Pith. sign in

REVIEW 3 major objections 5 minor 39 references

Schema-formatted tool descriptions, not the tools themselves, are why LLM agents lose their safety guardrails.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-03 10:43 UTC pith:CT43O3OJ

load-bearing objection The paper isolates schema-format representation (not tool semantics) as a major driver of agent safety degradation and ships a lightweight, apparently effective defense; the mechanism story is plausible but partly self-referential and needs semantic-equivalence and out-of-sample checks. the 3 major comments →

arxiv 2607.29254 v1 pith:CT43O3OJ submitted 2026-07-31 cs.AI

Tool Specifications Matter: Uncovering and Mitigating Safety Risks in AI Agents

Minghui Pan , Jiayuxuan Yang , Yuanyuan Yuan , Yu Jiang , Zhenpeng Chen This is my paper
classification cs.AI
keywords LLM agentstool specificationsrefusal directionsafety alignmentprompt injectionschema formattinginference-time safeguardrepresentation analysis
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper claims that when an LLM is deployed as an agent, the largest source of safety degradation is not the semantics of the tools but the schema-style format used to describe them. Presenting the same tool information in flattened plain text restores the model's internal refusal signal and blocks harmful execution. Building on that mechanism, the paper proposes SafeKeep, a lightweight inference-time safeguard that checks requests against flattened tool descriptions while leaving the original formatted specifications in place for execution. Across two benchmarks and four LLMs, SafeKeep raises the refusal rate for harmful requests from 23.8% to 70.6% and lowers average prompt-injection attack success from 25.6% to 2.5%. If the claim holds, agent safety can be improved substantially without retraining or any access to model internals.

Core claim

Schema-formatted tool specifications are a primary cause of agent safety degradation. Component ablations show tool specs produce the largest drop in harmful-benign separation along the model's refusal direction; converting specs from schema to flattened text while preserving semantics largely restores separation, whereas randomizing semantics while keeping schema format does not. White-box analysis defines a Schema Direction—the average hidden-state change from flat to schema presentation—and shows it opposes the refusal direction for harmful requests at every layer; activation steering against it converts harmful tool execution into refusal. SafeKeep operationalizes the finding by decoupli

What carries the argument

The refusal direction is the average hidden-state difference between harmful and benign requests, used as a probe for how strongly refusal features are activated. The Schema Direction is the average hidden-state change induced by presenting the same tool specification in schema form rather than flattened text; its opposition to the refusal direction for harmful requests is the paper's mechanistic evidence. SafeKeep is a two-stage inference-time framework: Safety Judgment scores requests with flattened textual tool specifications, and Execution Control forwards safe requests to the original agent pipeline (schema preserved) or blocks and redirects to refusal generation.

Load-bearing premise

The mechanism story assumes that flattening schema-formatted tool specifications into plain text preserves every safety-relevant detail, so the measured safety gains come from restoring native refusal rather than from confusing the model or changing how the task is framed.

What would settle it

Have an independent judge verify that each flattened tool specification is semantically equivalent to its schema version, then re-run SafeKeep only on pairs where equivalence strictly holds. If the refusal improvement disappears on that verified subset, the effect is information loss from flattening rather than recovery of the refusal representation.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • Agent safety can be improved without retraining or activation access; the safeguard only changes what the safety check sees.
  • The underlying model's native refusal is recoverable, so agent safety degradation is reversible rather than a fixed property of the model.
  • Tool-description format becomes a safety-relevant design variable; switching from schema to flat text in the safety path can move refusal rates by tens of percentage points.
  • Safety judgment and tool execution can be decoupled without modifying the agent's tool-use interface, making the approach usable with black-box LLMs.
  • Benchmark comparisons of agent safeguards should control for description format, since format alone can explain large safety differences.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • If formatting and not semantics is the trigger, other structured encodings—XML, typed signatures, code stubs—may also suppress refusal, so agent builders should treat description format as a safety knob.
  • SafeKeep reuses the same LLM to judge and to act, so a request that the flat-text judge marks safe but the schema-formatted executor acts on unsafely could bypass it; a separate or ensembled judge would close that gap.
  • A testable prediction follows: models whose tool-use training did not pair schema formatting with action-taking should show a smaller Schema Direction; if they don't, the proposed 'execution cue' mechanism would need revision.
  • Flattening may drop safety-relevant constraints encoded in schema fields; the reported capability retention on two benchmarks is promising, but broader tool suites should verify no constraint loss.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. This paper investigates why LLMs become less safe when deployed as tool-using agents. Using a paired harmful/benign dataset derived from ToolSafety, it shows that adding tool specifications to an agent context degrades the hidden-state separability of harmful and benign requests along a refusal direction (Section 3.2, Table 1), and that converting schema-formatted tool specifications into flattened textual descriptions largely restores separability, whereas replacing tool semantics with pseudowords does not (Section 3.3, Table 2). The paper defines a 'Schema Direction' as the average hidden-state difference between schema-formatted and flattened textual specifications, shows that it opposes the refusal direction, and reports that activation steering against this direction increases refusals (Section 4, Table 3). It then proposes SafeKeep, a two-stage inference-time safeguard that judges requests using flattened textual tool specifications while retaining the original schema-formatted specifications for execution. On AgentHarm and InjecAgent across Llama3.1-8B-Instruct, Qwen3-8B, Gemini3.1-Flash, and GPT5.4-mini, SafeKeep increases the average refusal rate from 23.8% to 70.6% and reduces the average attack success rate under prompt injection from 25.6% to 2.5% (Table 4). A control with schema-formatted specifications during safety judgment (SafeJudge) performs substantially worse, supporting the claim that the flattened representation is critical to the safeguard's effectivene

Significance. If the conclusions hold, the paper makes a valuable and non-obvious contribution: the representational format of tool specifications, not only their semantics, can materially undermine an LLM's refusal behavior, and a lightweight inference-time reformatting can recover much of the model's native refusal capability without retraining or activation access. The study is unusually thorough in several respects: component-level ablations on three open-weight LLMs, a length-matched control, a semantic-randomization control, a paired dataset with manual verification, a controlled SafeJudge comparison, and public code/data release. The SafeKeep defense is model-agnostic and preserves the original execution pipeline. The main weakness is that the mechanistic interpretation of the central claim rests on an untested semantic-equivalence assumption and on a steering experiment that is partly a manipulation check; these issues do not necessarily invalidate the empirical defense, but they do mean the paper currently overstates confidence in the proposed mechanism.

major comments (3)
  1. [Section 3.3 and Section 5] The central attribution depends on the assumption that converting schema-formatted tool specifications to flattened text preserves all safety-relevant semantic content. The conversion removes JSON syntax, nesting, type declarations, and required-field markers, but the paper never independently verifies that the model still understands the tools. The SafeJudge control (Section 6.4) only shows that a judge using flattened text refuses more; it does not show that the judge is not simply more conservative when tool specifications are less precise. This alternative explanation must be addressed (e.g., a tool-selection or functional-understanding test on flattened vs schema specs, or human semantic-equivalence ratings on the converted texts) before the conclusion that the format, rather than the semantics, drives degradation is fully supported.
  2. [Section 4.1 and Section 4.4] The steering experiment is partly a manipulation check. R_harmful in Eq. (2) is defined as the average schema-minus-text hidden-state difference; subtracting it in Eq. (3) is expected to move activations toward the text condition, so observing more refusals is consistent with the definition but does not, by itself, establish that the Schema Direction causally mediates unsafe tool execution. The causal conclusion needs controls: random directions with the same norm, the benign-request Schema Direction, or a direction constructed from an unrelated representation change, matched in intervention strength. Table 3 also reports a single run without confidence intervals; with roughly 120 harmful requests in the evaluation split, the 47.5% vs 5.0% difference at alpha=4 should be accompanied by a confidence interval or repeated sampling.
  3. [Tables 1-4] All results are point estimates with no confidence intervals, significance tests, or number of repeats. This matters for the source-localization claim because several comparisons are small (e.g., Table 2: Qwen original 0.786 vs semantic randomization 0.770; Table 1: Mistral chatbot 0.921 vs Chatbot-Long 0.915). Bootstrap or per-example confidence intervals on AUROC, and repeated evaluation runs for Table 4, would establish which differences are reliable. Without these, the precision implied by three-decimal AUROC values is difficult to assess.
minor comments (5)
  1. [Section 6.3] There is a typo: a stray period appears before 'SafeKeep is model-agnostic' at the start of the subsection.
  2. [Eq. (2) and Eq. (3)] The Schema Direction R_c is defined in Eq. (2) without normalization, but Eq. (3) uses a unit-normalized version. The paper should clarify which quantity is used in Figure 3 and the cosine-similarity analysis in Section 4.2.
  3. [Section 4.2] The random-direction baseline is described verbally but not shown quantitatively. Reporting the distribution of random-direction cosine similarities and the number of samples would make the 'negative at every layer' claim easier to evaluate.
  4. [Table 4] AgentHarm 'Acc' is a combined metric that jointly rewards refusal of harmful requests and correct handling of benign requests. Reporting benign-request accuracy separately would make the capability-preservation claim easier to verify, especially in cases where refusal rates are high.
  5. [Table 4] For GPT5.4-mini, ASR-B and ASR-E are 0.0 for most methods; the 'best or tied-best in 11 of 12 combinations' statement should explicitly account for ties so the reader can see where SafeKeep is not strictly better.

Circularity Check

0 steps flagged

No significant circularity: the component ablation, schema-direction analysis, and SafeKeep evaluation are self-contained and do not reduce to their inputs by construction.

full rationale

The paper's localization argument uses a fixed chatbot-derived refusal direction and a held-out evaluation split (7:3) to measure harmful-benign separability, so the AUROC drops are not fitted to the conclusion. The Schema Direction in Eq. (2) is defined as a mean hidden-state difference, but it is not fitted to refusal behavior; the opposition to the refusal direction is measured independently, and the steering intervention in Eq. (3) tests whether removing that direction changes behavior in a way not encoded in the vector's construction. SafeKeep's safety judgment is not a fitted predictor; it is the same LLM prompted on flattened specifications, and the SafeJudge ablation controls for the added judgment stage. The only author-overlapping citations ([18] and [31]) are an external benchmark and a corroborating reference, not load-bearing uniqueness or ansatz claims. Concerns about semantic equivalence of flattening are correctness/validity questions, not circularity.

Axiom & Free-Parameter Ledger

1 free parameters · 5 axioms · 1 invented entities

The core empirical claims rest on refusal-direction diagnostics, a linear-representation assumption, and the semantic-preservation assumption of the flattening conversion. The only hand-chosen scalar is the steering strength alpha; no other free parameters are fit to the headline SafeKeep results.

free parameters (1)
  • Steering strength alpha = 0, 4, 8, 12 (swept)
    Eq. (3) uses alpha to control the intervention strength in the causal validation. No single value is fit, but the beneficial effect at alpha=4 is selected from a sweep and reported without confidence intervals.
axioms (5)
  • domain assumption Refusal behavior is mediated by a single hidden-state direction, extractable as the mean harmful-minus-benign activation difference.
    Section 3.1 invokes prior work [3] and uses this direction as the diagnostic for all localization and mechanism analyses; if the direction is not stable across contexts, the AUROC comparisons lose meaning.
  • domain assumption The hidden state at the final prefill token (and first generated token) is a sufficient locus for safety-relevant representations.
    Stated in Sections 3.1 and 4.3; safety judgments and refusal-direction projections are computed at these tokens.
  • ad hoc to paper Converting schema-formatted tool specifications to flattened textual form preserves the semantic content needed for safety assessment.
    Section 5 Safety Judgment relies on this; if flattening removes safety-relevant tool semantics, SafeKeep's gains could reflect degraded understanding rather than recovered refusal.
  • domain assumption The paired harmful-benign dataset generated by Claude Sonnet 4.6 and manually inspected preserves scenario/tool structure and differs only in safety.
    Section 3.1 uses this dataset for all direction extraction and AUROC evaluations; errors in benign rewrites would bias AUROC and direction estimates.
  • domain assumption Averaging hidden-state differences across examples yields a linear 'Schema Direction' that can be subtracted as a causal intervention.
    Section 4.1 defines Eq. (2) and Section 4.4 uses Eq. (3); linearity of representation differences is assumed without direct validation.
invented entities (1)
  • Schema Direction (R_c) no independent evidence
    purpose: Quantify the average hidden-state change caused by presenting tool specifications in schema format vs flattened text; used to show opposition to refusal and to steer activations.
    A data-derived vector defined in Eq. (2); it has no falsifiable handle outside this paper's own hidden-state measurements, and the steering test may be in-sample.

pith-pipeline@v1.3.0-daily-deepseek · 11165 in / 14974 out tokens · 150298 ms · 2026-08-03T10:43:02.483489+00:00 · methodology

0 comments
read the original abstract

AI agents extend large language models (LLMs) with external tools, enabling them to perform complex tasks and translate model outputs into consequential real-world actions. Yet LLMs often become substantially less safe when deployed as agents, and the source of this degradation remains poorly understood. In this paper, we identify schema-formatted tool specifications as a primary source of agent safety degradation and show, through white-box representation analysis, that they weaken the model's internal refusal signals and contribute to unsafe tool execution. Building on this finding, we propose SafeKeep, an inference-time safeguard that decouples safety judgment from tool execution: it assesses requests using flattened textual tool specifications while retaining the original schema-formatted specifications for execution. Across two representative benchmarks and four LLMs, including both white-box and black-box models, SafeKeep increases the average refusal rate for harmful requests from 23.8% to 70.6% and reduces the average attack success rate under observation-level prompt injection from 25.6% to 2.5%. It also outperforms existing safeguards and preserves task-handling capability. We release the code and data at https://github.com/snowcatsmoking/SafeKeep .

Figures

Figures reproduced from arXiv: 2607.29254 by Jiayuxuan Yang, Minghui Pan, Yuanyuan Yuan, Yu Jiang, Zhenpeng Chen.

Figure 1
Figure 1. Figure 1: Comparison of chatbot- and agent-formatted inputs. [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Example of representation conversion. Setting Llama Qwen Mistral Original tool specifications 0.740 0.786 0.815 After representation conversion 0.885 0.845 0.898 After semantic randomization 0.776 0.770 0.827 [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Layer-wise cosine similarity between the Schema Direction and the chatbot-derived refusal [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Layer-wise projection of the first generated token onto the chatbot-derived refusal direction [PITH_FULL_IMAGE:figures/full_fig_p008_4.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

39 extracted references · 12 linked inside Pith

  1. [1]

    Alon and M

    G. Alon and M. Kamfonas. Detecting language model attacks with perplexity.arXiv preprint arXiv:2308.14132, 2023

    Pith/arXiv arXiv 2023

  2. [2]

    Andriushchenko, A

    M. Andriushchenko, A. Souly, M. Dziemian, D. Duenas, M. Lin, J. Wang, D. Hendrycks, A. Zou, Z. Kolter, M. Fredrikson, et al. Agentharm: A benchmark for measuring harmfulness of llm agents. InInternational Conference on Learning Representations, volume 2025, pages 79185–79220, 2025

    2025

  3. [3]

    Arditi, O

    A. Arditi, O. Obeso, A. Syed, D. Paleka, N. Panickssery, W. Gurnee, and N. Nanda. Refusal in language models is mediated by a single direction. In A. Globerson, L. Mackey, D. Bel- grave, A. Fan, U. Paquet, J. Tomczak, and C. Zhang, editors,Advances in Neural Information Processing Systems, volume 37, pages 136037–136083. Curran Associates, Inc., 2024

    2024

  4. [4]

    Y . Bai, S. Kadavath, S. Kundu, A. Askell, J. Kernion, A. Jones, A. Chen, A. Goldie, A. Mirho- seini, C. McKinnon, et al. Constitutional ai: Harmlessness from ai feedback.arXiv preprint arXiv:2212.08073, 2022

    Pith/arXiv arXiv 2022

  5. [5]

    J. Chen, Y . Luo, and L. Pan. Mechanistic data attribution: Tracing the training origins of interpretable llm units.arXiv preprint arXiv:2601.21996, 2026

    Pith/arXiv arXiv 2026

  6. [6]

    Debenedetti, J

    E. Debenedetti, J. Zhang, M. Balunovic, L. Beurer-Kellner, M. Fischer, and F. Tramèr. Agent- dojo: A dynamic environment to evaluate prompt injection attacks and defenses for llm agents. Advances in Neural Information Processing Systems, 37:82895–82920, 2024

    2024

  7. [7]

    H. Du, W. Li, M. Cai, K. Saraipour, Z. Zhang, H. Lakkaraju, Y . Sun, and S. Zhang. How post- training reshapes llms: A mechanistic view on knowledge, truthfulness, refusal, and confidence. InSecond Conference on Language Modeling, 2025

    2025

  8. [8]

    S. S. Ghosal, S. Chakraborty, V . Singh, F. Huang, D. Manocha, and A. S. Bedi. Safety recovery in reasoning models is only a few early steering steps away.arXiv preprint arXiv:2602.11096, 2026. 11

    arXiv 2026

  9. [9]

    Grattafiori, A

    A. Grattafiori, A. Dubey, A. Jauhri, A. Pandey, A. Kadian, A. Al-Dahle, A. Letman, A. Mathur, A. Schelten, A. Vaughan, et al. The llama 3 herd of models.arXiv preprint arXiv:2407.21783, 2024

    Pith/arXiv arXiv 2024

  10. [10]

    Hadeliya, M

    T. Hadeliya, M. A. Jauhar, N. Sakpal, and D. Cruz. When refusals fail: Unstable safety mechanisms in long-context llm agents.arXiv preprint arXiv:2512.02445, 2025

    arXiv 2025

  11. [11]

    P. Han, C. Qian, X. Chen, Y . Zhang, H. Ji, and D. Zhang. Safeswitch: Steering unsafe llm behavior via internal activation signals.arXiv preprint arXiv:2502.01042, 2025

    arXiv 2025

  12. [12]

    S. Han, K. Rao, A. Ettinger, L. Jiang, B. Y . Lin, N. Lambert, Y . Choi, and N. Dziri. Wildguard: Open one-stop moderation tools for safety risks, jailbreaks, and refusals of llms.Advances in neural information processing systems, 37:8093–8131, 2024

    2024

  13. [13]

    Jeung, Y

    W. Jeung, Y . Sangyeon, M. Kahng, and A. No. Safepath: Preventing harmful reasoning in chain-of-thought via early alignment.Advances in Neural Information Processing Systems, 38:99641–99670, 2026

    2026

  14. [14]

    Kumar, E

    P. Kumar, E. Lau, S. Vijayakumar, T. Trinh, E. Chang, V . Robinson, S. Zhou, M. Fredrikson, S. Hendryx, S. Yue, et al. Aligned llms are not aligned browser agents. InInternational Conference on Learning Representations, volume 2025, pages 26755–26776, 2025

    2025

  15. [15]

    M. Li, Y . Zhao, B. Yu, F. Song, H. Li, H. Yu, Z. Li, F. Huang, and Y . Li. Api-bank: A comprehensive benchmark for tool-augmented llms. InProceedings of the 2023 conference on empirical methods in natural language processing, pages 3102–3116, 2023

    2023

  16. [16]

    X. Liu, H. Yu, H. Zhang, Y . Xu, X. Lei, H. Lai, Y . Gu, H. Ding, K. Men, K. Yang, et al. Agent- bench: Evaluating llms as agents. InInternational Conference on Learning Representations, volume 2024, pages 52989–53046, 2024

    2024

  17. [17]

    Z. Liu, Z. Ying, W. Zhang, Q. Zou, D. Zhang, D. Yang, X. Zhang, and H. Peng. Safeharbor: Defining precise decision boundaries via hierarchical memory-augmented guardrail for llm agent safety. InForty-third International Conference on Machine Learning, 2026

    2026

  18. [18]

    H. Lu, M. Pan, G. Nan, J. Zhuang, Z. Zhao, Z. Sun, K. Wang, Y . Liu, et al. Streaming hallucination detection in long chain-of-thought reasoning. InFindings of the Association for Computational Linguistics: ACL 2026, pages 21157–21183, 2026

    2026

  19. [19]

    R. H. Maudslay and R. Cotterell. Do syntactic probes probe syntax? experiments with jabberwocky probing. InProceedings of the 2021 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, pages 124–131, 2021

    2021

  20. [20]

    Nakano, J

    R. Nakano, J. Hilton, S. Balaji, J. Wu, L. Ouyang, C. Kim, C. Hesse, S. Jain, V . Kosaraju, W. Saunders, et al. Webgpt: Browser-assisted question-answering with human feedback.arXiv preprint arXiv:2112.09332, 2021

    Pith/arXiv arXiv 2021

  21. [21]

    Y . Qin, S. Liang, Y . Ye, K. Zhu, L. Yan, Y . Lu, Y . Lin, X. Cong, X. Tang, B. Qian, et al. Toolllm: Facilitating large language models to master 16000+ real-world apis. InInternational Conference on Learning Representations, volume 2024, pages 9695–9717, 2024

    2024

  22. [22]

    Y . Ruan, H. Dong, A. Wang, S. Pitis, Y . Zhou, J. Ba, Y . Dubois, C. Maddison, and T. Hashimoto. Identifying the risks of lm agents with an lm-emulated sandbox. InInternational Conference on Learning Representations, volume 2024, pages 27031–27098, 2024

    2024

  23. [23]

    Singh, A

    A. Singh, A. Fry, A. Perelman, A. Tart, A. Ganesh, A. El-Kishky, A. McLaughlin, A. Low, A. Ostrow, A. Ananthram, et al. Openai gpt-5 system card.arXiv preprint arXiv:2601.03267, 2025

    Pith/arXiv arXiv 2025

  24. [24]

    G. Team, R. Anil, S. Borgeaud, J.-B. Alayrac, J. Yu, R. Soricut, J. Schalkwyk, A. M. Dai, A. Hauth, K. Millican, et al. Gemini: a family of highly capable multimodal models.arXiv preprint arXiv:2312.11805, 2023. 12

    Pith/arXiv arXiv 2023

  25. [25]

    Topsakal and T

    O. Topsakal and T. C. Akinci. Creating large language model applications utilizing langchain: A primer on developing llm apps fast. InInternational conference on applied engineering and natural sciences, volume 1, pages 1050–1056, 2023

    2023

  26. [26]

    B. Wang, W. He, S. Zeng, Z. Xiang, Y . Xing, J. Tang, and P. He. Unveiling privacy risks in llm agent memory. InProceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 25241–25260, 2025

    2025

  27. [27]

    J. Wang, Z. Ma, Y . Li, S. Zhang, C. Chen, K. Chen, and X. Le. Gta: a benchmark for general tool agents.Advances in Neural Information Processing Systems, 37:75749–75790, 2024

    2024

  28. [28]

    X. Wang, Y . Chen, L. Yuan, Y . Zhang, Y . Li, H. Peng, and H. Ji. Executable code actions elicit better llm agents. InForty-first International Conference on Machine Learning, 2024

    2024

  29. [29]

    T. Wolf, L. Debut, V . Sanh, J. Chaumond, C. Delangue, A. Moi, P. Cistac, T. Rault, R. Louf, M. Funtowicz, et al. Huggingface’s transformers: State-of-the-art natural language processing. arXiv preprint arXiv:1910.03771, 2019

    Pith/arXiv arXiv 1910

  30. [30]

    T. Xie, X. Qi, Y . Zeng, Y . Huang, U. Sehwag, K. Huang, L. He, B. Wei, D. Li, Y . Sheng, et al. Sorry-bench: Systematically evaluating large language model safety refusal. InInternational Conference on Learning Representations, volume 2025, pages 59937–59973, 2025

    2025

  31. [31]

    Y . Xie, Y . Yuan, W. Wang, F. Mo, J. Guo, and P. He. ToolSafety: A comprehensive dataset for en- hancing safety in LLM-based agent tool invocations. In C. Christodoulopoulos, T. Chakraborty, C. Rose, and V . Peng, editors,Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing, pages 14135–14156, Suzhou, China, Nov. 2025. A...

    2025

  32. [32]

    A. Yang, A. Li, B. Yang, B. Zhang, B. Hui, B. Zheng, B. Yu, C. Gao, C. Huang, C. Lv, et al. Qwen3 technical report.arXiv preprint arXiv:2505.09388, 2025

    Pith/arXiv arXiv 2025

  33. [33]

    H. Yang, S. Yue, and Y . He. Auto-gpt for online decision making: Benchmarks and additional opinions.arXiv preprint arXiv:2306.02224, 2023

    Pith/arXiv arXiv 2023

  34. [34]

    S. Yao, J. Zhao, D. Yu, N. Du, I. Shafran, K. Narasimhan, and Y . Cao. React: Synergizing reasoning and acting in language models.arXiv preprint arXiv:2210.03629, 2022

    Pith/arXiv arXiv 2022

  35. [35]

    T. Yuan, Z. He, L. Dong, Y . Wang, R. Zhao, T. Xia, L. Xu, B. Zhou, F. Li, Z. Zhang, et al. R-judge: Benchmarking safety risk awareness for llm agents. InFindings of the Association for Computational Linguistics: EMNLP 2024, pages 1467–1490, 2024

    2024

  36. [36]

    Q. Zhan, Z. Liang, Z. Ying, and D. Kang. Injecagent: Benchmarking indirect prompt injections in tool-integrated large language model agents. InFindings of the Association for Computational Linguistics: ACL 2024, pages 10471–10506, 2024

    2024

  37. [37]

    Zhang, L

    J. Zhang, L. Yin, Y . Zhou, and S. Hu. Agentalign: Navigating safety alignment in the shift from informative to agentic large language models.arXiv preprint arXiv:2505.23020, 2025

    Pith/arXiv arXiv 2025

  38. [38]

    S. Zhou, F. F. Xu, H. Zhu, X. Zhou, R. Lo, A. Sridhar, X. Cheng, T. Ou, Y . Bisk, D. Fried, et al. Webarena: A realistic web environment for building autonomous agents. InInternational Conference on Learning Representations, volume 2024, pages 15585–15606, 2024

    2024

  39. [39]

    Y . Zhou, S. Dai, Z. Cao, X. Zhang, and J. Xu. Length-induced embedding collapse in plm-based models. InProceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 28767–28791, 2025. 13

    2025