mlsanityData to 14 Oct 2026

What Counts as the Same Task? Executable Contracts for Robustness Evaluation of Tool-Using Agents

arXiv 2610.14477 ↗First posted 10 Oct 2026cs.SE cs.AI cs.CRcited by 0

Not on the map. Why?

Abstract (arXiv)

Robustness tests for tool-using agents often change the agent's environment, for example by hiding a hostile note in an invoice, and then judge the agent by what it does. The result tells us about the original task only if the changed test case is still a valid test of that task. Many evaluations decide this with weak rules, such as accepting any well-formed edit or any edit that stays close to the original in embedding space. We propose executable task contracts. A contract states which facts define a task, which edits are allowed, and what finishing the task means, and it checks each changed test case before the agent runs. We compare validity rules by scoring the same 14,336 stored agent runs under each rule. Across four encoders, embedding thresholds allowed 75-100% of edits that changed the task, such as swapping the payee, yet rejected 24-45% of valid hostile notes. With a MiniLM cosine threshold, Mistral appeared vulnerable on all 64 tasks, but only 26 had a successful valid attack. Replaying a saved solution and allowing edits to benchmark fields fail in similar ways. Evaluations should state, and check, what counts as the same task.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Builds on 24 of its 39 references that are in the map. First posted on arXiv 10 Oct 2026.

Builds on

24 of 39 references.

References · 24

  1. 2019Sentence-BERT: Sentence Embeddings using Siamese BERT-Networkscited by 9,170
  2. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  3. 2024Qwen2.5 Technical Reportcited by 4,942
  4. 2023Toolformer: Language Models Can Teach Themselves to Use Toolscited by 4,182
  5. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,998
  6. 2023Voyager: An Open-Ended Embodied Agent with Large Language Modelscited by 2,191
  7. 2023WebArena: A Realistic Web Environment for Building Autonomous Agentscited by 2,006
  8. 2020MiniLM: Deep Self-Attention Distillation for Task-Agnostic Compression of Pre-Trained Transformerscited by 1,463
  9. 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,443
  10. 2024τ-bench: A Benchmark for Tool-Agent-User Interaction in Real-World Domainscited by 1,402
  11. 2022Text Embeddings by Weakly-Supervised Contrastive Pre-trainingcited by 1,253
  12. 2024OSWorld: Benchmarking Multimodal Agents for Open-Ended Tasks in Real Computer Environmentscited by 1,195
12 more
  1. 2020MPNet: Masked and Permuted Pre-training for Language Understandingcited by 981
  2. 2023C-Pack: Packed Resources For General Chinese Embeddingscited by 578
  3. 2024The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructionscited by 493
  4. 2024Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agentscited by 369
  5. 2024AgentBoard: An Analytical Evaluation Board of Multi-turn LLM Agentscited by 339
  6. 2025Progent: Securing AI Agents with Privilege Controlcited by 141
  7. 2025Adaptive Attacks Break Defenses Against Indirect Prompt Injection Attacks on LLM Agentscited by 125
  8. 2024The Task Shield: Enforcing Task Alignment to Defend Against Indirect Prompt Injection in LLM Agentscited by 99
  9. 2020Reevaluating Adversarial Examples in Natural Languagecited by 85
  10. 2025Indirect Prompt Injections: Are Firewalls All You Need, or Stronger Benchmarks?cited by 18
  11. 2026StepShield: When, Not Whether to Intervene on Rogue Agentscited by 7
  12. 2026Defending against Adaptive Prompt Injection Attacks via Reasoning-enabled Task Alignmentcited by 6

Built on by

Not cited yet.