Research map / Multi-agent systems and games / LLM agents
TAI3: Testing Agent Integrity in Interpreting User Intent
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes TAI3, an API-centric stress-testing framework that partitions toolkit parameters into VALID/INVALID/UNDERSPEC equivalence classes, generates and intent-preservingly mutates tasks ranked by an SLM error-likelihood predictor, and reuses a datatype-aware strategy memory to find intent integrity violations in LLM agents.
Problem
LLM agents that call APIs via natural language often misinterpret user intent, especially as toolkits evolve; existing safety benchmarks use fixed cases and adversarial testing targets jailbreaks rather than benign task execution, and traditional software testing does not handle natural language amb
Approach
Combine equivalence-class partitioning over API parameter datatypes (semantic partitioning) with intent-preserving LLM mutations ranked by a small LM's likelihood of recovering the original intent, plus a datatype-indexed memory of successful mutation strategies that is retrieved and adapted for new seeds.
Key results
- TAI3 outperforms SelfRef in EESR across all domains and categories, e.g., up to +15.5 points on VALID Finance with Llama-3.1-8B and +10.0 on OFFICE UNDERSPEC with GPT-4o-mini.
- In UNDERSPEC setting TAI3 reduces AQFF by up to 12%.
- Ablation: full method reaches 63.5/62.4/64.3 EESR (VALID/INVALID/UNDERSPEC) versus 55.6/56.7/58.4 for SelfRef.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use TAI3 instead of SelfRef | Llama-3.1-8B target agent · Finance, VALID | EESR: 65.0 -> 80.5 | Helped |
| Use TAI3 instead of SelfRef | Llama-3.1-8B target agent · Office, UNDERSPEC | EESR: 65.7 -> 82.0 | Helped |
| Use TAI3 instead of SelfRef | GPT-4o-mini target agent · Office, VALID | EESR: 58.0 -> 64.0 | Helped |
| Add predictive ranking to SelfRef (ablation) | TAI3 mutation testing · VALID | EESR: 55.6 -> 60.8 | Helped |
| Add predictive ranking to SelfRef (ablation) | TAI3 mutation testing · INVALID | EESR: 56.7 -> 61.2 | Helped |
| Add predictive ranking to SelfRef (ablation) | TAI3 mutation testing · UNDERSPEC | EESR: 58.4 -> 59.9 | Helped |
| Add strategy retrieval to SelfRef (ablation) | TAI3 mutation testing · VALID | EESR: 55.6 -> 58.3 | Helped |
| Add strategy retrieval to SelfRef (ablation) | TAI3 mutation testing · INVALID | EESR: 56.7 -> 60.2 | Helped |
| Add strategy retrieval to SelfRef (ablation) | TAI3 mutation testing · UNDERSPEC | EESR: 58.4 -> 59.4 | Helped |
| Add both predictive ranking and strategy retrieval (ablation) | TAI3 mutation testing · VALID, INVALID, and UNDERSPEC | EESR | Helped |
Surprising findings
- Strategies learned for Bool parameters transfer to Enum parameters, outperforming Enum's native strategies.
- Open-source targets such as Llama-3.3-70B and DeepSeek-R1-70B show higher EESR than closed-source models.
Limitations
- Requires access to the agent's API-calling trajectory, limiting use on commercial agents exposing only high-level outputs.
- Partition count is deliberately limited, so coverage is modest.
- Baseline is a naive self-reflection method since no prior work addresses intent integrity testing.
Experimental setup
Datasets: ToolEmu toolkits (80 APIs, 233 parameters, 5 domains) Agent-SafetyBench ToolEmu test cases
Benchmarks: TAI3 test suite on 80 ToolEmu toolkit APIs across Finance, Healthcare, Smart Home, Logistics, Office
Metrics: EESR (error-exposing success rate) AQFF (average queries to first failure) partition coverage
Baselines: SelfRef
Builds on: ToolEmu equivalence class partitioning Self-reflection
Closest papers by meaning
- ShortcutsBench: A Large-Scale Real-world Benchmark for API-based Agents (ICLR 2025 · similarity 0.88)
- ToolACE: Winning the Points of LLM Function Calling (ICLR 2025 · similarity 0.88)
- AgentBench: Evaluating LLMs as Agents (ICLR 2024 · similarity 0.88)
- DoVer: Intervention-Driven Auto Debugging for LLM Multi-Agent Systems (ICLR 2026 · similarity 0.87)
- ContractBench: Can LLM Agents Preserve Observation Contracts? (NeurIPS 2026 · similarity 0.87)
- TUMIX: Multi-Agent Test-Time Scaling with Tool-Use Mixture (ICLR 2026 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.