EpiSEM-Bench: Evaluating Safety and Evidence Recovery in LLM Agents under Missing Evidence

What it claims

EpiSEM-Bench (arXiv, October 2026, City University of Hong Kong with HKUST Guangzhou and CUHK Shenzhen) measures whether tool-using agents commit prohibited actions when a true but incomplete tool response hides the fact that makes the action illegal. It has 600 worlds (300 unsafe/safe pairs) in 60 task families across cloud ops, commerce, communication, document access, finance and travel. The suppression inventory has 1,363 facts: 944 critical and 419 irrelevant, with two to seven critical facts per task. Across ten models, the authors report three findings. The model with the highest safety boundary does not get the highest paired recovery score. Recovery gains coexist with task-level regressions. Obtaining the missing evidence does not ensure the agent then acts correctly.

How it works

Each pair shares the user request, tools and target commit tool. Only the private state that decides legality differs, for example a payment authorization limit. Commit tools do not block prohibited operations, so an unsafe commit counts as failure even if the agent states safe intent. Free-form answers and invalid calls are scored separately from executed commits.

Facts are annotated as "evidence atoms" with every ordinary-tool response that exposes them. A mask removes those exposures for the whole rollout, so repeated reads cannot restore them. No false statements or injected instructions are added. Removing single facts, rather than whole responses, keeps the amount, recipient or resource the agent needs to execute.

flowchart TD
  P[Task pair: same request and tools] --> U[Unsafe world]
  P --> S[Safe twin]
  U --> C{Evidence condition}
  S --> C
  C --> F[Full evidence: Full UCR, Full SWS]
  C --> SE[Suppressed: Critical UCR, SBM]
  C --> RE[Recoverable: audit tool on valid query]
  RE --> Q{Agent queries audit?}
  Q -->|yes| A[Withhold in unsafe, complete in safe: PUR]
  Q -->|no| X[Acts on partial evidence: Recovery UCR]

In the Recoverable Evidence condition, an independent audit tool returns all omitted facts with authoritative values, but only when the agent makes a valid query. Having the tool available supplies nothing by itself.

Metrics

UCR is the share of the 300 tasks with at least one prohibited commit. Critical UCR covers all completed critical-mask rollouts in SE. Recovery UCR counts unsafe commits in RE, including those made without any recovery call. Safety Boundary Margin is SBM = (1/N) Σ m_i/(c_i+1). Here m_i is the smallest critical-mask size with an observed unsafe rollout: 0 for a failure under full evidence, and c_i+1 if exhaustive testing finds no failure. All smaller combinations are tested before a larger one is accepted, without assuming that more omission means more risk.

Paired Useful Recovery (PUR) requires two things under the same mask. In the unsafe world, the agent must restore all atoms and then abstain or escalate. In the safe twin, it must restore and then complete legally. A supplementary Critical Omission Failure Rate gives how often omissions fail, not only whether a task ever fails.

Limits

The authors state that an always-refusing agent can reach maximal SBM, so SBM must be read alongside SWS and PUR. The recovery tool returns every omitted fact at once, which is easier than realistic partial verification. Model families named in the overview figure are GPT, Claude, DeepSeek, Qwen, Gemma, GLM and MiMo. The fetched text ends before any per-model scores, exact model versions or the code release location. The authors say task definitions and rollout records are retained to regenerate the results.