mlsanityData to 7 Oct 2026

The Verifier Tax: Horizon Dependent Safety Success Tradeoffs in Tool Using LLM Agents

arXiv 2603.19328 ↗First posted 18 Mar 2026cs.CRcited by 10

On the map: LLM agents and tool use → Agent threats, guardrails and governance

Abstract (arXiv)

We study how runtime enforcement against unsafe actions affects end-to-end task performance in multi-step tool using large language model (LLM) agents. Using tau-bench across Airline and Retail domains, we compare baseline Tool-Calling, planning-integrated (TRIAD), and policy-mediated (TRIAD-SAFETY) architectures with GPT-OSS-20B and GLM-4-9B. We identify model dependent interaction horizons (15 to 30 turns) and decompose outcomes into overall success rate (SR), safe success rate (SSR), and unsafe success rate (USR). Our results reveal a persistent Safety Capability Gap. While safety mediation can intercept up to 94 percent of non-compliant actions, it rarely translates into strictly safe goal attainment (SSR below 5 percent in most settings). We find that high unsafe success rates are primarily driven by Integrity Leaks, where models hallucinate user identifiers to bypass mandatory authentication. Recovery rates following blocked actions are consistently low, ranging from 21 percent for GPT-OSS-20B in simpler procedural tasks to near zero in complex Retail scenarios. These results demonstrate that runtime enforcement imposes a significant verifier tax on conversational length and compute cost without guaranteeing safe completion, highlighting the critical need for agents capable of grounded identity verification and post-intervention reasoning.

Key facts. Cited by 10 papers in the map (data through 7 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 16 of its 33 references that are in the map. First posted on arXiv 18 Mar 2026.

Builds on

16 of 33 references.

Closest ancestors · 4

Same direction, newest first

  1. 2026AIR: Improving Agent Safety through Incident Response12 Feb
  2. 2026AgentSys: Secure and Dynamic LLM Agents Through Explicit Hierarchical Memory Management7 Feb
  3. 2026Towards Verifiably Safe Tool Use for LLM Agents12 Jan
  4. 2024Agent-SafetyBench: Evaluating the Safety of LLM Agents19 Dec

Other references · 12

  1. 2023Efficient Memory Management for Large Language Model Serving with PagedAttentioncited by 5,767
  2. 2023Toolformer: Language Models Can Teach Themselves to Use Toolscited by 4,072
  3. 2023Reflexion: Language Agents with Verbal Reinforcement Learningcited by 4,064
  4. 2022Constitutional AI: Harmlessness from AI Feedbackcited by 2,950
  5. 2023WebArena: A Realistic Web Environment for Building Autonomous Agentscited by 1,908
  6. 2024τ-bench: A Benchmark for Tool-Agent-User Interaction in Real-World Domainscited by 1,280
  7. 2020ALFWorld: Aligning Text and Embodied Environments for Interactive Learningcited by 1,143
  8. 2022MRKL Systems: A modular, neuro-symbolic architecture that combines large language models, external knowledge sources and discrete reasoningcited by 153
  9. 2025Evaluation and Benchmarking of LLM Agents: A Surveycited by 145
  10. 2024LLaMAR: Long-Horizon Planning for Multi-Agent Robots in Partially Observable Environmentscited by 32
  11. 2025SOP-Bench: Complex Industrial SOPs for Evaluating LLM Agentscited by 19
  12. 2026From Tool Orchestration to Code Execution: A Study of MCP Design Choicescited by 3

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2026: 10.

10 papers.

  1. 2026Permission Denied: Policy-Graded Evaluation of Coding Agents in Hardened Environmentscited by 2
  2. 2026Toward Safe LLM Agents: A Survey of Specification, Verification, and Enforcementcited by 2
  3. 2026SiLR: Structure-Preserving Admission and Process Reward for LLM Tool Agentscited by 1
  4. 2026The AI Evaluability Gap: The Missing Layer for Managing Risk and Sustaining Valuecited by 0
  5. 2026When Retrieval Metrics Mislead: Measuring Policy Signal in Long-Horizon Tool-Use Agentscited by 0
  6. 2026What Does Context Compression Cost an Agent? Interaction Costs Unrevealed by Task-Completion Metricscited by 0
  7. 2026More Rejective, Not More Discriminative: The Unit of Verification in Pre-Execution LLM Oversightcited by 0
  8. 2026LeaseGuard: Incumbent-Preserving Admission Control for Privileged LLM Agentscited by 0
  9. 2026Stale Does Not Mean Unsafe: Guard Precision for Tool-Using LLM Agents under Infrastructure State Racescited by 0
  10. 2026What Can Component-Replacement Evidence Establish? A Critical Scoping Review of Local Decisions in LLM Agentscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026The Causal Impact of Tool Affordance on Safety Alignment in LLM Agents
  2. 2026ToolSafe: Enhancing Tool Invocation Safety of LLM-based agents via Proactive Step-level Guardrail and Feedback
  3. 2026NEXUS: Structured Runtime Safety for Tool-Using LLM Agents
  4. 2026AgentS4D: Benchmarking Runtime Risks across the Execution Lifecycle of LLM-Based Workspace Agents
  5. 2026AgentBoundary: Counterfactual Evaluation of Safety in Tool-Using LLM Agents
  6. 2026Tool Specifications Matter: Uncovering and Mitigating Safety Risks in AI Agents
  7. 2026Guardrails as Scapegoats: Auditing Unfaithful Safety Refusals in Tool-Augmented LLM Agents
  8. 2026Mind the GAP: Text Safety Does Not Transfer to Tool-Call Safety in LLM Agents