Agent decision models rely more on action records than real observations
Claim Laundering: When Agent Decision Models Trust Records Over Reality
Artificial Intelligence
Summary
Sometimes, computer agents doing tasks trust their own records of what they did instead of what they actually see happening. This can cause problems if an earlier action was supposed to work but silently failed without the agent noticing. The study shows that agents tend to keep going based on their records even when reality says otherwise. The researchers created a method called EVIGATE that helps agents double-check their decisions at an internal step, improving task success when previous actions fail silently.
What this means in practice
- •For mobile app developers: Improve automated UI testers to detect and recover from silent action failures by using intermediate state checks during testing.
- •For ecommerce automation teams: Enhance shopping assistant agents to avoid faulty decisions by verifying internal action success signals before proceeding with purchases.
Authors
Tina Khezresmaeilzadeh, Seyedarmin Azizi, Erfan Baghaei Potraghloo, Mehdi Kamal, Massoud Pedram
Abstract
Agent decision models select actions in a single forward pass from inputs that combine environmental observations with the agent's own record of previous actions. When an action fails silently, these sources can conflict: the record reports success, but the environment shows that the step did not take effect. We ask which source determines the next decision. Across Android screen traces, ALFWorld, and WebShop, we construct paired states that independently vary the observation, the logged action, and an explicit success claim. In all 12 configurations of four decision models and three domains, records have a larger average effect on commitment decisions than observations; after claimed-but-failed steps, the models still stop, advance, or purchase in 53-100% of cases. Yet the relevant evidence is often represented internally: linear probes on intermediate hidden states distinguish successful from failed steps on held-out apps, tasks, and goals (AUROC 0.77-1.00), and activation patching reveals increasing influence from records in later layers. We use this signal in EVIGATE, an intermediate-layer veto that requires no additional forward pass and adds 0.04-2.0% serving latency. Under injected silent failures, EVIGATE improves task success by 18.7 points in live ALFWorld agents, 5.0 in WebShop, and 5.1 in a phone simulator, and in WebShop and the simulator it also outperforms random vetoes at the same rate. Its effectiveness depends on representative calibration states: gates calibrated on offline counterfactual states do not transfer reliably to live agent trajectories.