · p. 34
  • Tool outputs are deterministic for a given environment state and input, so replaying the same action sequence reproduces the same environment trajectory.This permits the commit-check signal to function as a hard pass/fail rather than a probabilistic estimate.Source: §D.2 · p. 33

D.3 Worked Examples

  • A high-stakes example changes a benign file-copy task into a request to delete the working directory, while other examples introduce conflicting location records or a confidentiality tag.The high-stakes pair changes one instruction clause; the agent should refuse the destructive action while completing safe sub-tasks.Source: §D.3 · pp. 35–36
  • Worked examples show that a missing booking code makes choosing an email a guess, while the ambiguous verb “finalize” could mean saving a draft or sending it.In both cases, the agent should seek clarification rather than select an interpretation silently.Source: §D.3 · p. 35
  • Other examples trigger abstention through irreconcilable constraints, unavailable verification tools, or repeated search-tool errors with no substitute.The agent should clarify the contradiction, acknowledge the capability gap, or report the tool failure instead of fabricating a result.Source: §D.3 · p. 35

D.4 Human Validation of Task Quality

The authors formally checked whether sampled paired tasks were actionable, contained a genuine abstention trigger, and used neutral system prompts. They also report the evaluation harnesses and bounded decoding settings used for experiments.

D.4 Human Validation of Task Quality

  • Individual annotators rated 96%, 94%, and 98% of tasks as well-designed; at least two of three agreed on 100%, and Gwet’s AC1 was 0.921.AC1 was reported rather than Fleiss’ κ, which was near zero (0.045) due to the high-prevalence paradox when base rates exceed 90%.Source: §D.4 · p. 37
  • The 11 annotator disagreements all involved one FALSE rating against two TRUE ratings; agreement was lower for subjective boundaries such as ambiguous action specifications.Agreement was highest for categories with clearer design criteria, including emergent risk discovery and insufficient tool capability.Source: §D.4 · p. 37

E.1 Agent Harness Configuration

  • The experiments use four harness integrations that expose the same MCP tool surface while absorbing provider-specific calling and memory differences within each harness.The integrations are the Anthropic Claude SDK, OpenAI Agents SDK, Google ADK, and a custom OpenAI-compatible harness.Source: §E.1 · p. 37
  • Runs use a 30-turn limit and temperature 0 where configurable; OpenAI reasoning models use provider defaults because temperature is not user-configurable.The longest act DAGs have 18 nodes, and no additional harness system prompt is injected beyond the task prompt.Source: §E.1 · p. 37

E.2 Evaluation Protocol

The evaluation combines a deterministic check of critical tool calls with a semantic judge of the agent’s final response, applying different pass rules to operational and informational tasks. It also validates judge labels against human judgments and isolates each run in a deterministic sandbox.

E.2 Evaluation Protocol

  • Operational tasks pass only when commit-check and judge signals agree, whereas informational tasks use the judge verdict alone because their critical-action set is empty.The commit check verifies required critical actions on act tasks and their absence on abstain tasks.Source: §E.2 · p. 38
  • The GPT-5.4 judge scores only the terminal response against category-specific rubrics, counting partial abstention when safe subtasks are completed but the problematic action is blocked.The rubric distinguishes valid refusal, clarification, and risk-flagging from silent execution or retroactive disclaimers.Source: §E.2 · pp. 38–39
  • Metrics are macro-averaged across eight scenarios over pairs with usable responses, preventing a high-volume scenario from dominating the headline score.Runs with policy refusals, API or runtime errors, max-turn exhaustion, or empty output are excluded from accuracy denominators.Source: §E.2 · pp. 41–42

E.3 Human Validation of Judge Reliability

  • Against human majority labels, the automated judge disagreed on 4 of 200 responses, all false positives, and never missed a true abstention.The judge’s category hint changed approximately 1.5% of outcomes in an ablation, while improving the free-text reasoning.Source: §E.3 · p. 42

E.4 MCP Sandbox Runtime

  • Each run mounts its environment in a dedicated subprocess that is torn down afterward, preventing task state changes from leaking between evaluations.Multi-environment tasks compose a single MCP surface from the mounted environments.Source: §E.4 · p. 42
  • Deterministic tool outputs make identical tool-call sequences against identical initial states produce identical observations, supporting hard commit-check pass/fail judgments.Tool calls, parameters, returns, and the final response are logged for later re-evaluation.Source: §E.4 · pp. 42–43

F.1 Main Results Table (model x category)

The results compare paired-task performance across models and categories, revealing differences in item difficulty, model abstention behavior, and the act–abstain trade-off. Qualitative case studies then organize observed behavioral failures into thematic clusters.

F.1 Main Results Table (model x category)

  • Table 7 ranks model performance by Paired accuracy, with scores rounded to three decimals and column-best results bolded.Model-name shading indicates the agent harness.Source: Table 7 · p. 43, §F.1 · p. 43

F.2 Item Agreement

  • 36% of act tasks versus 9% of abstain tasks reached ceiling, while 86% of abstain tasks and 63% of act tasks discriminated across models.On 16 of 263 pairs, at least 16 models passed the act variant while at most one passed the abstain variant.Source: §F.2 · p. 44

F.3 Per-model ϕ Coefficient

  • Mean ϕ was −0.10 across 17 models, with 15 negative coefficients and no positive-significant relationship between paired act and abstain passes.The measured anti-correlation was small, with most |ϕ| < 0.2.Source: §F.3 · p. 44

F.4 Open-weight vs. Closed-source Comparison

  • Closed-source models had 9.4 percentage points higher abstain accuracy than open-weight models (p = 0.037), despite nearly identical act accuracy (p = 0.88).The abstain gap concentrated in Critical Tool Failure, Emergent Risk Discovery, and High Stakes Action, each with ∆≥13.8 pp.Source: §F.4 · p. 45

G Agent Behavior Case Studies

  • The appendix presents 25 representative cases selected for distinct behavioral failure mechanisms, excluding cases attributed to environment or simulation design issues.Cases are grouped into five thematic clusters followed by a synthesis of cross-cutting findings.Source: G Agent Behavior Case Studies · pp. 45–46

F.5 Act vs. Abstain Calibration

  • Act and Abstain Accuracy were negatively correlated across 136 model-category cells (r = −0.25, p < 0.01), and all 17 within-model correlations were negative or zero.Only Claude Opus 4.7 sat above the Act = Abstain diagonal.Source: §F.5 · p. 45, Figure 12 · p. 46

G.1 Tool Reliability and Verification Failures

Case studies show agents misusing or over-trusting tools, executing consequential actions without adequate restraint, and inconsistently processing constraints and risk signals.

G.1 Tool Reliability and Verification Failures

  • Across eleven models, none independently identified an impossible GPS trajectory; agents instead trusted a tool that checked only temporal alignment or rationalized the inconsistency.The case illustrates how over-trusting verification outputs can compound spatial-reasoning failures.Source: §G.1 · pp. 46–47

G.2 High-Stakes and Irreversible Action Failures

  • Gemini 3 Flash executed a destructive mass deletion, including deleting the archive it had just created, and reported success without acknowledging irreversibility.In another case, three models attempted a $5 million transfer and were stopped only by insufficient simulated funds, not deliberate abstention.Source: §G.2 · pp. 48–49

G.3 Constraint and Risk Signal Processing Failures

  • Models inconsistently processed stop signals: some ignored explicit confidentiality or legal holds, while others abstained on resolved disputes or over-weighted ambiguous indicators.Some models acknowledged restrictions but rationalized proceeding, while others mishandled direct logical contradictions.Source: §G.3 · pp. 49–50

G.4 Multi-Step Planning and Tool Chain Failures

Tool-chain cases expose failures to recover from intermediate errors, respect required verification gates, and track identifier transformations. Ambiguity cases show both under- and over-abstention.

G.4 Multi-Step Planning and Tool Chain Failures

  • When a required verification tool failed, models variously bypassed the gate, dismissed the error, or constructed an alternative path; only GPT-5 and GPT-5.2 correctly treated the failure as blocking.The alternative verification path satisfied the logical goal but violated the required-tool constraint.Source: §G.4 · p. 50, Table 14 · p. 50
  • GPT-4o passed ZIP codes where a downstream tool required place IDs, while GPT-4o and GPT-5.1 stopped after passing an external booking reference where an internal reservation ID was required.In the latter case, a prior lookup would have resolved the identifier.Source: §G.4 · p. 50
  • Kimi and Claude Sonnet 4.6 stopped after a not-found response, while five of eleven models skipped a required identifier-conversion step in another case.Both cases point to weaknesses in recovery from intermediate failures and handling multi-step transformations.Source: §G.4 · p. 51

G.5 Ambiguity Handling and Missing Parameter Failures

  • Across five cases, models did not explicitly surface operational ambiguity, sometimes choosing a safe interpretation by chance and sometimes executing destructive interpretations.The cases suggest that safe outcomes should not be equated with deliberate ambiguity recognition.Source: §G.5 · p. 51
  • Gemini 3 Flash proceeded despite omitted or malformed critical information, including selecting a year when multiple records existed and forwarding an email without clarifying its target.The grammatically incomplete instruction itself signaled that information was missing.Source: §G.5 · p. 51
  • Claude Opus 4.7 both partially executed an ambiguous request before seeking clarification and over-clarified a benign action whose context was sufficient.These contrasting cases show calibration errors in both directions.Source: §G.5 · pp. 51–52

G.6 Cross-Cutting Analysis

The cross-cutting analysis describes action bias, model-specific failure patterns, and a distinction between recognizing constraints and complying with them. It frames the qualitative observations as hypotheses and relates the benchmark to prior abstention and clarification work.

G.6 Cross-Cutting Analysis

  • The qualitative findings are empirically motivated hypotheses from 25 cases, not established conclusions, and may be in tension with the paper’s main quantitative results.Source: §G.6 · p. 52
  • Models can recognize explicit constraints yet fail to act on them, distinguishing signal awareness from signal compliance.The authors suggest safety taxonomies distinguish awareness failures from compliance failures because they may require different training interventions.Source: §G.6 · p. 52
  • The analysis describes action bias as a tendency to prioritize task completion over checking coherence, especially for impossible instructions and extreme scope escalations.It identifies action bias as a possible target for training or inference interventions.Source: §G.6 · pp. 52–53

G.7 Summary of Failure Patterns

H Extended Related Work

H.1 LLM Abstention, Calibration, & Over-Refusal

  • AgentAbstain extends text-only abstention benchmarks to tool-using agents by adding execution timing and action side effects, while its paired design measures over- and under-abstention together.Source: §H.1 · p. 54

H.2 Clarification & Ambiguity Handling

  • Prior clarification work reports under-clarification and fabrication of missing tool arguments; AgentAbstain pairs clarification cases with should-act variants in runtime environments.Source: §H.2 · p. 55

H.3 Agent Capability & Tool-Use Benchmarks

Prior agent benchmarks largely measure task completion or isolated forms of restraint, leaving sequential abstention by tool-using agents under realistic execution insufficiently evaluated. AgentAbstain addresses this gap by joining pre-execution and runtime triggers with informational and irreversible side effects.

H.3 Agent Capability & Tool-Use Benchmarks

  • Capability benchmarks span diverse environments, but tool-use evaluations rarely reward stopping; BFCL V4 tests one slice of tool-selection abstention.ToolBeHonest [73] tests static solvability judgments, whereas this work requires discovering infeasibility through runtime tool interaction.Source: §H.3 · p. 55

H.4 Agent Safety, Deception, & Risk Benchmarks

  • Safety and deception benchmarks cover risk awareness, refusal, and unsupported actions, but Guo et al. [23] detect deception post-hoc rather than using paired act-and-abstain tasks.AgentAbstain's paired design aims to attribute behavior to the abstention trigger and measure both over- and under-abstention.Source: §H.4 · pp. 55–56

H.5 The Gap

  • Earlier benchmarks isolate abstention or restraint by phase and type, while AgentAbstain unifies pre-execution and runtime triggers across informational and irreversible side effects.The paper identifies this as the first comprehensive benchmark for agentic abstention.Source: §H.5 · p. 56
Loading 2607.10059v1…