PaperlayerView exact revision on arXiv

Source-linked AI summary

TrustDABench: Benchmarking Reliability and Robustness of LLMs for Structured Data Analysis

Boshen Shi, Yize Liu, Chen Zhao, Ce Chi, Zhendong Wang, Xing Wang, Junlan Feng

arXiv:2608.24145v1cs.CLcs.SE

TL;DR

Structured-data analysis is trustworthy only when answers follow supported evidence paths, including appropriate refusal when those paths break and invariant reasoning when table representations change. TrustDABench operationalizes these requirements with controlled perturbations and evaluates eight LLMs, finding low reliability and persistent robustness failures. The results motivate stronger evidence-boundary checking and representation-invariant reasoning.

  • Problem

    Structured-data analysis needs evaluation beyond answer correctness because trustworthy answers must be supported by complete, unique, sufficient, and consistent evidence paths.

  • Method

    TrustDABench derives 19 evidence-path perturbation operators and uses an Agentic-LLM generation and validation framework to construct human-verified benchmark instances.

  • Results

    Across eight evaluated LLMs, reliability and robustness remain imperfect, with conflicting evidence and structural perturbations exposing distinct failure patterns.

  • Takeaways & Limitations

    Reliable structured-data analysis requires evidence-boundary recognition and reasoning that remains invariant across diverse structured representations.

  • Takeaways & Limitations

    Absolute reliability remains low, and perturbation-aware prompting does not replace intrinsic evidence-boundary checking throughout the analysis chain.

Abstract

from arXiv · show

LLMs are increasingly used to analyze spreadsheets, CSV files, and other structured data, but producing a correct-looking answer is not the same as producing a trustworthy analysis. A trustworthy result should be supported by a valid path from the user question to the relevant data evidence. This requirement creates two diagnostic questions: whether an LLM can refuse to answer or ask for clarification when such a path does not exist, and whether it can preserve the correct analysis when the same evidence is expressed in different table forms. We introduce TrustDABench, a benchmark that operationalizes these questions as reliability and robustness. Starting from the evidence-path view, we derive 19 perturbation operators and instantiate them through an Agentic-LLM-based generation framework. TrustDABench contains 2,340 human-verified perturbed instances, and we evaluate eight representative LLMs. The results show substantial headroom: the best reliability result is only 24.21% average MRS, achieved by GPT-5.5, while the best robustness result still has 9.10% average ASR, achieved by Claude-Sonnet-5. The failures are systematic: models rarely detect conflicting evidence, often continue along executable but unsupported analysis paths, and remain sensitive to perturbations that change observation boundaries or cross-table relations. These findings suggest that stronger evidence-boundary recognition and representation-invariant reasoning are still needed for reliable structured-data analysis.

Introduction

Trustworthy structured-data analysis requires more than a plausible answer: the answer must follow an evidence-supported path from the question to the data. TrustDABench addresses whether models detect broken paths and preserve answers when evidence representation changes.

  • Structured-data analysis can produce plausible results despite missing columns, ambiguous headers, conflicting records, or misinterpreted table representations.
  • Trustworthy analysis requires checking whether the answer is supported by the provided files and table evidence.
  • An executable analysis path is insufficient when necessary evidence is not sufficient, unique, and consistent.
  • Existing benchmarks do not jointly test refusal when no supported answer path exists and accuracy under alternative table structures.
  • TrustDABench formalizes reliability and robustness through evidence-supported answer paths.

7 reliability operators

TrustDABench evaluates reliability and robustness separately, revealing that models more readily follow executable processing paths than verify whether those paths remain evidence-supported.

  • Current models are substantially better at following executable data-processing paths than checking whether sufficient, unique, and consistent evidence supports them.
  • Reliability and robustness are not interchangeable: the most reliable model is not the most robust one.
  • TrustDABench uses 19 controlled operators covering missing evidence, evidence conflicts, representation changes, and redundant information.
  • 2,340 human-validated perturbed instances were constructed through a pipeline that enforces unanswerability for reliability samples and semantic answerability for robustness samples.
  • Eight representative LLMs were evaluated to identify actionable failure patterns in structured-data analysis.

Task Formulation

The task formulation models structured-data analysis as an evidence-and-reasoning path, distinguishing whether a task is answerable from whether a model can traverse the complete correct-answer path.

  • A task is answerable when its specification is complete, semantic grounding is unique, and tabular evidence is sufficient and consistent.
  • Agentic structured-data analysis is modeled as a Markov state sequence spanning evidence localization, tool use, data processing, and answer generation.
  • A complete correct-answer path is reachable only when every necessary state transition is reachable.
  • Reliability perturbations make an originally answerable task unanswerable by invalidating necessary evidence that cannot be recovered.
  • Robustness perturbations preserve answerability and the correct answer while changing evidence representation or organization.

Benchmark Design

The benchmark constructs controlled reliability and robustness perturbations through operator-specific selection, constrained editing, automated validation, and human verification.

  • Operator design: Reliability operators remove necessary information or introduce evidence conflicts, while robustness operators preserve answerability and the correct answer through equivalent transformations or redundancy injection.
  • Operator design: The operator library covers seven reliability operators and twelve robustness operators grouped by modification scope and operation complexity.
  • Robustness operators: Robustness transformations include row and column reordering, equivalent value or unit encodings, wide-long reshaping, and relational decomposition.
  • Robustness operators: Additional robustness operators reorganize hierarchical or cross-sheet structures and inject semantic distractors, decoy features, or non-observation rows.
  • Generation framework: Task selection identifies applicable operators and targets, after which construction protocols guide constrained file modifications.
  • Sample validation: Validation combines rule-based checks, independent LLM assessment, a validity-contract decision, and human expert review.

Experiments

Experiments evaluate eight LLMs on reliability and robustness across two datasets, showing distinct cross-dimension strengths and systematic failures. Models most often continue unsupported analyses, struggle with conflicting evidence, and remain vulnerable to structural perturbations.

  • Experimental setup: Eight LLMs were evaluated on AIDABench-QA and DABench using reliability and robustness metrics and controlled operators.The benchmark construction included final human verification by ten experts, retaining instances judged valid by at least 90% of votes.
  • Cross-dimension results: GPT-5.5 leads reliability, while Claude-Sonnet-5 is most stable under semantics-preserving perturbations.This mismatch indicates that reliability and robustness are distinct diagnostic dimensions rather than one overall table-reasoning capability.
  • Reliability: 0.46% MRS for conflict-based operators contrasts with 16.49% for information-deletion operators.Models more readily notice explicitly absent inputs than recognize mutually inconsistent available cues; EC and HC remain shared blind spots.
  • Reliability: 74.8% of reliability failures are silent unsupported answers, revealing missing evidence gates before tool use, computation, and final reporting.No refusal is the default response mode under every reliability operator, especially conflict-based operators.
  • Robustness: NRI is the most damaging robustness operator for every model, while CSR is second most damaging for seven of eight models.Robustness failures concentrate on altered observation boundaries and cross-table relation recovery rather than local presentation changes; higher difficulty generally increases ASR, but not monotonically.

Related Work

Prior work studies table understanding, data-analysis completion, and Text-to-SQL reliability or robustness, but largely evaluates fixed inputs or separate capabilities. TrustDABench addresses the missing joint evaluation of unanswerability and semantics-preserving structural variation.

  • Table-oriented benchmarks mainly evaluate robustness, interpretability, fairness, privacy, answer correctness, or faithfulness over fixed structured inputs.
  • Text-to-SQL research extends evaluation to perturbation robustness, schema variation, semantic evaluation, unanswerability, clarification, calibration, privacy, and security.

Discussion

The discussion argues that trustworthy structured-data analysis requires intrinsic evidence-boundary checking and invariance across equivalent structured representations. Prompting can help reliability, but substantial gaps remain when perturbations alter observation boundaries or cross-table relations.

  • Toward reliable data analysis as an intrinsic model capability: Perturbation-aware prompting can improve MRS, especially for stronger models, but absolute reliability remains low.
  • Toward reliable data analysis as an intrinsic model capability: Future models should internalize evidence-boundary checking throughout the analysis chain rather than rely on prompts or harness rules to enumerate disruptions.
  • Toward robust data analysis under diverse structured representations: Robust analysis requires invariance beyond a single serialized input view, especially when perturbations alter observation boundaries or cross-table relations.

Conclusion

TrustDABench evaluates trustworthy structured-data analysis through abstention on unsupported answer paths and preservation of correct reasoning under semantics-preserving perturbations. Its evaluation identifies distinct, imperfect behaviors and motivates stronger intrinsic evidence-boundary checking and representation-invariant analysis.

  • TrustDABench evaluates abstention when no evidence-supported answer path exists and correct reasoning under semantics-preserving perturbations.
  • The benchmark uses an evidence-path formalization, perturbation operators, Agentic-LLM generation, and human expert verification to construct evaluation instances.
  • Current LLMs can miss conflicting evidence, follow executable but unsupported paths, and fail under structural perturbations.
  • The appendix supplies benchmark positioning, metric definitions, protocols, generation prompts, operator statistics, and reliability failure cases.

A Benchmark Comparison

The benchmark comparison distinguishes reliability from robustness in prior evaluations. Reliability covers unanswerability and related trust conditions, whereas robustness covers perturbations to inputs, schemas, tables, or data.

  • Reliability denotes explicit evaluation of unanswerability, abstention, ambiguity, calibration, or error detection.
  • Robustness denotes explicit evaluation under input, schema, table, or data perturbations.

B Metric Definitions

The benchmark evaluates reliability through evidence-grounded abstention on unanswerable tasks and robustness through failure under semantics-preserving perturbations. Its construction and validation use structured protocols and staged checks to keep interventions auditable.

  • Reliability metrics: Reliability instances are validated unanswerable tasks where models should recognize that available files do not support a unique answer.An LLM judge receives the question, gold unanswerability reason, and model answer.
  • Reliability metrics: MRS averages instance scores of 1, 0.5, or 0, representing full, partial, or absent evidence-grounded abstention.MRS is the primary reliability metric and gives partial credit when a model detects the issue but answers improperly.
  • Reliability metrics: FRR, PRR, and NRR report the proportions of instances receiving scores of 1, 0.5, and 0, respectively.These rates separate complete abstention, incomplete recognition, and unsupported answering.
  • Robustness metrics: ASR measures how often semantics-preserving perturbations cause failure on tasks the model originally answers correctly.This separates robustness from baseline task ability.
  • Robustness metrics: RAD averages multiple perturbations per question and normalizes one-way accuracy loss by all original questions.The corresponding robust accuracy is Accrob = Accclean − RAD, and perturbation coverage is reported because RAD reflects both effectiveness and coverage.
  • Benchmark protocols: Structured JSON protocols connect selection, construction, and validation while recording targets, interventions, and independent evidence checks.These protocols make each perturbation auditable rather than adding annotations only after generation.

E Dataset and Operator Statistics

The benchmark uses a registry of reliability operators that target distinct ways an evidence path can fail. Accepted instances are counted in the final benchmark after construction and validation rules are applied.

  • Dataset statistics: The final benchmark distribution reports counts of accepted perturbations by operator.Table 8 summarizes accepted perturbations used for evaluation.
  • Reliability operators: Field-missing removes a necessary field, while data-missing replaces answer-required values or records with NULLs.Field removal is invalid when an obvious reliable equivalent remains; legitimate zeros and empty results are not missing data.
  • Reliability operators: Evidence-conflict introduces irresolvable different values for the same fact without a source, version, or priority that resolves them.Normal repeated transactions or measurements do not count as conflicts.
  • Reliability operators: File-missing removes a necessary file while requiring the retained files to remain unable to recover the key information.The question or package structure must show why the removed file contains necessary evidence.
  • Reliability operators: Header-conflict gives semantically different key fields the same header, making both columns plausible and answer-changing.The perturbation is valid only when no reliable cue uniquely identifies the intended field.
  • Reliability operators: Deep-analysis-missing removes evidence needed at a middle or later analytical step while earlier operations remain executable.If the missing evidence is detectable during first retrieval, the case should use data-missing instead.

F.2 Robustness Operator Registry

The robustness registry defines semantics-preserving transformations for tables and their representations. Each operator specifies expected behavior, construction instructions, supported extensions, and validation requirements.

  • Ordering transformations: Row- and column-order shuffles reorder records or columns while preserving bindings, named fields, and the normalized answer.Column shuffling targets dependence on fixed positions and requires moving complete columns with their formats and relationships.
  • Semantic transformations: Header-synonym substitution replaces answer-relevant headers with strictly equivalent, uniquely resolvable business synonyms.The transformation tests whether models rely on surface header wording.
  • Value transformations: Equivalent-value reencoding and unit-scale conversion test reversible value normalization while preserving the represented information.Unit conversion updates the unit label consistently.
  • Context and distractor transformations: Other operators add semantic distractors, Excel header or cross-sheet rearrangements, and non-observation rows while retaining the original evidence.These perturbations test whether models preserve the specified computation path and distinguish observations from related but irrelevant structure.
  • Relational transformations: Relational decomposition splits CSV or TSV data into losslessly joinable relations whose answer-required fields span multiple files.A stable safe join key is required, and no single output file may independently answer the original question.
  • Relational transformations: Wide/long reshaping must be reversible, non-aggregating, and lossless, preserving records, NULL positions, type semantics, and question-dependent fields.The inverse transformation must establish per-value equivalence, with unique key combinations and complete transformation specifications.

G Failure-Mode Statistics

The failure-mode analysis maps no-refusal judgments to evidence-verification stages induced by reliability operators. It uses 3,695 AIDABench-QA no-refusal judgments as its analysis population.

  • Failure-stage analysis: 3,695 AIDABench-QA no-refusal judgments are used to compute shares across evidence-verification stages.Table 9 reports the full mapping from no-refusal failures to stages, with each stage induced by its corresponding reliability operator.
  • Failure-stage analysis: Table 9 organizes failure stages by the reliability operator that induces each evidence-verification condition.The table is specifically concerned with AIDABench-QA no-refusal cases.

H Reliability Failure Cases

Figures 7–16 present ten reliability failures spanning all seven reliability operators and seven model families. Across these cases, models detect missing or conflicting evidence yet continue through executable but unsupported analysis paths.

  • Conflicting evidence: Models treat parser-generated or plausible fields as evidence when resolving conflicting candidates.The cases include selecting a parser-generated column name after detecting a header conflict and choosing between same-name columns by plausibility alone.
  • Missing evidence: Models replace missing targets or comparison evidence with invented values or empty sets rather than stopping.Examples include inventing a mean for a missing target field and converting an unavailable comparison file into a zero-valued comparison set.
  • Unsupported computation: Models continue calculations despite incomplete paired data, using inconsistent denominators or relabeling nearby fields.Gemini-3 Pro uses two denominators, while DeepSeek-V4-Pro relabels a nearby field as the missing denominator.
  • Structural context: Models substitute unrelated structural context, producing coherent outputs with incorrect grouping semantics.GPT-5.5 substitutes hire month for absent monthly snapshot context when grouping franchise-store statistics.
  • Conflict checks: Downstream cleaning and regression can proceed after evidence conflicts without validating whether records or measurements are consistent.Qwen3.7-Max cleans after unsupported same-header disambiguation, while Claude Sonnet 5 aggregates inconsistent same-entity records and GLM-5.2 regresses duplicate measurements.
  • Cross-field relations: Models bridge missing late-stage evidence by conflating related but distinct attributes, such as battery type and battery brand.Qwen3.7-Max completes an early ranking step before using the conflated attributes to report corresponding battery brands.
Loading 2608.24145v1…