EpiSEM-Bench: Evaluating Safety and Evidence Recovery in LLM Agents under Missing Evidence
EpiSEM-Bench tests whether tool-using agents notice missing safety evidence before acting.
Paper (from PDF)
Read full text
EpiSEM-Bench: Evaluating Safety and Evidence Recovery in LLM Agents under Missing Evidence *,1 *,1 *,1 1 Qijin Zhang , Hanzhen Wang , Yuehan Zhao , Haoyu Dai 2 3 †,1 Yao Shu , Zhongxiang Dai , Shuang Qiu 1City University of Hong Kong 6202 tcO 22 ]IA.sc[ 1v05613.0162:viXra 2The Hong Kong University of Science and Technology (Guangzhou) 3The Chinese University of Hong Kong, Shenzhen ---------------------------- ---------------------- ------- ---------- --------------------------- ---------------------------- -------- --- --- --- qijizhang5-c@my.cityu.edu.hk hanzhwang9-c@my.cityu.edu.hk yzhao843@cityu.edu.hk haoyudai3-c@my.cityu.edu.hk yaoshu@hkust-gz.edu.cn daizhongxiang@cuhk.edu.cn shuanqiu@cityu.edu.hk Abstract Tool-usinglanguagemodelagentsrelyonenvironmentalfactstodecidewhetheranactionispermitted. Whenatoolresponseomitsasafety-relevantfact,anagentmaycarryoutaprohibitedactioneventhough theuserrequestisbenignandeveryreturnedstatementistrue. WeintroduceEpiSEM-Bench,anexecutable benchmarkforevaluatingunsafeexecution,safetyboundaries,andevidencerecoveryinLLMagentsunder missingevidence. Itcontains300matchedunsafe/safetaskpairsacrosssixdomains. …
Explained
What happened
EpiSEM-Bench (City University of Hong Kong and others) tests a quiet failure mode of tool-using agents: acting unsafely because a fact is missing, even when nobody is attacking and everything the tools return is true.
Example: an agent asked to send a payment checks the account. If the tool response leaves out the authorization limit, the agent may send a payment that should have been blocked.
The benchmark:
- 300 matched task pairs (600 "worlds") across 6 domains. In each pair the request and tools are identical, but in one world the action is prohibited and in the other it is permitted.
- 944 critical facts (that decide legality) and 419 irrelevant ones are systematically hidden from tool outputs.
- An optional independent audit tool lets the agent go look up the missing fact.
Ten models were tested. Example findings: Qwen3 14B, Gemma 4 31B and GLM 4.7 Flash complete permitted tasks well (85% to 92%) but are weak on safety and recovery. GPT-6-Luna shows strong restraint but completes fewer legitimate tasks. DeepSeek-V4.1-Flash makes better use of recovered evidence than GPT-6-Luna despite a lower safety margin.
Why it works
The paired design stops two cheap strategies from looking good:
- Always refuse looks safe but fails every permitted twin.
- Always act completes every task but commits the prohibited ones.
So it measures what we actually want: does the agent notice a fact is missing, go get it, then act correctly in both worlds? Key metrics: unsafe-commit rate when evidence is hidden, the minimum number of hidden facts needed to cause failure, and "paired useful recovery" (fetch the fact, refuse in the bad world, complete in the good one).
Main finding: resisting missing evidence and recovering it usefully are different skills. Giving agents a recovery tool lowers unsafe actions for all ten models, but many don't use it consistently.
The bigger pattern
Most agent-safety work focuses on adversarial inputs (prompt injection). This is the epistemic side: absence of evidence is treated as evidence of permission. It is the same bug as code that treats a missing permission row as "allowed".
What it means in practice
- When you give agents tools that move money or delete things, don't rely on the model noticing missing facts. Enforce rules in code: the payment API itself should check limits.
- Design tool responses to be explicit about permissions (
authorized: false,limit: 500) rather than omitting fields. - Default-deny: if a required field is absent, the tool should fail, not proceed. This matters most for flows that move money or points.