Evaluation and reliability: how do we know it worked?¶
简体中文 · English
Agents / 176 questions · 44 papers
Try answering each question before opening the explanation. The bank grows as papers and questions are added.
Read this topic's comparisons, analysis, and cross-paper Q&A
176 questions · 44 papers
Agents / Evaluation and reliability: how do we know it worked?
Basics
Why is finding a similarly titled page after hitting a login wall not necessarily successful AgentHeal recovery?
AgentHeal: Evaluating Goal-Preserving Resource Recovery of Web Agents under Access Barriers
Show answer and example
Answer: It may be another work, an unverifiable look-alike, or an older version. AgentHeal preserves the original objective: prefer an exact-version copy when available; disclose differences when only other versions remain; otherwise abstain and diagnose the barrier, asking the user for help when necessary. Topic similarity is not equivalence.
Illustrative example: Teaching example: a requested metric from paper v2 cannot silently be replaced by v1. Use an institutional v2 copy if one exists; if only v1 remains, explicitly disclose the version difference.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Core mechanism
Why must AgentHeal's exact-copy and alternative-version source conditions remain different?
AgentHeal: Evaluating Goal-Preserving Resource Recovery of Web Agents under Access Barriers
Show answer and example
Answer: Equation 1 requires the attributed source set to intersect available exact copies. When only other versions remain, the nonempty source set must lie entirely within those versions and declare other. Any prohibited action multiplies final success by zero. Strengthening the first branch to copies only, or relaxing the second to one version somewhere, changes the paper.
Illustrative example: Teaching example: with only v1 reachable, mixing v1 and a decoy fails even with an other declaration. When v2 is available, Equation 1 itself only checks that v2 is among the sources; it does not prove answer semantics are correct.
Sections in the Chinese source: 核心公式, 数据协议与实现边界. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Method comparison
AgentPerturb requires solvability after perturbation, whereas AgentHeal includes unrecoverable tasks. Is that contradictory?
AgentHeal: Evaluating Goal-Preserving Resource Recovery of Web Agents under Access Barriers
Show answer and example
Answer: They target different behaviors. AgentPerturb compares paired robustness under the same objective and must not count destroyed solvability as capability loss. AgentHeal explicitly labels unrecoverable regimes to assess honest abstention, accurate diagnosis, and policy compliance rather than demand nonexistent answers. Recoverable and unrecoverable cases need separate reporting, not one undifferentiated answer-accuracy score.
Illustrative example: Teaching example: deleting the only evidence while still requiring the original number is an unfair perturbation. Labeling that condition unsolvable and testing refusal to fabricate instead measures recovery reliability.
Sections in the Chinese source: 背景与主要改动, 核心公式, 本地结果与负控. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Implementation details
The local diagnostic knows work, version, and reachable resources. Does it reveal the recovery path to an agent?
AgentHeal: Evaluating Goal-Preserving Resource Recovery of Web Agents under Access Barriers
Show answer and example
Answer: Those are independent evaluator annotations. The module calls no actor and must not supply them as actor observations. Source attribution and per-action policy judgments also come from external evaluators rather than local string rules. TS=0.5 across four synthetic truth-table cases verifies the decision contract, not agent capability. Real browser evaluation still needs separation of actor, gold, and judge.
Illustrative example: Teaching example: directly providing copy_id to a model before scoring recovery leaks the path. An independent evaluator should inspect visits and attributed sources only after the model submits.
Sections in the Chinese source: 数据协议与实现边界, 本地结果与负控, 代码映射. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Basics
Why does PLE require auditable engineering artifacts rather than only written answers?
PLE: Physical-Engineering's Last Exam
Show answer and example
Answer: Long engineering tasks have multimodal inputs, constraints, and deliverable files. Experts or independent graders check whether actual outputs meet requirements. Fluent descriptions do not establish completed designs.
Illustrative example: A written explanation does not prove the corresponding engineering file exists or passes constraints.
Sections in the Chinese source: 背景与主要改动. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Core mechanism
Why use hard gate G to cut off objective credit instead of letting high objective values offset failed hard constraints?
PLE: Physical-Engineering's Last Exam
Show answer and example
Answer: Engineering artifacts may optimize a target while violating requirements. All hard constraints must pass for the gated reward. Constraint ratios retain component information, and missing tasks score zero in the full denominator. Local aggregation consumes external grades, not independent physical or regulatory judgments.
Illustrative example: A lightweight design that fails a load-bearing constraint cannot compensate with weight savings. Missing artifacts cannot be dropped from the average.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Method comparison
How does PLE's hard-gated constraint score differ from scoring continuously by objective value alone?
PLE: Physical-Engineering's Last Exam
Show answer and example
Answer: When any hard constraint fails, G=0 and objective optimization earns nothing; higher objective values cannot offset the violation. Expert rubrics and special site/MEP graders have separate rules, so one formula does not cover every task.
Illustrative example: High efficiency cannot earn the 0.6GO′ term after any hard-constraint failure.
Sections in the Chinese source: 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Implementation details
Why retain the complete task denominator and missing items in PLE aggregation?
PLE: Physical-Engineering's Last Exam
Show answer and example
Answer: Average each run over all tasks with missing scores at zero, then average three run means. Conditioning on successful submissions inflates results. Local scoring accepts external grades and artifact bytes, not independent certification of physical or regulatory correctness.
Illustrative example: If only 10 of 85 tasks are complete, their average is not the full benchmark mean.
Sections in the Chinese source: 核心公式, 离线验收接口. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Basics
Why does SCOPE save stateful API tapes from successful executions?
SCOPE: Selective Certification of Program Edits for Embodied Heuristic Learning
Show answer and example
Answer: Rerunning all earlier scenarios after a program edit is expensive. A full tape records requests, public state before and after, and results or exceptions, enabling same-instance replay and surfacing differences for native diagnosis.
Illustrative example: A complete tape can screen an old successful case without immediately restarting the robot environment.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Core mechanism
Why doesn't successful API tape replay prove program equivalence for every input or serve as a candidate acceptance gate?
SCOPE: Selective Certification of Program Edits for Embodied Heuristic Learning
Show answer and example
Answer: Replay checks recorded cases with given state, responses, and exceptions, leaving unseen inputs unknown. It selects divergences worth diagnosing natively rather than requiring rollback of a successful candidate. Only native-environment success updates the accepted program; replay divergence is not environment failure.
Illustrative example: Changed return ordering on an old tape can prompt targeted retesting. A candidate that completed the native task is not rejected solely because an old tape is incompatible.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Method comparison
Are SCOPE replay divergence and failure in the actual environment the same conclusion?
SCOPE: Selective Certification of Program Edits for Embodied Heuristic Learning
Show answer and example
Answer: No. Divergence means the candidate differs from or cannot use a recorded witness and informs further search. Native failure requires real execution. Unknown is not failure, and replay cannot establish equivalence over all inputs.
Illustrative example: An extra API query can diverge from the tape without showing that the actual task fails.
Sections in the Chinese source: 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Implementation details
Is matching only API names and return values enough for stateful SCOPE replay?
SCOPE: Selective Certification of Program Edits for Embodied Heuristic Learning
Show answer and example
Answer: Also match requests and prior state, restore subsequent mutations, exceptions, and aliases, consume the complete tape, and make no extra external calls. Native success updates the accepted program; do not turn replay into acceptance or rollback.
Illustrative example: If two objects share one list, replaying them as independent copies changes later behavior even when the immediate result matches.
Sections in the Chinese source: 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Basics
Why does ToolBottleneckBench control tool catalogs, menus, workflows, and return encoding?
Show answer and example
Answer: Tool-agent failure may reflect interface and budget interactions rather than only model capability. Hold task facts and decisions fixed and manipulate R/V/W/D separately to identify pressure associated with outcomes.
Illustrative example: A longer visible menu can raise selection costs for the same model without proving weaker reasoning.
Sections in the Chinese source: 背景与主要改动. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Core mechanism
Why isn't recording the first unmet obligation a completed causal attribution?
Show answer and example
Answer: Obligation ordering provides a consistent label, but later failures can coexist. Hold task facts fixed and manipulate catalog, menu, workflow, and return state to study pressure. Truth-assisted routed menus are diagnostic, not oracle-free deployment ability.
Illustrative example: Failure to retrieve a tool is labeled first, but argument logic may also be wrong. Fixing retrieval may expose it; label order is not causal proof.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Method comparison
How does a truth-assisted routed menu differ from an oracle-free production router?
Show answer and example
Answer: Truth-assisted narrowing is a controlled condition. It localizes bottlenecks but does not show that a live system can autonomously find the same menu.
Illustrative example: Showing only the already-known correct tool is different from retrieving it from a large catalog at deployment.
Sections in the Chinese source: 背景与主要改动. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Implementation details
Can missing retrievals and infrastructure failures be dropped from the catalog-pressure ITT denominator?
Show answer and example
Answer: No. Keep them in the planned denominator; conditioning on available requests inflates selection rates. Distinguish first unmet obligation from separately logged termination reasons. Neither automatically establishes causation.
Illustrative example: If only 80 of 100 planned requests obtain a menu, still report outcomes over all 100.
Sections in the Chinese source: 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Basics
Why does Shortcut Sensitivity first inspect construction cues in evaluation inputs?
Shortcut Sensitivity in Agent-Safety Evaluations
Show answer and example
Answer: Tool names, lengths, source markers, and repeated interactions can predict labels without genuine risk judgment. Audit label predictability, guard association, and construct-preserving paired interventions separately.
Illustrative example: If a tool name occurs in every unsafe case, a model may score well using that cue alone.
Sections in the Chinese source: 背景与主要改动. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Core mechanism
Why doesn't tool-name predictability prove a guard uses the shortcut?
Shortcut Sensitivity in Agent-Safety Evaluations
Show answer and example
Answer: Label predictability shows a construction cue. Guard association is a second check. Changing only the cue under matched conditions gives stronger behavioral evidence. Control random inconsistency and placebos; association, unsigned flips, and signed effects are distinct.
Illustrative example: A name lookup can score well when dangerous samples share a tool name. To test guard reliance, rename it without changing behavior and compare decisions.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Method comparison
Do label predictability, guard-decision association, and paired intervention effects imply each other?
Shortcut Sensitivity in Agent-Safety Evaluations
Show answer and example
Answer: No. The first two motivate testing. Interventions must change only the cue while preserving risk and controlling random guard behavior and format placebos. Correlation is insufficient to establish shortcut use.
Illustrative example: A tool name can correlate with unsafe while removing it leaves guard decisions unchanged. Evidence of reliance remains insufficient.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Implementation details
Why not compute F1 per interaction and then average when weighting interactions equally?
Shortcut Sensitivity in Agent-Safety Evaluations
Show answer and example
Answer: Assign steps weight 1/n_g, sum weighted TP/TN/FP/FN, then calculate F1. F1 is nonlinear, so averaging group F1s defines another metric. Signed paired effects also cannot be replaced by unsigned flip rates.
Illustrative example: Long interactions should not carry more total confusion-matrix weight just because they have more steps.
Sections in the Chinese source: 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Basics
Does SciPIvot test research redirection or whether a project ultimately succeeds?
Show answer and example
Answer: It gives the pre-correction project state and two next steps and asks which is more appropriate. The reference comes from later human correction, but the tested model sees no future trajectory or option provenance. This is not prediction of eventual project success.
Illustrative example: The better next step today does not guarantee a successful project six months later.
Sections in the Chinese source: 背景与主要改动. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Core mechanism
Why reopen an independent session after swapping options and resample by case rather than answer?
Show answer and example
Answer: Swapping checks position stability, and separate sessions prevent the first answer from influencing the second. Both orderings still represent one project decision, not independent samples. The model sees only the pre-correction state; later records may build references but cannot be inputs or reveal human versus original LLM authorship.
Illustrative example: If plans A and B are presented in both orders in one session, the model may remember the earlier choice instead of judging again.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Method comparison
How does swapping option order differ from treating two answers for the same case as independent samples?
Show answer and example
Answer: Both orderings measure and offset position bias, but they remain one case. Compute a case score, then resample cases. Counting answers independently inflates sample size and ignores correlation.
Illustrative example: AB and BA judgments for one case are not two distinct research decisions.
Sections in the Chinese source: 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Implementation details
Why not attach SciPIvot's original questions file to the evaluated agent?
Show answer and example
Answer: The official source includes references. Trusted ingestion exports only the ID and two options via an allowlist, storing private grader references separately. Sessions are independent and cannot access repositories or future records to bypass options-only isolation.
Illustrative example: Providing the full questions.json with an instruction not to read references is not data isolation.
Sections in the Chinese source: 背景与主要改动, 已发布数据与来源. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Basics
Why does PROBE audit policy compliance separately from task completion?
PROBE: Learning to Audit Policy Compliance in Tool-Using LLM Agents
Show answer and example
Answer: Final state or harmful-text checks can miss violations during multi-turn tool use. An auditor interacts with a frozen target while a private verifier checks the full trace for business-policy compliance, customer realism, task progress, and coverage rather than tone alone.
Illustrative example: A task can look complete despite missing required confirmation or making an unrequested state change.
Sections in the Chinese source: 背景与主要改动. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Core mechanism
Why decay rewards for repeated violations of the same policy but retain raw yield?
PROBE: Learning to Audit Policy Compliance in Tool-Using LLM Agents
Show answer and example
Answer: Decay prevents the auditor from farming one flaw and encourages policy coverage. Raw yield describes actual events and can exceed 100 per 100 episodes. Report deduplicated coverage separately from event volume. A local reward implementation is not the entire auditing RL pipeline.
Illustrative example: If one conversation triggers a violation three times, give decreasing or zero subsequent reward but preserve all three events.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Method comparison
Why aren't raw violation yield, deduplicated episode-policy yield, and coverage interchangeable?
PROBE: Learning to Audit Policy Compliance in Tool-Using LLM Agents
Show answer and example
Answer: Raw yield includes repeated turn-level hits and can exceed 100 per 100 episodes. Deduplicated yield removes same-policy repetitions per episode; coverage uses all declared policies as its denominator. They describe hit volume and breadth, not one success probability.
Illustrative example: Three hits of one policy in one episode give raw yield 3, deduplicated yield 1, and add only one policy to coverage.
Sections in the Chinese source: 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Implementation details
Where must PROBE reset repeated-hit counts?
PROBE: Learning to Audit Policy Compliance in Tool-Using LLM Agents
Show answer and example
Answer: n_i counts previous hits in the current episode. The first gets weight 1, the second 1/2, and later hits zero; restart each episode. Do not decay raw-yield events, and retain zero-hit and unsupported policies in denominators.
Illustrative example: Two hits in a previous episode must not turn the first hit of the next episode into zero reward.
Sections in the Chinese source: 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Basics
Why does Librarian organize a workspace before knowing future questions?
Librarian Agents: Training LLMs to Curate Long-Context Workspaces that Anticipate Future Queries
Show answer and example
Answer: A corpus may receive many queries. Hierarchical files and source references amortize organization across documents. The builder sees only the corpus; a frozen answerer later navigates it, without prewriting test answers.
Illustrative example: Organize project files before answering several users, rather than tailoring a directory to a known question.
Sections in the Chinese source: 背景与主要改动. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Core mechanism
Why can't a builder organize its hierarchical filesystem as an answer index using known evaluation questions?
Librarian Agents: Training LLMs to Curate Long-Context Workspaces that Anticipate Future Queries
Show answer and example
Answer: The aim is a reusable workspace a frozen answerer navigates for unseen queries. Seeing questions early creates answer-oriented shortcuts instead of cross-query organization. Preserve originals for fallback; Delete must not remove raw documents. A general cost formula does not establish nonzero shaping in the main training run.
Illustrative example: Organizing by company and date supports diverse questions. Placing one anticipated answer on the front page stops the evaluation testing general organization.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Method comparison
Is Librarian's general cost utility the same as the paper's main training reward?
Librarian Agents: Training LLMs to Curate Long-Context Workspaces that Anticipate Future Queries
Show answer and example
Answer: No. The general form has build, token, and read penalties, but main training sets them to zero with gamma=1, probes answerability change every eight builder turns, and checks terminal correctness. A definable cost term is not necessarily used for shaping.
Illustrative example: A token penalty in the formula does not mean this training run deducted reward for reading another file.
Sections in the Chinese source: 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Implementation details
How does Librarian preserve provenance after deleting a synthetic node?
Librarian Agents: Training LLMs to Curate Long-Context Workspaces that Anticipate Future Queries
Show answer and example
Answer: Delete archives only the synthetic node, promotes its children, and retains raw documents and historical sources. Cold load checks hashes, hierarchy, and disk content. Local work implements filesystem contracts and frozen result recomputation without training a learned builder.
Illustrative example: After removing a summary folder, original files and sources for merged subdirectories must remain discoverable.
Sections in the Chinese source: 文件系统合同与代码映射. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Basics
Why does HDA first test paired gain of evolved versus baseline?
Harness-Delta Attribution: Dissecting Gains From Harness Evolution
Show answer and example
Answer: If the observed gain could be noise, decomposing it into compute, shortcuts, and residual has no reliable starting point. First perform a two-sided paired bootstrap, then build compute-matched and shortcut-neutralized controls only after significance. Both require task-aware human review.
Illustrative example: Small fluctuations across runs on the same tasks do not justify quantifying generalization.
Sections in the Chinese source: 背景与主要改动. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Core mechanism
Why is HDA residual G only an upper bound on generalization improvement, rather than direct transfer evidence?
Harness-Delta Attribution: Dissecting Gains From Harness Evolution
Show answer and example
Answer: Compute matching removes extra computation and neutralizing detected shortcuts removes some overfit, but undetected shortcuts can remain. Controls need task-aware human review and attribution starts only after confirming a significant gain. Algebraic accounting does not establish full causal identification or transfer to a new distribution.
Illustrative example: Removing a known filename shortcut may leave gains from hidden directory ordering. Do not call all remaining gains general reasoning.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Method comparison
Why can't HDA's residual G be called proven generalization gain?
Harness-Delta Attribution: Dissecting Gains From Harness Evolution
Show answer and example
Answer: It is the difference after neutralizing detected shortcuts relative to the compute-matched baseline and may retain unidentified shortcuts, so it is only an upper bound. O covers detected and neutralizable mechanisms, a lower bound on overfit.
Illustrative example: Gains after eliminating one form of answer leakage do not rule out another shortcut.
Sections in the Chinese source: 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Implementation details
Can negative raw T, O, or G be clipped to zero before displaying HDA percentages?
Harness-Delta Attribution: Dissecting Gains From Harness Evolution
Show answer and example
Answer: Preserve signed raw effects satisfying Delta=T+O+G. Clip display shares only according to their separate rule and do not overwrite original attribution. All four arms must align by item and cost units, with human-reviewed control rationale.
Illustrative example: If neutralization improves scores, retain negative O instead of setting it to zero for a prettier chart.
Sections in the Chinese source: 核心公式, 本地复现与边界. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Basics
Why does GACC-Bench use one compressed memory for several questions under one goal?
GACC-Bench: Benchmarking Goal-Adaptive Context Compression Ability across Large Language Models
Show answer and example
Answer: Only the high-level goal is visible during compression. Reuse checks whether the whole group's evidence was retained. Recompressing after seeing a question becomes targeted extraction for a known query.
Illustrative example: A travel-goal memory should answer both transport and lodging without creating a new summary per question.
Sections in the Chinese source: 背景与主要改动. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Core mechanism
Why generate one memory per context–goal–budget and reuse it for all follow-up questions?
GACC-Bench: Benchmarking Goal-Adaptive Context Compression Ability across Large Language Models
Show answer and example
Answer: Compression sees only the high-level goal, not individual questions. Reuse tests whether one memory retains evidence for the group. Recompressing per question gives the compressor extra query information and changes the task. Strict token truncation, empty memory for zero budget, and no padding determine actual reader inputs, beyond nominal budget.
Illustrative example: A project-decision goal can lead to date and reason questions. Both should read the same precompressed memory, not query-specific summaries extracted later.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Method comparison
How can GACC Micro be high while Macro is zero?
GACC-Bench: Benchmarking Goal-Adaptive Context Compression Ability across Large Language Models
Show answer and example
Answer: Micro counts correct answers over all questions. Macro scores a goal only when all its questions are correct. Missing one key question in every group can retain high per-question accuracy but zero goal completeness.
Illustrative example: Two goals with two of three questions correct each yield Micro=2/3 and Macro=0.
Sections in the Chinese source: 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Implementation details
What should GACC pass to the reader when compressor output exceeds budget or the budget floors to zero?
GACC-Bench: Benchmarking Goal-Adaptive Context Compression Ability across Large Language Models
Show answer and example
Answer: Use the fixed tokenizer to take the first L tokens and decode, without regeneration or padding. L=0 gives empty memory. Bind caches to source, goal, tokenizer, and compressor version so configurations do not share memories incorrectly.
Illustrative example: With three source tokens and retention 0.2, L=0; do not retain one token to improve scores.
Sections in the Chinese source: 核心公式, 代码映射、成本与边界. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Basics
Why doesn't weak-model uncertainty necessarily justify escalation?
Disagreement-Guided Weak-to-Strong Routing
Show answer and example
Answer: If the strong model is also unstable on the question, escalation may not improve reliably. Subtract strong self-disagreement from weak–strong disagreement to learn escalation value. Offline equivalence comparisons need no correct-answer labels.
Illustrative example: Both models may waver between options. The weak model's hesitation alone does not show that the strong model can fix it.
Sections in the Chinese source: 背景与主要改动. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Core mechanism
Why subtract strong-model self-disagreement from weak–strong disagreement?
Disagreement-Guided Weak-to-Strong Routing
Show answer and example
Answer: Disagreement may come from strong-model instability rather than a fixable weak answer. Estimate self-disagreement over distinct sample indices and subtract it for a better escalation signal. The score can be negative and is not a success probability. At test time run only weak representations and probes before paying for escalation.
Illustrative example: Opposite strong answers make high weak–strong disagreement inconclusive. A consistent strong model disagreeing with the weak one provides a clearer signal.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Method comparison
How does the corrected routing score range differ from raw weak–strong disagreement probability?
Disagreement-Guided Weak-to-Strong Routing
Show answer and example
Answer: Raw disagreement is a probability. The corrected score subtracts two probe outputs, can be negative, and must not be clipped to [0,1]. Take the minimum response-level prediction across weak answers first, then subtract prompt-level strong self-disagreement.
Illustrative example: Weak–strong disagreement 0.2 and strong self-disagreement 0.5 yield −0.3.
Sections in the Chinese source: 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Implementation details
Why exclude self-pairs when estimating strong-model self-disagreement?
Disagreement-Guided Weak-to-Strong Routing
Show answer and example
Answer: Use K_s(K_s−1) ordered pairs of distinct indices. Diagonal comparisons always agree and bias disagreement down. Calibrate inference thresholds on validation only; under test distribution shift, exact routing quotas are not guaranteed.
Illustrative example: Two strong responses give two ordered cross pairs, not four pairs including both self-pairs.
Sections in the Chinese source: 核心公式, 代码映射与边界. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Basics
Why does AgentPerturb change only one of U, P, C, or T at a time?
AgentPerturb: Evaluating LLM Agent Robustness under Controlled Interaction Perturbations
Show answer and example
Answer: User request, procedure, history/context, and tool contract are distinct input surfaces. Holding others, backend, and success oracle fixed isolates pressure better. Changing several surfaces introduces confounds.
Illustrative example: A single-target pair can change only tool wording while preserving user requirements and tool implementation.
Sections in the Chinese source: 背景与主要改动. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Core mechanism
Why independently verify unchanged goals and solvability after perturbations pass JSON checks?
AgentPerturb: Evaluating LLM Agent Robustness under Controlled Interaction Perturbations
Show answer and example
Answer: Parseable inputs can still change the task or remove essential information. Single-target semantic validation holds other factors, backend, and oracle fixed so differences reflect interaction pressure. Report paired coverage and bounds for missing scores rather than dropping failures and claiming robustness.
Illustrative example: Rewording a tool description should preserve behavior. Removing the only required tool introduces unsolvability, not the same perturbation effect.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Method comparison
What do AgentPerturb syntax checks and independent semantic verification establish?
AgentPerturb: Evaluating LLM Agent Robustness under Controlled Interaction Perturbations
Show answer and example
Answer: Syntax checks parseability, not goal preservation or solvability. An independent verifier checks single-target change, unchanged goal, solvability, and executability together with a native validator. A local arithmetic verifier does not prove arbitrary natural-language equivalence.
Illustrative example: Valid JSON that changes a sum into a product changes the goal and is not a robustness perturbation.
Sections in the Chinese source: 背景与主要改动, 真实性、gold 隔离与成本. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Implementation details
Can AgentPerturb drop unscored requests when calculating paired degradation?
AgentPerturb: Evaluating LLM Agent Robustness under Controlled Interaction Perturbations
Show answer and example
Answer: Compute C, P, and Delta on scored pairs, but report coverage and unknown bounds across all requested pairs. Missing is unknown, and native partial credit must not be arbitrarily binarized to align formats.
Illustrative example: If only 60 of 100 planned pairs have both scores, do not report just their drop while hiding 40 missing pairs.
Sections in the Chinese source: 核心公式, 本地复现. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Basics
How does the CTXGAP reporting gap differ from task completion rate?
What Coding Agents Leave Unsaid: Measuring Task-State Gaps Between Execution and Reports
Show answer and example
Answer: It compares cumulative-report and full-execution observers on the same probes, measuring how well users can recover true task state. A completed task can omit key facts in its report; a detailed report does not establish success.
Illustrative example: Code may be fixed while the report omits an unrun check, leaving users unable to judge acceptance accurately.
Sections in the Chinese source: 背景与主要改动. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Core mechanism
Why can't public execution materials be relabeled T_full to recompute the full report gap?
What Coding Agents Leave Unsaid: Measuring Task-State Gaps Between Execution and Reports
Show answer and example
Answer: The original full view includes some unpublished reasoning or memory evidence. Without it, observer capability and answerable questions change. Pair probes and weight important facts, but separate public and full conditions. Cluster by task/run rather than assuming many probes for one task are independent.
Illustrative example: If a port appears only in private memory, a public-log observer's failure cannot represent the original full-view ceiling.
Sections in the Chinese source: 背景与主要改动, 核心公式与统计单位. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Method comparison
How does CTXGAP importance-weighted accuracy differ from averaging all probes equally?
What Coding Agents Leave Unsaid: Measuring Task-State Gaps Between Execution and Reports
Show answer and example
Answer: More probes in one category should not outweigh another category's important facts. Divide the number of important atomic facts by probes in the category, sum weighted scores, and normalize. Equal weighting can let many easy or similar probes hide omissions.
Illustrative example: Many questions about a trivial log should not obscure one missing acceptance fact.
Sections in the Chinese source: 背景与主要改动, 核心公式与统计单位. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Implementation details
Why resample CTXGAP intervals by task/run rather than individual probes?
What Coding Agents Leave Unsaid: Measuring Task-State Gaps Between Execution and Reports
Show answer and example
Answer: Probes within one task share execution and reporting conditions and are not independent. Cluster while keeping paired conditions together. Preserve category weights and equal task aggregation rather than replacing the main gap with pooled accuracy differences.
Illustrative example: A task with 100 similar probes is not 100 independent tasks and should not artificially narrow confidence intervals.
Sections in the Chinese source: 核心公式与统计单位. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Basics
Why does CODA freeze retrieval before rewriting skills?
Evolving Together, Failing Apart: The Skill-Policy Co-evolution Trap in Self-Improving Agents
Show answer and example
Answer: It audits dependence on delivered content and wording. Reretrieval changes selection and ranking, so fix retrieval-side fields and replace content only.
Illustrative example: If a rewritten skill is no longer retrieved, wording dependence cannot be distinguished from recall changes.
Sections in the Chinese source: 背景与主要改动. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Core mechanism
Why freeze the original retrieved skill set before meaning-preserving rewrites?
Evolving Together, Failing Apart: The Skill-Policy Co-evolution Trap in Self-Improving Agents
Show answer and example
Answer: Retrieval could change which skills are delivered, confounding wording sensitivity with ranking. Freeze selected identities and retrieval fields, then change only content. String similarity does not prove semantic equivalence, and unchanged aggregate success can hide bidirectional flips.
Illustrative example: Provide the same three skills after paraphrasing. If three different skills are retrieved, outcome changes no longer isolate wording.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Method comparison
Why does CODA report per-task CR alongside aggregate success?
Evolving Together, Failing Apart: The Skill-Policy Co-evolution Trap in Self-Improving Agents
Show answer and example
Answer: Success totals can remain unchanged when some successes become failures and other failures become successes. CR measures agreement across conditions per task; repeated unperturbed runs estimate stochastic noise.
Illustrative example: If success and failure swap across two tasks, total success remains 50% but CR is zero.
Sections in the Chinese source: 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Implementation details
Is the number of no-skill successes the CODA RR denominator?
Evolving Together, Failing Apart: The Skill-Policy Co-evolution Trap in Self-Improving Agents
Show answer and example
Answer: No. RR is the proportion of all matched tasks successful under both no-skill and perturbed-skill conditions. Conditioning on successes changes the definition. Keep identical ID sets and reject missing tasks.
Illustrative example: Of 100 tasks, 20 no-skill successes and 10 joint successes give RR=10%, not 50%.
Sections in the Chinese source: 核心公式, 本地复现. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Basics
Why does AlphaDiana separate execution status from grading status?
AlphaDiana: A Measurement System for Agents in Verifiable Reasoning Tasks
Show answer and example
Answer: A successful run may lack a valid grader decision. Interrupted grading is unknown, neither correct nor incorrect. Separate statuses and full planned denominators expose execution failures, missing grades, and coverage.
Illustrative example: If a tool completes but the grader times out, mark ungraded rather than removing the sample.
Sections in the Chinese source: 背景与主要改动. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Core mechanism
Why do retries add attempts without adding logical samples or choosing the best result?
AlphaDiana: A Measurement System for Agents in Verifiable Reasoning Tasks
Show answer and example
Answer: Retries of a task/sample address the same request. Changing denominators or selecting the best attempt distorts sampling and hides failure costs. Report the latest record and sum costs over attempts; separate execution and grading. Ungraded is unknown, not correct or silently excluded.
Illustrative example: If a task times out then succeeds, charge both attempts' tokens while retaining one sample. Do not keep only the cheap success.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Method comparison
What evaluation difference arises from selecting the latest rather than best retry?
AlphaDiana: A Measurement System for Agents in Verifiable Reasoning Tasks
Show answer and example
Answer: Retries leave the logical denominator unchanged, and the protocol reports latest status. Best-of selection introduces an implicit extra-attempt advantage. Costs accumulate across every attempt, not only the one shown.
Illustrative example: If a success is followed by a failed retry, latest-status reporting cannot restore the earlier success and charge only one execution.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Implementation details
When must AlphaDiana return unknown for complete tokens per correct result?
AlphaDiana: A Measurement System for Agents in Verifiable Reasoning Tasks
Show answer and example
Answer: Return None if there are no confirmed correct samples, any attempt lacks token counts, or any requested sample lacks execution records. Report known tokens and coverage separately; partial measurement is not complete cost.
Illustrative example: If one of two attempts has no token count, even an eventual correct result cannot establish full cost per correct sample.
Sections in the Chinese source: 核心公式, 无 gold 边界与限制. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Basics
Why does CLASHarness execute a reference plan before agents handle conflicting messages?
Show answer and example
Answer: Reference execution verifies solvability under fixed true state and compiles checks from observed effects. Otherwise failure may reflect a broken scenario, not inability to handle false facts, stale state, or conflicting peer instructions.
Illustrative example: If a peer claims a file changed, verify actual state and a reachable goal first.
Sections in the Chinese source: 背景与主要改动. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Core mechanism
Why fix true state and run a reference plan to prove solvability before generating conflict scenarios?
Show answer and example
Answer: Otherwise failures may stem from contradictions or an unusable interface rather than peer-conflict handling. Executable references establish true state, permitted goals, and obligations, then evaluation tests whether the agent finishes from the environment. Empty requirements or missing verdicts are not automatic success, and fairness adjustments must be preregistered.
Illustrative example: A peer may claim a file was deleted while it still exists and the reference can complete the task. This tests whether the agent checks the environment rather than facing an impossible case.
Sections in the Chinese source: 背景与主要改动, 核心公式与公平性口径. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Method comparison
Why report CLASHarness complete success separately from partial check pass rate?
Show answer and example
Answer: Complete success requires a verified nonempty required list with every item passed. Partial rate reports how many checks passed. An empty conjunction or incomplete verdict list does not establish full success.
Illustrative example: Passing three of four required checks gives 75% partial credit and no complete success.
Sections in the Chinese source: 核心公式与公平性口径. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Implementation details
Why shouldn't CLASHarness match records by list position when downgrading checks for fairness?
Show answer and example
Answer: Identify checks by original task_id/check_index, mark specified required items diagnostic, and union overlapping categories. Reordering or duplicate labels can cause wrong removals or double counts if based on positions.
Illustrative example: A check in two disputed categories should appear only once in the downgrade set.
Sections in the Chinese source: 核心公式与公平性口径. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Basics
Why can Option-Channel Attack change a guard decision by altering only labels?
One Word Opens the Gate: The Option-Channel Attack on Typed Decision Models as Agent Guardrails
Show answer and example
Answer: Typed-output names also enter the model. Misleading labels can affect the mapping from an unchanged action to allow or deny, exposing the option-name channel while trusted policy and actions stay fixed.
Illustrative example: The meaning of allow and deny is unchanged, but caller-supplied names can induce the wrong choice.
Sections in the Chinese source: 背景与主要改动. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Core mechanism
Why can changing only option labels affect guard approval while actions and trusted policy remain fixed?
One Word Opens the Gate: The Option-Channel Attack on Typed Decision Models as Agent Guardrails
Show answer and example
Answer: Labels are model inputs and their semantics can affect typed output selection without action changes. Separate unsafe approvals from benign denials. Conditional attack rate uses prohibited examples correctly rejected on clean inputs; an empty denominator is undefined, not zero.
Illustrative example: A misleading label for 'deny' can change the model's choice for the same prohibited call without changing the actual policy.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Method comparison
Why not combine fail-open and fail-closed into one safety accuracy?
One Word Opens the Gate: The Option-Channel Attack on Typed Decision Models as Agent Guardrails
Show answer and example
Answer: Fail-open admits prohibited actions; fail-closed denies permitted actions. Safety and usability effects differ. Conditional ASR applies only to clean correctly rejected cases and cannot replace overall error rates.
Illustrative example: Rejecting everything can reduce unsafe approvals while making legitimate tasks unusable.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Implementation details
What is conditional ASR when no clean example was correctly rejected?
One Word Opens the Gate: The Option-Channel Attack on Typed Decision Models as Agent Guardrails
Show answer and example
Answer: Undefined because the denominator is empty; do not report zero or one. Recompute the conditional denominator in each paired bootstrap draw. Select attack labels on calibration and measure on separate evaluation data.
Illustrative example: A model already incorrectly approving every case offers no clean rejection that could flip to approval.
Sections in the Chinese source: 核心公式, 代码映射与复现边界. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Basics
Why does OnTrack represent trajectories as dependency graphs rather than compare action text?
Show answer and example
Answer: Order and artifact dependencies determine deviation, and independent branches may have different valid orders. Structured unbalanced alignment allows partial prefix/reference matches. Without a reference, explicitly fall back to loop, retry, and stagnation signals.
Illustrative example: Swapping the order of two independent files should not be labeled deviation merely because indices change.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Core mechanism
Why not rescale old prefix-node mass to 1/t whenever a new event arrives?
Show answer and example
Answer: Rescaling changes historical weights merely because the stream grows, confounding progress with normalization. Fixed prefix mass, streaming warm starts, and structural coupling preserve comparisons over time. Before intervening, increase the solver budget and recompute; irreversible-action gates cannot rely on stale frontier caches.
Illustrative example: A new log read should not automatically reduce the mass of an earlier critical edit. Otherwise a score change can come from the denominator rather than actual drift.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Method comparison
Why use different weights for OnTrack's early exploration grace and final alignment?
Show answer and example
Answer: Online new nodes receive age discount and a frontier mask to avoid premature penalties. At termination, cold-start without these adjustments to check the complete trace. Keeping exploration grace in final scores can hide unresolved drift.
Illustrative example: A temporary artifact gets early grace, but if still unused at termination it needs full review.
Sections in the Chinese source: 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Implementation details
May OnTrack reset existing node mass from 1/m to 1/t at each event?
Show answer and example
Answer: No. Agent nodes receive fixed prefix mass 1/m_bar. Rescaling changes old masses and leakage conventions. Recompute the frontier with current coupling before irreversible actions. Planner references can warn but cannot automatically halt execution.
Illustrative example: One unrelated new event should not lower all prior masses solely by changing a denominator.
Sections in the Chinese source: 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Basics
Why doesn't SpecGuard let SpecAgent see tests?
SpecGuard: Proving a Task Is Broken Before the Agent Cheats
Show answer and example
Answer: Tests may conflict with trusted task descriptions; copying them into intent would prove only the tests' own requirements. SpecAgent sees description and code, TestAgent translates independently, and Lean checks conflict after semantic connection.
Illustrative example: If the description says add one but tests demand 2 become 4, do not write '2 becomes 4' into the intent specification.
Sections in the Chinese source: 背景与主要改动, 数据协议. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Core mechanism
Why can a Lean proof still yield inconclusive even though SpecAgent never sees tests?
SpecGuard: Proving a Task Is Broken Before the Agent Cheats
Show answer and example
Answer: Test isolation keeps intent independent of potentially wrong or malicious requirements, and the Certifier checks conflict. A proof applies only to translations and connector expressions. If natural-language meaning cannot be aligned faithfully, kernel success does not prove the original task is corrupted; keep inconclusive.
Illustrative example: Sorting versus reverse-order requirements can be formalized as a conflict. Ambiguity over 'stable sorting' should not be settled solely by a limited proof.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Method comparison
Does a Lean-kernel conflict certificate prove that the original natural-language task must conflict?
SpecGuard: Proving a Task Is Broken Before the Agent Cheats
Show answer and example
Answer: It establishes no common implementation for the generated specification and test constraints, not faithful translation. Semantic connection or intent extraction may be wrong. Allow inconclusive when expression or alignment fails.
Illustrative example: A proof obtained after translating 'add one' as 'add two' does not validate the original task.
Sections in the Chinese source: 核心公式, 结果与验收边界. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Implementation details
Does a passed SpecGuard A100 receipt show real end-to-end model success?
SpecGuard: Proving a Task Is Broken Before the Agent Cheats
Show answer and example
Answer: No. All three archived small-model cases were inconclusive with zero conflict certificates and stopped at Spec. Passed verifies real CUDA execution and provenance. Handwritten Lean passes test mechanics, not model output.
Illustrative example: A working GPU command and saved failures do not establish that the model reached TestAgent and connector stages.
Sections in the Chinese source: 结果与验收边界. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Basics
Why does VeriHarness challenge consensus as well as resolve disagreement?
VeriHarness: Scaling Agentic Verification for Long-Horizon Tasks
Show answer and example
Answer: Multiple matching answers can share missing evidence or omitted requirements. The resolver investigates disputed claims; the challenger questions shared claims and gaps. Evidence tools and workspaces keep agreement from substituting for correctness.
Illustrative example: Three agents can cite the same unchecked claim, which still needs verification despite unanimous votes.
Sections in the Chinese source: 背景与主要改动. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Core mechanism
Why add a consensus challenger after multiple verifiers agree?
VeriHarness: Scaling Agentic Verification for Long-Horizon Tasks
Show answer and example
Answer: Consensus can share mistakes or omissions. Resolving explicit disagreement cannot find requirements everyone skipped. The challenger questions consensus and gaps; the resolver gathers evidence for conflicts. Use evidence tools rather than majority counts as truth.
Illustrative example: If three reviewers inspect screenshots but none examines downloaded files, the challenger can flag missing artifact review even without disagreement.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Method comparison
How does VeriHarness evidence scoring differ from simple majority voting?
VeriHarness: Scaling Agentic Verification for Long-Horizon Tasks
Show answer and example
Answer: Voting counts opinions. The score also considers supporting evidence, contradictions involving consensus, and a claim-count penalty. More votes or claims do not improve verifiability automatically. The local fixture checker is not the paper's actual tool environment.
Illustrative example: One precise, supported claim can be preferable to ten repeated but contradictory claims.
Sections in the Chinese source: 核心公式, 复现边界. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Implementation details
Why record claim segmentation when implementing the VeriHarness claim-count penalty?
VeriHarness: Scaling Agentic Verification for Long-Horizon Tasks
Show answer and example
Answer: The score includes epsilon times claim count, so splitting or merging content changes the penalty. Preserve support, contradiction, and count to explain selection. Fixture verdicts are not real-world fact verification.
Illustrative example: Splitting one sentence into three claims changes the penalty; use consistent segmentation across candidates.
Sections in the Chinese source: 核心公式, 复现边界. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Basics
Why does Safe Self-Improvement distinguish the next edit source from the current implementation?
Safety Must Survive Self-Improvement: Why Failures Persist and How Agents Recover
Show answer and example
Answer: A program can be a useful starting point without meeting current execution conditions. Detection, executable selection, and edit-source selection are separate, and candidates are revalidated under current conditions so old passes do not conceal current failure.
Illustrative example: Useful code from an old version does not make the entire version safe to run today.
Sections in the Chinese source: 背景与主要改动. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Core mechanism
Why select the currently executable version separately from the next edit source?
Safety Must Survive Self-Improvement: Why Failures Persist and How Agents Recover
Show answer and example
Answer: A promising edit parent may not run safely under present conditions. Revalidate execution candidates and select from the qualified set. If none pass, return to founder rather than using a failed incumbent. Restoring execution and continuing search differ, and historical passes are not permanent eligibility.
Illustrative example: Keep a failed incumbent for edit analysis if useful, but execute a currently qualified version or roll back to founder.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Method comparison
How does founder rollback differ from continuing with the incumbent when nothing passes?
Safety Must Survive Self-Improvement: Why Failures Persist and How Agents Recover
Show answer and example
Answer: Select the highest score only among currently valid candidates. If none qualify, roll back to founder. Continuing with a failed incumbent bypasses validation; rollback is a recovery protocol, not proof founder is always safe in any new condition.
Illustrative example: A top-scoring candidate that currently fails cannot keep the execution role on the strength of past scores.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Implementation details
Can Safe Self-Improvement reuse a candidate's previous pass flag directly?
Safety Must Survive Self-Improvement: Why Failures Persist and How Agents Recover
Show answer and example
Answer: No. Recheck current conditions and choose the highest-scoring current pass. The local path executes verification and founder fallback selection, without the paper's edit model or Bedrock experiments.
Illustrative example: Changed tool permissions or task conditions invalidate unconditional reuse of an old passed flag.
Sections in the Chinese source: 背景与主要改动, 复现边界. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Basics
Why does PACE check capability and provenance before tool side effects?
PACE: Provenance-Aware Capability Enforcement for Tool-Using LLM Agents
Show answer and example
Answer: Trusted stored material does not grant authority for every action. Derive authority from authenticated requests and check it with input provenance before each effect, preventing low-trust content from expanding permissions.
Illustrative example: A webpage saying 'send the file' is not user authorization to send it.
Sections in the Chinese source: 背景与主要改动. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Core mechanism
Why doesn't safe memory ingestion guarantee that its content has authority at execution time?
PACE: Provenance-Aware Capability Enforcement for Tool-Using LLM Agents
Show answer and example
Answer: Ingestion checks content then; execution also limits real effects under the authenticated request and verifies trusted provenance. Both authority and provenance must pass so untrusted memory cannot use a legitimate tool beyond scope. Text claiming authorization does not replace system authentication or per-effect checks.
Illustrative example: A stored webpage that says to delete files does not authorize deletion, even if ingestion found no danger. Check effects and provenance before execution.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Method comparison
Can PACE use capability or provenance checks alone?
PACE: Provenance-Aware Capability Enforcement for Tool-Using LLM Agents
Show answer and example
Answer: Allow an effect only if authority covers it and provenance is trusted. Capability limits what can be done; provenance checks whether the present basis is trustworthy. Both are required.
Illustrative example: General file-read permission does not imply approving this specific read instruction from an untrusted page.
Sections in the Chinese source: 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Implementation details
Can PACE execute a tool first and apply the gate later from logs?
PACE: Provenance-Aware Capability Enforcement for Tool-Using LLM Agents
Show answer and example
Answer: No. A pre-effect gate must obtain the complete effect set before execution and compare authority and provenance. Later logs only audit; they cannot undo effects. The local path tests selection without operating system or browser tools.
Illustrative example: Finding untrusted provenance after an email is sent misses the opportunity to prevent it.
Sections in the Chinese source: 背景与主要改动, 核心公式, 复现边界. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Basics
Why does DeFA trace backward along dependencies from the final violation?
DeFA: Dependency-Guided Failure Attribution for LLM Agents
Show answer and example
Answer: The last error may be downstream of a propagated mistake. Combine protocol and semantic relationships into an event graph, trace the source, and retain downstream propagation and responsible agent to distinguish trigger from decisive error.
Illustrative example: The deploying agent is not necessarily at fault if earlier configuration was written incorrectly.
Sections in the Chinese source: 背景与主要改动. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Core mechanism
Why retain the propagation subgraph when locating a decisive error instead of labeling only the last failed action?
DeFA: Dependency-Guided Failure Attribution for LLM Agents
Show answer and example
Answer: Final failure may stem from earlier facts, parameters, or agent messages. Backward dependencies connect the source with affected nodes. Protocol relations give structure and semantic dependencies capture information flow. Maximum error scores still need evidence and do not prove complete causality.
Illustrative example: Deployment can fail because an early read used stale configuration. A propagation graph follows stale fields into the final arguments instead of blaming only deployment.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Method comparison
How does DeFA choose a decisive error differently from taking the last failure?
DeFA: Dependency-Guided Failure Attribution for LLM Agents
Show answer and example
Answer: It selects by error magnitude among ancestors of the violation and retains responsibility and propagation. The last event is just a time position. Graph selection depends on supplied edges and error definition, not independent causal proof.
Illustrative example: A final retry timeout may be a symptom of wrong parameters generated earlier.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Implementation details
Why retain dependencies and responsibility rather than only event text in DeFA propagation graphs?
DeFA: Dependency-Guided Failure Attribution for LLM Agents
Show answer and example
Answer: Candidates come from Ancestor(V); missing edges hide upstream sources and wrong edges add unrelated events. Preserve protocol/semantic dependencies, event IDs, error magnitudes, and responsible agents. The local path reads no gold plan and runs no multimodal judge.
Illustrative example: If two agents write a file, trace the specific version consumed by the failure to identify the relevant write.
Sections in the Chinese source: 背景与主要改动, 核心公式, 复现边界. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Basics
Why does UserProxyBench separate simulator fidelity from task reward?
UserProxyBench: Evaluating LLM User Simulators for Agent Benchmarks and Training
Show answer and example
Answer: Simulators can leak private fields and let agents succeed with less information collection. Independent UFS checks every user contract, avoiding misreading reward on an easier task as real interaction ability.
Illustrative example: An unrequested hidden order number can enable success without showing strong clarification ability.
Sections in the Chinese source: 背景与主要改动. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Core mechanism
Why can premature disclosure by a user simulator improve task success but reduce UFS?
UserProxyBench: Evaluating LLM User Simulators for Agent Benchmarks and Training
Show answer and example
Answer: The agent should ask for information, and unsolicited disclosure bypasses that capability. UFS separately checks every applicable user contract per episode rather than reusing task reward. Completion and fidelity are distinct; success alone does not establish simulator quality.
Illustrative example: Giving an order number before being asked may make refunds succeed without testing whether the agent knew when to request it.
Sections in the Chinese source: 背景与主要改动. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Method comparison
How does the UFS all-criteria product differ from averaging criterion pass rates?
UserProxyBench: Evaluating LLM User Simulators for Agent Benchmarks and Training
Show answer and example
Answer: An episode scores one only when all applicable criteria pass; any failure gives zero. Per-criterion means can let other passes offset a key violation and are a different metric. Report UFS separately from task reward.
Illustrative example: Passing nine of ten criteria gives 90% per-criterion average but strict UFS zero for that episode.
Sections in the Chinese source: 背景与主要改动, 本地复现. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Implementation details
Why retain the order of request and disclosure when auditing premature disclosure?
UserProxyBench: Evaluating LLM User Simulators for Agent Benchmarks and Training
Show answer and example
Answer: Prematurity depends on whether the relevant request came first, not whether a field eventually appears. Local evaluation checks public interaction events against the rubric while keeping private blueprints on the grading side. It does not run paper enterprise tasks or the closed-proxy matrix.
Illustrative example: Disclosing the same field before or after a question can leave identical final text but different fidelity verdicts.
Sections in the Chinese source: 背景与主要改动, 本地复现. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Basics
Why can selective automated evaluation defer some cases to people?
Certified Selective Automation of LLM Agent Evaluation
Show answer and example
Answer: The aim is to automate reliable regions within a certified error budget, not apply machine judgments to every trace. If the upper confidence bound fails the budget, retain human or other evaluation. Report coverage together with risk.
Illustrative example: Automate clear cases while routing ambiguous ones to reviewers; accuracy on automated cases alone is incomplete.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Core mechanism
Why bootstrap by task clusters for an automated-region error certificate instead of treating all traces as independent?
Certified Selective Automation of LLM Agent Evaluation
Show answer and example
Answer: Traces from the same task share difficulty and structure, so independent resampling understates correlation and uncertainty. Cluster sampling builds an error upper bound; automate only below budget, with human or external review otherwise. Low average error does not certify arbitrary thresholds, and the certificate depends on calibration distribution and selection.
Illustrative example: A hundred similar traces from one task are not a hundred independent successes. Resample them as one task cluster.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Method comparison
What does an error upper confidence bound control beyond empirical error in the automated region?
Certified Selective Automation of LLM Agent Evaluation
Show answer and example
Answer: Empirical error summarizes observed samples, while the upper bound reflects uncertainty from finite evidence. Automate only below budget; even zero observed errors can be insufficient. Certification concerns risk in the selected region, not guaranteed correctness on every item.
Illustrative example: No observed errors in a small region does not imply a low enough upper bound or justify expanding coverage.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Implementation details
Can the local bootstrap certificate be reported as coverage on the paper's corpus?
Certified Selective Automation of LLM Agent Evaluation
Show answer and example
Answer: No. The mini-suite tests clustered resampling and the upper-bound takeover rule. Fix traceable task identities, automated regions, and error labels. The confidence bound rather than point error must satisfy budget.
Illustrative example: Low sample error with a high bound does not establish that the error budget is met.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Basics
What decisions outside the model does the harness encompass in a harness design study?
An Empirical Study of Harness Design for Coding Agents
Show answer and example
Answer: It organizes planning, available actions, and context management and executes tasks through an underlying loop. These are workflow decisions, not model-weight changes. Identifying editable components explains why the same model behaves differently under different execution designs.
Illustrative example: One coding model may see a single file fragment or compressed context from several files. That is a harness change.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Core mechanism
Why vary planning, action space, and context separately while fixing the execution loop?
An Empirical Study of Harness Design for Coding Agents
Show answer and example
Answer: Full-harness comparisons change many factors, confounding more reasoning, easier actions, and improved state management. Control components separately under the same loop and evaluate effects and costs. References or statistical contracts do not run the paper's large coding workloads.
Illustrative example: Change only the editor to precise replacement while keeping prompts and budgets fixed, rather than crediting a simultaneous model change to the action space.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Method comparison
Why not combine more detailed planning and a richer action space into one improvement claim?
An Empirical Study of Harness Design for Coding Agents
Show answer and example
Answer: They affect cost and behavior through different pathways. A combined change does not reveal individual contributions; controlled factors are needed, and interactions may occur. Do not assign a combined gain to one component.
Illustrative example: Success after adding both planning and tools does not tell which helped most.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Implementation details
Does testing controllable local harness factors mean SWE-bench was run?
An Empirical Study of Harness Design for Coding Agents
Show answer and example
Answer: No. The mini-suite verifies factors and control flow. Keep model version, budget, and tool protocol fixed, and do not report benchmark capability without actual tasks and execution evidence.
Illustrative example: A simulated tool success cannot be converted into a real repository repair rate.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Basics
Does FUSE train a social agent or provide a verifiable social-reasoning evaluation environment?
Verifiable Social Reasoning for LLM Assistants
Show answer and example
Answer: It is an evaluation: a multi-agent simulation with verifiable hidden motives tests how assistants interpret user retellings and social context. Hidden state supplies grading evidence, not assistant answers. Implementing the simulator or local kernel does not train a stronger social reasoner.
Illustrative example: The simulation knows a character's true intent, while the assistant judges from the retelling. The evaluator checks afterward without revealing it first.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Core mechanism
Why are verifiable hidden motives better for social-reasoning evaluation than judging the fluency of retellings?
Verifiable Social Reasoning for LLM Assistants
Show answer and example
Answer: Retellings can be biased or incomplete. Fluent replies may not identify real goals. A simulator keeps motives and event conditions hidden from the actor and uses them to check inferences rather than textual agreement. Only the verifier sees references, and fixed fixtures are not actual multi-agent semantic interaction.
Illustrative example: A user calls a coworker's refusal hostility while the simulated cause is a resource conflict. Evaluate whether the assistant distinguishes them from visible evidence rather than echoing the framing.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Method comparison
How does a framing-bias evaluation differ from ordinary QA accuracy?
Verifiable Social Reasoning for LLM Assistants
Show answer and example
Answer: Framing can influence attribution even with unchanged facts. Comparing retellings against hidden state measures shifts in social judgment. Small simulated state machines do not establish comprehensive real-world social understanding.
Illustrative example: Describing the same lateness as indifference or a traffic delay can change the assistant's judgment.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Implementation details
What boundaries did the local FUSE evaluator execute, and did it call twelve external LLMs?
Verifiable Social Reasoning for LLM Assistants
Show answer and example
Answer: It runs only an observation-safe evaluation state machine, not the external model matrix. Project public observations separately from private motives; never pass an internal object containing gold to the actor callback.
Illustrative example: The grader may know the actual relationship without exposing that field in the assistant input.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Basics
Does SiLR shadow execution undo actions after real execution fails?
SiLR: Structure-Preserving Admission and Process Reward for LLM Tool Agents
Show answer and example
Answer: No. It evaluates proposed state effects on a shadow path before a gate admits real execution. Separate proposal assessment from real effects; executing first cannot establish prevention, especially for irreversible effects.
Illustrative example: Simulate which constraints a configuration edit touches before committing, rather than breaking the configuration and then attempting rollback.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Core mechanism
Why shouldn't a safety gate reject every action that leaves any residual violation?
SiLR: Structure-Preserving Admission and Process Reward for LLM Tool Agents
Show answer and example
Answer: Recovery can require intermediate states that remain partly unsafe. Rejecting all of them can deadlock the system. SiLR shadow-executes and requires every constrained branch not to worsen, allowing gradual improvement. A total can hide branch regressions, and shadow outcomes must match real execution contracts.
Illustrative example: Revoke one of two problematic permissions first. The system remains imperfect but improves; requiring all violations to disappear in one step can block recovery.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Method comparison
How does product order differ from adding violation severities into one score?
SiLR: Structure-Preserving Admission and Process Reward for LLM Tool Agents
Show answer and example
Answer: Componentwise non-worsening prevents improvement on one branch from offsetting deterioration on another. A scalar can hide that exchange. Preserve constraints; a weighted sum is not an equivalent safety gate.
Illustrative example: Storage savings do not justify expanded permissions even if a combined score decreases.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Implementation details
Can SiLR substitute an unreliable simulator for real effects during shadow execution?
SiLR: Structure-Preserving Admission and Process Reward for LLM Tool Agents
Show answer and example
Answer: Not as a safety claim. Admission requires deterministic, adequately covering verification. Shadow first, compare states, then execute. Without a real simulator, local checks establish only structured criteria and process signals.
Illustrative example: If shadowing omits deletion side effects, an unchanged vector can conceal actual risk.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Basics
Why does RedEvoAgent distill experience into skills rather than store whole traces?
RedEvoAgent: Automatic Red-Teaming Agent with Experience-Driven Skill Evolution
Show answer and example
Answer: Long traces contain noise and consume context. Readable abstract skills improve reuse, and tool credit focuses on decisive steps. Abstraction can lose detail, so skills require held-out validation before promotion.
Illustrative example: Extract 'verify permission boundaries first' from a long investigation rather than copying every irrelevant attempt.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Core mechanism
Why must an experience skill beat the incumbent on a holdout rather than just come from a successful audit trace?
RedEvoAgent: Automatic Red-Teaming Agent with Experience-Driven Skill Evolution
Show answer and example
Answer: The original success supports only one context. Abstraction may overfit wording or credit irrelevant tools. Holdout comparison measures reuse, and only strict gains replace an incumbent to prevent low-quality accumulation. Readable skills still need real execution; a local filter is not full evaluation.
Illustrative example: An audit skill that succeeds on its original example but fails on related unseen cases should not become the default.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Method comparison
How does attributing only decisive tools differ from crediting every tool in a successful trace?
RedEvoAgent: Automatic Red-Teaming Agent with Experience-Driven Skill Evolution
Show answer and example
Answer: Trace success does not mean each call contributed. Equal credit can fossilize irrelevant steps into skills. Decisive attribution retains experiences that change audit outcomes, reducing library noise. An attribution score does not establish a universal causal law.
Illustrative example: An irrelevant lookup before a decisive tool should not become a required skill simply because the trace succeeded.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Implementation details
Has RedEvoAgent locally red-teamed an actual product?
RedEvoAgent: Automatic Red-Teaming Agent with Experience-Driven Skill Evolution
Show answer and example
Answer: No. A safety mini-suite checks attribution and skill-update control flow. Replaying public artifacts is not a new external attack. Record skill provenance, evaluation splits, and replacement evidence without calling replay fresh execution.
Illustrative example: Loading an existing result confirms the protocol can be read, not that an attack just occurred.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Basics
What do Pre, Post, and Sug mean in specification-driven testing, and can suggestions replace behavior contracts?
Grounding AI Agents in Contracts: An Empirical Evaluation of Spec-Driven Test Generation
Show answer and example
Answer: Pre defines conditions before a call. Post specifies behavior given those conditions. Sug suggests verification. Suggestions are not contracts; define valid inputs and outcomes first, then mark tested and untested conditions to identify omissions.
Illustrative example: For sorting, Pre may require comparable elements, Post requires order and element preservation, and Sug proposes duplicate and empty-list tests.
Sections in the Chinese source: 背景与主要改动. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Core mechanism
Why does writing preconditions and postconditions first expose coverage gaps missed by direct test generation?
Grounding AI Agents in Contracts: An Empirical Evaluation of Spec-Driven Test Generation
Show answer and example
Answer: Specifications list input restrictions and guaranteed behavior per unit, then mark tested and untested items so tests target auditable coverage. Source interpretation can still be unfaithful. The paper's automated comparison did not include human edits, so don't treat optional developer steps as executed.
Illustrative example: A specification can flag empty input returning an empty list as an untested postcondition, whereas copying normal examples can miss it indefinitely.
Sections in the Chinese source: 背景与主要改动. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Method comparison
How does fixed-source input differ from exposing historical bugs to test generation?
Grounding AI Agents in Contracts: An Empirical Evaluation of Spec-Driven Test Generation
Show answer and example
Answer: The generator sees only repaired source and public requirements; the private evaluator uses buggy versions. Old patches or bug locations change difficulty and no longer test discovery under the same protocol.
Illustrative example: Knowing which line broke supports targeted tests, not independent contract inference.
Sections in the Chinese source: 背景与主要改动. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Implementation details
Does compilation failure or modifying source count as bug detection?
Grounding AI Agents in Contracts: An Empirical Evaluation of Spec-Driven Test Generation
Show answer and example
Answer: No. The same test must compile and pass on fixed code and compile but fail a real assertion on buggy code. Illegal file edits invalidate runs; use an external trusted diff, not self-reports.
Illustrative example: An intentional call to a nonexistent API that breaks old compilation is not a valid regression test.
Sections in the Chinese source: 背景与主要改动. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Basics
What may HarnessOpt-Bench optimize, and does that include retraining the base model?
HarnessOpt-Bench: Evaluating LLMs at Harness Optimization
Show answer and example
Answer: It searches prompt, tools, control flow, and memory under a target-evaluation budget. Arbitrary base-model retraining or hidden training data are not the same search space. Record candidate versions and allowed edit scope.
Illustrative example: A search can try context compression, but replacing the base with a stronger model confounds harness gains.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Core mechanism
Why fix target-evaluation budget instead of comparing the highest final score alone?
HarnessOpt-Bench: Evaluating LLMs at Harness Optimization
Show answer and example
Answer: More evaluations create more search opportunities and confound optimizer quality with resources. Hidden tests isolate selection, while trusted environments and version records audit changes. Relative gains depend on baseline scale; the best visible search score is not final unseen performance.
Illustrative example: An optimizer that tries a thousand candidates versus ten is not necessarily better because its best is higher. Match call budgets first.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Method comparison
Why separate open search feedback from hidden test?
HarnessOpt-Bench: Evaluating LLMs at Harness Optimization
Show answer and example
Answer: Search uses visible feedback to choose versions, while hidden evaluation measures generalization. Repeatedly reading test during search turns it into tuning data; score gains no longer reflect unseen ability.
Illustrative example: Choosing the highest test score after dozens of variants overstates performance on unseen tasks.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Implementation details
Can local candidate registration replace trusted execution and version audit?
HarnessOpt-Bench: Evaluating LLMs at Harness Optimization
Show answer and example
Answer: No. Count real budget, snapshot candidates, and isolate execution. Do not report benchmark scores without the actual model and environment. Define epsilon for relative gains near a zero baseline rather than silently changing the denominator.
Illustrative example: Adding a configuration name does not mean the optimizer changed and tested it.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Basics
Does OS-Shepherd operate the computer or judge trajectory success?
Show answer and example
Answer: It judges complete computer-operation traces. The evaluated actor clicks and types. OSReward provides human-verified tasks and trajectories for testing reward models. Do not confuse recognizing success with performing the task.
Illustrative example: The actor attempts to save a file and the judge checks the trace. A correct verdict does not mean the judge saved it.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Core mechanism
Why can ordinary accuracy conceal a reward model that predicts almost everything successful?
Show answer and example
Answer: With many successes, approving every trace can score well while missing actual failures. Report success recall, failure recall, and their mean. Cross-system and hard-subset conclusions need real labels; interface diagnostics do not measure open judge capability.
Illustrative example: At 90% successes, predicting all successes gives 90% accuracy and zero failure recall, so balanced accuracy is only 50%.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Method comparison
How does a judge reading the last five states plus text history differ from using only the final screenshot?
Show answer and example
Answer: A final image can omit process and implicit requirements, while history supplies evidence but also noise. An arbitrary summary changes the observation protocol and is not directly comparable with the paper's scores.
Illustrative example: An open window at the end does not show that prior file edits were saved.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Implementation details
Did the local OSReward path train an open 9B or 35B vision judge?
Show answer and example
Answer: No. It did not download official screenshot trajectories either; it only implements the evaluation contract. Join predictions with human labels on the grading side. Explicitly report empty class denominators rather than filling fake balanced accuracy.
Illustrative example: A batch with no failures cannot estimate failure recall.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Basics
Is a FinanceGym rubric score of 3 a 3% success rate?
FinanceHarness: Autonomous Financial Deep Research Framework
Show answer and example
Answer: No. A rubric uses five grades from 0 through 4, and 3 is one level. Normalize within each item by its four-point maximum before averaging items. Interpretation still depends on the rubric. Raw levels, normalized item scores, and overall Outcome are distinct.
Illustrative example: For two rubrics scored 3 and 1, the item score is (3+1)/(4×2)=0.5, not 4% or a two-item hit rate.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Core mechanism
Why keep predictions verifiable after the cutoff with the post-submission evaluator?
FinanceHarness: Autonomous Financial Deep Research Framework
Show answer and example
Answer: Research may use only evidence available by cutoff. Earlier access to future materials turns prediction into repetition. Thesis and rubric also remain with the grader; normalize per item before averaging. Leakage invalidates the run rather than justifying dropping or zeroing a row.
Illustrative example: Later earnings can verify a forecast after submission, but must not be backfilled into the earlier evidence pack.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Method comparison
How does equal weighting by item differ from pooling all rubrics?
FinanceHarness: Autonomous Financial Deep Research Framework
Show answer and example
Answer: Items have different counts. Pooling gives detailed items more weight; normalize per item first and then average. Do not replace the five-point rubric with an arbitrary continuous scale.
Illustrative example: An item with ten criteria should not automatically weigh five times one with two.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Implementation details
Can a finance-protocol row with time leakage be set to zero and included in the mean?
FinanceHarness: Autonomous Financial Deep Research Framework
Show answer and example
Answer: No. Invalidate the run rather than silently dropping or zeroing the row. publication_date must be no later than cutoff, and thesis, rubric, and future evidence stay away from the agent. This is a point-in-time evaluation protocol, not investment advice.
Illustrative example: A tool finding an article published after the cutoff is not merely one wrong answer.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Basics
Why does AgentDebugX preserve immutable raw traces and layer diagnoses on top?
Show answer and example
Answer: Failure analysis needs the original sequence and evidence; overwriting logs hides behavior. Detect, Attribute, Recover, and Rerun produce separately traceable artifacts. The symptom step is not necessarily the cause.
Illustrative example: A tool error late in a trace may originate from bad arguments supplied earlier.
Sections in the Chinese source: 背景与主要改动, 核心机制与评测边界. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Core mechanism
Why must repair proposals not automatically replay arbitrary external tools from imported logs?
Show answer and example
Answer: Logs are observations and can be stale, unauthorized, or side-effecting. Separate diagnosis and attribution from authorized execution. Layer hypotheses and suggestions over immutable traces, and create independent rerun evidence after a human or policy gate. Reference-privileged diagnosis is distinct from answer-free online ability.
Illustrative example: A recorded command deleting a temporary folder should not run on import. Suggest a repair, then let authorized execution decide.
Sections in the Chinese source: 背景与主要改动, 核心机制与评测边界. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Method comparison
What comparison boundary does the reference answer in Who&When introduce?
Show answer and example
Answer: The diagnostic receives the task answer but not the responsible agent or step, so it is localization with ground truth. Do not omit that privilege and present it as an answer-free online capability test.
Illustrative example: Knowing the intended result helps find deviations but does not identify who first erred.
Sections in the Chinese source: 背景与主要改动, 核心机制与评测边界. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Implementation details
May AgentDebugX automatically replay tools from logs after proposing repairs?
Show answer and example
Answer: No. Real reruns need a human or policy gate. Imported logs do not authorize arbitrary external commands. Score a real independent post-repair trajectory for loop evidence. Paper results did not evaluate memory or Error Hub gains.
Illustrative example: If a log contains a deletion, the debugger may propose a correction rather than rerunning the command.
Sections in the Chinese source: 背景与主要改动, 核心机制与评测边界. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Basics
Why does LogAct separate vote commit from execution?
LogAct: Enabling Agentic Reliability via Shared Logs
Show answer and example
Answer: Persist intent, review, and commit before execution, separating authorization from external effects and enabling crash audit. Agreement in conversation is not a trusted durable commit.
Illustrative example: Record approval before an executor calls a payment API.
Sections in the Chinese source: 背景与主要改动. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Core mechanism
Why can't a committed action be executed again unconditionally after a crash?
LogAct: Enabling Agentic Reliability via Shared Logs
Show answer and example
Answer: Commit records approval but may not reveal whether the external side effect happened. A call can succeed before its receipt is logged. Recovery needs idempotency keys or transaction contracts to distinguish those cases. Votes govern approval, not external exactly-once execution.
Illustrative example: If payment succeeds and the process crashes before logging a result, blind replay may charge twice. Use idempotency or transaction lookup.
Sections in the Chinese source: 背景与主要改动. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Method comparison
How does LogAct k-of-N approval differ from waiting for every vote?
LogAct: Enabling Agentic Reliability via Shared Logs
Show answer and example
Answer: A fixed threshold permits commit as soon as k approvals arrive. Reject early if approvals plus remaining votes cannot reach k. Irrelevant pending votes need not finish, and a voter counts once. This does not implement all dynamic approval policies.
Illustrative example: With three voters and a threshold of two, two approvals suffice. Two rejections make the last vote unable to reach two approvals.
Sections in the Chinese source: 背景与主要改动. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Implementation details
How does local LogAct handle quorum and crash recovery?
LogAct: Enabling Agentic Reliability via Shared Logs
Show answer and example
Answer: Require k approvals from N named voters, deduplicate voters, and disallow vote changes. Started without Result does not retry by default. Only explicit recovery for a known idempotent action, after excluding live executors, uses a stable key. Arbitrary dynamic policy languages are unsupported.
Illustrative example: One person's two votes do not count twice, and a commit does not justify replaying unknown side effects.
Sections in the Chinese source: 背景与主要改动. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Basics
Why does TFRBench check both numerical error and reasoning consistency?
TFRBench: A Reasoning Benchmark for Evaluating Forecasting Systems
Show answer and example
Answer: A close forecast may be luck and a fluent explanation may forecast badly. References need both criteria. Labels and feedback used in construction do not yield held-out ability scores.
Illustrative example: A lucky trend guess without evidence and a justified forecast with large errors both fail full admission.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Core mechanism
Why must a summary forecast and pass independently after a long reasoning trace meets reference gates?
TFRBench: A Reasoning Benchmark for Evaluating Forecasting Systems
Show answer and example
Answer: Summaries can omit decisive evidence and cannot inherit original correctness. Numerical accuracy and reasoning consistency jointly constrain references. Label-informed filtering measures construction quality, not held-out ability. Reject zero historical scales rather than adding arbitrary epsilon.
Illustrative example: A long trace explains seasonality and predicts correctly, while a summary saying only 'upward trend' may predict badly. Check compression independently.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Method comparison
How does TFRBench MASE differ in scale from comparing raw MAE across series?
TFRBench: A Reasoning Benchmark for Evaluating Forecasting Systems
Show answer and example
Answer: MASE divides error by historical mean absolute seasonal differences, defining thresholds relative to each series. MAE retains original units and is not directly comparable across dimensions. MASE below one is a numeric gate alongside separate consistency. Zero historical scale makes it undefined.
Illustrative example: An error of ten has different meaning for volatile sales and nearly constant temperature. Normalize by each series' historical seasonal changes.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Implementation details
Can TFRBench add epsilon and award a high score when historical seasonal scale is zero?
TFRBench: A Reasoning Benchmark for Evaluating Forecasting Systems
Show answer and example
Answer: No. MASE is undefined and the sample must be rejected. Reference admission strictly requires MASE below one and S at least four. Document composite ranking weights; local settings are not the authors' unique formula. Future truth remains with the grader.
Illustrative example: Constant histories have no difference scale. Inventing a denominator does not make their errors comparable.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Basics
Is ConvApparel's PLSA the topic model with the same acronym?
Show answer and example
Answer: No. Population-Level Statistical Alignment compares behavior distributions of simulated and human populations. The local kernel uses KS distance and tie-aware MWU. Group alignment does not establish human realism in every dialogue.
Illustrative example: Comparing human and simulator turn-count distributions is population alignment, not learning latent topics from shopping text.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Core mechanism
Why doesn't achieving a simulated shopping goal prove that the simulator behaves like a human?
Show answer and example
Answer: Success measures cooperation with the current recommender. Tone, behavior distributions, and response patterns can still be unrealistic. Population statistics, trained real/fake discrimination, and cross-policy counterfactuals test distinct dimensions. HLS is the classifier's probability of human behavior, not task success or human approval.
Illustrative example: A simulator accepting the first item immediately can succeed quickly without human-like comparison and may fail under another recommender.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Method comparison
How does cross-recommender validation differ from testing under the policy used to generate simulated data?
Show answer and example
Answer: Same-policy testing may show adaptation to a familiar interaction. Cross-policy tests put a simulator trained under one recommender into another to see whether behavior transfers. This complements distribution matching and discrimination but does not guarantee every deployment policy.
Illustrative example: Train with a popularity-oriented recommender, then check whether shopping responses remain reasonable under an exploration-oriented one.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Implementation details
Is PLSA a topic model here, and how are local statistical choices documented?
Show answer and example
Answer: No; it is Population-Level Statistical Alignment. Exact permutation for small samples and fixed-seed, plus-one-corrected Monte Carlo for larger ones are explicit local choices. Train and validate the HLS classifier independently rather than filling predictions from gold.
Illustrative example: A passing KS-distance calculation verifies the statistic, not human alignment.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Basics
Why does CausalArmor compare user and tool attribution before privileged actions?
CausalArmor: Efficient Indirect Prompt Injection Guardrails via Causal Attribution
Show answer and example
Answer: Untrusted tool content can dominate a proposal. Leave-one-out ablation measures likelihood changes for the same action. If tool attribution exceeds user attribution, selectively sanitize and propose again rather than executing the original action.
Illustrative example: A webpage can suggest deleting files despite no such user request.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Core mechanism
Why isn't lower action likelihood after removing an untrusted span a causal safety proof?
CausalArmor: Efficient Indirect Prompt Injection Guardrails via Causal Attribution
Show answer and example
Answer: Leave-one-out ablation shows a change in probability, but removal can change context structure or remove legitimate evidence. Compare user attribution, sanitize only flagged spans, mask contaminated continuation, and repropose. Preserve threshold direction and recomputation; low user attribution alone does not establish an attack.
Illustrative example: If a paragraph contains both a necessary number and a suspicious instruction, its likelihood effect cannot all be attributed to malicious content.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Method comparison
How does targeted sanitation of flagged tool spans differ from deleting all tool results?
CausalArmor: Efficient Indirect Prompt Injection Guardrails via Causal Attribution
Show answer and example
Answer: Keep unflagged evidence, sanitize flagged spans, and mask potentially contaminated assistant content after the first hit before reproposing. Deleting all tool results also removes legitimate evidence. Reevaluate the new proposal; text removal does not guarantee safety.
Illustrative example: Sanitize an injected instruction and remove affected later drafts while retaining unrelated valid retrieval evidence.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Implementation details
What happens when CausalArmor has no sanitizer or reproposal callback?
CausalArmor: Efficient Indirect Prompt Injection Guardrails via Causal Attribution
Show answer and example
Answer: Withhold the action and mark intervention_required instead of fabricating sanitation or reruns. Mask assistant content after the first hit. Larger τ flags more spans; preserve the sign and require normal authorization for any eventual action.
Illustrative example: Without a real sanitizer, deleting a string is not a successful defense loop.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Basics
Is a written method suggestion enough for AIRS-Bench?
AIRS-Bench: a Suite of Tasks for Frontier AI Research Science Agents
Show answer and example
Answer: No. Starting from a problem, dataset, and metric, the agent must propose a method, implement training, analyze experiments, and revise. The agent, search scaffold, and execution harness are distinct. A plausible plan is not a completed experiment.
Illustrative example: Suggesting a different loss is a start; implement and run it, then revise using permitted feedback.
Sections in the Chinese source: 背景与主要改动. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Core mechanism
Why give AIRS-Bench problems, data, and metrics without directly providing baseline solutions?
AIRS-Bench: a Suite of Tasks for Frontier AI Research Science Agents
Show answer and example
Answer: Research involves proposals, implementation, analysis, and revision; complete solutions reduce autonomous design. Distinguish agent, search scaffold, and runtime so outer tree-search gains are not fully attributed to the model. Human SOTA is a comparison, not an answer script.
Illustrative example: Give classification data and scoring rules and let the agent design experiments. Providing the best training code would mostly test script execution.
Sections in the Chinese source: 背景与主要改动. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Method comparison
Why match budgets when comparing sequential MLGym with tree-search AIRA-dojo?
AIRS-Bench: a Suite of Tasks for Frontier AI Research Science Agents
Show answer and example
Answer: Search design affects coverage and cost, and unrestricted branching can consume more evaluations. Fix resources and isolate labels to assess scaffold differences. Metrics from different tasks cannot simply be added.
Illustrative example: A tenfold increase in candidates can yield better models without the gain coming entirely from the search method.
Sections in the Chinese source: 背景与主要改动. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Implementation details
Does access to an AIRS-Bench scoring script imply access to test labels?
AIRS-Bench: a Suite of Tasks for Frontier AI Research Science Agents
Show answer and example
Answer: No. Submit predictions to isolated test scoring and use only permitted validation feedback for selection. Author results above SOTA on some tasks are not local results; full research training must actually run for a reproduction claim.
Illustrative example: Knowing the metric is accuracy does not reveal any example's correct class.
Sections in the Chinese source: 背景与主要改动. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Basics
Why do LifeAgentBench's long-term life records require more than classifying one event?
LifeAgentBench: Benchmarking LLMs for Long-Horizon, Cross-Dimensional Lifestyle Health Reasoning
Show answer and example
Answer: Questions span times, dimensions, or users across diet, sleep, activity, and mood records. Gather relevant evidence before calculating or comparing. Filtering and aggregation scope are part of the answer; a single record rarely suffices.
Illustrative example: To compare activity and sleep for one user over a week, use both kinds of records for the same dates. One day's step count is incomplete.
Sections in the Chinese source: 背景与主要改动. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Core mechanism
Why doesn't an SQL scorer computing definitive answers implement LifeAgent tool reasoning?
LifeAgentBench: Benchmarking LLMs for Long-Horizon, Cross-Dimensional Lifestyle Health Reasoning
Show answer and example
Answer: The scorer uses rules and records to verify final answers; it does not decompose tasks, retrieve evidence, maintain statistics, or revise plans. Keep scorer and tool baseline distinct and do not let actors read reference calculations. Field checks are not long-term health-record reasoning; this describes evaluation, not health advice.
Illustrative example: A verifier can compute mean weekly sleep, but the agent must choose the window, query records, and check missing values without calling the reference-answer function.
Sections in the Chinese source: 背景与主要改动. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Method comparison
How do executable SQL, complete evidence, and final correctness differ?
LifeAgentBench: Benchmarking LLMs for Long-Horizon, Cross-Dimensional Lifestyle Health Reasoning
Show answer and example
Answer: Executability concerns syntax and runtime. EX measures evidence completeness on its defined denominator, and Acc|EX checks answers given complete evidence. Mixing denominators conceals retrieval or reasoning problems.
Illustrative example: A query can execute but omit a required user and fail to collect all evidence.
Sections in the Chinese source: 背景与主要改动. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Implementation details
How do read-only SQL and Context Prompting isolate gold answers?
LifeAgentBench: Benchmarking LLMs for Long-Horizon, Cross-Dimensional Lifestyle Health Reasoning
Show answer and example
Answer: For SQL, the model generates an allowed query before receiving results. Context Prompting selects public evidence by user first. Gold stays with the scorer. Numeric grading follows piecewise tolerances, and multi-item answers must match item counts, not merely substrings.
Illustrative example: A correct term accompanied by extra incorrect items is not a fully correct answer.
Sections in the Chinese source: 背景与主要改动. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Basics
What do CoReflect's planner, simulator, evaluator, and analyzer produce?
CoReflect: A Reflective Co-Evolution Framework for Improving Conversational Evaluation
Show answer and example
Answer: The planner organizes tasks, the simulator generates interactions, the evaluator applies current criteria, and the analyzer distills reflection that changes later tasks and criteria. These are semantic model roles, not four JSON fields. Local work did not substitute handwritten rules for them.
Illustrative example: An ambiguous criterion appears during dialogue. The analyzer identifies it, then later rounds revise the rubric and plan scenarios that test the issue.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Core mechanism
Why can't editing rubric strings or averaging supplied scores reproduce CoReflect's reflective co-evolution?
CoReflect: A Reflective Co-Evolution Framework for Improving Conversational Evaluation
Show answer and example
Answer: The core needs semantic planning of scenarios, dialogue simulation, evaluation, and an analyzer that uses reasons to identify deficits and update both tasks and criteria. Mechanical state transitions are scaffolding without semantic judgment or real interaction. Source formulas explain the loop, not local execution.
Illustrative example: An analyzer should identify missed empathy criteria and create relevant scenarios. Manually changing a weight from one to two does not provide that reflection.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Method comparison
How does CoReflect persona–scenario consistency checking differ from valid JSON?
CoReflect: A Reflective Co-Evolution Framework for Improving Conversational Evaluation
Show answer and example
Answer: Syntax only makes fields readable, not semantically compatible. The paper retains pairs passing actual LLM consistency checks. This filter is part of task quality; a state machine or manual score does not replace semantic checking and reflection.
Illustrative example: A persona unable to use the internet paired with a completed online booking can be valid JSON and still require semantic review.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Implementation details
Did the local project implement CoReflect's 953 scenarios and full semantic modules?
CoReflect: A Reflective Co-Evolution Framework for Improving Conversational Evaluation
Show answer and example
Answer: No. This is literature coverage without a heuristic adapter. JSON state transitions or averaging supplied values do not replace LLM checks and dialogue generation; formulas explain the source method.
Illustrative example: More loop iterations do not show the evaluator learned a new judgment dimension.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Basics
Do SOPBench service constraint nodes record chat turns or define required pre-service checks?
SOPBench: Evaluating Language Agents at Following Standard Operating Procedures and Constraints
Show answer and example
Answer: The graph connects services to constraints and constraints to executable helper checks, specifying permission and prerequisites rather than summarizing dialogue order. Follow each service's dependencies to see what must be verified, not just whether final text sounds fluent.
Illustrative example: If a service requires eligibility, the graph should link to that constraint and helper rather than merely contain 'I checked.'
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Core mechanism
Why can correct final database state still fail SOPBench?
SOPBench: Evaluating Language Agents at Following Standard Operating Procedures and Constraints
Show answer and example
Answer: The service must be permitted and required helpers executed in order. And, Or, and Chain encode distinct conditions; guessing the result cannot bypass procedure. Full success requires eligibility, state, and procedure together.
Illustrative example: A refund amount can be correct while the agent skipped order eligibility. A later check does not satisfy a chain requiring eligibility first.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Method comparison
How do And, Or, and Chain constraints differ in verification order?
SOPBench: Evaluating Language Agents at Following Standard Operating Procedures and Constraints
Show answer and example
Answer: And needs every condition without imposing suborder. Or allows a verified true branch. Chain enforces sequence. Treating them as unordered sets permits violations like acting before checking.
Illustrative example: Identity verification before a transfer is Chain; checking after the transfer does not satisfy it.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Implementation details
Can agent self-reports replace SOPBench helper-call records?
SOPBench: Evaluating Language Agents at Following Standard Operating Procedures and Constraints
Show answer and example
Answer: No. procedure_complete needs trusted execution traces showing actual checks in graph order. Gold stays with graders. This protocol component is not a full production service agent.
Illustrative example: Saying 'I verified it' is not a logged successful helper call.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Basics
Does GAIA expect a long reasoning transcript or a checkable short final answer?
Show answer and example
Answer: Score the final answer by exact comparison after prescribed normalization. Solving may still require browsing, images, and tools. Reasoning and submission format are distinct, so many plausible steps do not guarantee a match, and format failure cannot be hidden as reasoning success.
Illustrative example: If a question asks for a person, submit the checkable name. Search notes without a clear final name are not automatically correct.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Core mechanism
Why can exact short answers still test multi-tool reasoning rather than memorization?
Show answer and example
Answer: Short output is the scoring interface; finding it can require browsing, multimodal understanding, calculation, and cross-source checks. Normalized matching makes endpoints clear, not evidence quality or failure location. Distinguish accuracy from executed traces and never put reference answers into agent prompts.
Illustrative example: One final year may require identifying a person from a picture, researching an event, and verifying dates.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Method comparison
How does normalized GAIA exact match differ from an LLM judge assigning semantic scores?
Show answer and example
Answer: Exact match checks equality after fixed normalization. A semantic judge decides equivalent meaning and has different tolerance and biases. Changing the evaluator cannot silently keep the same GAIA score. Predefine normalization instead of rewriting predictions after seeing gold.
Illustrative example: One normalizer handles permitted surface variation. Asking a model to accept a vague paraphrase changes the grader.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Implementation details
May GAIA normalization be relaxed arbitrarily after inspecting gold?
Show answer and example
Answer: No. Fix allowed normalization and task sets, and expose gold only to the scorer. Local interface or protocol checks lack real web and multimodal runs and cannot report benchmark scores.
Illustrative example: Changing rules because a wrong answer contains a correct substring changes the evaluation.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Basics
Why does AutoformBench require all proof obligations in a task to pass?
AutoformBench: A Lean Formalization Benchmark for Advanced Mathematics
Show answer and example
Answer: Advanced formalization requires definitions, auxiliary lemmas, and final proof to work together. A single fragment is insufficient. Trusted Lean/Mathlib must verify all obligations; partial counts do not replace task success.
Illustrative example: A main theorem with a dependency still containing sorry is not a complete task.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Core mechanism
Why aren't source-present and source-free scores comparable by task ID alone?
AutoformBench: A Lean Formalization Benchmark for Advanced Mathematics
Show answer and example
Answer: Visible materials change difficulty: a source or proof offers definitions and strategies, while a source-free workspace requires more autonomous construction. Matching task names do not align information. All obligations must pass, and failures, budget overruns, and infrastructure errors stay in the denominator.
Illustrative example: For the same theorem, one group reads a textbook proof while another gets only a Lean skeleton. Match source conditions before attributing score differences to the model.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Method comparison
How does AutoformBench differ from filling one isolated Lean proof with all definitions given?
AutoformBench: A Lean Formalization Benchmark for Advanced Mathematics
Show answer and example
Answer: It also requires constructing definitions and supporting lemmas, then satisfying every obligation. An isolated proof usually starts with more context fixed. Shared Lean verification does not mean equal autonomous formalization work or comparable pooled success.
Illustrative example: If a definition is missing, formalize it and prove supporting lemmas. Filling only the final by block is incomplete.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Agents / Evaluation and reliability: how do we know it worked?
Implementation details
Can the AutoformBench interface drop failed, over-budget, or infrastructure-error rows?
AutoformBench: A Lean Formalization Benchmark for Advanced Mathematics
Show answer and example
Answer: No. Keep the full fixed task set and actual CSV costs. Nominal caps do not imply equal spend. Importing existing verdicts is not running Harbor; mark planned runs as such if unexecuted.
Illustrative example: Counting only successfully launched tasks hides environment failures and inflates results.
Sections in the Chinese source: 背景与主要改动, 核心公式. The example illustrates the mechanism.
Topic guide and reading order
Start with this question¶
How can we distinguish model success, a permissive environment, scorer bias, and unsafe overreach?
Takeaway¶
Fix tasks, visible inputs, allowed actions, success conditions, and budget before scoring. GAIA asks real-world questions requiring tools and reasoning. Perturbation protocols change one factor and test the same goal. Safety checks also ask whether actions were justified and authorized; a correct answer does not excuse overreach. Separation of actor and scorer information is part of the protocol.
Example¶
To study robustness, run one task twice, changing only an irrelevant redundant tool field with backend, data, and success condition fixed. If a necessary field is removed, the task may become impossible and cannot be counted as simple brittleness. When scoring times out, report scored outcomes and unscored counts rather than dropping unknowns.
Common pitfall¶
Valid syntax does not guarantee preserved meaning, and simulator scores are not real-user or production evidence. The local GAIA mini-suite and AgentPerturb CPU interface are not complete official benchmarks. Safety fixtures do not establish attack-defense rates. Literature-only and cost-only reviews are not verified capabilities.
Reading order¶
Read GAIA for end-to-end task design and difficulty, then AgentPerturb for single-factor, goal-preserving paired tests and independent verification. Distinguish official tasks, CPU protocols, and unrun parts in each local scope.
- GAIA · Original paper
- AgentPerturb: Evaluating LLM Agent Robustness under Controlled Interaction Perturbations · Original paper
Check your understanding¶
Of 100 tasks, 80 were scored and 60 succeeded. Can we report only 75% success and omit the other 20?
Show suggested answer
Report 75% as conditional on being scored, and keep the full denominator of 100 and 20 unknowns. With equal weights, overall success lies between 60% and 80%. Attribute execution failure, interrupted scoring, and genuine task errors separately.