When May an Agent Stop? Evidence-Carrying Termination for Tool-Using LLMs

• URL: http://arxiv.org/abs/2608.23623v1
• Date: Sat, 22 Aug 2026 18:56:27 GMT
• Title: When May an Agent Stop? Evidence-Carrying Termination for Tool-Using LLMs
• Abstract summary: ECT certifies support in a recorded trace under declared assumptions, not external truth, safety, or alignment.<n>ECT executed successful recovery in 18/66 trajectories, of which 17 subsequently completed with support.
• Score: 1.7936680693145324
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Tool-using agents must decide when to stop. Existing systems already gate terminal success, certify execution traces, or enforce runtime polici es, but do not test this particular receipt-, scope-, and closed-replay design at the COMPLETE boundary across controlled termination faults. W e instantiate and evaluate Evidence-Carrying Termination (ECT): an agent may return COMPLETE only when a typed certificate binds every required answer claim to valid, in-scope trace evidence and a deterministic replay reconstructs the claimed value. A locked static study crosses 48 ful ly synthetic tasks in six tool-use families with clean execution and eight faults. ECT produced 0/288 unsafe completions versus 252/288 for the inspected termination-critic core (difference -87.50 pp, 95% task-cluster interval [-87.50, -87.50] pp). A fresh, prespecified and frozen 576- trajectory study then compares ECT with the critic core, its faithful controller, and a full-trace LLM critic. On 22 primary held-out task clus ters, ECT produced 0/66 premature unsupported terminations versus 40/66 for the controller (difference -60.61 pp, 95% interval [-78.79, -40.91] pp), while supported completion was 97/132 versus 92/132 (difference 3.79 pp, interval [0.00, 9.09] pp), satisfying a -10-point noninferiority margin. ECT executed successful recovery in 18/66 trajectories, of which 17 subsequently completed with support; all three closed-loop gates p assed. ECT certifies support in a recorded trace under declared assumptions, not external truth, safety, or alignment.

Related papers

• When Agent Metrics Measure Different Things: An Evidence-Grounded Audit of the Praxa AI Pipeline [0.0]
  We present a retrospective measurement audit of selected Praxa AI implementation files, historical evaluation artifacts, and operational records.<n>A 139-case offline routing report contains 112 passes and 27 failures despite zero gating failures.<n>The pooled recorded 99th percentile is 2,147,483,647 ms, versus 38,118.31 ms among server-observed completed calls.
  arXiv  Detail & Related papers  (2026-09-10T07:55:12Z)
• Evidence-State Reliability Under Controlled Degradation: Parser-Validity Divergence in a Multi-Stage LLM Pipeline [1.6921396880325779]
  Multi-stage LLM pipelines can remain structurally valid even when evidence available to downstream stages becomes incomplete, compressed, or conflicting.<n>This paper introduces and operationalizes Evidence-State Reliability (ESR), an evaluation layer concerned with whether intermediate evidence remains sufficiently complete, grounded, internally consistent, and usable for a stage's assigned function.<n>We evaluate the framework using GLM-5.2 on 60 sanitized base cases under four evidence conditions: clean, compressed-lossy, partial-dropout, and noisy-conflicting.
  arXiv  Detail & Related papers  (2026-08-21T18:50:13Z)
• Task-Conditioned Least-Privilege Learning for Executable Terminal and MCP Agents [45.88028371034407]
  Tool-using large language-model agents can complete a task while exercising authority that the user did not grant or the task does not need.<n>We propose a framework where each action is audited before execution and again from observed effects along six dimensions of risk.<n>We find that after training using this framework on Qwen3.5-4B over 1,500 tasks, the selected seed reaches 98.48% safe success across 2,896 evaluation episodes.
  arXiv  Detail & Related papers  (2026-08-18T22:07:23Z)
• Argus: A General-Purpose Agentic Reasoning Runtime for Long-Horizon Tasks [38.52523278435824]
  We present Argus, a persistent, self-evolving runtime in which Manager, Planner, Engineer, and Reviewer execute bounded missions over durable project state.<n>Argus separates stable user intent from operational objectives, constraints, and verification criteria, and admits memories, skills, procedures, verifiers, routing decisions, and rejected routes only after role-owned review and, when available, task-native verification.
  arXiv  Detail & Related papers  (2026-08-05T17:58:58Z)
• From Trajectories to Evidence: Auditable Experimental Records for Industrial Research Agents [47.678562263387214]
  Research agents increasingly conduct multi-round machine-learning experiments in industrial recommendation settings.<n>Yet a completed trajectory is not automatically evidence: generated artifacts may be unsupported or incomplete, executed rounds may be invalid or confounded, and later modifications may obscure earlier findings.<n>We introduce an evidence-grounded framework that couples bounded verification of consequential artifacts with post-execution claim qualification.
  arXiv  Detail & Related papers  (2026-08-05T13:37:38Z)
• ALIVE: Warnings Before Exclusion in Budgeted Multi-Source Learning [18.17400877167872]
  A routing decision can be revised at the next transaction, but a latched source exclusion persists across later decisions.<n>We ask what evidence should authorize unequal-persistence actions when finite-population auditing and learning share a budget.
  arXiv  Detail & Related papers  (2026-07-31T13:18:47Z)
• TRACT: Temporally Routed Action Chunks with Chronological Phase Authority for Contact-Rich Manipulation [33.980402689056895]
  Action chunking shortens the effective decision horizon of robot imitation learning.<n>We present TRACT, which factorizes phase-structured action chunking into an accepted current phase and a single CURRENT variants-to- boundary inside the future horizon.
  arXiv  Detail & Related papers  (2026-07-31T10:59:14Z)
• Looping Is Not Reliability: State-Bound Evidence and Typed Revision Contracts for Agentic Code Repair [36.56438114281786]
  We study the gap between finding a correct patch and retaining, verifying, and submitting it.<n>We derive an evidence-bound typed loop contract and instantiate its mechanically enforceable subset in a reference implementation.
  arXiv  Detail & Related papers  (2026-07-27T16:05:23Z)
• ContainmentBench: Trace-Based Evaluation of Post-Injection Containment in Tool-Using LLM Agents [4.018837636907658]
  We introduce a sandboxed, trace-based benchmark that measures benchmark-defined endpoint policy compliance.<n>We find that aggregate logged-spread rankings change with evidence-stage composition and denominator choice.<n>These results show that a terminal policy label is not a sufficient statistic for operational post-exposure containment.
  arXiv  Detail & Related papers  (2026-07-27T04:51:20Z)
• ContractBench: Can LLM Agents Preserve Observation Contracts? [9.057486468322933]
  We show that observation contract compliance is an emergent, regression-prone capability.<n>We introduce ContractBench, a benchmark of 33 dual-axis tasks that probe two failure modes.<n>We report four findings: (i) no evaluated model clears 80%, with Claude-Opus-4.6 leading at 77.8%; (ii) a sharp within-family capability cliff in Qwen 3.5 between 4B (0%) and 9B (56.6%), smoothing to 70.7% at 397B-A17B; (iii) non-monotonic scaling across the GPT-5 family: agentic post-training can erode
  arXiv  Detail & Related papers  (2026-05-17T06:37:04Z)
• Distributional Energy-Based Models for Uncertainty-Aware Structured LLM Reasoning [40.342912574072024]
  Large Language Models produce structured outputs such as travel plans or code solutions.<n>Individual reasoning steps may appear correct while the output as a whole violates budgets, fails test cases, or contradicts earlier deductions.<n>We propose a learned quality scorer with deterministic analytical constraint penalties for verifying structured LLM outputs.
  arXiv  Detail & Related papers  (2026-05-15T17:08:27Z)
• STAC: When Innocent Tools Form Dangerous Chains to Jailbreak LLM Agents [38.755035623707656]
  This paper introduces Sequential Tool Attack Chaining (STAC), a novel multi-turn attack framework that exploits agent tool use.<n>We apply our framework to automatically generate and evaluate 483 STAC cases, featuring 1,352 sets of user-agent-environment interactions.<n>Our evaluations show that state-of-the-art LLM agents, including GPT-4.1, are highly vulnerable to STAC, with attack success rates (ASR) exceeding 90% in most cases.
  arXiv  Detail & Related papers  (2025-09-30T00:31:44Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.