AgentPerturb: Evaluating LLM Agent Robustness under Controlled Interaction Perturbations

1 Introduction

• Prior robustness evaluations focus mainly on prompts, instructions, or reasoning inputs, leaving failures across complex, stateful agent interactions less visible.In these tasks, outcomes can depend on intent interpretation, instruction following, context selection, tool use, and adaptation to the current state.Source: §1 · p. 1
• AgentPerturb crosses four agent-input targets with three perturbation types to define 12 families for controlled evaluation.The targets include user utterances, procedural specifications, carried-over context, and tool contracts; the types are missing, redundant, and incorrect information.Source: §1 · pp. 1–2, Figure 1 · p. 2
• The study characterizes robustness through outcome and factor analyses and traces failures through agent trajectories.Its contributions include finding environment-dependent vulnerabilities and auditing cases where agents succeed cleanly but fail after perturbation.Source: §1 · p. 2

2 Related Work

• Static-input robustness benchmarks test prompt variations, consistency, and reasoning-input changes, but not executable, stateful trajectories or multiple information sources within them.Examples include PromptRobust, SCORE, and Math-RoB [Yu et al., 2025].Source: §2 · p. 2
• Agentic robustness benchmarks target particular interaction faults, such as indirect prompt injections, production-style faults, noisy tool results, or recovery from tool failures.Examples include AgentDojo, ReliabilityBench [Gupta, 2026], AgentNoiseBench, AgentHijack, and ToolMaze [Zhu et al., 2026].Source: §2 · p. 3
• AgentPerturb crosses four selected agent-input sources with three perturbation types to support matched, attributable robustness evaluation.Its construction pipeline instantiates concrete edits and retains instances that meet validity checks.Source: §2 · p. 3, Figure 2 · p. 3

3.1 Perturbation Targets and Types

• The method defines four independently perturbed targets—user utterance, procedural specification, carried-over context, and tool contract—and three types: missing, redundant, and incorrect information.The 12 target–type combinations provide the framework’s perturbation families.Source: §3.1 · p. 3

3 Method

• Table 1 reports clean and perturbed performance, with perturbed scores paired with relative degradation and averages across ten models.The caption defines relative degradation as 100(C −P)/C.Source: Table 1 · p. 4

3.2 Perturbation Construction

• The construction pipeline selects a compatible target and type, then uses demonstrations to instantiate a concrete edit in the benchmark’s native object.Figure 3 presents marginal clean-minus-perturbed score differences; Figure 4 breaks effects down by target–type combinations.Source: §3.2 · pp. 4–5, Figure 3 · p. 4, Figure 4 · p. 5
• When a missing-information edit requires recovery, the evaluation protocol requires the agent to ask for the omitted information before proceeding.An independent verifier checks that one target changed, the task goal and a successful path remain, and the instance is executable; failing candidates are regenerated.Source: §3.2 · p. 5

4 Experiments

• Ten frontier models ran 25 tasks per benchmark, with each clean task paired to one perturbed instance per family and scored by the native grader.Each model ran 300 perturbed episodes per benchmark; paired runs differed by a single perturbed target.Source: §4 · p. 5

4.1 Overall Performance

• 21.8% on APEX-Agents and 26.4% on Toolathlon were the average relative losses; every model lost performance on both benchmarks.Hunyuan-3-High and Qwen3.8-Max both scored 64.0 on clean APEX-Agents, yet Qwen3.8-Max lost almost three times as much under perturbation.Source: §4.1 · p. 6

4.2 Which Perturbations Are Most Disruptive?

• APEX-Agents was most affected by procedural specifications and redundant information, whereas Toolathlon was most affected by user utterances and missing information.Across 12 target–type cells, APEX-Agents showed broad sensitivity while Toolathlon’s degradation concentrated in missing user information; task-level profiles were more similar for perturbations sharing a target than a type.Source: §4.2 · p. 6

4.3 Does Robustness Track Base-Model Capability?

• Capability had a positive but weak association with robustness on both benchmarks, with no significant permutation test among ten models.The three most capable models degraded less than half as much as the others on average, yet similarly capable models diverged sharply and model rankings were almost independent across benchmarks.Source: Figure 5 · p. 6, §4.3 · p. 7

4.4 Does Noise Increase Recovery Cost?

• 73% more tokens per successful trajectory on average and 44% fewer successes per million tokens accompanied perturbations for Hunyuan-3-High.Median successful-trajectory cost barely moved, but incorrect tool contracts made successful runs most expensive and incorrect context yielded the fewest successes per token; rewriting a tool description was especially damaging.Source: Figure 6 · p. 7, §4.4 · p. 8

4.5 Failure Awareness and Behavioral Attribution

• Among 30 DeepSeek-V4-Flash failures whose clean counterparts succeeded, 27 never flagged a possible error, and none suspected altered inputs.The most common first-error response, seen in 13 failures, was accepting a corrupted value and carrying it into later reasoning and output; verbalized uncertainty did not coincide with successful recovery.Source: §4.5 · pp. 8–9, Figure 7 · p. 8

• Perturbations consistently reduce performance across APEX-Agents and Toolathlon, while the dominant vulnerability depends on the task environment.Source: §5 · p. 9
• Sensitivity is organized more strongly by where information is perturbed than by how it is corrupted.Source: §5 · p. 9
• Trajectory analysis finds that agents often propagate unverified information without recognizing altered inputs, and successful perturbed trajectories can consume substantially more computation.Source: §5 · p. 9
• The authors recommend evaluating input-channel sensitivity, recovery cost, and perturbation awareness alongside task success.Source: §5 · p. 9

Limitations

• AgentPerturb covers two agentic benchmarks under one scaffold and injects perturbation families independently, leaving broader domains and compound or evolving noise for future evaluation.Source: Limitations · p. 9

A.1 Model Suite and Decoding Settings

• The study evaluates ten frontier models from seven providers; all completed both benchmarks, while target- and type-level analyses use the five with per-family scores on both.Source: §A.1 · p. 12
• Models use provider-default temperature and top-p, a 16,384-token completion cap, and one trajectory per episode, with specified Kimi and DeepSeek endpoint constraints.Reasoning is enabled where available; DeepSeek uses maximum effort and Kimi-K2.6 uses reasoning mode.Source: §A.1 · p. 12

A.2 Evaluation Protocol

• Every clean episode is paired with a perturbed episode per family, and both are scored by the benchmark’s native grader.Source: §A.2 · pp. 12–13
• APEX-Agents reports mean reward on a continuous 0–1 scale, whereas Toolathlon’s binary outcomes make mean reward its success rate.Source: §A.2 · p. 13
• Toolathlon results use 25 of 79 tasks selected by run completion; cross-benchmark comparisons therefore use relative degradation, while within-benchmark differences are absolute.All contrasts use the same 25 tasks on each paired clean and perturbed side.Source: §A.2 · p. 13

A.3 External Capability Proxy

• Capability proxies use each model family’s highest published Artificial Analysis Intelligence Index v4.1.1 score, retrieved September 29, 2026.Source: §A.3 · p. 13, Table 3 · p. 13

A.4 Failure-Attribution Annotation Scheme

• Failure traces receive an awareness grade for the highest explicit awareness reached and a behavior label for the immediate behavior at the first observable error.The scheme examines 30 matched DeepSeek-V4-Flash pairs: 20 Toolathlon and 10 APEX-Agents pairs across 13 tasks.Source: §A.4 · p. 14, Table 4 · p. 14

B.1 Tool-Perturbation Edit Magnitude

• The analysis groups 67 Hunyuan-3-High tool-targeted perturbations by patch operation and pairs each with its base task’s clean outcome.There were 25 clean base tasks, of which 16 succeeded.Source: §B.1 · p. 14
• Description replacement produces the largest success drop and successful-trajectory cost increase; adding a fake tool or removing one costs only about five points.A false description leaves the interface callable without an execution error, while structural inconsistencies may be detected or bypassed; group sizes and task composition differ, so comparisons are descriptive.Source: §B.1 · pp. 14–15, Table 5 · p. 15
• Table 6 presents representative tool-contract edits as one changed-field patch per edit level, with gray text showing the source perturbation.Source: Table 6 · p. 15

B.2 Cross-Family Sensitivity Correlations

• Families sharing a target correlate more strongly than those sharing only a perturbation type, indicating sensitivity is organized primarily by where information is disturbed.Figure 8 reports partial Spearman correlations across 75 model–task pairs, controlling for clean performance and model identity.Source: §B.2 · p. 16, Figure 8 · p. 16
• The analysis ranks normalized performance changes within each family, regresses out clean-performance rank and model fixed effects, then correlates residuals.Uncertainty is estimated by resampling 25 tasks with replacement across 2,000 bootstrap replicates while keeping each task’s models together.Source: §B.2 · p. 16
• 58 of 66 family-pair correlation intervals exclude zero, and both contrasts between target-sharing pairs and the other two groups exclude zero.Individual-pair interval widths are broad, with a median width of 0.51; Table 8 reports cluster-bootstrap percentile intervals.Source: §B.2 · p. 16, Table 8 · p. 17

B.3 Effects on Rollout Length and Stability

• A small number of loop-like trajectories can produce exceptionally high token consumption despite typical rollout lengths remaining nearly unchanged.The analysis uses medians and interquartile ranges as primary summaries because ratios have heavy tails.Source: §B.3 · p. 17
• All median ratios for tool calls, turns, input tokens, and output tokens fall between 0.82 and 1.11; only two of 28 comparisons reach nominal significance.The reported user-utterance and context effects are not strong evidence given the number of comparisons.Source: §B.3 · p. 17
• For INCORRECT and context perturbations, mean input-token ratios approach two and standard deviations approach six, although both median ratios stay below one.A few loop-like trajectories account for the spread; typical rollouts remain close to their clean length.Source: §B.3 · p. 17

C Prior Robustness Evaluations

• Table 9 compares prior robustness evaluations by direct and partial coverage of the paper’s targets and perturbation types.Tool-contract coverage refers to static contracts, not runtime tool outputs; interventions on observations or environment state may have type coverage without a target check.Source: C Prior Robustness Evaluations · p. 17, Table 9 · p. 18

D Perturbation Examples

• Table 10 presents examples of all 12 perturbation families in one repository-coding task, with each group changing only its listed target.The examples vary the edited target and edit type.Source: Table 10 · p. 18, D Perturbation Examples · p. 18

E Illustrative Failure Trajectories

• A missing multiple or redirected precedent led agents to wrong answers without signaling a problem, while misdescribed interfaces prompted sustained trial and error.The clean runs demonstrate the agents could reason correctly; in the interface case, the successful call came at step 6 rather than step 2.Source: E Illustrative Failure Trajectories · pp. 18–20

F Prompt Templates

• Generation uses a shared prompt template with target-specific slot ontologies, edit strategies, and output contracts; variants are written into copied directories while grader files and verifier configuration remain unchanged.Each variant is produced by one LLM call over the original target content.Source: F Prompt Templates · p. 20

F.1 Prompt Assembly and Label Mapping

• The implementation calls INCORRECT perturbations “mistake”; all four targets apply to MCP tasks, while coding tasks expose only the user-instruction surface.Source: §F.1 · p. 20

F.2 Target and Type Selection Prompt

• The selection step chooses a compatible target and type for each clean instance without modifying it, subject to preserving the task goal and at least one completion path.Source: §F.2 · pp. 20–21

F.3 Shared Generation Prompt

• The shared generation prompt rewrites only the selected content, preserving answers and recognizable identifiers while keeping edits plausible and syntactically valid.For REDUNDANT edits, true facts remain intact so the correct answer stays reachable.Source: §F.3 · p. 22

F.4 Target-Specific Prompt Blocks

• Target-specific blocks identify distinct content to edit, including user-task facts and constraints, user-instruction details, and procedural steps or tool conventions.Source: §F.4 · pp. 22–23

F.5 Uniform JSON Output Contract

• Every generation call returns a four-key envelope: the replacement, modified slots, misleading tokens, and an explanation; replacement payloads vary by target.The misleading-token field is empty for REDUNDANT edits.Source: §F.5 · p. 24

F.6 Verification Prompt

• An independent verifier retains a candidate only if it passes separate single-target, goal-preservation, solvability, and executability checks.Semantic checks are handled by the verifier; benchmark validators handle schema validation and test execution where available.Source: §F.6 · p. 24