ToolChain-CRC: Conformal Risk Control for Agentic AI Under Retrieval and Tool-Use Drift

• URL: http://arxiv.org/abs/2606.18467v1
• Date: Tue, 16 Jun 2026 20:27:37 GMT
• Title: ToolChain-CRC: Conformal Risk Control for Agentic AI Under Retrieval and Tool-Use Drift
• Abstract summary: We propose ToolChain-CRC, a conformal risk-control method for retrieval-augmented and tool-using agents under drift.<n>The method treats each agent run as a full trajectory of actions, observations, and final output.<n>It builds step-level risk scores, combines them into a trajectory risk score, calibrates an accept-or-intervene rule, and adds an anytime alarm.
• Score: 0.0
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Modern AI agents retrieve documents, call tools, check intermediate information, and then produce a final answer or action. This creates a risk-control problem that is not visible from the final answer alone. A final response may look acceptable even when the retrieval was weak, a tool output was wrong, or an earlier step was unsupported. We propose ToolChain-CRC, a conformal risk-control method for retrieval-augmented and tool-using agents under drift. The method treats each agent run as a full trajectory of actions, observations, and final output. It builds step-level risk scores, combines them into a trajectory risk score, calibrates an accept-or-intervene rule, and adds an anytime alarm that can stop risky runs before the final answer. We prove trajectory-level risk control under exchangeable calibration runs, give a drift-aware extension with auditable constants, and prove an anytime escalation rule through a supermartingale construction. Experiments cover synthetic tool-chain drift, RAG/tool-use stress tests, public SQuAD-derived retrieval tasks, an API-free agentic QA case study, ablations, target-risk sensitivity checks, 20-seed robustness checks, a drift-margin audit, and a live RAG/tool-use agent benchmark. Across these settings, final-answer-only calibration can miss retrieval and tool failures, while trajectory-level calibration keeps accepted-trajectory risk below the target.

Related papers

• Risk-Aware Reranking for Agentic Tool Retrieval [13.019844558764099]
  We study risk-aware tool retrieval, where the goal is to retrieve useful tools while reducing exposure to higher-risk tools.<n>We propose a lightweight reranking framework on top of a frozen first-stage retriever.<n>We show that our approach improves the relevance--safety tradeoff over relevance--only retrievers and reranking baselines.
  arXiv  Detail & Related papers  (2026-08-24T03:20:54Z)
• Robustness Analysis of Agentic AI to Inconsistent and Incomplete Tool Responses [8.002494437891077]
  We analyze tool failures at the moment a return enters the agent context.<n>We show that likelihood-based signals clearly capture incomplete returns and some direct inconsistencies.<n>Some failures that are weak under likelihood signals can still redirect the agent toward state-changing actions.
  arXiv  Detail & Related papers  (2026-08-24T00:26:57Z)
• Disagree to Explore, Agree to Commit: Routing-Guided Test-Time Scaling for Software Agents [60.650808962786364]
  We study whether native MoE router traces can guide steering and selection without an external judge or selection-time test execution.<n>Our analysis shows that routing provides a robust behavioral role signal; token-granular readouts and decision-matched comparison sets turn it into effective control.<n>We evaluate on SWE-bench Verified using open-weight sparse MoE agents across scales and reasoning-effort settings.
  arXiv  Detail & Related papers  (2026-08-23T03:07:03Z)
• Beyond Suspicious Steps: Ontological Trust in Long-Horizon Agents [13.208673657449175]
  We introduce ontological trust, a task-conditioned property of trajectory prefixes, and instantiate it as RGE.<n>RGE decomposes trust along Role, Goal, and Evidence.<n>We construct a cross-domain trajectory corpus from OSWorld, FinanceBench, and EICU-AC.
  arXiv  Detail & Related papers  (2026-08-18T12:44:43Z)
• TTHE: Test-Time Harness Evolution [50.26245555541721]
  Existing approaches optimize such harnesses before deployment, searching training or development data for a fixed agent workflow that is then frozen at test time.<n>We ask whether the harness can instead be optimized during evaluation itself, using only the unlabeled execution traces the agent produces on the test inputs.<n>During evaluation, TTHE maintains a population of candidate harnesses and refines them through an agentic proposer that reasons over their execution traces.<n>A judge then commits an improved harness from execution-derived proxy signals, and the selected program persists to govern subsequent inputs.
  arXiv  Detail & Related papers  (2026-07-09T05:53:39Z)
• What to Test Next: Interpretable Coverage Gap Discovery in Driving VLMs [52.50210189669399]
  Driving vision-language models (VLMs) must accurately understand scenes across diverse conditions defined by Operational Design Domains (ODDs)<n>We propose SliceScorer, a deterministic scoring rule for missing-slice recommendation.<n>We show that SliceNav surfaces high-risk coverage gaps more effectively than prior slice-discovery methods.
  arXiv  Detail & Related papers  (2026-06-01T03:18:01Z)
• On-Policy Self-Evolution via Failure Trajectories for Agentic Safety Alignment [54.30690671490447]
  Existing safety-alignment signals are largely response-level or off-policy.<n>FATE transforms verifier-scored failures into repair supervision without expert demonstrations.<n>FATE reduces attack success rate by 33.5%, harmful compliance by 82.6%, and improves external trajectory-safety diagnosis by 6.5%.
  arXiv  Detail & Related papers  (2026-05-12T09:56:28Z)
• AgentForesight: Online Auditing for Early Failure Prediction in Multi-Agent Systems [30.172832661173928]
  LLM-based multi-agent systems are increasingly deployed on long-horizon tasks.<n>A single decisive error is often accepted by downstream agents and cascades into trajectory-level failure.<n>We introduce AgentForesight, a framework that reframes this problem as online auditing.
  arXiv  Detail & Related papers  (2026-05-09T05:55:19Z)
• TACT: Mitigating Overthinking and Overacting in Coding Agents via Activation Steering [70.99933391739154]
  We focus on two recurring failure modes where the agent repeatedly reasons over information it already has, and where it issues tool calls without integrating recent observations or acquiring new evidence.<n>In this paper, we introduce TACT (Think-Act via activation Steering), to detect and mitigate agent drift in the residual stream before it surfaces as a behavioral failure.<n>In specific, we label trajectory steps as overthinking, overacting, or calibrated, and find that their hidden states can separate linearly along two *drift axes*, pointing from calibrated behavior toward each failure mode.
  arXiv  Detail & Related papers  (2026-05-07T10:24:27Z)
• CORA: Conformal Risk-Controlled Agents for Safeguarded Mobile GUI Automation [68.53387633351484]
  We propose CORA (COnformal Risk-controlled GUI Agent), a post-policy, pre-action safeguarding framework that provides statistical guarantees on harmful executed actions.<n> CORA reformulates safety as selective action execution: we train a Guardian model to estimate action-conditional risk for each proposed step.<n>To rigorously evaluate this paradigm, we introduce Phone-Harm, a new benchmark of mobile safety violations with step-level harm labels.
  arXiv  Detail & Related papers  (2026-04-10T09:41:21Z)
• TRACER: Trajectory Risk Aggregation for Critical Episodes in Agentic Reasoning [4.928838343487574]
  Existing uncertainty proxies focus on single-shot text generation.<n>We introduce TRACER, a trajectory-level uncertainty metric for dual-control Tool-Agent-User interaction.
  arXiv  Detail & Related papers  (2026-02-11T22:23:56Z)
• E-valuator: Reliable Agent Verifiers with Sequential Hypothesis Testing [7.984665398116918]
  We introduce e-valuator, a method to convert any black-box verifier score into a decision rule with provable control of false alarm rates.<n>Evaluator builds on tools from eprocesses to develop a sequential hypothesis test that remains statistically valid at every step of an agent's trajectory.<n>We show that e-valuator provides greater statistical power and better false alarm rate control than other strategies across six datasets and three agents.
  arXiv  Detail & Related papers  (2025-12-02T05:59:18Z)
• Building a Foundational Guardrail for General Agentic Systems via Synthetic Data [76.18834864749606]
  LLM agents can plan multi-step tasks, intervening at the planning stage-before any action is executed-is often the safest way to prevent harm.<n>Existing guardrails mostly operate post-execution, which is difficult to scale and leaves little room for controllable supervision at the plan level.<n>We introduce AuraGen, a controllable engine that synthesizes benign trajectories, injects category-labeled risks with difficulty, and filters outputs via an automated reward model.
  arXiv  Detail & Related papers  (2025-10-10T18:42:32Z)
• Quantifying Distributional Robustness of Agentic Tool-Selection [8.457056023589951]
  We introduce ToolCert, the first statistical framework that formally certifies tool selection robustness.<n>We show that ToolCert produces a high-confidence lower bound on accuracy, formally quantifying the agent's worst-case performance.<n>Our evaluation with ToolCert uncovers the severe fragility: under attacks injecting deceptive tools or saturating retrieval, the certified accuracy bound drops near zero.
  arXiv  Detail & Related papers  (2025-10-05T01:50:34Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.