EpiSEM-Bench: Evaluating LLM Agents' Safety Boundaries and Evidence Recovery Under Missing Evidence

Tool-using language model agents rely on facts returned by the environment to determine whether an action is permitted. However, when a tool response deliberately omits a safety-critical fact, the agent may still perform a prohibited action even though the user's request is entirely legitimate and every statement returned is true. This blind spot is exactly what EpiSEM-Bench aims to quantify.

Why Missing Evidence Is More Dangerous Than Misinformation

Conventional safety evaluations typically focus on how agents behave when faced with incorrect or malicious information, but EpiSEM-Bench reveals a more insidious failure mode: the information isn't wrong, it's just incomplete. The agent doesn't receive contradictory signals—it simply never gets the chance to see the decisive safety constraint. As a result, the model's reasoning based on the available true information is logically unimpeachable, yet the action it executes crosses the safety boundary.

This kind of failure is hard to catch with conventional testing because every intermediate step appears correct. Evaluation requires an experimental design that can systematically "remove" key facts while keeping the rest of the information true and consistent—which is precisely the starting point of EpiSEM-Bench.

Epistemic omission and misinformation belong to two different categories of informational deficiency in epistemology. The former is "truth conditions not instantiated"—a proposition is simply never expressed in the environment, and the agent cannot logically derive its truth value from known premises; the latter is "truth conditions incorrectly instantiated"—the agent receives statements contrary to fact. In tool-calling scenarios, tool responses are typically treated as authoritative descriptions of world state, and agents' action policies often rest on a "closed-world assumption"—facts not returned are treated as nonexistent or irrelevant. When a safety constraint happens to be among the omitted facts, the agent's reasoning chain is locally sound but globally invalid due to incomplete premises. Such failures cannot be eliminated through adversarial training or fact-checking, because they involve no false signals—only information gaps.

Benchmark Design: 300 Matched Task Pairs and Systematic Fact Suppression

EpiSEM-Bench is an executable benchmark spanning six domains, containing 300 matched unsafe/safe task pairs. Each pair is highly similar on the surface, differing only in whether a certain key fact is present. By systematically suppressing these key facts, the benchmark can measure "unsafe execution under missing critical evidence."

The evaluation doesn't just produce a binary safe/unsafe verdict; it further determines the minimum observed failure base rate, including failures that occur even with complete evidence, and cases where no failure is observed after exhaustive testing. This granularity lets researchers distinguish between "robust" and "just happened not to trip the wire."

Matched-pair design is a classic method in causal inference for controlling confounding variables. In EpiSEM-Bench, each unsafe/safe task pair shares the same user request, tool interfaces, and most of the environment state, with the only controlled difference being whether a certain key safety fact is included in the tool response. This design makes "whether the key fact is missing" the sole independent variable, so differences in unsafe execution rates can be attributed to evidence omission itself rather than confounders such as task difficulty, request phrasing, or model preference. Systematic fact suppression requires that the suppression operation be consistent across domains and task types, preventing models from leaking judgments based on surface patterns (such as specific tool names or request templates). The paired design also allows the benchmark to compute a "conditional unsafe rate"—the model's failure increment on the missing version after controlling for within-pair similarity—which reflects a model's sensitivity to evidence gaps better than a global unsafe rate.

Independent Audit Tool: Do Agents Actively Seek Missing Facts?

The benchmark is equipped with an independent audit tool that examines two types of agent behavior: whether it actively seeks missing facts, and whether, once facts are completed, it can complete the legitimate task while refusing prohibited actions. This effectively splits safety evaluation into two dimensions—evidence acquisition capability and appropriate action capability.

An agent may never cross the line because it is overly conservative, but if it never actively looks for missing information, it may make suboptimal or incomplete decisions over the long run in real environments. Conversely, an agent that actively acquires evidence may not necessarily use that evidence correctly. EpiSEM-Bench's design allows these two capabilities to be observed separately.

Evidence acquisition behavior is typically operationalized in agent evaluations as "proactive query rate" or "proportion of information-seeking actions." EpiSEM-Bench's audit tool quantifies this dimension by recording whether the agent invokes additional tool interfaces during task execution, whether it initiates clarification requests to the user, and whether it checks environment-state fields not directly returned before making decisions. The complementary appropriate action capability focuses on whether, after obtaining complete evidence, the agent can precisely refuse prohibited actions while completing the legitimate goal. These two dimensions are orthogonal: a high query rate doesn't guarantee a high appropriate action rate, because an agent may obtain evidence but misread its safety implications; a low query rate can't be directly judged unsafe either, because a model may correctly infer missing facts from prior knowledge. The key design point of the audit tool is to decouple "whether it knows" from "whether it acts correctly," avoiding conflating two capabilities under a single metric.

Divergence Across Ten Models: Resistance to Omission Doesn't Equal Recovery

Benchmark results reveal significant differences among ten models across three dimensions: omission robustness, evidence acquisition, and appropriate action. A key finding is that resistance to missing evidence does not necessarily translate into useful recovery capability. Some models tend to stall or refuse when evidence is missing, which may look safe, but such conservatism is not the same as being able to make correct judgments once evidence is obtained.

Another notable conclusion is that recovery access—allowing agents to obtain missing facts—reduces the unsafe execution rate of all ten models. This shows that information accessibility itself is an important lever for safety. But models differ in whether they actively seek out these facts, and whether they can act appropriately in both "complete evidence" and "missing evidence" world states.

Recovery access in the benchmark refers to allowing the agent, before executing an action, to obtain deliberately suppressed key facts through additional tool calls or environment queries. This mechanism simulates scenarios in real deployments where agents can proactively initiate information retrieval. Experimental results show that recovery access reduces the unsafe execution rate for all ten models, but the effect size varies by model: some models substantially reduce boundary-crossing behavior once granted access, while others change only marginally, indicating that they either don't actively exploit access or fail to correctly integrate the facts into their decisions after obtaining them. This finding echoes the concept of the information accessibility lever—safety improvements depend not only on whether information exists, but also on whether the agent has the motivation and capability to acquire and use it. Thus, the benchmark treats "recovery access" as an independent experimental condition rather than a default assumption, distinguishing "passive safety" from "active safety."

Implications for Agent Safety Evaluation

EpiSEM-Bench's value lies in transforming safety from a static policy-compliance problem into a dynamic evidence-management problem. Real-world tool interfaces rarely return all relevant information at once—omission is the norm, not the exception. Agents need the ability to identify information gaps, proactively query, and pause high-risk actions when evidence is insufficient.

For developers, this means safety alignment should not only train models to "refuse dangerous requests" but also to "recognize what they don't know." For evaluators, a single unsafe execution rate metric masks capability differences between models; evidence acquisition behavior and post-recovery decision quality must be reported alongside it.

FAQ

How does EpiSEM-Bench differ from conventional safety benchmarks?

Conventional benchmarks mostly test how agents respond to malicious requests or misinformation. EpiSEM-Bench focuses on situations where information is true but key facts are omitted—a more insidious failure mode that is also closer to real tool-calling scenarios.

What is the "minimum failure base rate"?

It refers to the minimum failure scale that can be reliably observed in tests with systematic suppression of key facts, while distinguishing between failures that still occur with complete evidence and cases where no failure is observed after exhaustive testing—helping researchers determine whether a model's robustness is genuine or incidental.

Why does recovery access reduce unsafe execution?

When an agent can obtain omitted key facts, it has the basis for making correct safety judgments. The benchmark shows this mechanism is effective for all ten models, indicating that information accessibility is a direct means of improving agent safety.

One-line Summary

EpiSEM-Bench uses 300 matched task pairs to evaluate LLM agents' safety boundaries and evidence recovery when key facts are omitted.

Paragraph Summary

EpiSEM-Bench is an executable benchmark focused on the failure mode of tool-using language model agents when safety-critical facts are deliberately omitted from tool responses. It contains 300 matched unsafe/safe task pairs across six domains, measures "unsafe execution under missing critical evidence" through systematic fact suppression, and includes an independent audit tool that separately examines agents' evidence acquisition behavior and their appropriate action capability after facts are completed. Testing of ten models shows that resistance to omission does not necessarily translate into effective evidence recovery; recovery access reduces unsafe execution rates for all models, but models differ significantly in whether they proactively acquire and correctly use missing facts. The benchmark reframes agent safety from a static policy-compliance problem into a dynamic evidence-management problem.