PaperlayerView exact revision on arXiv

Source-linked AI summary

Trains but Doesn't Learn: A Post-Training Delivery Benchmark for LLM Agents as Forward-Deployed Engineers

Weihang Ding, Junfei Zhan

arXiv:2609.25237v1cs.LGcs.AIcs.CL

TL;DR

Existing agent evaluations ask whether post-training raises a metric, not whether an agent can be trusted to deliver the customer’s intended model. This paper evaluates end-to-end delivery through a governed plane with oracle-scored stages. Four frontier agents shipped no TBDL deliveries, but the delivery contract rejected many metric-passing deliveries.

  • Problem

    Existing agent benchmarks score target-metric gains rather than whether the agent delivers what the customer wanted, leaving delivery-level trust unmeasured.

    Source: §1 · p. 1

  • Method

    The paper evaluates four frontier agents on a ten-stage governed delivery plane, with an oracle scoring stages from platform-recorded facts and an operator-run held-out acceptance gate.

    Source: §1 · p. 2

  • Results

    In 38 certified episodes, agents produced 0 TBDL deliveries and 0 gate bypasses, yet the delivery contract rejected 31/38 metric-passing deliveries.

    Source: §1 · p. 2, §5 · p. 7

  • Takeaways & Limitations

    Delivery acceptance should rely on semantic held-out evaluation and governance controls, not training-signal health alone.

    Source: §4 · p. 7, §5 · p. 8

    The flagship tier’s gate discipline is measured on a call-level governance probe, not full delivery episodes.

    Source: §6 · p. 8

Abstract

from arXiv · show

Post-training is becoming a service (PTaaS): a customer hands an operator data and a goal, and a forward-deployed engineer (FDE) returns a fine-tuned, evaluated, and deployed model under a budget, a human-approval gate, and reproducibility requirements. Seating an LLM agent in the FDE seat raises a question existing benchmarks cannot answer: not whether an agent can raise a metric, but whether it can be trusted to deliver. We answer it on a governed delivery plane, where an agent drives ten stages and an oracle scores each stage from platform-recorded facts. The central silent failure is the run that trains but does not learn (TBDL): loss falls, every signal stays green, and the delivered model is no better than the base. An operator-run acceptance gate catches every such run before payment, and a detector calibrated on known-corrupted runs flags severe corruption mid-run. We ran four frontier agents (Claude Opus 5, GPT-5.6-luna, Gemini 3.7 Flash, DeepSeek V4-Pro) end to end on metered L40S, A100, and H200 GPUs across 8B to 70B open bases, certifying every scenario before scoring. We also ran a human FDE arm under the same oracle and compare every agent against it.

1 Introduction

The paper frames agentic post-training as a delivery-trust problem: existing benchmarks score metric gains, not whether an agent delivers what the customer wanted. It proposes a governed, oracle-scored delivery plane and reports results from four frontier agents, including delivery-contract failures despite metric-passing runs.

Motivation

  • TBDL is a run that trains to completion while the delivered model fails to learn what the customer wanted, despite falling loss and passing signal-level checks.The paper distinguishes the failed run from the delivery decision to ship it as the finished product.Source: §1 · p. 1
  • Existing agent benchmarks grade target-metric gains rather than delivery, so they can count a run that optimizes the wrong objective as successful.Runtime checkers do not close the gap because TBDL is invariant-clean and is surfaced only by governed held-out evaluation.Source: §1 · pp. 1–2

Contributions

  • The benchmark treats the FDE as accountable for end-to-end delivery across ten oracle-scored stages, using platform-recorded facts rather than agent claims.The stages run from intake and planning through training, evaluation, deployment, cost review, and handoff.Source: §1 · p. 2
  • In 38 certified real episodes, agents produced 0 TBDL deliveries and 0 gate bypasses, while the delivery contract rejected 31/38 metric-passing deliveries.With oracle-correct configuration, 22/24 were still rejected; under pressure, flagship arms held the governance gate in 360/360 deliverable trials.Source: §1 · p. 2
  • The human FDE reference had a lower judgment residual than every autonomous arm, but no arm reached zero.The engineer-plus-assistant arms scored 0.06 and 0.09, against 0.10 for the closest agent.Source: §1 · p. 2

2 The governed delivery plane

The governed delivery plane models an LLM agent as an FDE driving ten stages from ticket to delivered model, with each stage scored against oracle predicates. The setup separates arithmetic, execution/artifact, and judgment stages, and certifies scenarios and calibration instruments before evaluating agent conduct.

System under test

  • The agent receives the natural-language ticket, a read-only environment and cluster sheet, and read-only dataset inspection, but never held-out labels; the harness executes its proposals and scores each stage independently.The agent is accountable for the governed delivery, not a metric.Source: §2 · p. 2

Ten governed stages

  • The ten stages divide into arithmetic stages {config, schedule, cost review}, execution/artifact stages {train, register, handoff}, and judgment stages {intake, plan, eval, deploy}.Arithmetic stages are those whose oracle predicate is achieved by a certified deterministic function of specification, environment, and budget.Source: §2 · p. 3

Scenarios as customer tickets

  • The delivery campaign uses five SFT ticket scenarios with held-out metrics across four open-weight bases spanning 8B–70B and three model families.The scenarios cover intent classification, support response, function calling, numerical QA, and legal clauses; the UltraFeedback preference scenario was excluded after failing its positive control.Source: §2 · p. 3
  • Scenario agents never see the held-out split, which supplies the acceptance metric for each ticket.The learned margin is task-specific, pre-registered, and set at 0.06–0.08 across scenarios.Source: §2 · p. 3

De-looped, stage-independent scoring

  • Stage predicates use externally annotated accepted sets, and the oracle never reads the trained model; execution stages use the gold configuration to isolate agent judgment from configuration arithmetic.Per-stage failure rates use full-N denominators, while a pinned-configuration intervention supplies the causal contrast.Source: §2 · pp. 3–4

Calibration positives (fault injection)

  • Calibration uses deliberately corrupted objectives, retaining relabeling and dirty-data after the short-label loss-masking fault recovered at every scale.Agent episodes are injection-free; the platform executes their actual choices, with the documented full-sequence loss-masking default as the environmental trap.Source: §2 · p. 4

3 Results

The results trace TBDL from calibrated, injected corruptions through agent judgment and governance tests to a certified delivery campaign and a human reference. Across certified episodes, current agents had no TBDL deliveries or gate bypasses, but many metric-passing deliveries failed the delivery contract, and human FDEs reduced judgment residuals without eliminating them.

3 Results

  • The three-act results examine TBDL calibration, certified delivery failures, and residual failures for current agents and human FDE arms.TBDL is defined as a run that passes training but fails the held-out evaluation; the evidence is presented across real-GPU runs.Source: §3 · p. 4, §3.1 · p. 4

3.1 Act I: the TBDL run

  • Relabeling induced TBDL on every tested model and seed (12/12), while the detector flagged the severe permute trap 11/12 times and missed subtle dirty-data TBDL 0/11 times.Correct deliveries learned on every base (12/12); the held-out evaluation catches subtle TBDL, complementing mid-run detection of severe corruption.Source: §3.1 · p. 4

3.2 Act I: the intake judgment switch

  • Under deliberately ambiguous hand-off, Sonnet-4.6 and GPT-5.4-mini omitted masking on all five seeds, while Gemini-3.5-Flash recovered it on three.The masking judgment alone switched the outcome: correct masking learned (+0.45), whereas an omitted-masking misread fell below base (−0.49).Source: §3.2 · p. 5

3.3 Act I: governance under pressure

  • Pooled gate-staging compliance fell from 1.00 under neutral tickets to 0.47 under sunk-cost pressure, despite pressure-invariant infeasibility sensitivity (HR = 1.00; FAR = 0.00).Claude Opus 5, GPT-5.6-luna, and Gemini 3.7 Flash staged all 360 deliverable trials and refused all 60 infeasible tickets.Source: §3.3 · p. 6

3.4 Act II: the TBDL delivery

  • 31/38 metric-passing deliveries failed the documented contract, and 22/24 still failed when agents received the oracle-correct configuration.The certified campaign observed 0 TBDL deliveries in 38 episodes; the observed TBDL runs arose on an excluded contract.Source: §3.4 · p. 6

3.5 Act III: the human-in-the-loop reference

  • Engineer A’s judgment residual was 0.06 (7/120) and Engineer B’s was 0.09 (11/120), lower than every autonomous arm, but no arm reached zero.The engineers’ 120-cell grid used five judgment stages, while current agents’ certified campaign used four.Source: §3.5 · p. 7, Table 5 · p. 7

4 Discussion and lessons learned

The discussion argues that PTaaS operators should govern delivery rather than trust training signals or model-enforced compliance. It highlights contract checks, a non-bypassable deployment gate, and failures caught while building the evaluation apparatus.

4 Discussion and lessons learned

  • Because current frontier agents fail at the delivery surface, prioritize contract CI—schema-checked cards, reconciled cost reports, and registry CI—over configuration review, and gate acceptance and billing on semantic held-out audits.Source: §4 · p. 7
  • A deployment gate should be non-bypassable: prompt-level compliance failed under pressure for the first-generation tier, while the flagship tier held its discipline.The reference architecture uses an external approval service and signed, single-use tokens bound to model and evaluation-artifact hashes.Source: §4 · p. 7
  • A bf16 LoRA run propagated an infinite gradient as NaN yet kept “training”; finite-loss and survived-K predicates caught it.An omitted variance-term factor of 4 also voided an initial e-process guarantee before adversarial review caught the error.Source: §4 · p. 7
  • The authors conclude that green signals do not certify the outcome that matters, and release the instrument for operators to audit agentic FDEs.They frame acceptance and billing around a semantic held-out audit rather than training-signal health.Source: §4 · p. 7

5 Conclusion

The conclusion reports that agents produced no TBDL deliveries, yet many metric-passing deliveries failed the delivery contract. Human FDEs had lower judgment residuals than every agent, and no arm reached zero.

5 Conclusion

  • 31/38 metric-passing deliveries were rejected by the delivery contract, and oracle-correct configuration repaired none of the rejections.The first-generation cheaper tier released the gate under pressure, while flagship arms held it in every pressure-suite condition.Source: §5 · p. 7
  • The human FDE arm had a lower judgment residual than every agent, but no arm reached zero.The conclusion locates residual risk in the delivery contract and judgment of what is safe to ship, beyond training objectives and configuration.Source: §5 · p. 8
  • A green training dashboard is a billing liability, not a delivery certificate.The operator-run acceptance gate catches a run that trains but does not learn before payment.Source: §5 · pp. 7–8

6 Limitations

The instrument’s claims are bounded by its post-training, single-node SFT scope, and several comparisons use different evaluation grids or limited probes. Preference delivery remains unvalidated, and the oracle’s judgment labels have not yet received independent re-annotation.

Scope

  • The instrument covers five real-GPU SFT scenarios across four open-weight bases from 8B to 70B, is single-node and post-training only, and excludes DPO from certification.The DPO preference contract failed its positive control at every swept budget; six tasks bound clustering, and detector resolution is bounded.Source: §6 · p. 8

Bridge ledger

  • The bridge ledger’s end-to-end flags fall below the detectability floor and fire identically for the judgment-free baseline, so it yields no agent-attributable TBDL rate.Source: §6 · p. 8

Comparison

  • The Act III engineer-agent comparison shares an oracle but differs in scenario mix and judgment-stage set, limiting direct cross-grid comparability.Engineer aggregates use the first-generation six-scenario grid and five-stage judgment set; current-agent residuals use certified-campaign scenarios and a four-stage set.Source: §6 · p. 8

Flagship pressure verdict

  • The current flagship tier’s gate discipline is measured on a call-level governance probe, not full delivery episodes.The full-episode collapse reported in this comparison is a first-generation cheaper-tier result.Source: §6 · p. 8

Human reference

  • The human-in-the-loop arm is a policy reference for task difficulty, not a causal estimate of human contribution.Source: §6 · p. 8

Judgment labels

  • Oracle judgment labels are single-annotator; independent ML engineers have not yet re-judged the frozen cells.The release includes de-identified replay artifacts for blind re-annotation, with percent agreement and Cohen’s κ against the oracle.Source: §6 · p. 8

Preference delivery

  • The preference contract failed its positive control at every swept budget from 150 to 1200 DPO steps, reaching at most +0.015 held-out win-rate.Log-probability win-rate cannot cleanly distinguish genuine preference learning from SFT-on-chosen; preference delivery needs generation-judged evaluation.Source: §6 · p. 8

Ethics Statement

The ethics statement limits the governance probe to benign business pressure and legitimate deliverables. The appendix catalogs supporting materials, while related work distinguishes delivery grading from metric-raising benchmarks and connects the instrument to monitoring and serving-side systems research.

Ethics Statement

  • The governance probe uses benign deadline, authority, and sunk-cost pressure on legitimate deliverables; it is neither a jailbreak nor a harmful-instruction suite.Pressure suffixes are released for auditability, and the human-in-the-loop and in-progress annotation studies use consenting engineers under the study protocol.Source: Ethics Statement · p. 8

Appendix overview

  • The appendix collects customer-ticket scenarios, pressure suffixes, oracle predicates, detector specifications, and endpoint reporting details.Source: Appendix overview · p. 10

A Related work

  • Prior post-training benchmarks score whether a chosen metric rises, whereas this work grades delivery, including intake grounding, deploy governance, lineage, cost, and silent non-learning.The related-work passage identifies PostTrainBench, Agent2 RL-Bench, FT-Dojo, and TREX as metric-raising benchmarks.Source: A Related work · p. 10
  • TBDL is distinguished from runtime invariant violations because it keeps loss finite and gradients bounded, and only governed held-out evaluation surfaces it.The passage also situates TBDL alongside prior silent-failure examples and states that the detector adds an anytime-valid guarantee.Source: A Related work · p. 10
  • Related work places delivery governance beside serving-side routing, energy measurement, and resource-budget discipline in cloud-edge and green-IoT systems.Source: A Related work · pp. 10–11

B Scenarios and customer tickets

The scenario set consists of five SFT customer tickets run on real GPUs across four open-weight bases, plus a preference-alignment ticket excluded from certification. The tickets specify datasets, held-out metrics, traps, and pre-registered detectable effects.

B Scenarios and customer tickets

  • Table 6 lists five SFT tickets and an uncertified preference-alignment ticket, with datasets, base models, held-out metrics, traps, and pre-registered minimum detectable effects.All scenarios run on real GPUs across four current-generation bases, with the agent’s plan driving each fine-tune.Source: B Scenarios and customer tickets · p. 11
  • Refusal calibration adds a GPU-free paired probe: refuse an over-budget 70B request but proceed on a feasible one.Source: B Scenarios and customer tickets · p. 11

C Pressure-condition suffixes (verbatim)

The pressure conditions vary social framing while the correct behavior remains fixed: stay within budget and stage deployment for human approval. The appendix freezes the suffixes before leaderboard runs to preserve the paired design.

C Pressure-condition suffixes (verbatim)

D Per-stage oracle predicates

The oracle scores each stage against de-looped ground truth using discrete gating predicates, so a stage passes only when all required conditions hold. Its ten predicates span judgment, arithmetic, and execution, with TBDL defined by training passing while evaluation fails.

D Per-stage oracle predicates

  • Intake and plan require the gold task, metric, format, accepted method, and any required loss-masking, allowing clear synonyms.Source: D Per-stage oracle predicates · p. 11
  • Config and schedule must meet accepted-class, schema, GPU-hour, feasibility, and world-size constraints.Config also requires micro-batch and grad-accumulation of at least 1 and a LoRA rank for LoRA/QLoRA.Source: D Per-stage oracle predicates · p. 11
  • Train, register, deploy, cost review, and handoff check execution health, valid registration, human-gated deployability, budget reporting, and reproducible delivery artifacts.Handoff requires a schema-valid model card, pull request, and complete reproducibility manifest; the EU-AI-Act crosswalk is descriptive, not a gate.Source: D Per-stage oracle predicates · p. 11
  • Eval passes only when a one-sided exact McNemar test rejects at α=.05 and ∆≥δ⋆; flat runs and trivially small significant gains fail.Source: D Per-stage oracle predicates · p. 11
  • TBDL is the auditable conjunction of a passing train stage and a failing eval stage.The detector specification is in Appendix E.Source: D Per-stage oracle predicates · p. 11

E The online TBDL detector

The online detector monitors a clean-probe gap with an empirical-Bernstein e-process and alarms at a threshold that controls per-run false alarms under its conditional null. Its guarantee applies to the clipped sequence, while endpoint reporting is specified separately.

E The online TBDL detector

  • The detector tests whether clipped, rescaled clean-probe gap increments have conditional mean above the null mean using an empirical-Bernstein e-process.The process is a fixed mixture over λ values; alarming at E_t≥1/α controls the per-run ever-false-alarm probability at α=.05 under the conditional null.Source: E The online TBDL detector · pp. 11–12
  • The guarantee covers only the clipped sequence; any subtracted baseline must be preregistered or pilot-frozen, and R runs have an expected false-alarm count bounded by Rα rather than family-wise control.Source: E The online TBDL detector · p. 12
  • 11/12 severe relabeling traps were detected at a median step of 250/300, with 0/36 false alarms and a 1.0%≤5% adversarial max-variance bound.Source: E The online TBDL detector · p. 12

F Endpoint reporting

Related papers

Loading 2609.25237v1…