Back to AI Research

AI Research

EpiSEM-Bench tests whether agents recover safety facts missing from tool responses

Key Takeaways

  • The benchmark distinguishes refusing an uncertain action from obtaining evidence and completing the safe version of the task.
  • EpiSEM-Bench examines a subtle failure mode for tool-using agents: every returned statement can be true while an omitted fact makes the next action unsafe.
  • The study therefore tests what an agent does when the tool’s evidence is incomplete, rather than only when the request is overtly problematic.
  • ## Compare matched safe and unsafe cases
  • The [paper](https://arxiv.org/abs/2610.31650) introduces 300 matched unsafe-and-safe task pairs across six domains.

EpiSEM-Bench examines a subtle failure mode for tool-using agents: every returned statement can be true while an omitted fact makes the next action unsafe. The user’s request can also be benign. The study therefore tests what an agent does when the tool’s evidence is incomplete, rather than only when the request is overtly problematic.

Compare matched safe and unsafe cases

The paper introduces 300 matched unsafe-and-safe task pairs across six domains. It systematically suppresses critical facts and measures whether the agent executes an action that should be prohibited.
The matched structure matters because the same kind of request may be permissible in one world and prohibited in another. Refusing everything can avoid some unsafe actions while still failing to provide useful assistance on the safe counterpart.

Give the agent a way to investigate

An independent audit tool lets agents seek missing facts. The evaluation then checks whether they use the recovered evidence to withhold prohibited actions while completing permissible tasks.
This separates access to a recovery tool from successful recovery behavior. A model may have the means to ask for information without recognizing when to use it, or may obtain a fact without applying it to the final action. The benchmark makes those stages visible.

Robustness and useful recovery are different measures

Across ten models, the authors report substantial differences in omission robustness, evidence acquisition and appropriate action. Recovery access reduces unsafe execution for every tested model, but the models differ in whether they actively obtain and use the missing information.
For agent evaluators, the practical question is whether the system distinguishes “not stated” from “known to be safe,” then resolves the uncertainty when a suitable evidence source exists. Testing only the rate of refused actions would miss part of that behavior. The paper’s results concern its executable task pairs and tools; they do not establish that a recovery tool eliminates missing-evidence risks in every deployment.

Comments