PaperlayerView exact revision on arXiv

Source-linked AI summary

NAQD Env: A benchmark for selective withdrawal in language agents

Mohamed Abouzahra

arXiv:2609.38460v1cs.AI

TL;DR

Language agents must revise planned actions when evidence, permission, or constraints change, but selective suspension and repair decisions need evaluation against explicit dependencies. NAQD-Env tests those decisions with a deterministic reference policy and varied dependency structures. Across the reported evaluation, withdrawal recall is at most 0.06 and only one of 3,150 episodes fully matches the reference; the setting tests policy application with trusted structured inputs, not real-world containment or source verification.

  • Problem

    Selective withdrawal requires agents to suspend actions that lose support while preserving unaffected work and resuming only after relevant blockers are repaired.

    Source: §1 · p. 1

  • Method

    NAQD-Env evaluates action assessments against a deterministic reference policy over explicit evidence, authorization, and constraint dependencies, with separate scoring for attempts and simulated execution.

    Source: §1 · pp. 1–2, §4 · p. 5

  • Results

    Withdrawal recall is at most 0.06, and only one of 3,150 model–prompt episodes fully matches the reference policy.

    Source: §10 · p. 13

  • Takeaways & Limitations

    The results motivate evaluating selective withdrawal as a distinct component of agent reliability, with withdrawal, continuation, reporting, and task value measured together.

    Source: §10 · p. 13

    The evaluation uses trusted structured inputs and does not test source verification or attack detection from raw text.

    Source: §9 · p. 12

Abstract

from arXiv · show

Language agents must revise planned actions when evidence changes, permission is revoked, or a stop instruction arrives. A useful response is selective: suspend affected actions, preserve unaffected work, and resume only after sufficient repair. We introduce NAQD-Env, a synthetic environment that evaluates these decisions against a deterministic reference policy over explicit evidence, authorization, and constraint dependencies. Eleven dependency families support evaluation on development structures, held-out families, and held-out combinations of structures. Metrics distinguish attempted violations from violations permitted by a simulated execution gate and jointly report policy agreement, task value, withdrawal, resumption, and event reporting. We evaluate three open-weight instruction-tuned models from two families under three prompt conditions on 350 frozen scenarios, yielding 3,150 model-prompt episodes before gate replay. Across the reported conditions, withdrawal recall is at most 0.06, no valid resumption is observed at eligible opportunities, and only one episode matches the complete reference policy. Under the NAQD prompt, Qwen2.5-7B has fewer unsafe-attempt episodes than Qwen2.5-3B and Llama-3.1-8B, but also completes less useful work and preserves unaffected actions less accurately. Exploratory supervised fine-tuning probes increase Qwen2.5-3B decision accuracy from 0.45-0.54 to 0.83-0.92; separate diagnostics reveal inappropriate withdrawal after curriculum omissions and a loss of event reporting. These results motivate evaluating selective withdrawal as a distinct component of agent reliability. The setting measures policy application with trusted structured inputs and does not establish real-world containment or source-verification ability.

1 Introduction

NAQD-Env evaluates whether language agents selectively suspend actions when their supporting evidence, authorization, or constraints change, while preserving unaffected work. It combines explicit dependency structures with deterministic policy scoring and situates this task among related work without claiming that joint safety-and-utility evaluation is new.

1 Introduction

  • Selective withdrawal requires suspending actions that lose support, preserving unaffected work, and resuming only after relevant blockers are repaired.The benchmark focuses on action-level decisions under an explicit policy.Source: §1 · p. 1
  • Three evaluation requirements are explicit dependencies and event effects, structures beyond mention matching, and safety reporting alongside useful task completion.Separating proposed actions from simulated execution keeps controller protection distinct from model behavior.Source: §1 · p. 1
  • NAQD-Env combines typed premises, deterministic reference decisions, multidimensional scoring, and a versioned evaluation instrument.The instrument includes scripted controls, regression tests, checksummed builds, split boundaries, and recorded replies, while acknowledging these checks do not rule out every leakage form or validate every deployment.Source: §1 · p. 2
  • The baselines cover three open models from two families, three prompt conditions, and three frozen regimes; conclusions are limited to tested models, scenarios, and inference configuration.The evaluation establishes baselines for structured policy application, not real-world containment or source verification.Source: §1 · p. 2

2 Related work

  • The contribution is a bounded evaluation design combining explicit action–premise dependencies, selective suspension, cause-specific repair, and policy scoring across varied graph structures.Related benchmarks address agent safety, intervention, belief revision, provenance, attribution, and access control; the paper does not claim that joint safety-and-utility evaluation is new or that no earlier benchmark contains these components.Source: §2 · pp. 2–3

3 The environment

NAQD-Env presents each model with a fixed workflow and asks it to assess prepared actions as events arrive. Its reference answers come from a specified simulator policy, not independently observed real-world truth.

3 The environment

  • A scenario supplies a domain, premises, actions, events, and policy; the model assesses every action at each decision point and separately reports events it judges illegitimate.Execution is simulated by the grader for scoring; the model does not issue arbitrary tool calls.Source: §3 · p. 3
  • The scenario fixes available actions and event timing, so the model makes sequential decisions within a supplied workflow rather than discovering a plan.Ground truth means the specified simulator policy’s output, not independently observed real-world truth.Source: §3 · p. 3
  • The evaluation tests policy application to structured inputs, not whether an agent can infer actions or dependencies from raw evidence.The model selects assessments rather than discovering a plan or making arbitrary tool calls.Source: §3 · p. 3

3 1 Typed premises

The environment represents actions through typed premises and explicit dependency rules. Events update those conditions, and a deterministic reference policy assigns action assessments at every step.

3 1 Typed premises

  • Premises are evidential or authorizational conditions that must hold, or impediments that must be absent for an action.Dependencies encode derivation, copying, delegation, alternative support, and impediments; independently issued co-agent authority can survive removal of a parent grant.Source: §3 · pp. 3–4

3 2 Dependency families

  • Eleven dependency families cover direct and indirect dependencies, alternative support, and joint constraints, with simpler development families and more demanding combinations.Table 2 summarizes the dependency families and their evaluation roles.Source: §3 · p. 4, Table 2 · p. 4

3 3 Events

  • Events can invalidate evidence or grants, activate impediments, stop actions, or repair a matching earlier cause; unauthenticated expansions are never accepted.Weakly authenticated contractions such as stops and revocations are honored, while other unauthenticated invalidations change nothing and should be reported.Source: §3 · p. 4

3 4 Options and the reference policy

  • The reference policy applies a fixed precedence to eight options; withdrawal suspends blocked actions, while valid resumption follows repair of the last blocking cause.A repaired cause enables resumption only if no independent stop, revoked permission, or other blocker remains.Source: §3 · p. 5

3 5 What the model sees

The agent receives trusted structured premises, dependencies, events, and its own prior decisions, then applies policy without seeing current reference decisions. Scoring separately tracks violations, policy agreement, task value, event reporting, and protocol handling.

3 5 What the model sees

  • The model receives trusted premise states, dependencies, alternatives, events, and prior decisions, but must derive current decisions itself; the task measures policy application, not source verification.Future events and scenario metadata are excluded from the view.Source: §3 · p. 5

4 Scoring

  • The grader uses no LLM judge and reports outcomes separately, without a weighted overall score.Provenance fidelity is a sixth framework term but remains unmeasured because the runner does not elicit transformation declarations.Source: §4 · pp. 5–6
  • Attempted violations are proposals outside policy, while simulated executed violations are the attempts that pass the gate.The gate changes simulated execution, not model behavior.Source: §4 · p. 5
  • Decision accuracy measures action-step agreement with the reference, while an exact-policy episode requires every assessment and required event report to match.Missing or invalid assessments count as mismatches.Source: §4 · p. 5
  • Task value combines completion credit with option costs, whose weights are design choices rather than estimates of real-world utility.Pending verification earns no completion credit; safe partial execution receives 0.6 credit and can later increase to one.Source: §4 · p. 5
  • Event-reporting scores reward reporting illegitimate events and penalize other or missed reports, while exact-policy scoring separately requires the correct report set at arrival.The lenient protocol retains the first well-formed decision per known action; protocol defects can invalidate episode exactness without automatically invalidating that retained decision.Source: §4 · pp. 5–6

5 Validation of the instrument

Validation combines scripted controls, regression tests, split and leak checks, and run provenance to assess specific properties of the instrument. These checks do not establish universal validity or eliminate all leakage concerns.

5 Validation of the instrument

  • The answer-key reference agent achieved 180/180 exact episodes across 30 scenarios, three prompts, and two gate settings; the always-decline agent achieved 0/30 exact episodes under either gate.These are repeated checks on 30 scenarios, not 180 independent samples; the reckless agent produced unsafe proposals in 30/30 scenarios.Source: §5 · p. 6
  • The released checkout passes 45 regression tests covering revocation, repair, delegation, composition, protocol handling, split integrity, and file integrity.The test count refers to commit 3514e74f3de9a18a8b0ff09d5c78b0d4f0a2d77a.Source: §5 · p. 6
  • An earlier diagnostic sweep found a stop-and-repair defect in 9 of 100 cases, a rate for that sweep rather than the final benchmark.The present build adds a guard against exposing current or future decisions; this does not establish that an earlier release leaked answers.Source: §5 · p. 6
  • The build defines five test splits, but this paper reports validation and two test splits rather than all five.The splits cover new seeds, held-out families, a held-out domain, a joint family/domain change, and held-out structures.Source: §5 · p. 6
  • Leak checks address direct answer exposure and future information, but do not establish absence of template overlap, isomorphic split graphs, pretraining contamination, or curriculum adaptation after evaluation inspection.A prefix test checks that changing later events leaves earlier reference decisions unchanged.Source: §5 · p. 6
  • Recorded trajectories can be rescored without another model query, but cannot reconstruct behavior under a different live protocol because retained decisions affect later model views.Section 7 runs use the same lenient live protocol and worked-example prompt configuration.Source: §5 · pp. 6–7
  • Section 7 used one RTX 5090 system, temperature 0, structured output, and prompt configuration v4; eight incomplete restart folders were excluded.Exclusion was a completion criterion and does not establish that interrupted cases were missing at random.Source: §5 · p. 7
  • Each baseline model contributes 1,050 model-prompt episodes and 2,100 scored records, but the three models share 350 unique scenarios.Gate-on results reuse the same replies; the earlier comparison of policy-only and worked-example prompts is excluded because it also changed the live parsing protocol.Source: §5 · p. 7

6 Baseline experiments

The baseline evaluates three open-weight models on frozen regimes using a shared detailed prompt with controlled procedural variations. Gate replay and scenario-level bootstrap intervals define the reported comparisons.

6 Baseline experiments

  • The baseline evaluates Qwen2.5-3B-Instruct, Qwen2.5-7B-Instruct, and Llama-3.1-8B-Instruct without NAQD-specific fine-tuning.Two task-specific Qwen2.5-3B checkpoints are reserved for exploratory probes.Source: §6 · p. 7
  • All prompts share a detailed policy description and worked examples; checklist adds a procedure, while naqd uses the same procedure with a NAQD label.Baseline versus checklist tests the added reminder; checklist versus naqd tests labeling.Source: §6 · p. 7
  • The main comparisons use 150 validation scenarios, 100 test_family scenarios, and 100 test_structure scenarios.The latter two regimes use held-out families and held-out structures, respectively; the paper's v2 probe shares the baseline cases.Source: §6 · pp. 7–8
  • Each scenario-prompt pair is queried once, then its recorded replies are scored with the gate off and on; gate-on replay blocks ineligible execution proposals.Attempts are identical across replay conditions; inference uses temperature 0, an 8,192-token context window, and a maximum of 384 output tokens per step.Source: §6 · p. 8
  • Episode-level intervals use 2,000 scenario-bootstrap resamples, while prompt contrasts remain descriptive and no formal prompt-effect test is reported.Intervals reflect scenario uncertainty, not variation across training seeds, decoding seeds, model families, or deployments.Source: §6 · p. 8

7 Results

Under the naqd prompt, Qwen2.5-7B has fewer unsafe-attempt episodes than the other models, but lower task value and continuation scores. Withdrawal recall is low, no valid resumption is observed, and only one episode matches the complete reference policy.

7 2 Persistence and withholding

  • Under naqd, unsafe-attempt episodes are 31.0–50.0% for Qwen2.5-7B versus 78.0–95.0% for Qwen2.5-3B and Llama-3.1-8B, alongside lower task value and continuation.Qwen2.5-7B task value is 1.63–2.06 versus 2.49–2.89 for the other models, and its appropriate-continuation scores are lowest in all three regimes.Source: Table 4 · p. 8, §7 · p. 10

7 Results

  • All naqd exact-episode rates are zero; one exact episode under another prompt gives one across 3,150 baseline model-prompt episodes.Gate replay does not count as an additional model response.Source: §7 · p. 9

7 1 Selective withdrawal and resumption

  • Withdrawal recall is 0.00–0.06 across models and regimes, and no valid resumption is observed at eligible opportunities.Most cells have no model-history-eligible opportunity and are marked N/A; Qwen2.5-7B withdraws only 15 of 372 newly blocked actions on validation.Source: §7 · p. 9, Table 5 · p. 9
  • Qwen2.5-3B makes at least as many false-positive withdrawals as true positives in every regime, while Llama-3.1-8B makes no withdrawals.At most four invalidation event steps per regime meet the exact-event criterion; re-proposals of invalidated actions remain frequent across models.Source: §7 · p. 9
  • A valid resumption requires a prior withdrawal in the model's own history, and withdrawal precision and recall distinguish unnecessary suspensions from missed suspensions.A newly blocked action not withdrawn, including a missing assessment in a retained reply, counts as a false negative.Source: §7 · p. 9

7 3 Prompt conditions

Across the prompt conditions, the tested reminders and NAQD label show no consistent practical improvement; held-out results expose weak delegation handling, while gate replay prevents simulated execution of recorded violations. The fine-tuning probe raises decision accuracy and withdrawal recall, but diagnostics qualify those gains.

7 3 Prompt conditions

  • Across three conditions, Qwen2.5-7B’s validation unsafe-rate range was 45.3–53.3%; adding the procedure or NAQD label showed no consistent practical improvement.The largest accuracy range was 0.034; the reported ranges do not estimate a paired effect or establish statistical equivalence.Source: §7 · p. 10

7 4 Held-out families and structures

  • Delegation-family accuracy was 0.30–0.36, with 0–4 correct withdrawals among 55 eligible actions in test_family and 0–3 among 61 in test_structure.The surviving-route diagnostic found zero inappropriate withdrawals among 34 F5 actions per baseline model, but withdrawal recall remained near zero.Source: §7 · p. 11
  • Correct narrowing was 10/33 and 18/37 for Qwen2.5-3B, 14/33 and 15/37 for Qwen2.5-7B, and 23/33 and 27/37 for Llama-3.1-8B across test_family and test_structure.Higher overall held-out accuracy may reflect option frequencies and scenario difficulty rather than transfer.Source: §7 · p. 11

7 5 Gate replay

  • With the gate on, simulated executed violations were zero in every reported cell, while attempted violations were unchanged.The replay used trusted simulator state and recorded proposals; it did not test adaptation to feedback or real-tool containment.Source: §7 · p. 11

7 6 Exploratory sensitivity to training

  • The main Qwen2.5-3B probe used LoRA fine-tuning on 12,302 decision-step examples from 3,000 enriched v2 development scenarios, for two epochs with seed 1.Its baseline used Q4_K_M inference quantization and the trained checkpoint Q8_0, so the contrast does not isolate fine-tuning from quantization.Source: §7 · p. 11
  • Decision accuracy rose to 0.827–0.920 and withdrawal recall to 0.63–0.86 in the main probe.Table 8 compares the instruction-tuned baseline and v2 fine-tuned model on the same cases; resumption denominators depend on each model’s prior withdrawals.Source: Table 8 · p. 11, §7 · p. 11
  • The v1 checkpoint wrongly withdrew 26 of 34 F5 actions with surviving support, versus 0 of 34 for v2; both checkpoints reported zero injected-authority events on all three regimes.The contrast is consistent with curriculum sensitivity but does not isolate enrichment’s causal effect; conditional resumption of 39/40 applies only to model-created opportunities, not all 71 reference repair cells.Source: §7 · p. 11

8 Failure taxonomy

The taxonomy describes observable failures in persistence, withdrawal, delegation, and reporting. The paper bounds interpretation by its synthetic policy-application setting, conservative reference policy, limited model and scenario coverage, exploratory training, and verification procedure.

8 Failure taxonomy

  • Persistence re-proposes an action after premise invalidation, while hedging answers verify or decline when withdrawal or proceeding is required, reducing task value and appropriate continuation.Persistence was the modal failure for Qwen-3B and Llama-8B; hedging was modal for Qwen-7B.Source: §8 · p. 12
  • Withdrawals can miss delegated revocations and target unaffected or still-supported actions; Qwen-3B made 21 false withdrawals against 17 true positives on validation.The v1 probe withdrew an action despite surviving support in 26 of 34 F5 cases; preservation alone can look strong when a model rarely withdraws.Source: §8 · p. 12
  • Reporting ranged from Qwen2.5-7B identifying nearly all injected-authority events with 175–332 false reports to Llama-3.1-8B reporting almost none; the taxonomy is trace-based, without independent human annotation.No causal analysis of model internals is reported.Source: §8 · p. 12

9 Limitations

  • The synthetic setting supplies evidence statuses and authentication flags, so it tests policy application rather than source verification, raw-text attack detection, action discovery, or inference of dependencies.It also does not test coping with ambiguous evidence or tool errors.Source: §9 · p. 12
  • The conservative reference honors weakly authenticated contractions and rejects weak expansions, potentially imposing an unmeasured denial-of-service cost; option prices are not calibrated to deployment harms.Exact agreement may penalize a safe but different response, so violation and task metrics accompany exactness.Source: §9 · p. 12
  • The main evaluation covers three 3–8B models from two families, one inference seed, and three regimes, excluding frontier models and held-out-domain results.Broad policy-following difficulty, formatting, prompt length, and the response limit may contribute to errors.Source: §9 · p. 12
  • Training claims are limited by one checkpoint per curriculum, differing example counts, no documented untouched final test, changed inference quantization, and unpaired validation builds.Held-out-family evaluation uses previously taught concepts in new templates, not unseen rules; resumption denominators depend on prior model behavior.Source: §9 · p. 12
  • Internal consistency checks are not independent validation, and the privileged-state gate provides no evidence about sandbox escape prevention.Independent replication also requires full split hashes, source versions, prompts, training configurations, and trace-level metric regeneration.Source: §9 · p. 12

Ethics and reproducibility

The conclusion reports low selective-withdrawal performance in a controlled benchmark, while the ethics and reproducibility discussion limits what the synthetic setting and available checks establish.

Ethics and reproducibility

  • All scenarios are synthetic, use no real vendor, patient, or user records, and execute no external tools, so the benchmark is not safety certification.Injected-authority events use simulator labels rather than realistic exploitation procedures.Source: Ethics and reproducibility · p. 13
  • AI assistance covered conceptual exploration, code development and review, and manuscript revision; the author retains responsibility, and no independent audit is claimed.Source: Ethics and reproducibility · p. 13
  • The paper identifies a repository commit and directs readers to the v5 release for adapters and dataset artifacts, but claims no independent rerun of training or inference.The repository contains additional training-arm results beyond those compared in the paper.Source: Ethics and reproducibility · p. 13

10 Conclusion

  • Withdrawal recall is at most 0.06, and only one of 3,150 model–prompt episodes fully matches the reference policy.The authors call for broader model coverage, independent replication, stronger non-oracle baselines, and evaluation with inferred dependencies and real tool interfaces.Source: §10 · p. 13

Appendix A Withdrawal and resumption definitions

The appendix defines withdrawal, resumption, continuation, and event-reporting measures, then clarifies how prompt-condition ranges and a model artifact identifier should be read.

Appendix A Withdrawal and resumption definitions

  • At non-initial steps with retained replies and newly required withdrawals, D(t) records newly withdrawn actions and W(t) retained first valid model withdrawals.The analyzer skips whole-step backend or parsing failures, whereas decision accuracy counts their missing assessments as mismatches.Source: Appendix A · p. 14
  • Withdrawal precision and recall compare W(t) with D(t); repeated withdrawal of an already-blocked action earns no new true positive.A missing assessment where withdrawal was required is a false negative.Source: Appendix A · pp. 14–15
  • Valid resumption is measured only for repaired actions previously withdrawn that remain suspended in the model’s recorded history; a zero denominator is N/A.The rate is conditional, not unconditional recovery, and should be reported with repair-cell and history-eligible counts.Source: Appendix A · p. 15
  • Continuation counts exact matches on non-withdraw-or-resume cells, while episode-level event reporting deduplicates IDs and separates injected from false reports.A premature proceed or resume still removes an action from the suspended set.Source: Appendix A · p. 15

Appendix B Ranges across prompt conditions

  • Reported prompt-condition ranges are minima and maxima, not confidence intervals or paired effect estimates.The cells use the same live lenient protocol and common worked examples.Source: Appendix B · p. 15

Qwen2.5-3B

  • The Qwen2.5-3B artifact identifier is 357c53fb659c5076de1d65ccb0b397446227b71a42be9d1603d46168015c9e4b.Source: Qwen2.5-3B · p. 15

Qwen2.5-7B

This block lists model and adapter artifact identifiers and documents the Qwen2.5-3B LoRA probe recipe, alongside limits on attributing its training effects.

Qwen2.5-7B

  • The Qwen2.5-7B artifact identifier is 845dbda0ea48ed749caafd9e6037047aa19acfcfd82e704d7ca97d631a0b697e.Source: Qwen2.5-7B · p. 16

Llama-3.1-8B

  • The Llama-3.1-8B artifact identifier is 46e0c10c039e019119339687c3c1757cc81b9da49709a3b3924863ba87ca666e.Source: Llama-3.1-8B · p. 16

LoRA v2

  • The LoRA v2 adapter identifier is db5514aa0e2c84be500578b2e3b1eb1b9721f469a3d4c5961c38baaaa4ae2af0.Source: LoRA v2 · p. 16

LoRA v1

  • The cited passage records identifier f5e4a739d799d0dcdf2204198bda4829 0de2289b1cd73efa016371033e6fc88a, displayed with a space between the two segments.Source: LoRA v1 · p. 16

Appendix D Training recipe

  • Both Qwen2.5-3B probes use rank-16 LoRA and train for two epochs with assistant-completion loss, saving each epoch without validation-based checkpoint selection.The recipe uses bf16 base weights, AdamW, learning rate 0.0001, and effective batch size 16 on one GPU.Source: Appendix D · p. 16
  • The scripts do not reconstruct prior curriculum or prompt selection, and matched-quantization baselines plus repeated seeds are needed to isolate training effects.The logs record 12,302 examples for v2 and 12,748 for v1.Source: Appendix D · p. 16

Related papers

Loading 2609.38460v1…