Source-linked AI summary
KC-Bench: A Dynamic Interactive Benchmark for Evaluating Knowledge Conflicts in LLM Agents
Yaxing Lyu, Shengjie Zhou, Binbin Toh, Pengyu Zhu, Lijun Li
TL;DR
LLM agents need to reconcile user instructions, parametric knowledge, and dynamic environmental evidence before taking actions, but existing evaluations incompletely capture these conflicts. KC-Bench provides a controlled, multi-turn benchmark with operational conflict types and trajectory-level evaluation, finding that no evaluated model performs consistently across domains and that unresolved conflicts can reach tool execution or protected-data flows.
Problem
Existing evaluations incompletely capture agents’ need to detect and resolve conflicts among user instructions, parametric knowledge, and dynamic environmental evidence before acting.
Method
KC-Bench combines a three-part conflict taxonomy with multi-turn interaction, stateful tools, deterministic environment assertions, trajectory-level evaluation, and human verification.
Results
No evaluated model performs consistently across domains, with unresolved conflicts reaching simulated tool execution or protected-data flows.
Takeaways & Limitations
KC-Bench makes conflict handling a distinct, measurable dimension of agent reliability beyond aggregate task-success scores.
Takeaways & Limitations
KC-Bench evaluates model-level conflict handling under a standardized harness, not complete agent products or framework comparisons.
Abstract
from arXiv · showhide
As LLMs increasingly act through tools, they must reconcile user instructions, parametric knowledge, and dynamic environmental observations before taking actions. We introduce KC-Bench, a controlled multi-turn benchmark for measuring this capability across world-knowledge conflicts, input inconsistencies, and multi-source temporal conflicts. Its 238 tasks are manually screened from more than 1,000 generated candidates and combine a user simulator, stateful tools, deterministic environment assertions, an open-source natural-language evaluator, and human trajectory verification. Evaluation of nine models, including DeepSeek-V4-Flash, GLM-5.2, and MiniMax-M3, shows substantial cross-domain variation: no model handles factual correction, identity consistency checking, and temporal conflict resolution reliably across all settings. In the simulated environments, missed conflicts can propagate to tool calls or synthetic protected-data flows. KC-Bench isolates this model-level behavior rather than ranking complete agent frameworks, and provides a reproducible diagnostic for developing conflict-aware reasoning and execution safeguards.
Introduction
LLM agents must reconcile conflicting evidence from users, their own knowledge, and dynamic tools before acting. KC-Bench operationalizes this challenge across conflict types and evaluates whether agents detect, verify, and safely resolve inconsistencies.
- Motivation: LLM agents combine user requests with parametric knowledge, records, tool feedback, and interaction history, making unresolved disagreement an execution-level safety risk.Potential failures include querying the wrong account, exposing private information, or using stale tool outputs.
- Benchmark Focus: KC-Bench targets whether agents detect and safely resolve conflicts among parametric knowledge, user instructions, and dynamic environmental observations before consequential actions.This target complements evaluations focused separately on static knowledge conflict or interactive task completion.
- Evaluation Need: A useful evaluation must expose conflicts through realistic interaction and score verification before action, not only final task completion.The required safe behavior varies across domains and may emerge only after a tool call or across multiple records.
- Conflict Taxonomy: The benchmark distinguishes World Knowledge Conflict, Input Inconsistency, and Multi-source Conflict, covering factual contradictions, identity mismatches, and temporal or contextual inconsistencies.These types increase the interactional complexity of the evidence agents must reconcile.
- Contributions: KC-Bench formalizes knowledge conflicts for agent evaluation and introduces a dynamic benchmark spanning 238 multi-turn tasks across three domains.Its empirical analysis covers nine models and reports persistent, domain-dependent weaknesses in factual correction, identity consistency checking, and temporal conflict resolution.
Related Work
Prior research has examined input-side threats, knowledge conflicts in question answering and retrieval-augmented generation, and interactive agent evaluation. However, existing benchmarks largely overlook failures caused by conflicting knowledge across dynamic information sources.
- LLM agents introduce execution-space risks beyond adversarial inputs, including insufficient tool-output verification and incorrect reasoning over environmental feedback.These risks arise as agents perform multi-step planning and action through external tools.
- Knowledge-conflict research has mainly studied discrepancies between external context and parametric knowledge in question answering and retrieval-augmented generation.
- Agent settings broaden knowledge conflicts because agents must reason over multiple dynamic and potentially inconsistent information sources.
- Interactive benchmarks add tool use, state tracking, and user simulation, but primarily assess task success and efficiency rather than conflicting-knowledge failures.
KC-Bench
KC-Bench models agent–environment interaction as a partially observable process in which agents must reconcile user instructions, parametric knowledge, and tool or database observations before acting. It evaluates three escalating conflict types and checks whether agents detect conflicts, clarify or reason over evidence, and avoid policy-violating actions.
- Problem formulation: The agent policy receives user instructions, prior observations, and parametric knowledge, then selects tool execution, clarification, or final-response actions.
- Three-level taxonomy: World Knowledge Conflict tests whether agents reject a false user premise that contradicts parametric knowledge before tool use.
- Three-level taxonomy: Input Inconsistency tests mismatched credentials and database observations, requiring clarification before sensitive operations such as writing or querying private data.
- Three-level taxonomy: Multi-source Conflict tests temporal or state contradictions across records, requiring agents to derive a valid subset rather than execute with outdated information.
- Domain and task creation: KC-Bench generates conflict-injected tasks with deterministic tools, explicit state constraints, domain policies, and human screening; the final benchmark contains 238 tasks from more than 1,000 candidates.
- Evaluation scope: Evaluation verifies conflict detection and protected-state safety across the full trajectory, while the standardized harness evaluates model-level handling rather than complete agent products.
Experiments
KC-Bench evaluates nine models on conflict handling across Region, Retail, and Personal Assistant settings using automatic and human-verified trajectory outcomes. Results show strong cross-domain variation, with failures in factual correction, identity verification, and temporal consistency sometimes propagating to downstream actions.
- Evaluation Setup: Nine models were evaluated with automatic and human verification across three interactive conflict domains.The benchmark includes closed-source, open-source, and recently released agentic models; each task uses a user simulator and assertion model under fixed evaluation settings.
- Overall Performance Analysis: No evaluated model performs consistently well across all three domains.The best Region score rises from 0.5070 to 0.6761 with the recent-model extension, but DeepSeek-V4-Flash scores 0.1831 in Region versus 0.6522 and 0.6986 in Retail and Personal Assistant; MiniMax-M3 shows the reverse imbalance, and GLM-5.2 still fails approximately 34–46% of tasks.
- Execution-Level Consequences: Unresolved conflicts can propagate into synthetic protected-data disclosure or actions using obsolete identifiers.These are benchmark-observed consequences; the paper distinguishes them from real-world breaches and recommends deterministic authentication, authorization, and API permission checks.
- World Knowledge Conflict: Factual Compromise: World-knowledge tasks expose frequent failures to reject false premises before tool execution.For food-origin tasks, only Qwen3.5-35B-A3B reaches a 50% error rate, while all other models reach 100%; in birthplace tasks, Claude achieves the best result at 25.9% (7/27).
- Input Inconsistency: Missed Identity Conflicts: Retail evaluations reveal pervasive failures to detect explicit credential mismatches and clarify before sensitive operations.The benchmark therefore tests whether agents verify identity inconsistencies before downstream actions rather than merely completing the requested task.
- Multi-source Conflict: Reversal under User Pressure: Temporal conflicts can cause agents to reverse evidence-supported conclusions under user insistence.In Personal Assistant tasks, models sometimes accepted an outdated identifier marked “Not in Use” into downstream API execution after initially recognizing its expiration.
Conclusion
KC-Bench evaluates conflict handling through multi-turn interaction, stateful tools, and trajectory-level assessment. Across nine models, performance varied by conflict type, and unresolved inconsistencies could reach tool execution or protected data flows.
- Benchmark scope: KC-Bench combines a three-part conflict taxonomy with multi-turn interaction, stateful tools, and trajectory-level evaluation of conflict resolution and downstream actions.The benchmark targets conflict handling beyond text-level responses.
- Empirical findings: Across nine models, no model performs consistently across factual correction, identity consistency checking, and temporal reasoning.Performance in one conflict type did not reliably transfer to the others.
- Empirical findings: Unresolved conflicts can propagate to tool execution or protected data flows in simulated environments.This connects conflict-resolution failures to execution-level consequences.
- Implications: KC-Bench makes hidden conflict-handling failures measurable and comparable beyond aggregate task-success scores.It traces whether agents detect, verify, resolve, and safely act on inconsistent information.
Ethical Statement
The study uses de-identified, synthetic, or publicly accessible data to address ethical risks. It also identifies simulated temporal sycophancy and related risks to logical consistency and system operations.
- Data protections: The experiments use publicly accessible information, de-identified records, and synthetic data to avoid exposing sensitive personal information.Personal identifiers were removed, and retail or personal-assistant records were synthetic or strictly de-identified.
- Risks: Simulated temporal sycophancy can cause agents to abandon previously correct reasoning in response to persistent user misinformation.The paper links these failures to logical inconsistencies and unsafe system operations.
- Mitigation: The findings motivate execution-level conflict detection, permission controls, and safety guardrails for real-world deployments.These measures are presented as ways to mitigate negative impacts and preserve system integrity.