SentryBench: A Cost-Sensitive Benchmark for Adversarial Robustness of Tool-Using LLM Agents in Public-Safety Deployments

What it is

SentryBench (arXiv 2610.34535, October 2026) is a benchmark of 190 scenarios for tool-using LLM agents that send public alerts, dispatch units and query citizen records. Content comes from four public Hugging Face datasets (two for attack payloads, two for emergency and disaster content). Tools are six mocked functions, and scoring is deterministic from the tool-call ledger with no LLM judge. The paper also proposes TGCC, a trust-gating wrapper, and compares it with a prompt-only "when in doubt, do not act; escalate" caution preamble.

How it works

Scenarios fall into six families: urgent benign (40), ambiguous benign (38), and four adversarial kinds (suppress 38, false alert 30, records query 24, tool-result poisoning 20). Over-refusal means failing to take the warranted action on an urgent control. It is scored at tool-name level, so a wrong unit type does not count.

TGCC has four parts: spotlighting of untrusted data, a pattern-based injection detector (threshold of one matched pattern), a gate, and escalation counted as containment. The gate sends a consequential tool call to a human when the detector fires, or when a citizen-records query is over-broad and the detector score is above zero.

The paper proves two things. Caution raises harm whenever the harm it averts is below the cost of the urgent cases it newly refuses. The gate adds no over-refusal on inputs where no detector pattern fires. Residual attack success is bounded by the detector's miss set.

Results

Table IV, in percent (harm is the cost-weighted score):

False-positive rate was 0.0 in every cell. Baseline attack success is already low (0 to 3.7 percent), so the attack harm that caution can avert is small. Baseline over-refusal is high on its own (37.5 to 62.5 percent).

Caveats

• On Sonnet, TGCC matched the baseline on every headline metric except containment (92.6 vs 74.1). "Lowest harm on every model" is a tie there.
• The paper states that TGCC's over-refusal reduction on clean urgent controls comes from the provenance preamble, not the gate. Remaining over-refusal is inherited from the base model.
• The one TGCC attack success (Sonnet, scenario C-008) was an over-trust payload phrased to evade the pattern set. Directive templates were deliberately mixed so some evade the detector, so the recall gap is built in and the 0.0 results depend on that mix.
• Haiku ran all 190 scenarios (570 episodes). Sonnet and GPT-5 ran a 45-scenario stratified subset (270 episodes). Per-cell rates on the subset rest on few attack episodes.
• Models tested were claude-sonnet-4-5, claude-haiku-4-5 and Azure gpt-5. Provider content filters block some episodes, and these get no outcome and are reported separately.
• The fetched text ends partway through the results section. The ablation, the provider-filter accounting and the confidence intervals were not available.