EpiSEM-Bench probes LLM agent epistemic safety under omission of critical environment evidence

A benchmark of 300 matched task pairs reveals that tool-using agents routinely execute prohibited actions when environment tools omit constraints, with passive refusal rarely translating into active evidence recovery.

Primary source: arXiv:2610.31650: https://arxiv.org/abs/2610.31650

What’s new: Autonomous tool-using agents rely on observations returned by environmental tools and APIs to judge whether a requested action complies with safety rules and authorization boundaries. However, standard safety benchmarks assume either direct adversarial jailbreaks or fully observable environments, ignoring scenarios where tool responses are entirely truthful but inadvertently omit a safety-critical fact. In EpiSEM-Bench: Evaluating Safety and Evidence Recovery in LLM Agents under Missing Evidence (arXiv:2610.31650, 22 Oct 2026), researchers Qijin Zhang, Hanzhen Wang, Yuehan Zhao, Haoyu Dai, Yao Shu, Zhongxiang Dai, and Shuang Qiu from City University of Hong Kong, HKUST Guangzhou, and CUHK Shenzhen present EpiSEM-Bench, an executable benchmark evaluating epistemic safety and evidence recovery in LLM agents.

EpiSEM-Bench contains 300 matched task pairs (spanning 600 executable environments) across six practical domains and 60 task families. Each pair presents identical user prompts and available tools, but differs in underlying system state, making the requested action strictly permissible in one environment and prohibited in the other. Across an inventory of 1,363 facts (944 critical and 419 irrelevant), the benchmark systematically suppresses critical parameters (such as spending limits, access clearance levels, or medical contraindications). Evaluating ten frontier LLMs, the authors find that models frequently execute prohibited operations when constraints are omitted, treating incomplete affirmative tool responses as implicit approval. Furthermore, the benchmark introduces an independent audit tool to measure active recovery: whether agents proactively query environment tools to uncover missing facts before acting. While providing recovery pathways reduces unsafe execution across all models, agents that exhibit passive refusal under missing evidence frequently fail to seek out missing information, resulting in unnecessary refusals of legitimate tasks.

Why it matters: Real-world enterprise tools, databases, and third-party APIs routinely return partial data due to pagination, schema variations, timeouts, or network errors. If an agent assumes that the absence of an explicit prohibition implies permission, benign users can unintentionally trigger severe policy violations, unauthorized financial transactions, or unauthorized data disclosures without any adversarial intent. EpiSEM-Bench highlights the vital distinction between passive refusal and active epistemic verification in agentic architectures.

Caveats: The current evaluation relies on simulated tool environments and synthetic execution oracles with rule-based safety criteria; real-world corporate IT environments feature heterogeneous permission hierarchies that may be more ambiguous. In addition, the benchmark evaluates single-agent execution chains rather than multi-agent collaborative workflows where secondary validator agents might catch evidence gaps.