Reason Less, Verify More: Deterministic Gates Recover a Silent Policy-Violation Failure Mode in Tool-Using LLM Agents
Quick Answer
This paper shows that Deterministic gates improve tool-using LLM agents' success rates by addressing silent policy violations, raising benchmark performance from 29.6% to 42.0% on gpt-4o-mini.
Quick Take
Deterministic gates improve tool-using LLM agents' success rates by addressing silent policy violations, raising benchmark performance from 29.6% to 42.0% on gpt-4o-mini. In a study of the $ au^2$-bench airline domain, 78% of failures were silent, and the gates effectively mitigated this issue without guaranteeing overall task success.
Key Points
- 78% of failures in the study were silent wrong-state failures without tool errors.
- Deterministic gates increased success rates by 12.4 percentage points in gpt-4o-mini.
- The intervention was reproducible across different seeds, confirming its reliability.
- Gates were most effective in policy-permissive environments, showing significant performance lift.
- Similar silent policy violations were observed in gpt-5.2, indicating a persistent issue.
Paper Resources
📖 Reader Mode
~2 min readAbstract:Tool-using LLM agents can violate the very policies they are deployed to enforce while appearing to complete the task successfully. In policy-permissive environments, a tool may execute any well-formed call even when the corresponding state transition is forbidden by domain policy. The result is a silent wrong state (a booking cancelled, a passenger count changed, a claim acted on without verification) that neither the tool nor the agent's self-report exposes.
We study this failure mode in the $\tau^2$-bench airline domain. On a budget agent, 78% of observed failures are silent wrong-state failures with no tool error, and the aggregate failure rate is reproducible across disjoint seeds, not sampling noise. We then evaluate a lightweight intervention: deterministic, read-only pre-execution gates that inspect the proposed call and current state before allowing a write. A four-gate suite raises full-benchmark success from 29.6% to 42.0% on gpt-4o-mini (+12.4pp; paired task-level bootstrap P=0.0012), and the lift reproduces on a disjoint 15-seed set (+12.3pp; P=0.0008).
The effect is concentrated where the gates fire: on the 26/50 firing tasks, success rises by +19.2pp, while movement on the 24 non-firing tasks does not exclude zero. Two negative controls (a self-enforcing retail domain and BFCL) bound the mechanism: gates help when tools are policy-permissive and add little where tools already self-enforce. As suggestive evidence, not a central claim, the same failure mode persists at the frontier: gpt-5.2 at default reasoning still attempts policy-violating writes, and the same suite improves success from 61.2% to 71.6% (+10.4pp; P=0.020; n=5, no replication). The contribution is a bounded evaluation and reliability result: deterministic gates do not guarantee task success, but they can deterministically prevent a known class of silent policy-violating writes at the action boundary.
| Subjects: | Artificial Intelligence (cs.AI); Cryptography and Security (cs.CR) |
| Cite as: | arXiv:2607.07405 [cs.AI] |
| (or arXiv:2607.07405v1 [cs.AI] for this version) | |
| https://doi.org/10.48550/arXiv.2607.07405 arXiv-issued DOI via DataCite (pending registration) |
Submission history
From: Vikas Reddy Challaram [view email]
[v1]
Wed, 8 Jul 2026 13:38:54 UTC (17 KB)
— Originally published at arxiv.org
Want this in your inbox every morning?
Daily brief at your local 8am — bilingual EN/中文, free.
More from arXiv cs.AI
See more →Onnes: A Physics-Grounded LLM Simulator for Cryogenic Fault Diagnosis in Quantum Computing Infrastructure
Onnes is a physics-grounded digital twin simulator for dilution refrigerators, enhancing cryogenic fault diagnosis in quantum computing. It achieves a classification accuracy of 99.0% using few-shot demonstrations, matching a supervised ML classifier, while maintaining a low false alarm rate of 6.4% on real hardware.