Evals

Plan injection can make an actor follow adversarial instructions while producing reasoning that looks benign to a monitor. Agent builders should treat chain-of-thought inspection as one signal, not a security boundary.

Claim-level quotes can look verifiable while failing to support the full claim. Builders of retrieval agents should score citation coverage, verbatim accuracy, and entailment separately.

VLoc Bench isolates whether security agents can find vulnerable files across real repositories. Its low scores argue for testing localization and post-fix restraint separately from patch generation.

HypoEvolve turns multi-agent scientific work into explicit population updates governed by a genetic algorithm. The result suggests agent collaboration is easier to test when selection and revision are formalized.

Vercel’s data agent improved after replacing prescriptive specialist pipelines with a filesystem, Bash and company-specific context. Eve packages that pattern as conventions.

Loophole turns a natural-language policy into rules, then uses adversarial agents to find forbidden allowances and wrongful refusals. It is a useful pattern for testing agent constitutions.

On Anthropic's financial-analysis bench, assigning tokens to adviser, grader, or memory roles beat pure execution at a fixed budget. Agent topology may matter as much as token count.

A calibrated DeBERTa detector scored well on HaluEval but transferred poorly to biomedical claims. Builders should tune hallucination checks to their domain instead of trusting a general evaluator.

Token counts do not show whether an agent was worth running. Define outcomes and cheap acceptance checks first, then reserve agents for work that is uncertain to execute but relatively easy to verify.

Instruction capacity rose sharply, but long skill files still need evals. Current models can track thousands of constraints, with large differences by model, wording, and order.

Vision encoders can expose an object’s typical color even from grayscale input, and VLM post-training can substantially alter that signal. Useful evidence that visual representations contain learned concepts, not only pixels.

Semantically equivalent instructions can make VLM reward models score identical robot behavior differently. Agent evaluators should test paraphrase invariance, not assume model scale or reasoning fixes it.

LLMs' stated top decision factors only weakly tracked factors shown to affect outputs. For agent oversight, validate explanations with controlled interventions before using them for escalation.

LLM decompilers can produce compilable C that passes shipped tests while changing behavior or hiding crashes. Validate reconstructed code against the original with shared fuzzed inputs.

A 52,988-request audit found black-box LLM judges too unstable for preregistered gates. Measure repeatability first, and pilot the judge before fixing evaluation thresholds.

Readable chain-of-thought is not a reliable map of which steps caused a correct answer. Treat step-level LLM critiques as partial signals, especially on already-correct traces.

SWE-Gate shows why green tests are an incomplete agent-eval signal: 221 of 644 functionally passing repairs still violated constraints derived from code review.

A causal framework separates deceptive-looking model output from the mechanism producing it, giving agent evaluators a stricter basis for claims about intent or agency.

Legora says GPT-6 Astra reviewed 41 documents within minutes, caught every planted error, and improved its workflow result by nearly 40%, though the underlying measure is unspecified.

User feedback helps models repair targeted faults, but LLM judges often miss those repairs. Agent evals should retain human feedback and avoid treating model preference as ground truth.

Cliff trains on the location of a rollout’s first reasoning error, rewarding the valid prefix and penalizing the suffix. It offers finer supervision without a specialized reward model.

A label-free Dutch-book test finds internally inconsistent probabilities from language models, especially when prompts add logical complexity or irrelevant context.

Mechanistic tests suggest two open LLM judges route local errors early and form ratings late, giving eval builders concrete layers and components to probe for judge failures.

CordisBench finds that models lose reliability as harness lifecycle interactions grow, while deterministic execution semantics can replace costly reasoning on controlled cases.

StudentSim turns sparse user histories into individualized simulators that model both current behavior and response to guidance, a pattern for testing adaptive agents before live deployment.

BLOOM-WILT makes rare model behaviors easier to surface by adapting both the auditor’s strategy and target decoding. Its results also show that elicitation method can reverse safety rankings.

S3Gym tests whether agents can explore, judge outcomes, and reuse experience. Raw history, compressed memory, and training each help in some tasks, but none is a reliable default.

Ironclad argues against optimizing token volume or spend alone: measure reviewed, merged code and fix review and CI bottlenecks before judging coding-agent ROI.

Formal verification gives agent-generated code a machine-checkable contract beyond tests. The hard part shifts upstream: humans must define and validate what correct means.

SWE-Prime finds that filtering coding-agent traces by process and segment quality can beat training on every resolved trajectory, reducing noisy imitation from redundant or risky steps.

RedEvoAgent turns prior jailbreak trajectories into a compact attack skill, then keeps only validated improvements. It offers a more interpretable way to probe tool-using agents for unsafe actions.

A multi-GPU kernel benchmark shows coding agents can improve with tools and iteration, but still struggle with communication scheduling, partitioning, and transfer choices.

Agentic checkout spans product feeds, tool discovery, checkout state, and delegated payment authority. Builders need protocol-specific adapters and evals because ACP and UCP have not converged.

TraceML exposes why coding agents stall on long ML work: they repeat narrow optimization loops instead of alternating work types, revisiting discarded ideas, and pivoting like experts.

Correct answers can hide invalid computation. Trace Integrity proposes executable, replayable contracts for data agents and reports 45.8–59.1% correct-answer/invalid-trace rates across three SQL modes.

Snowflake’s rollout favors narrow, high-accuracy coverage, staged adoption, and log-driven iteration over connecting every data source before launch.

Einstein Arena suggests multi-agent environments can outperform fixed workflows when they expose verifiers, shared solutions, forums, and incentives. Its results also show why benchmark shortcuts need active testing.

Plausible outputs can hide consequential omissions that generic LLM judges miss. Production evals need real failure discovery and retrieved expert judgments, not a frozen rubric alone.

Per-task model routing cut the demonstrated coding session’s cost from 44¢ to 14¢ with similar completion time, but builders still need workload-specific evals to validate quality.

A tool-exposed ontology steered models closer to human therapy patterns without fine-tuning, showing how explicit action vocabularies can improve agent behavior.