PaperlayerView exact revision on arXiv

Source-linked AI summary

Who Verifies the Agent's Success Claim? Self-Report Leakage in GUI-Agent Completion Judging

Yunfeng Zhu, Shengcheng Yu, Zihan Li, Zhenyu Chen

arXiv:2610.29609v1cs.SE

TL;DR

A GUI agent’s confident success report can advance downstream automation even when the recorded trace does not show that it accomplished the task. This paper tests whether the report alters completion judging and builds a report-isolated auditor. Withholding the report improves dangerous-misreport recall, and the auditor achieves strong F1 while blocking many dangerous misreports under audit-stage gating.

  • Problem

    The paper studies whether an agent’s success report is supported by its independently recorded trace, since a success claim unsupported by causal accomplishment can be recorded as a silent false pass.

    Source: §I · p. 1

  • Method

    A report-isolated auditor reads claim intent from the report, extracts completion evidence from the task and trace without the report, and applies deterministic rules to the evidence.

    Source: §I · p. 2

  • Results

    The auditor achieves F1 0.75–0.78 on 465 audit-stage records and 0.77–0.81 on held-out Batch 2, outperforming claim-aware and PROMPT-BLIND controls in recall and F1.

    Source: §I · p. 2

  • Takeaways & Limitations

    Under audit-stage gating, the auditor blocks 74–90% of dangerous misreports from automatic pass at 45–56% inspection load within the audit-target set.

    Source: §IX · p. 11

    The auditor operates on passive post-hoc traces and assumes those traces are independently recorded; detecting manipulation or omissions in the logging substrate is outside scope.

    Source: C. Remaining Limitations · p. 9

Abstract

from arXiv · show

In automation pipelines, a GUI agent's confident success report can let downstream stages proceed even when the recorded execution trace does not show that the agent produced the requested outcome. We call this case a dangerous misreport: an unhedged success claim that the trace does not support as causal accomplishment during the run. We study report--trace auditing, which checks an agent's completion claim against an independently recorded trace. A controlled aware/blind intervention reveals self-report leakage: the agent's own self-report changes how completion is judged. The same judge reads the same task and trace; only that self-report is included or withheld. Withholding it improves trace-only dangerous-misreport recall by 43.4 percentage points with Qwen3.5-35B-A3B and 13.3 percentage points with DeepSeek-284B-A13B, with the same trend on held-out Batch 2. This motivates report isolation. The report records what the agent claims, but it must not influence the trace-state judgment. We implement this separation with a structured auditor that separates claim interpretation from claim-blind trace analysis and applies deterministic rules to extracted evidence. Because evidence extraction is separated from the policy that consumes it, the same audit record can be replayed under alternative policies without new model calls. The auditor achieves F1 0.75--0.78 on the 465-record audit-target set and 0.77--0.81 on held-out Batch 2, outperforming claim-aware and prompt-blind controls in recall and F1. Under audit-stage gating, where flag and review both block automatic pass, it blocks 74--90% of dangerous misreports at 45--56% inspection load, or 16--19% of the full in-scope stream after coarse status triage.

I. INTRODUCTION

The paper studies whether a GUI agent’s success report is supported by its independently recorded execution trace, addressing circularity when a judge uses the report as evidence. It finds self-report leakage and proposes a report-isolated auditor that separates claim interpretation from trace analysis and deterministic policy enforcement.

II. PROBLEM FORMULATION

  • A dangerous misreport is an unhedged success claim unsupported by trace evidence that the agent causally accomplished the task during the run.A compatible final screen alone is insufficient: a goal may pre-exist, the target list may be empty, or an edit may remain unsaved [5], [6].Source: §I · p. 1

I. INTRODUCTION

  • Claim-aware judging can use an agent’s final report as evidence for its own truth, creating a circular evaluation path [10]–.Because task-specific checks and human trajectory review are costly, recent work increasingly uses LLM or agent judges for trajectory success –[10].Source: §I · p. 1
  • Withholding the self-report raises trace-only dangerous-misreport recall by 43.4 percentage points for Qwen3.5-35B-A3B and 13.3 for DeepSeek-284B-A13B, with the same trend on held-out Batch 2.The intervention holds the task and trace fixed while including or withholding only the agent’s report.Source: §I · p. 1
  • The auditor separates report-based claim interpretation from claim-blind trace evidence, then applies deterministic rules; cached evidence can be replayed under alternative policies without new model calls,.Claim intent is labeled from the report alone, while causal accomplishment is judged from the task and trace alone.Source: §I · pp. 1–2
  • F1 reaches 0.75–0.78 on 465 audit-stage records and 0.77–0.81 on held-out Batch 2, outperforming claim-aware and PROMPT-BLIND controls in recall and F1.With audit-stage gating, FLAG and REVIEW block automatic pass for 74–90% of dangerous misreports at 45–56% inspection load.Source: §I · p. 2

A. Audit-Target Runs and Completion Construct

  • Causal accomplishment requires the trace to show a task-relevant action and the requested post-condition during the run, not merely a compatible ending state.The audit is post-hoc and operates on passive traces; it does not re-execute tasks, query the environment, or verify postconditions outside the trace.Source: A. Audit-Target Runs and Completion… · p. 2

B. Claim Intent, Trace Support, and Positive Class

The formulation keeps claim intent and trace support as separate, independently derived judgments. It defines the positive evaluation class as success reported despite a trace that does not support completion.

B. Claim Intent, Trace Support, and Positive Class

  • A valid trace-state estimate excludes the final report, so changing the report may change the claim label but cannot change the trace judgment.The distinction from one-shot claim-aware judging is this information-flow constraint.Source: B. Claim Intent, Trace Support, and… · pp. 2–3
  • Claim intent comes from the final report alone, while actual completion is judged from the task and trace under a claim-blind causal-accomplishment policy.The gold axes are independently annotated, and the gold-claim condition replaces the predicted claim reading to isolate trace-channel behavior.Source: B. Claim Intent, Trace Support, and… · p. 3
  • The positive class is a success report paired with a trace that does not support completion; the reverse inconsistency is an underclaim, not a positive case.Self-reported failures are excluded because they do not create a silent false pass.Source: B. Claim Intent, Trace Support, and… · p. 3

C. Audit Disposition and Evaluation Views

The auditor maps claim and checked trace state to PASS, FLAG, or REVIEW, while keeping evidence extraction separate from policy enforcement. Cached evidence makes policy changes replayable without new model calls.

C. Audit Disposition and Evaluation Views

  • The auditor’s disposition is PASS, FLAG, or REVIEW, and a success claim paired with NOT COMPLETED trace state maps to FLAG.Uncertainty in either channel routes to REVIEW; PASS means the consistency check does not flag a dangerous misreport, not necessarily that the task was completed.Source: C. Audit Disposition and Evaluation… · p. 3
  • In audit-stage gating, both FLAG and REVIEW block automatic pass; in automatic detection, only FLAG counts as a positive prediction.The two views treat REVIEW differently when reporting detection versus deployment gating.Source: C. Audit Disposition and Evaluation… · p. 3

III. REPORT-ISOLATED EVIDENCE–POLICY AUDITOR

  • The auditor extracts structured evidence once and applies deterministic rules, caching the record so alternative policies need no new model calls.The design avoids asking a model for a final completion verdict and exposes an inspectable, replayable evidence–policy boundary.Source: §III · p. 3

A. Structured Evidence Interface

The evidence interface keeps the claim reader separate from a claim-blind extractor that returns cited, typed evidence. A deterministic checker uses task-specific required fields to assign a trace state.

A. Structured Evidence Interface

  • The claim reader labels a report SUCCESS only for an unhedged assertion that the requested task was completed; failure, partial completion, inability, uncertainty, and ambiguity are not confident success.Its three-way label space is SUCCESS, FAILURE OR INCOMPLETE, or UNCLEAR.Source: A. Structured Evidence Interface · p. 3
  • The extractor reads the task and trace but not the self-report, producing typed evidence for action, target identity, transition, commitment, and final support for the goal.These fields represent obligations needed to audit causal accomplishment.Source: A. Structured Evidence Interface · p. 3
  • Each evidence field includes a value, cited trace support, and a short rationale; the extractor cannot itself output COMPLETED or NOT COMPLETED.The structured record is an intermediate representation consumed by deterministic code.Source: A. Structured Evidence Interface · pp. 3–4

B. Deterministic Trace-State Checking

  • The deterministic checker maps task and evidence to COMPLETED, NOT COMPLETED, or UNKNOWN using task-class-specific required fields and a closed-world rule.Figure 1 illustrates the separation: the extractor sees task and trace, while the report enters only through the claim reader.Source: B. Deterministic Trace-State Checking · p. 4, Figure 1 · p. 4

NOT COMPLETED,

The checker uses task-specific required evidence fields and a closed-world rule to determine whether the trace supports completion. A missing or negative obligation prevents a COMPLETED outcome.

NOT COMPLETED,

  • The checker requires evidence for the correct target and direct support for the task-specific post-condition, not a proxy cue.The listed obligations vary by task class, such as requiring committed state for create/edit and send tasks.Source: NOT COMPLETED · p. 4
  • A frozen rule assigns each task to one of six classes, selecting required fields for the checker or falling back to the general other obligations.The classes are create/edit, delete, configure, send, query, and other.Source: NOT COMPLETED · p. 4
  • A task is COMPLETED only when every required field is YES with cited trace support; missing or negative obligations force NOT COMPLETED or UNKNOWN.If no required field is NO but any is UNKNOWN, the result is UNKNOWN.Source: NOT COMPLETED · p. 4

C. Report–Trace Disposition

The disposition layer applies deterministic rules to claim and trace evidence, while the evidence–policy boundary allows cached evidence to be replayed under alternative policies. The experiment treats Batch 2 as held out and the combined 465-record set as the complete two-batch analysis.

C. Report–Trace Disposition

  • The auditor deterministically returns FLAG for overclaim, PASS for agreement between channels, and REVIEW when either channel is uncertain.The disposition function uses no language-model adjudication.Source: C. Report–Trace Disposition · p. 4

D. Replayable Evidence–Policy Boundary

  • Cached evidence can be replayed under alternative deterministic policies without another model call, enabling policy changes to be assessed from the same audit record.The record exposes evidence fields and policy decisions for inspection, regression testing, and replay.Source: D. Replayable Evidence–Policy Boundary · p. 5

IV. EXPERIMENTAL SETUP

  • The evaluation reports the 465-record combined two-batch analysis and uses Batch 2 as the held-out validation set.The detector predicts a dangerous misreport when an unhedged-success report is paired with a NOT COMPLETED trace state.Source: §IV · p. 5

A. Corpus and Evaluation Universe

The audit-target set contains unresolved report-producing, trace-analyzable runs, and its held-out Batch 2 split includes a source absent from development. Gold completion and claim intent are annotated independently from trace/task and report, respectively.

A. Corpus and Evaluation Universe

  • The audit-target set contains 465 records, including 180 dangerous misreports, drawn from runs left unresolved by coarse harness status.The audit stage excludes clean passes and non-auditable runs such as timeouts, execution errors, and invalid or missing reports.Source: A. Corpus and Evaluation Universe · p. 5

B. Validation Split and Development Protocol

  • Batch 2 contains 130 records and is held out from prompt, schema, parser, checker, and policy development; it includes all Themis records, a source absent from development.The split is fixed before scoring and released with record lists and validation scripts.Source: B. Validation Split and Development… · p. 5

C. Gold Labels

  • Annotators assign actual completion from task and trace without the final report, and claim intent from the report without the trace.Two annotators independently label each axis, with remaining disagreements adjudicated by a third party.Source: C. Gold Labels · pp. 5–6

D. Models, Inference, and Metrics

Withholding the self-report improves trace-only dangerous-misreport recall on both backends, with the same direction on Batch 2. The evaluation compares model backends and judging controls under a shared report-exposure intervention.

D. Models, Inference, and Metrics

  • The evaluation uses qwen and deepseek separately, with temperature 0 and five-run majority aggregation for multi-run methods.If no label reaches a majority, the component returns UNKNOWN or REVIEW.Source: D. Models, Inference, and Metrics · p. 6

E. Baselines and Controls

  • Baselines include simple claim-based controls, claim-aware judges, a report-withheld prompt-level control, and an adapted trajectory judge.PROMPT-BLIND withholds the report but emits a prompt-level verdict without an evidence–policy boundary.Source: E. Baselines and Controls · p. 6

V. EVALUATION

  • The evaluation asks whether report exposure biases trace-state judging, whether structure adds beyond prompt-level isolation, and what policy replay reveals about silent false passes.The intervention holds the task, trace, model, serialization, scoring rule, and aggregation fixed while varying report exposure.Source: §V · p. 6, A. RQ1: Does Report Exposure Bias… · p. 6

A. RQ1: Does Report Exposure Bias Trace-State Judging?

  • 43.4 percentage points with qwen and 13.3 percentage points with deepseek: withholding the report improves trace-only dangerous-misreport recall on the combined set.Batch 2 preserves the direction, with gains of 38.0 and 14.0 points; harmful versus recovery flips are significant in three of four settings.Source: A. RQ1: Does Report Exposure Bias… · p. 6, Table II · p. 7

B. RQ2: Is Prompt-Level Isolation Enough, or Does Structure Add?

The structured auditor improves dangerous-misreport detection over both claim-aware and prompt-blind controls, while exposing an inspectable, replayable evidence–policy boundary. Its gating results trade inspection load for fewer silent false passes.

B. RQ2: Is Prompt-Level Isolation Enough, or Does Structure Add?

  • The structured auditor detects 40/49 additional positives over PROMPT-BLIND on the combined set and 15/16 on Batch 2, with all four paired tests significant (p ≤0.001).It adds 13/23 false positives on the combined set and 4/6 on Batch 2; counts are qwen/deepseek.Source: B. RQ2: Is Prompt-Level Isolation… · p. 7
  • The structured auditor records combined-set F1 of 0.75 with qwen and 0.78 with deepseek; on held-out Batch 2, it reaches 0.77 and 0.81, ahead of both controls in recall and F1.Source: B. RQ2: Is Prompt-Level Isolation… · p. 7
  • Against the AER text-only comparator, the auditor is correct on more discordant records (85 vs. 24 for qwen; 76 vs. 33 for deepseek), with ∆F1 +0.28/+0.20.The comparison covers the 465-record set under the same backbone and aggregation.Source: B. RQ2: Is Prompt-Level Isolation… · p. 7
  • Leave-one-agent-out F1 stays near the full-set result for appagent (0.74/0.77) and mav3 (0.76/0.78), while the Themis slice is too small for a stable source-specific estimate.The Themis slice has 38 records and 14 positives; one record shifts F1 by roughly 0.07.Source: B. RQ2: Is Prompt-Level Isolation… · pp. 7–8
  • Audit-stage gating blocks 138/180 and 159/180 dangerous misreports on the combined set at 48% and 56% inspection load, respectively.On Batch 2 it blocks 37/50 and 45/50 positives at 45% and 54% load; both FLAG and REVIEW block automatic pass.Source: B. RQ2: Is Prompt-Level Isolation… · p. 8
  • The structured auditor adds recoverable positives and an inspectable, replayable policy boundary beyond report isolation alone, trading moderate inspection load for fewer silent false passes.The paper notes that a missed dangerous misreport passes silently, whereas a false positive adds review work.Source: B. RQ2: Is Prompt-Level Isolation… · p. 8

the Auditor Still Fail?

Policy replay changes outcomes by modifying deterministic rules over cached evidence, without another model call. Remaining silent false passes are mostly trace-side cases that human readers can identify, while the discussion argues for separating the agent’s claim from trace-state judgment.

the Auditor Still Fail?

  • Changing the audited construct to final-state satisfaction lowers F1 to 0.71/0.72 and raises silent-pass risk by 0.07/0.13; a lower-load policy also raises silent-pass risk while lowering F1.The lower-load replay reduces inspection by 15/28 records and lowers F1 to 0.66/0.70; these are qwen/deepseek values.Source: the Auditor Still Fail? · p. 8
  • With gold claim labels, F1 rises from 0.75 to 0.82 for qwen and 0.78 to 0.84 for deepseek, but most remaining silent positives are trace-side misses.Human readers reach F1 0.90–0.95 from the same passive traces, compared with 0.82/0.84 for the trace channel; human reading is also below 1.0.Source: the Auditor Still Fail? · p. 8
  • The 42 qwen silent positives include 31 trace-side misses visible to human readers and 5 passive-trace limits; the 21 deepseek cases include 12 and 3, respectively.Each model’s remaining cases also include 6 claim-side misses.Source: the Auditor Still Fail? · p. 8
  • Delete and send tasks often expose clearer transition or commitment evidence, while create/edit tasks more often require distinguishing durable changes from intermediate visible content.Longer-trace classes do not show inflated recall, so trace length alone does not explain the result.Source: the Auditor Still Fail? · p. 8
  • Among 79 harmful qwen flips, the claim-blind trace channel judges NOT COMPLETED on 77, and 67 reach an end-to-end FLAG; extractor errors dominate residual trace-side misses.In one example, an empty target list makes a delete report sound successful despite failed action, transition, and final-state fields.Source: the Auditor Still Fail? · p. 8
  • Policy replay can adjust the audited construct and load/silent-pass trade-off over fixed evidence, while stronger trace estimation is the clearest path to further gains.The replay changes deterministic policy code rather than prompting a judge again.Source: the Auditor Still Fail? · p. 8

VI. DISCUSSION

  • The report may define the claim under audit, but it must not enter the trace-state judgment that verifies it.The discussion presents the structured auditor as one operational form of this information-flow boundary.Source: §VI · pp. 8–9

A. Implications for Self-Reporting Agent Pipelines

  • PROMPT-BLIND demonstrates the value of withholding reports; structured evidence adds deterministic obligation checking and an inspectable, replayable audit record.The record can be regression-tested and replayed without re-querying a hosted model.Source: A. Implications for Self-Reporting… · p. 9

B. Audit-Stage Deployment Boundary

Audit-stage gating blocks many dangerous misreports while keeping inspection load below the full audit-target set. The reported scope is post-hoc trace auditing, with limitations in deployment boundary, construct validity, and evidence-field validation.

B. Audit-Stage Deployment Boundary

  • 74–90% of dangerous misreports are blocked from automatic pass at 45–56% inspection load under audit-stage gating.Both FLAG and REVIEW block automatic pass; coarse status checks handle easy outcomes before semantic trace auditing is invoked.Source: B. Audit-Stage Deployment Boundary · p. 9

C. Remaining Limitations

  • The auditor uses passive, post-hoc traces and does not re-execute tasks, query the environment, or verify postconditions beyond the recorded trace.It assumes independently recorded traces are available; detecting logging manipulation or omissions is outside scope –.Source: C. Remaining Limitations · p. 9
  • The evaluation measures detector behavior only when coarse harness status does not already settle completion.The full-stream inspection fraction is reported separately using the observed audit-stage invocation rate.Source: C. Remaining Limitations · p. 9
  • Results are strongest for Android GUI traces under the studied reporting styles and passive trace representation.Residual silent false passes mostly occur when post-condition evidence is indecisive or the extractor fails to surface it.Source: C. Remaining Limitations · p. 9

A. Construct Validity

  • The target labels use independent annotations of actual completion from task and trace and claim intent from the report, not the detector’s decision rule.This addresses label circularity in the audit logic under evaluation.Source: A. Construct Validity · p. 9
  • “Checkable” means evidence fields are mechanically inspectable and deterministically enforced, but their correctness is not validated against field-level gold labels.Correctness is bounded indirectly by human-bound and residual analyses.Source: A. Construct Validity · pp. 9–10
  • F1 falls to 0.71/0.72 (qwen/deepseek) and silent-pass risk rises by 0.07/0.13 when final-state satisfaction replaces causal accomplishment.The authors characterize causal accomplishment as the strictest completion construct.Source: A. Construct Validity · p. 10

B. Internal Validity

The paper positions report–trace auditing as a distinct leakage risk in GUI-agent judging and recommends keeping the report out of trace-state estimation. Its intended generalization is architectural, while the evidence and deployment stream remain bounded by the studied corpus and validity checks.

B. Internal Validity

  • Multi-run methods share a five-run, temperature-0, majority-vote protocol, and single-run stability holds.Batch 2 is separately maintained against development-to-validation contamination; API drift affects full reruns, not metrics recomputed from cached predictions and evidence.Source: B. Internal Validity · p. 10
  • Repeated model calls are a possible alternative explanation for improvements, but the paper applies a shared multi-run protocol and reports single-run stability.This is the internal-validity control described by the authors.Source: B. Internal Validity · p. 10

C. External Validity

  • The corpus covers Android GUI-agent traces from three sources, two architectures, and six task classes, but generalization across app ecosystems, agent families, and trace representations remains future work.The corpus is an audit-target set rather than a full deployment stream; the intended generalization is architectural separation of report and trace-state estimation.Source: C. External Validity · p. 10

VIII. RELATED WORK

  • Prior LLM-judge work treats report exposure as an evaluation setting, whereas this paper frames it as an information-flow hazard and identifies the agent’s success narrative as a source of suppressed dangerous-misreport recall.The reference for checking the report is independently estimated execution-trace evidence, not the report itself.Source: §VIII · p. 10

IX. CONCLUSION

  • The conclusion’s rule is to read claim intent from the report alone and judge completion from the task and trace alone.The system under audit should not provide evidence for its own success.Source: §IX · p. 11
  • The auditor keeps 74–90% of dangerous misreports from silently passing at 45–56% inspection load, with the same pattern on held-out Batch 2.It improves dangerous-misreport recall and F1 over claim-aware and PROMPT-BLIND controls.Source: §IX · p. 11

Related papers

Loading 2610.29609v1…