BLINDSPOT: A Benchmark for Safety and Refusal Calibration in Long-Horizon Tool-Using Agents
Sadia Asif, Mohammad Mohammadi Amiri, Momin Abbas, Tejaswini Pedapati, Prasanna Sattigeri
cs.AI · cs.CE · cs.CL · cs.LG · cs.MA
Quick verdict
Trajectory-level safety benchmark for tool-using agents with five-way outcome taxonomy; solid design, but results are preliminary and lack statistical rigor.
Summary
BLINDSPOT is a benchmark for evaluating safety and refusal calibration of LLM agents over long, tool-using trajectories rather than single turns. A policy-grounded scenario initializes a User Agent, a Target Agent, stateful tools, and environment state; the User Agent adaptively generates each request conditioned on the full interaction history, and each trajectory is assigned one of five labels — Safe Completion, Correct Refusal, Unsafe Completion, Over-Refusal, Indeterminate — via deterministic execution checks, semantic judges, and selective human review. The current instantiation spans 22 attack families and 35 scenarios in seven domains, yielding 2,500+ trajectories averaging 14.7 turns across 13 evaluated models. Key results: GPT-5.6 Sol attains the lowest unsafe completion rate (2%) and highest calibration score (96.0), while Mistral Large 3 reaches 58% UCR with 33% over-refusal; adaptive adversaries raise UCR 1.6–4× over non-adaptive ones; stateful execution adds up to +14 UCR points; Fail@k grows monotonically (GPT-4o 23%→51% at k=10); post-refusal failure reaches 60% for Mistral Large 3. An adjudication ablation shows final-response-only labeling misses 22% of unsafe completions versus 3% for the full pipeline. Limitations: no confidence intervals or significance tests, a delayed-failure analysis built on only 16 unsafe trajectories, unreported judge-model details and human-review volume, and self-described preliminary scope.
Review complete
Assessment at a glance
4
risk flags identified
● high 1
● medium 2
● low 1
5 strengths · 5 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- Long-horizon agent safety is a trajectory-level calibration property: in Figure 6, no unsafe completions occur before turn 4 and 50% occur only by turn 11, so short-prefix evaluation misses most failures.
- A five-way outcome taxonomy separating Correct Refusal from Over-Refusal is necessary because binary attack-success metrics cannot express safety-utility calibration (Table 1, Table 7 safe-twin columns).
- Response-conditioned adaptive adversaries raise Unsafe Completion Rate by 1.6–4× over non-adaptive variants for every one of the 13 evaluated models (Table 7).
- Execution-grounded adjudication is essential: final-response-only labeling misses 22% of Unsafe Completions versus 3% for the full deterministic+semantic pipeline (Table 14), and stateful execution raises UCR by up to +14 points (Table 11).
- Repeated runs and continued pressure expose additional failures for every model: Fail@k rises monotonically (GPT-4o 23%→51% at k=10, Table 9) and Post-Refusal Failure Rate reaches 60% for the weakest models (Table 10).
Strengths
Trajectory-level five-way outcome taxonomy
Table 1 separates Correct Refusal from Over-Refusal and reserves Indeterminate for execution failure rather than judge uncertainty, directly targeting the safety-utility calibration gap the authors identify. The evidence-precedence rule in B.9 (executed state transitions override cautious textual claims) is a concrete anti-gaming measure.
Adjudication pipeline validated by ablation, not just asserted
Table 14 quantifies necessity: final-response-only labeling agrees with final labels on only 71% of trajectories and misses 22% of Unsafe Completions, while deterministic+semantic reaches 96% agreement with 3%/4% miss rates; the complementary error patterns (deterministic best for unsafe states, semantic best for refusal justification) are genuinely informative.
Design choices isolated by ablations
Dedicated metrics for long-horizon failure modes
Unusually complete construction transparency
Weaknesses
No statistical uncertainty anywhere
Headline delayed-failure claim rests on 16 trajectories
Judge and User-Agent model opacity
Human-review volume and agreement unreported
Thin per-domain scenario base
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
BLINDSPOT: Preliminary Review
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 5 strengths & 5 weaknesses, analyzed in detail
- 4 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
What is the BLINDSPOT benchmark?
BLINDSPOT is a benchmark that evaluates the safety of LLM agents over entire long, multi-turn, tool-using interactions rather than single prompts. An adaptive adversarial User Agent interacts with the target model in a stateful tool environment, and each full trajectory is labeled Safe Completion, Correct Refusal, Unsafe Completion, Over-Refusal, or Indeterminate using tool-execution evidence, semantic judges, and human review.
Which models performed best and worst in BLINDSPOT?
Among the 13 evaluated models, GPT-5.6 Sol was safest with a 2% unsafe completion rate and 96.0 safety calibration score, with Claude Opus 4.6 at 4% and GPT-5.6 Luna at 5%; Mistral Large 3 was weakest at 58% unsafe completion with 33% over-refusal, and 60% of its initial refusals later failed under continued adversarial pressure.
How is BLINDSPOT different from AgentDojo or AgentBench?
AgentBench-style suites primarily measure whether agents complete tasks, and AgentDojo focuses on prompt-injection attack success. BLINDSPOT instead scores whole trajectories on a five-way calibration taxonomy with stateful tool execution, response-conditioned adaptive adversaries, and execution-grounded adjudication, distinguishing unsafe compliance from both correct refusal and over-refusal.
Is BLINDSPOT's code and dataset publicly available?
The paper carries a code-and-dataset availability footnote and publishes detailed appendix templates (scenario schemas, attack-family taxonomy, judge prompts, adjudication logic), but the extracted text does not show the actual URL or license, so availability should be verified on the paper's arXiv page.
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- Figures 1–7 are images and could not be analyzed; all cited numbers come from in-text prose and tables.
- Extraction omitted parts of Section 3 (metric definitions) and segments of Appendices B.12 and C, so metric formulas beyond those quoted (SCS composition, Fail@k definition details) were not fully verifiable.
- The code/dataset footnote marker ('§ Code and Dataset') lacks a visible URL in the extracted text; availability is asserted from the footnote only.
- Table 3 extraction is truncated mid-row (Llama-3.3-70B); some values were cross-checked against Section 6.2 prose instead.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.