tau2-bench 实证研究：LLM 评委与边界检查对智能体评估结果严重分歧
When Evaluators of AI Agents Disagree: An Empirical Study of Native Scoring, LLM Judges, and Commit-Boundary Checks on tau2-bench
AI 导读
论文在 tau2-bench 航空与零售域运行 2,160 个智能体 episode，用四种方式评分并比较分歧。LLM 评委自评一致率 98.2%，但与金标准原生评分仅一致 56.2%；11 例违规写入中评委放行 10 例，无模型调用的 boundary evaluator 捕获全部 11 例。
正文 · 原文
Abstract:Agentic workflows, in which a large language model (LLM) calls tools to read and write data, are evaluated in two ways. Benchmarks compare the final state against a gold answer. Deployed services have none; an LLM judge reads the transcript and decides. Practice treats the two as interchangeable. This paper measures whether they are.
We ran 2,160 episodes in tau2-bench's airline and retail domains and recorded every database write. We scored each episode four ways: native scoring against gold state, an LLM judge, that judge given the policy document, and the boundary evaluator, a minimal rule-based check of whether a write was expected against whether one occurred in the trace. Two annotators independently labeled 120 episodes for task correctness, policy compliance, and commitment correctness.
The judge repeated its verdict 98.2% of the time but agreed with native scoring on 56.2%. In 11 episodes the agent executed a forbidden write. The judge passed 10 to 11, with or without the policy or transcript. A stronger judge still passed 6. The boundary evaluator, with no model call, caught all 11; no judge significantly exceeded it on human labels. Forbidden writes occurred in 11.1% of episodes without gates. Verification, correction, and safe-termination gates did not reduce them significantly. The traces show a candidate cause: the gates' evidence digest dropped the order status and customer authentication, so valid requests were rejected. The choice of evaluator decides the conclusion; the minimal check exposes failures the judges miss. Traces, code, prompts, and labels are released.
| Comments: | 38 pages, 3 figures, 11 tables. Submitted to Empirical Software Engineering. Replication package: this https URL. Supplementary material (Online Resource 1) is included as an ancillary file |
| Subjects: | Software Engineering (cs.SE); Artificial Intelligence (cs.AI); Cryptography and Security (cs.CR) |
| Cite as: | arXiv:2611.14581 [cs.SE] |
| (or arXiv:2611.14581v1 [cs.SE] for this version) | |
| https://doi.org/10.48550/arXiv.2611.14581 arXiv-issued DOI via DataCite (pending registration) |
Submission history
From: Sungbin Im [view email]
[v1]
Tue, 10 Nov 2026 05:34:47 UTC (354 KB)
来源：arXiv cs.AI · arxiv.org