CTE-Bench is introduced, which measures whether a model can predict how an intervention changes a stateful service's future behavior, without asking it to choose actions.
Abstract
Coding agents change running software: they patch a service's code or overwrite its stored state, and then act on their own expectation of how the service will respond afterwards. A wrong expectation may surface only several calls later. Function-level code-execution benchmarks omit persistent service state, and agent benchmarks score the actions an agent takes or the final state it reaches. We introduce CTE-Bench, which measures whether a model can predict how an intervention changes a stateful service's future behavior, without asking it to choose actions. Each scenario gives the model Python service code, the calls and responses observed before the intervention, the intervention itself (a source edit or a state overwrite), and 40 fixed future calls; the model predicts every future response, and predictions are checked by executing the service. Three memory protocols control whether the model sees the correct earlier responses, none of them, or its own earlier predictions. CTE-Bench-Core-v1 contains 255 scenarios over six deterministic Python services, giving 10,200 predictions per model. The main score is effect-step value match (VM): exact response equality on the 2,476 future calls whose response the intervention changes. With correct earlier responses revealed, four API-hosted models (DeepSeek V4-Flash, Kimi K2.5, Qwen3.6-35B-A3B, and Claude Sonnet 4.6) reach 54.3%-61.5% effect-step VM. Hiding those responses lowers effect-step VM to 23.2%-28.9%; conditioning on self-generated predictions gives 24.8%-33.2%, and at most 1.2% of scenarios are predicted exactly end to end. Current models thus track intervention effects mainly when correct feedback is supplied, and their errors compound over a rollout. We release CTE-Bench-Core-v1 with its executable oracle, evaluation scripts, and an evaluation card mapping each claim to its protocol.
This work forms attack and defense as partially observed state control in SEAD, deriving their design requirements from this shared execution process and constructs an environment-verifiable dataset integrating controlled initial states, replayable tool environments, and task-specific executable checks.
Xin-Jie Shen, Jun-Ran Wang, Rong-Zhe Wei et al.· 0 citations
This work introduces SINGED (Source Integrity and the Nonidentifiability Gap in Execution Decisions for LLM Agents), a controlled benchmark covering five primary and two held-out task families and exposes a rank-, evidence-, and choice-sensitive outcome-to-execution gap.
XiaoYu Xu, Zi Liang, Min-Xin Du et al.· 0 citations
SkillGuard is presented, a harness-level enforcement layer that treats this event as contamination and restricts future capabilities to disconnect the resulting state from deployer-defined forbidden states and preserves substantially more capabilities than binary restriction at the same attack success rate.
Wu-Jie Xiong, Rabimba Karanjai, Yang Lu et al.· 2 citations
IEC-Bench is built from the changes observed in real-world use, with chains of dependent calls under the execution paths of 4 widely-used harnesses, and intent-execution correspondence (IEC) is defined as the property that the executed action matches the action the emitted call denotes under the tool contract.
Bo-Yang Yang, Zhen-Hao Li, Zi-Yao Yang et al.· 0 citations
Large language models increasingly generate Solidity smart contracts that, once deployed, can never be patched, making a single latent fault permanent and exploitable. Yet current evaluations mostly ask only whether generated code compiles. We introduce SolBehave, a benchmark for evaluating the correctness of model-gen...
G. Delvecchio, Stefano Fantazzini, Giacomo Frisoni et al.· 0 citations
Verifier scores now serve as both benchmark metrics and training rewards for large language model (LLM) agents, and a change in score is routinely read as a change in capability. It may instead reflect a change in the evaluation. We introduce TRACE, a protocol that turns a score change from a verdict into a testable di...
Radhika Gaonkar· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.