PaperlayerView exact revision on arXiv

Source-linked AI summary

EpiSEM-Bench: Evaluating Safety and Evidence Recovery in LLM Agents under Missing Evidence

Qijin Zhang, Hanzhen Wang, Yuehan Zhao, Haoyu Dai, Yao Shu, Zhongxiang Dai, Shuang Qiu

arXiv:2610.31650v1cs.AIcs.LG

TL;DR

Tool-using agents may lack the safety-relevant facts needed to judge whether an operation is permitted, even when tool observations contain no false statements. EpiSEM-Bench evaluates matched unsafe and safe tasks under controlled evidence omission and optional recovery. Across ten models, omission robustness does not necessarily translate into useful recovery, and agents vary in how they acquire and use evidence.

  • Problem

    Tool-use evaluations need to establish whether agents distinguish permission from prohibition, respond appropriately to missing safety evidence, and recover facts needed for appropriate action.

    Source: §1 · p. 2

  • Method

    EpiSEM-Bench uses matched prohibited and permissible worlds, controlled suppression of true facts, six evaluation measures, and an optional independent recovery tool.

    Source: §1 · p. 2

  • Results

    Across ten models, resistance to missing evidence did not necessarily translate into useful recovery, and model profiles differed in restraint, legitimate completion, and paired recovery.

    Source: §5 · p. 10

  • Takeaways & Limitations

    Jointly reading safety, utility, and recovery measures distinguishes indiscriminate refusal or execution from evidence acquisition followed by permission-appropriate action.

    Source: §1 · p. 2, §5 · p. 10

    Evaluation covered GPT-6-Luna and Claude-Haiku-5.5, the latest fast variants available at evaluation time, so results may not generalize to larger models in either family.

    Source: §5 · p. 10

Abstract

from arXiv · show

Tool-using language model agents rely on environmental facts to decide whether an action is permitted. When a tool response omits a safety-relevant fact, an agent may carry out a prohibited action even though the user request is benign and every returned statement is true. We introduce \bench{}, an executable benchmark for evaluating unsafe execution, safety boundaries, and evidence recovery in LLM agents under missing evidence. It contains 300 matched unsafe/safe task pairs across six domains. By systematically suppressing critical facts, the benchmark measures unsafe execution under critical evidence omission and determines the minimum observed failure cardinality, including failures with full evidence and cases with no observed failure after exhaustive testing. An independent audit tool tests whether agents seek missing facts and then withhold prohibited actions while completing permissible tasks. The benchmark reveals substantial variation across the ten models in omission robustness, evidence acquisition, and appropriate action. Resistance to missing evidence does not necessarily translate into useful recovery. Recovery access reduces unsafe execution for all ten models, but agents differ in whether they actively obtain the missing facts and use them to act appropriately in both worlds.

1. Introduction

Tool-using agents must judge whether an operation is permitted from environmental facts, but missing safety evidence can make that decision difficult even when all observed statements are true. EpiSEM-Bench evaluates this problem with matched prohibited and permissible worlds, controlled evidence omission, and recovery, revealing that safety boundaries, evidence acquisition, and appropriate action vary across models.

1. Introduction

  • The benchmark contains 300 matched task pairs across six domains, with an executable oracle judging actions against complete state and persistent suppression of selected facts.The pairs comprise 600 worlds and 60 task families; the inventory includes 944 critical and 419 irrelevant facts.Source: §1 · p. 2
  • The evaluation finds that high completion can coexist with prohibited execution, strong restraint with refusal after permission is established, and recovery access with inconsistent evidence use.Domain, model family, and interaction-cost analyses further locate variation in these outcomes.Source: §1 · pp. 2–3
  • EpiSEM-Bench addresses missing safety evidence by suppressing true facts while preserving world safety conditions and pairing prohibited tasks with permissible twins.This makes both unsafe execution and excessive refusal observable; avoiding all action is not sufficient for useful safety.Source: §1 · p. 2
  • Its six core measurements span complete-evidence behavior, omission vulnerability, and evidence recovery, distinguishing task completion, restraint, and evidence-guided action.Recovery calls and action sequences help locate whether failures occur before acquisition or after facts are restored.Source: §1 · p. 2
  • Across ten models, strong omission resistance did not necessarily coincide with useful recovery, and agents differed in evidence acquisition and appropriate action.The model with the highest observed safety boundary did not have the highest paired recovery score; recovery gains could coexist with task-level regressions.Source: §1 · p. 2

2. Related Work

Prior work studies tool-use capability, safety, adversarial observations, and missing information, but EpiSEM-Bench focuses on decisions under suppressed safety evidence. Its matched worlds and persistent fact-level omissions assess whether agents act appropriately when remaining observations are true but insufficient.

2. Related Work

3. EpiSEM-Bench

EpiSEM-Bench separates the complete state used to judge action legality from the evidence visible to an agent. Its matched worlds, persistent fact-level suppression, and optional recovery tool support joint evaluation of safety, utility, and evidence-guided behavior.

3. EpiSEM-Bench

  • The full-state evaluator judges legality while agents receive requests and tool observations, allowing safety-relevant facts to be hidden without changing whether an operation is permitted.The overview pairs separate unsafe and safe-twin rollouts under the same goal, tool interface, and omission mask.Source: §3 · p. 3, Figure 1 · p. 4

3.1. Environments and task pairs

  • Unsafe and safe twins share the goal, target operation, and tools but differ in the state that makes the operation prohibited or permissible.Commit tools do not block prohibited operations, so the evaluator can observe unsafe decisions; the benchmark spans six domains and 300 pairs.Source: §3.1 · pp. 3–4

3.2. Evidence atoms and suppression

  • Fact-level masks remove every ordinary-tool exposure of selected atoms throughout a rollout while leaving the private state, safety rule, request, and unmasked values unchanged.This preserves operational context and prevents repeated reads from restoring the selected facts.Source: §3.2 · pp. 4–5

3.3. Optional evidence recovery

  • Recoverable Evidence keeps the same omissions as Suppressed Evidence but restores all omitted facts only after a valid query to an independent audit tool.Agents must choose whether to seek evidence and then use it to withhold a prohibited action or complete its permissible twin.Source: §3.3 · p. 5

3.4. Reporting safety, utility, and recovery

  • The six core metrics jointly characterize complete-evidence behavior, omission vulnerability, recovery safety, and paired useful recovery rather than serving as independent quality claims.Safety Boundary Margin searches omission combinations by increasing cardinality, counting full-evidence failures as zero and assigning ci + 1 when exhaustive testing finds no unsafe commit; refusal alone can yield a maximal margin without useful completion. Paired Useful Recovery requires restoration and correct outcomes in both twins, while acquisition and action records help explain failures.Source: §3.4 · pp. 5–7

4. Evaluation

Ten models were evaluated under complete evidence, critical omissions, and recovery access, using matched unsafe/safe worlds to assess completion, safety, and recovery. The evaluation also probes omission boundaries and how agents act after evidence becomes available.

Omission safety and boundaries

  • High Full SWS could coexist with frequent prohibited operations under complete evidence, while GPT-6-Luna showed fewer prohibited commits but lower legitimate completion.The matched worlds make clear that readiness to act can help on permissible requests while withholding action can preserve safety at the expense of legitimate tasks.Source: §4 · p. 7, Table 1 · p. 8

Omission failures and boundaries

  • GPT-6-Luna’s task-level omission vulnerability was 21.0%, versus a 7.9% condition-level failure rate; Qwen3-14B showed high values on both measures.The measures distinguish the share of tasks affected from how often unsafe execution recurred across tested conditions; SBM further separates baseline failures, suppression-triggered failures, and tasks with no observed failure after exhaustive testing.Source: §4 · pp. 7–8

Task variation and cost

  • Aggregate recovery gains coexisted with tasks newly unsafe only in RE and reduced permissible-task completion for MiMo-V2.5-Pro; performance also varied by workflow, and recovery added interaction cost.A net safety gain can conceal task-level regressions, and active recovery does not guarantee useful action.Source: §4 · pp. 8–9

Evidence acquisition and useful recovery

  • Audit access did not ensure evidence-guided action: agents varied in whether they queried before committing, and acquiring facts could still fail to produce appropriate actions in both worlds.DeepSeek-V4.1-Flash more often initiated recovery and withheld prohibited actions; MiMo-V2.5-Pro made valid recovery calls substantially more often than it achieved strict unsafe recovery.Source: §4 · pp. 8–9, Figure 2 · p. 9

Recovery gains and regressions

  • Recovery access improved safety for all ten models on matched critical omissions, and nine also improved legitimate completion, though gains varied substantially.The largest safety gains were reported for DeepSeek-V4-Pro, DeepSeek-V4.1-Flash, and Qwen3.8-27B; GLM-4.7-Flash and Qwen3-14B improved much less.Source: §4 · p. 8, Figure 2 · p. 9

Safe-world recovery

  • Qwen3-14B’s task-averaged safe RE completion was 94.7%, but its strict safe recovery rate was only 15.4%.The paired criterion requires establishing permission rather than completing an operation while the missing facts remain unresolved.Source: §4 · p. 9, Figure 2 · p. 9

5. Conclusion and Discussion

EpiSEM-Bench distinguishes omission robustness from useful recovery: agents must obtain missing evidence, withhold prohibited actions, and complete permissible tasks. The examples preserve the same request and tools across worlds while changing safety-relevant facts.

5. Conclusion and Discussion

  • DeepSeek-V4.1-Flash achieves higher PUR than GPT-6-Luna despite a lower SBM, while high completion can coexist with poor safety and paired recovery.The conclusion argues that the six metrics and recovery records should be interpreted jointly to distinguish restraint, verification, and legitimate completion.Source: §5 · p. 10
  • The evaluation uses GPT-6-Luna and Claude-Haiku-5.5 fast variants, so results may not generalize to larger models in either family.Source: §5 · p. 10

Appendix

  • Table 2 presents one task pair from each domain, retaining each row’s request and ordinary-tool interface while showing prohibited and permissible outcomes.The examples cover numerical comparisons, conditional requirements, and set membership, with critical facts distinguished from workflow context and irrelevant controls.Source: Table 2 · p. 15, A. Benchmark Examples · p. 15

A.1. Safety facts and omission controls across domains

  • The backup example tests production status, backup status and age, and the permitted-age limit; the cancellation example tests whether approved reactivation permits shipment.The owner-team label and customer loyalty tier are irrelevant to permission; product and quantity remain available for execution.Source: §A.1 · p. 15
  • The communication example tests approved-audience membership, while the document-access example compares recipient clearance with the required rank.The safe communication twin expands the approved audience; the document twin raises the recipient’s rank from 2 to 4 against a rank-4 requirement.Source: §A.1 · pp. 15–16
  • Payment permission depends on comparing amount with the approver’s limit, while travel permission depends on base price plus mandatory taxes against the budget.Approval alone does not establish payment authority, and optional fees do not enter the travel cost rule.Source: §A.1 · p. 16

A.2. A payment task under suppression and recovery

The payment example holds the request and tools constant while the authorization limit changes whether the payment is permitted. Recovery lets GPT-6-Luna and DeepSeek-V4.1-Flash restore the limit, but DeepSeek also completes the safe twin under suppression without restoring it.

A.2. A payment task under suppression and recovery

  • The same $42,800 payment is prohibited with a $30,000 limit and permissible with a $50,000 limit, with the request, recipient, approval, and tools otherwise unchanged.Source: §A.2 · p. 16
  • Suppressing the limit leaves role and currency visible but removes the limit; repeating the ordinary read does not restore it, whereas the audit source returns the world-specific value.Source: §A.2 · p. 16
  • Under SE, GPT-6-Luna escalates in both worlds; under RE, it queries the audit and escalates at $30,000 but pays at $50,000.DeepSeek also restores the limit before acting in both RE worlds, but its SE safe-world rollout completes without recovery.Source: §A.2 · p. 16
  • Both models achieve strict recovery in both RE worlds under the limit-omission mask, while DeepSeek-V4.1-Flash’s SE safe-world completion has no evidence restoration.The retained outcomes distinguish acting legally from recovering evidence before acting.Source: §A.2 · p. 16, Table 3 · p. 17

A.3. Agent rollout examples

The rollout examples separate evidence acquisition from action: agents may recover facts and still fail to complete a permissible task, or commit unsafely before querying recovery. A paired payment example shows recovery followed by different actions in the prohibited and safe worlds.

A.3. Agent rollout examples

  • Tables 4–6 present four retained rollouts in recorded event order, with operations and visible tool results or final responses; private reasoning is omitted.Source: §A.3 · p. 17
  • GPT-6-Luna’s payment recovery yields escalation when the $42,800 request exceeds the prohibited-world limit and payment when it falls below the safe-twin limit.The two outcomes jointly satisfy strict recovery and constitute a successful PUR outcome for this task-mask pair.Source: §A.3 · pp. 17–18
  • MiMo-V2.5-Flash executes an export containing an unauthorized third tenant before using the available audit source, producing both premature and unsafe commits.The complete-world authorization permits Fjord and Lyra only; adding Marrow violates the rule.Source: §A.3 · p. 18, Table 5 · p. 18
  • GPT-6-Luna restores an invoice’s unpaid status and reads transaction history in a permissible world, but then escalates instead of completing the legal payment.The example is a false abstention because evidence restoration occurred but required safe-world completion did not.Source: §A.3 · p. 18, Table 6 · p. 18

B. Safety Boundary Evaluation Procedure

The safety-boundary procedure uses retained unsafe-world SE rollouts to identify the smallest tested critical-omission cardinality associated with an unsafe commit. It assigns zero for a full-evidence failure and a sentinel above the critical-atom count only after exhaustive testing finds no failure.

B. Safety Boundary Evaluation Procedure

  • A full-evidence unsafe commit sets mi to 0; otherwise, the procedure tests critical omission combinations in increasing cardinality and stops at the first unsafe witness.Source: B. Safety Boundary Evaluation Procedure · p. 19
  • If every critical subset is tested without an unsafe commit, mi is set to ci + 1; the ordering within each cardinality is hash-based.The ordering uses the recorded seed, scenario identifier, and atom identifiers.Source: B. Safety Boundary Evaluation Procedure · p. 19
  • A witness of size k establishes mi = k because all smaller masks were tested without failure and the witness itself contains an unsafe commit.This reasoning does not assume monotonicity; tasks with at most seven critical atoms have at most 128 critical subsets.Source: B. Safety Boundary Evaluation Procedure · p. 19

C. Additional Quantitative Results

The additional analyses document omission coverage, compare matched recovery conditions, decompose observed safety boundaries, and trace baseline and recovery behavior through evidence acquisition and action.

C.1. Coverage of critical omissions

  • Unsafe-world coverage ranges from 1,020 to 3,060 critical-omission records in SE and 948 to 999 in RE, motivating aligned comparisons.Record counts describe tested conditions, not the UCR denominator.Source: §C.1 · p. 19, Table 7 · p. 20

C.2. Failure scope, frequency, and matched recovery

  • Critical UCR measures how widely failures occur across tasks, whereas Critical Omission Failure Rate measures their within-task frequency with equal task weighting.A task with any unsafe rollout counts once toward UCR but contributes its unsafe fraction to the frequency measure.Source: §C.2 · p. 20, Table 8 · p. 20
  • All ten models reduce UCR under recovery access, from 45.3 to 0.7 percentage points, while nine improve SWS and MiMo-V2.5-Pro decreases by 0.6 points.The contrasts use the same completed critical masks across settings.Source: §C.2 · p. 20, Table 9 · p. 21

C.3. Boundary decomposition

  • The boundary decomposition separates full-evidence failures, failures first observed after omission, and tasks with no unsafe commit through exhaustive critical-subset testing.Full-evidence failures have zero boundary margin; no observed failure means all critical omission combinations were tested.Source: §C.3 · p. 21, Figure 4 · p. 22

D.1. Baseline safety and legitimate task completion

  • DeepSeek-V4.1-Flash combines 4.0% UCR with 66.3% SWS, while GPT-6-Luna combines 3.0% UCR with 51.0% SWS under full evidence.The comparison separates legal task completion from avoidance of prohibited execution.Source: §D.1 · p. 22, Figure 5 · p. 23

D.2. Recovery gains and aligned setting transitions

  • For DeepSeek-V4-Pro, 47.3% of tasks are unsafe only in SE and 2.0% only in RE, so a net 45.3-point UCR reduction coexists with task-level regressions.The transition comparison aligns the same unsafe world and omission mask across settings.Source: §D.2 · p. 22, Figure 6 · p. 23

D.3. Recovery acquisition, timing, and outcome

  • GLM-4.7-Flash has 1.7% Attempt and 74.7% Premature rates, while DeepSeek-V4.1-Flash has 0.8% Premature and the highest strict unsafe recovery at 86.7%.Premature action can occur before the missing evidence is restored; strict recovery evaluates subsequent action against recovery criteria.Source: §D.3 · p. 24, Figure 7 · p. 24

D.4. False abstention and safe-world outcomes

Safe-world analyses separate legal completion from false abstention and other non-completion, comparing outcomes with and without recovery access.

D.4. False abstention and safe-world outcomes

  • GPT-6-Luna succeeds strictly in the unsafe twin alone more often than in both twins, while false abstention remains frequent even with recovery access.Obtaining evidence and avoiding a prohibited operation do not consistently translate into completing a permitted task.Source: §D.4 · pp. 24, 26
  • DeepSeek-V4.1-Flash has false-abstention rates of 55.3% in SE and 30.8% in RE, alongside a 24.2-point gain in legal completion on matched conditions.False abstention is a distinct safe-world outcome, not the complement of SWS.Source: Figure 8 · p. 25, §D.4 · p. 26
  • Qwen3-14B has false-abstention rates of 6.3% in SE and 5.0% in RE, alongside high unsafe-world UCR.The three-way outcome composition distinguishes refusal from other failures to complete the safe task.Source: Figure 8 · p. 25, §D.4 · p. 26

D.5. Domain and task-family heterogeneity

The analyses show variation in recovery success across domains and task families, and compare token use and request counts under suppressed and recoverable evidence.

D.5. Domain and task-family heterogeneity

  • Finance PUR is 53.2% for GPT-6-Luna and 84.3% for DeepSeek-V4.1-Flash; Commerce and fulfillment PUR is 10.1% for GPT-6-Luna.Cloud development and operations PUR is 42.2% for DeepSeek-V4.1-Flash.Source: §D.5 · p. 26
  • Task-family PUR values for GPT-6-Luna and DeepSeek-V4.1-Flash range from 0% to 100%, across families containing three to seven tasks.Fifty-four of the 60 families contain five tasks; each plotted mean summarizes its family’s tasks.Source: §D.5 · pp. 26, 28, Figure 10 · p. 27

D.6. Token and interaction cost

  • GPT-6-Luna averages 2,647 tokens and 4.68 requests per rollout in SE versus 3,922 tokens and 5.93 requests in RE.DeepSeek-V4.1-Flash averages 9,261 tokens and 5.43 requests in SE versus 12,635 tokens and 6.56 requests in RE; token accounting is provider-specific.Source: Figure 11 · p. 28, §D.6 · p. 28

E. Reproducibility and Evidence Provenance

The reproducibility materials connect task definitions and complete-world grading to persistent rollout records and offline numerical analyses.

E. Reproducibility and Evidence Provenance

  • The benchmark snapshot contains 300 task pairs across 60 families, with completed records for the same pairs and families across all ten deployments.It uses 944 critical and 419 irrelevant evidence atoms.Source: E. Reproducibility and Evidence… · p. 29
  • Evidence projection removes selected facts from every ordinary-tool exposure while preserving world state, safety rules, target action, and user goal; recovery returns omitted values.The oracle grades actions against the unprojected world, and target commits terminate trajectories.Source: E. Reproducibility and Evidence… · p. 29
  • Numerical tables and figures are computed offline from completed rollout records, with retained analysis records, checks, and source-record checksums supporting reproduction.Matched conditions are used for setting contrasts, twin comparisons, and cost analyses.Source: E. Reproducibility and Evidence… · p. 29

Related papers

Loading 2610.31650v1…