{
  "schema_version": "1.1",
  "id": "s13:https://arxiv.org/abs/2610.31650v1",
  "slug": "2610-31650v1-1wmxt69",
  "url": "https://feed7.dev/p/2610-31650v1-1wmxt69",
  "title": "EpiSEM-Bench: Evaluating Safety and Evidence Recovery in LLM Agents under Missing Evidence",
  "why_included": "EpiSEM-Bench tests whether tool-using agents notice missing safety evidence, seek it out, and still complete permitted work instead of blindly acting or refusing.",
  "summary": "EpiSEM-Bench contains **300 matched unsafe/safe task pairs** across **six domains**. It suppresses critical facts and audits whether agents recover the evidence, block prohibited actions, and complete permissible ones.",
  "practical_implication": "Treat missing tool output as an explicit harness state. Agents should request safety-critical facts before acting, while evals should test both unsafe execution and over-refusal on paired tasks.",
  "agent_context": "EpiSEM-Bench contains **300 matched unsafe/safe task pairs** across **six domains**. It suppresses critical facts and audits whether agents recover the evidence, block prohibited actions, and complete permissible ones.\n\nTreat missing tool output as an explicit harness state. Agents should request safety-critical facts before acting, while evals should test both unsafe execution and over-refusal on paired tasks.\n\nResults varied across **ten models**. Recovery access reduced unsafe execution for every model, but omission resistance did not reliably imply active evidence gathering or appropriate action.",
  "source": {
    "name": "arXiv",
    "url": "https://arxiv.org/abs/2610.31650v1",
    "published_at": "2026-10-22T17:57:04.000Z"
  },
  "source_class": "blog_post",
  "content_type": "Paper",
  "layer": "benchmark",
  "domains": [
    "security"
  ],
  "topics": [
    "agent-evals",
    "agent-reliability",
    "tool-use"
  ],
  "verification": {
    "status": "needs_review",
    "label": "Needs Review",
    "method": "unverified",
    "verified_at": null
  },
  "uncertainty": [
    "Results varied across **ten models**. Recovery access reduced unsafe execution for every model, but omission resistance did not reliably imply active evidence gathering or appropriate action."
  ],
  "connected_context": {
    "meaning": "EpiSEM-Bench adds missing evidence as a first-class safety state and separates three behaviors that simpler refusal tests can conflate: seeking critical facts, blocking unsafe action, and completing safe action. Recovery access consistently reduced unsafe execution, but the results show that passive resistance to omissions does not establish active evidence gathering or well-calibrated action.",
    "corpus_size": 898,
    "generated_at": "2026-10-24T10:28:17.103Z",
    "connections": [
      {
        "title": "Simulated Control Evals",
        "source_name": "arXiv",
        "source_url": "https://arxiv.org/abs/2610.31593v1",
        "feed7_url": "https://feed7.dev/p/2610-31593v1-1lanp1p",
        "reason": "EpiSEM-Bench supplies a concrete simulated-control condition—suppressed or recoverable tool evidence—while the control-evals result supports simulation as a lower-cost way to estimate deployment-specific safeguard behavior."
      },
      {
        "title": "Move by Move: Measuring and Steering How LLMs Conduct Psychotherapy",
        "source_name": "arXiv",
        "source_url": "https://arxiv.org/abs/2608.21325v1",
        "feed7_url": "https://feed7.dev/p/2608-21325v1-0ebpnes",
        "reason": "Both make agent behavior observable through explicit actions: EpiSEM-Bench audits evidence requests and execution decisions, while the psychotherapy work shows that exposed action vocabularies can also steer behavior."
      },
      {
        "title": "Vulnerability Localization Benchmark: Measuring Agentic Security Analysis at Repository Scale",
        "source_name": "arXiv",
        "source_url": "https://arxiv.org/abs/2609.15939v1",
        "feed7_url": "https://feed7.dev/p/2609-15939v1-0w15mi5",
        "reason": "The paired safe and unsafe tasks reinforce the need for separate gates: an agent must withhold prohibited action without over-refusing permissible work, analogous to testing vulnerability localization and post-fix restraint independently."
      }
    ]
  },
  "lifecycle": "Current",
  "published_at": "2026-10-22T17:57:04.000Z",
  "modified_at": "2026-10-22T17:57:04.000Z",
  "supersedes": [],
  "expires_at": null,
  "formats": {
    "html": "https://feed7.dev/p/2610-31650v1-1wmxt69",
    "json": "https://feed7.dev/p/2610-31650v1-1wmxt69.json",
    "markdown": "https://feed7.dev/p/2610-31650v1-1wmxt69.md"
  }
}