Sina Tayebati / Preliminary examination

Reliable and Adaptive Agentic AI

From Uncertainty-Aware Risk Control to Evidence-Gated Self-Healing

Presenter · Sina Tayebati

Chair & advisor · Prof. Amit Ranjan Trivedi

Committee ·
  • Prof. A. Enis Cetin
  • Assoc. Prof. Arman Roohi
  • Dr. Omesh Tickoo
  • Dr. Amanda Rios

ECE · University of Illinois Chicago

01 / 45
Speaker notes · 0:30
  1. I’m Sina Tayebati, a PhD student working with Professor Amit Ranjan Trivedi in Electrical and Computer Engineering at the University of Illinois Chicago. My proposed thesis is Reliable and Adaptive Agentic AI: From Uncertainty-Aware Risk Control to Evidence-Gated Self-Healing.
  2. My research asks how an increasingly autonomous system should operate—and change its behavior—when the evidence available to it is incomplete. I’ll develop that question through four first-author papers.

Contents

  1. 01Motivation
  2. 02Generative sensing
  3. 03Adaptive risk control
  4. 04Trajectory reliability
  5. 05Evidence-gated adaptation
02 / 45
Speaker notes · 0:20
  1. I’ll begin with why autonomy changes reliability, then follow four questions: how to recover missing observations, how to manage decision risk, how to recognize failure across an interaction, and how to validate changes that persist. I’ll close with the contributions and the research questions that remain.

Why autonomy demands stronger evidence.

03 / 45
Speaker notes · 0:10
  1. Autonomy changes what reliability must cover: the answer, the interaction, and the behavior carried into future tasks. I’ll start with that progression.

Autonomy changes the reliability problem

One answer

Predict

InputModelAnswer

Is the answer correct?

Within a task

Act

AgentTools + worldActionObservations + user feedback

Does the whole task succeed?

Across tasks

Adapt

Current taskInstructions / memoryLater tasks

Should this change persist?

Reliability must cover answers, trajectories, and the changes that persist.

04 / 45
Speaker notes · 0:50
  1. With a predictive model, an input produces one answer. The immediate question is whether that answer is correct.
  2. An agent acts, receives feedback, and decides again. Blue circles are agent decisions; gold squares are tool interactions. Together they form a trajectory. Reliability depends on the whole task, even when each step looks plausible.
  3. Adaptation carries experience across tasks through retained instructions or memory. Green marks changed behavior in later tasks; it does not establish improvement. A correction that helps one task can create failures elsewhere. Should that change persist?
  4. The scope expands from answers, to trajectories, to persistent changes. Each must be judged with incomplete evidence—the common starting point for my research.

Incomplete evidence is unavoidable

Visible evidenceStill uncertain

Physical observation

Sensed regions

Unobserved geometry

Model output

Available evidence

Correctness of an answer

Agent interaction

Visible messages and tools

Task state and coordination

Behavioral update

Tested cases

Effects on future behavior

A useful model acts with incomplete evidence. A reliable system must account for what remains unknown.

05 / 45
Speaker notes · 1:00
  1. The first form of incomplete evidence is physical: observing the world has a cost. A LiDAR sensor cannot collect an unlimited number of measurements for free. Learned structure can help infer the geometry that was not directly sensed.
  2. At the level of model output, available evidence can support a plausible answer without establishing that it is correct. The next question is how strongly the model should commit to that answer.
  3. Across an agent interaction, messages and tool returns reveal only part of the task state. A locally plausible action can still miss a coordination problem or move the overall trajectory toward failure.
  4. A behavioral update has been tested on only a limited set of cases, while its effects extend to future executions. These are distinct statistical problems, connected by the need to act before all uncertainty disappears. My research asks how the strength and scope of evidence should constrain each commitment.

Evidence should govern commitment

  1. Evidence

    What has been observed?

    eAvailable observations

  2. Uncertainty

    What could still be wrong?

    Plausible outcomes Y

  3. Commitment

    What action is justified?

    a₁a*a₃Select the lowest expected loss

  4. Consequence

    What happens if it fails?

    L(a, Y)Cost of an outcome
a∗(e)=arg⁡min⁡a  E[L(a,Y)∣e]\textcolor{#419777}{a^*}(\textcolor{#4288c6}{e})=\arg\min_{\textcolor{#419777}{a}}\;\mathbb{E}[\textcolor{#e13841}{L}(\textcolor{#419777}{a},Y)\mid\textcolor{#4288c6}{e}]

Given the evidence, choose the action with the lowest expected loss.

Observation
Infer missing structure
Decision
Choose a response
Trajectory
Monitor an interaction
Adaptation
Admit a correction
06 / 45
Speaker notes · 1:15
  1. Available observations give us evidence e, shown in blue. That evidence leaves uncertainty over possible outcomes Y. The system has several candidate actions a, and each action can incur a loss L depending on what actually happens. Reliability depends on connecting these four ideas.
  2. The expectation averages loss across the outcomes still plausible given the evidence. The decision rule selects the action with the lowest expected loss, highlighted in green. That action might be returning alternatives, requesting help, stopping an interaction, or retaining a correction. The red loss term expresses the consequence of the choice.
  3. This is the organizing lens for the thesis. The small diagrams are schematic, not measured distributions or losses. Each paper uses its own objective and evaluation; I am not claiming a common optimization problem or a shared guarantee across all four.
  4. The commitment becomes broader over the research progression: infer missing structure, choose a response, assess an interaction, and decide whether a correction should change later executions. Each expansion requires evidence at the corresponding scale.

The object of reliability expands

As autonomy expands, the object of reliability assessment expands with it.

01

Observation

What can we infer from what we did not sense?

R-MAE / ICASSP 2025

02

Decision

How strongly should a model commit?

CAP / ACML 2025

03

Trajectory

When is an interaction going wrong?

TRACER / ICML 2026

04

Adaptation

Which changes deserve to persist?

HARNESS / AAAI · under review

07 / 45
Speaker notes · 0:55
  1. The first contribution is Generative Sensing: radial masking and occupancy reconstruction make sparse physical observations useful for downstream perception. This establishes the theme of operating with incomplete information.
  2. CAP moves to foundation-model decisions. It learns how uncertainty should influence the choice between one answer, a prediction set, and abstention. TRACER then considers the complete interaction, where short behavioral failures can matter more than confidence in individual generations.
  3. The Self-Healing Harness addresses the final question: which corrections deserve to persist? The agent proposes a change, and an external runtime evaluates whether the evidence supports retaining it.
  4. These are connected research questions with distinct implementations. The perception study motivates the progression; the later three contributions develop decision, trajectory, and adaptation controls in more depth.

Recover useful structure from partial observations.

08 / 45
Speaker notes · 0:10
  1. My starting point is physical perception: can learned generative structure recover useful information when observing the world has an energy cost?

Physical observation has a budget

Physical cost

LiDAR acquisition

LiDAR

Every emitted pulse has a physical cost.

Prior work

Masked pretraining

LearnPartial inputReconstruction

MAE · Point-MAE

Occupancy-MAE · MAELi

Research direction

Generative sensing

LiDAR
SensedInferred
Sensing power
Ptotal=Plaser+Pscan+Psignal+PcontrolP_{\mathrm{total}}=P_{\mathrm{laser}}+P_{\mathrm{scan}}+P_{\mathrm{signal}}+P_{\mathrm{control}}

Generative sensing: acquire fewer measurements, then reconstruct useful scene structure.

09 / 45
Speaker notes · 0:50
  1. LiDAR emits light and measures the return. Each blue beam represents a physical measurement. Acquisition consumes energy through laser emission, scanning, signal processing, and control. Reducing observations can therefore reduce the sensing cost.
  2. Masked autoencoding provides the learning foundation. MAE and Point-MAE reconstruct missing input; Occupancy-MAE and MAELi extend this direction to LiDAR representation learning. The middle diagram illustrates that training objective.
  3. My contribution connects learned reconstruction to physical acquisition. The right diagram uses fewer blue measurements and infers the missing structure in gold. These scenes are schematic. R-MAE makes this idea sensor-aware through radial and range-aware masking; its detection performance and reconstruction energy must then be evaluated.

R-MAE learns from radial observations

Angular masking

Select radial scan regions

Range-aware sampling

Reduce distant observations

Occupancy prediction

Reconstruct unsensed structure

Original R-MAE Figure 1: angular masking and range-aware sampling, sparse 3D encoding, occupancy reconstruction and downstream object detection.

Self-supervision uses occupied and empty voxels.

Loccup=BCE⁡(o^,o)\mathcal L_{\mathrm{occup}}=\operatorname{BCE}(\hat o,o)
10 / 45
Speaker notes · 1:30
  1. The mask follows the geometry of acquisition. I group voxels by azimuth and select angular regions to observe, matching the radial pattern of a LiDAR scan. Range-aware masking then reduces observations within those regions according to distance.
  2. The observed non-empty voxels enter a sparse 3D convolutional encoder. An occupancy decoder predicts whether query voxels are occupied or empty, using binary cross-entropy for reconstruction. This teaches the representation about structure that is absent from the partial observation.
  3. The pretrained encoder then supports downstream 3D detection. The method operates at very high radial masking ratios, including more than 90%, and the next slides examine detection and energy separately.
  4. The evidence is about useful reconstruction and downstream performance. It does not certify the correctness of each inferred region. That distinction—between generating missing information and knowing how much to trust it—becomes central in the later work.

Learned structure improves detection

Detector baselineWith R-MAE pretraining
mAP (%) · higher is better505560657075CenterPointWaymo · Level 264.5167.20+2.69pointsPV-RCNNWaymo · Level 264.8468.95+4.11pointsCenterPointnuScenes56.0359.20+3.17points

The learned representation improves downstream detection across these settings.

Reported validation results. Waymo uses Level 2 mAP; nuScenes uses its benchmark mAP definition.

11 / 45
Speaker notes · 1:15
  1. Each pair compares the same detector and benchmark with and without R-MAE pretraining. The gray point is the baseline; the gold point uses the learned representation.
  2. On Waymo, CenterPoint Level 2 mAP increases from 64.51 to 67.20, and PV-RCNN increases from 64.84 to 68.95. On nuScenes, CenterPoint mAP increases from 56.03 to 59.20.
  3. These are gains of 2.69, 4.11, and 3.17 percentage points in their respective metrics. The comparisons are within rows because Waymo and nuScenes use different evaluation definitions.
  4. The sparse reconstruction task produces a useful detection representation. Additional heading-aware and KITTI transfer results are in the appendix. These detector comparisons and the masking-ratio study are separate experiments; they do not establish one joint operating point with every reported benefit.

Sensing savings exceed reconstruction cost

Physical sensingReconstruction
Conventional sensing72 mJR-MAE sensing + reconstruction0.792 + 7.1 = 7.892 mJ
≈9.1×lower estimated total energy

A small amount of observation
can support useful inference.

The next question is how strongly to trust a generated output.

Paper estimate per 360° scan, including Jetson Nano reconstruction overhead. Table V reports >90% masking.

12 / 45
Speaker notes · 1:15
  1. Reconstruction has a computational cost, so sensing savings alone are insufficient. The relevant comparison includes the energy needed to generate the missing structure.
  2. The conventional estimate is 72 mJ per full scan. R-MAE uses 0.792 mJ for sensing and approximately 7.1 mJ for reconstruction. The displayed components total 7.892 mJ, giving the reported reduction of approximately 9.1×.
  3. These are engineering estimates under the paper’s assumptions, including reconstruction on a Jetson Nano. They support the systems argument that avoided sensing can outweigh the additional reconstruction cost.
  4. This establishes my starting point: generative structure can make incomplete observation useful. The next question is how strongly a system should commit to what it generates. I study that question in foundation models through CAP, using uncertainty to govern the response decision.

Let uncertainty guide the decision.

13 / 45
Speaker notes · 0:10
  1. Generating a plausible answer leaves a decision about how much to trust it. CAP uses uncertainty to choose among answering, preserving alternatives, and abstaining.

A plausible completion still needs a decision

Recovered information becomes useful only when a system decides how much to commit.

INCOMPLETE EVIDENCEGenerativemodelPlausible outputsABCDecisionpolicyACommitA single answer when the decision is clear{A, B}Preserve alternativesA set when ambiguity mattersAbstainDefer when the cost of error is too high

Next reliability question: what action should uncertainty permit?

14 / 45
Speaker notes · 0:35
  1. A plausible completion still leaves an operational decision. A language or vision-language model can return one answer, preserve several alternatives, or abstain. Each option has a different cost.
  2. A wrong answer can be expensive, a large set can be unhelpful, and refusing every question provides little utility. CAP learns how uncertainty should govern that choice for each input.
  3. The statistical starting point is conformal prediction, which converts model scores into prediction sets using held-out calibration data.

Calibration turns uncertainty into a prediction set

A held-out calibration set defines which candidate labels remain plausible.

1 · Calibrate a nonconformity threshold
q̂αMore conformingLess conforming
q^α=Q⌈(n+1)(1−α)⌉/n({si}i=1n)\hat q_\alpha=Q_{\lceil(n+1)(1-\alpha)\rceil/n}\big(\{s_i\}_{i=1}^n\big)

Illustration of the calibration mechanism; dots are schematic.

2 · Include labels within that threshold
Γα(x)={y:s(x,y)≤q^α}\Gamma_\alpha(x)=\{y:s(x,y)\leq\hat q_\alpha\}
ABC

Smaller risk budget → generally larger prediction sets

Pr⁡{Y∈Γα(X)}≥1−α\Pr\{Y\in\Gamma_\alpha(X)\}\geq 1-\alpha

Marginal coverage · fixed α · exchangeable calibration and test examples

15 / 45
Speaker notes · 1:30
  1. Conformal prediction begins with a nonconformity score: how incompatible is a candidate label with the input? On a held-out calibration set, I compute the score of each known true label.
  2. A risk level α selects a finite-sample corrected quantile of those scores. For a new input, the prediction set contains the candidate labels whose scores fall below that threshold. Lowering the risk budget generally makes the set more inclusive. The scores in this illustration are schematic.
  3. With exchangeable calibration and test examples, a fixed α, and an appropriately fixed score function, split conformal prediction provides marginal coverage of at least 1 − α. The probability averages over calibration and test draws; it does not certify every individual input.
  4. Methods such as LAC and APS use this foundation to construct informative sets. CAP adds a decision layer: how should the risk choice and response action depend on the utility of this particular input?

The risk budget should reflect the decision

Confidence signals→Conformal sets→Operational decisions
Prior foundation

One global risk budget

α=constant\alpha=\text{constant}
Input 1→Adaptive set
Input 2→Adaptive set

LAC / APS adapt the set, while the nominal risk level stays fixed.

CAP research question

Learn the cost of commitment

x⟼πθ(α,β∣x)x\longmapsto\pi_\theta(\alpha,\beta\mid x)
Input 1→Answer
Input 2→Set or abstain

Optimize instance-dependent decisions for downstream utility.

The new control variable is the risk and abstention policy.

16 / 45
Speaker notes · 1:00
  1. Conformal prediction sets already adapt to the input: an easy example may yield one candidate, while a difficult one yields several. CAP addresses the policy that determines the risk budget and the operational response.
  2. The relevant background provides three pieces. Confidence and semantic uncertainty characterize model evidence. Conformal prediction calibrates prediction sets. Selective classification introduces rejection when making a prediction is too costly.
  3. CAP connects these pieces through a learned, instance-dependent policy. It chooses risk and abstention parameters so that answering, returning alternatives, and deferring reflect the decision costs.
  4. The examples on the slide illustrate that policy choice. Learning it offers greater flexibility, and also creates a statistical question: what coverage claim remains justified after the risk level itself becomes adaptive?

CAP learns when to answer, offer alternatives, or abstain

CAP learns how strongly to commit for each input.

Input

Model evidence

Base model stays fixed

x

Learned policy

Select risk

Lightweight MLP

πθαβ
(α,β)∼πθ(⋅∣x)(\alpha,\beta)\sim\pi_\theta(\cdot\mid x)

Conformal mechanism

Set thresholds

Held-out calibration scores

PredictionAbstention
q^predict(α)\hat q_{\mathrm{predict}}(\alpha)
q^abstain(β)\hat q_{\mathrm{abstain}}(\beta)

Decision

Choose a response

Three possible actions

One answerPrediction setAbstain

The learned controls are the risk parameters; calibration turns them into decision thresholds.

Control structure shown. Exact policy features and action mapping are not fully specified in the paper.

17 / 45
Speaker notes · 1:30
  1. The foundation model supplies the evidence for a decision. I denote the context available to the policy by x. CAP keeps the base model fixed and learns a separate control policy around it. The manuscript does not fully specify the exact feature construction, so this diagram represents the control structure.
  2. A lightweight multilayer perceptron implements the policy πθ. For each input, it samples the risk parameters α and β. These are the adaptive controls: the policy can change how strongly the system commits as the input and its uncertainty change.
  3. The conformal mechanism converts those parameters into prediction and abstention thresholds using held-out calibration scores. The two score strips are schematic; their cutoff positions do not encode numerical operating points. This step makes the role of calibration explicit. The validity conditions for a learned policy are a separate question that I address after the training objective.
  4. The configured mechanism can return one answer, preserve a prediction set, or abstain. These branches are alternative actions, not three consecutive operations. Because calibration quantiles and discrete decisions are not differentiable, CAP learns the policy from the utility of sampled actions. That leads to the next slide: what should that utility reward?

The policy optimizes the cost of commitment

The preferred response depends on the costs of being wrong, being vague, and declining.

+

Penalties

Error

Penalize incorrect decisions

Set size

Penalize uninformative alternatives

Abstention

Account for the cost of deferral

−

Credits

Coverage

Reward retained correct outcomes

Exploration

Entropy encourages policy diversity

C=(1−acc)+λ1avgSet+λ2abstention−λ3coverage−λ4divC=(1-\mathrm{acc})+\lambda_1\mathrm{avgSet}+\lambda_2\mathrm{abstention}\textcolor{#4288c6}{-\lambda_3\mathrm{coverage}-\lambda_4\mathrm{div}}
Risk policySample α, βEvaluate rewardR = −CUpdate withREINFORCEUpdate θ
∇θJ≈(R−b)∇θlog⁡πθ(α,β∣x)\nabla_\theta J\approx(R-b)\nabla_\theta\log\pi_\theta(\alpha,\beta\mid x)

b: moving-average reward baseline

Quantiles and discrete actions can be optimized through sampled utility.

18 / 45
Speaker notes · 1:15
  1. The objective assigns a cost to each form of commitment. Decision error is penalized; a set-size penalty discourages unhelpfully large sets; and an abstention penalty captures the cost of declining to answer. Coverage contributes a reward, while policy entropy encourages exploration.
  2. These weights express application preferences. They determine how the policy trades answer quality, informativeness, and deferral. The reward is the negative of the resulting cost.
  3. CAP uses REINFORCE. The policy samples an action, observes its reward, and adjusts the log probability of that action relative to a moving-average baseline. The reported implementation trains the lightweight MLP for 200 epochs.
  4. The reward can encourage coverage, but a coverage bonus is not a hard statistical constraint. I therefore evaluate the learned policy’s usefulness separately from the coverage statements its assumptions support.

Adaptive decisions need a precise coverage claim

Fixed-risk CP

Exchangeability supports a marginal guarantee for a fixed risk level.

Pr⁡{Y∈Γα(X)}≥1−α\Pr\{Y\in\Gamma_\alpha(X)\}\geq1-\alpha

Adaptive policy

Choosing α from the input changes the guarantee question.

Fixed-risk marginal validity alone does not establish input-conditional coverage.

Held-out evidence

A fixed policy can be evaluated with a finite-sample coverage bound.

∣Cov^m−Covπ∣≤log⁡(2/δ)2mwith probability ≥1−δ|\widehat{\mathrm{Cov}}_m-\mathrm{Cov}_{\pi}|\leq\sqrt{\frac{\log(2/\delta)}{2m}}\quad\text{with probability }\geq1-\delta

Fresh i.i.d. test data · frozen policy and calibration mechanism

Policy-calibrated coverage bounds estimation error. A 90% target remains an empirical claim to assess on held-out data.

19 / 45
Speaker notes · 1:00
  1. I separate three claims. Standard split conformal prediction provides marginal coverage for a fixed risk level under exchangeability. That is the calibration foundation.
  2. An input-dependent α requires additional analysis. The fixed-risk theorem alone does not establish input-conditional coverage for arbitrary adaptive choices, so that stronger interpretation is outside the guarantee I rely on here.
  3. After fixing the policy and calibration mechanism, fresh independent test examples let us estimate its population coverage. Proposition 2 applies Hoeffding’s inequality to bound the gap between empirical coverage and that fixed mechanism’s true coverage.
  4. That concentration bound controls estimation error; it does not establish that the true coverage exceeds 90%. The experiments report coverage above the target using an abstention-aware metric. I treat those values as empirical evidence under that definition.

Better uncertainty ranking supports selective answers

CAP improves model-average uncertainty ranking.

BenchCAP

AUROC ↑

Rank correct versus incorrect predictions

0.40.50.60.70.80.91.0LLaVA-34B0.730.80LLaVA-13B0.600.69LLaVA-7B0.600.65Yi-34B0.700.80Qwen-14B0.610.70Qwen-7B0.450.60

AUARC ↑

Retain accurate answers as rejection increases

0.40.50.60.70.80.91.0LLaVA-34B0.920.97LLaVA-13B0.910.96LLaVA-7B0.890.95Yi-34B0.860.97Qwen-14B0.840.92Qwen-7B0.710.89

Table 1 · reported five-task averages per model · Bench = the paper’s VLM-/LLM-Bench baseline · MCQA evaluation

Qwen-7B: 0.45 → 0.60 AUROC and 0.71 → 0.89 AUARC.

20 / 45
Speaker notes · 1:45
  1. The multiple-choice evaluation includes ten benchmarks: five vision-language tasks and five language-only tasks. Each plotted pair is the reported five-task average for one model, comparing the Bench baseline with CAP.
  2. AUROC measures how well the uncertainty signal separates correct and incorrect predictions. AUARC summarizes the accuracy retained as increasingly uncertain examples are rejected. The first measures ranking; the second connects ranking to selective answering.
  3. CAP improves both reported averages for all six models shown. For Qwen-7B, AUROC rises from 0.45 to 0.60 and AUARC from 0.71 to 0.89. Those absolute differences are 0.15 and 0.18.
  4. The unit of this comparison is the model average. Individual datasets include counterexamples, so the result does not imply improvement on every task. The conclusion is that the learned policy produces more useful uncertainty ranking and selective responses across these reported averages.
  5. The same decision principle can also be applied inside a free-form answer, where the question becomes which claims to retain.

Adaptive filtering preserves more factual content

More content retained at a 90% factuality target.

Conformal FactualityCAPYi-34B · claim retention (%)
0%20%40%60%80%100%FActScore35.548.2+12.7 ppNatural Questions74.883.1+8.3 ppMATH89.594.3+4.8 pp

Table 5 · percentage points (pp) indicate absolute retention gains · target factuality is distinct from retention rate

The next unit of reliability is larger: an agent’s entire trajectory.
21 / 45
Speaker notes · 1:15
  1. For free-form generation, CAP decomposes an answer into atomic claims and uses the learned risk policy to control a retention threshold. The decision is how much useful information can remain while meeting the evaluation’s factuality requirement.
  2. The comparison uses Yi-34B and Conformal Factuality at a stated 90% factuality target. The vertical quantity is content retention. On FActScore, retention rises from 35.5% to 48.2%, a gain of 12.7 percentage points. Natural Questions gains 8.3 points, and MATH gains 4.8 points.
  3. This extends adaptive decision control from selecting an answer to filtering the claims within an answer. The retention gains are distinct from a measured increase in factuality itself.
  4. The unit remains one response. An agent may generate individually plausible responses and still fail through repeated actions, ignored observations, or poor coordination. The next contribution evaluates the whole trajectory.

Recognize failure across an agent’s trajectory.

22 / 45
Speaker notes · 0:10
  1. The next unit is the whole interaction. TRACER looks for behavioral evidence of failure even when an agent’s individual responses remain confident.

Confident steps can still produce a failed task

A sequence of plausible outputs can lose contact with the task.

Agent–tool interactionObserveRead the requestLocally plausibleActCall the toolLocally plausibleRepeatCall it againStill locally fluentInterpretIgnore the errorStill locally fluentRespondReport successStill locally fluentThe failure lives in the relationships between steps.
From output risk to trajectory riskTrack behavior, tool feedback, and user coordination over time.
23 / 45
Speaker notes · 0:50
  1. Confidence in the next response does not tell us whether the task is progressing. An agent can produce fluent messages while repeating an unproductive tool call or overlooking an error returned by the environment.
  2. In this illustrative sequence, the failure becomes visible through the relationship between the action and the observation. The content may remain locally confident even as the interaction stops making sense.
  3. A short critical episode can determine the outcome, while averaging uncertainty over many ordinary steps dilutes its contribution. TRACER therefore evaluates behavior and coherence across the trajectory, with particular attention to its highest-risk episodes.

Uncertainty must account for interaction structure

The object of uncertainty expands from a generated answer to an evolving interaction.

Token confidence

How likely is this generation?Malinin & Gales, 2021 · Jiang et al., 2020

Fluent repetition can remain locally confident.

Semantic uncertainty

Do plausible answers disagree?Kuhn et al., 2023 · Farquhar et al., 2024

Agreement alone does not establish correct tool use.

Agent uncertainty
propagation

How does uncertainty evolve?SAUP: Zhao et al., 2025 · UProp: Duan et al., 2025

Which sparse episodes should dominate the final risk?

TRACERBehavioral evidence + coherence gaps + emphasis on critical episodes.
24 / 45
Speaker notes · 1:00
  1. Token and sequence uncertainty measure how probable generated text is. Semantic uncertainty instead measures disagreement in meaning, avoiding the problem of treating paraphrases as different answers.
  2. Those signals are useful, but fluent or semantically consistent text can still accompany an incorrect action. Agent-focused methods such as SAUP and UProp bring uncertainty propagation across steps into the analysis.
  3. TRACER builds on that trajectory perspective. Its emphasis is the sparse critical episode: a loop, an action–observation mismatch, or a coordination failure that changes the task outcome. It combines content uncertainty with behavioral signals and an aggregation that preserves high-risk episodes.
  4. The direct experimental comparisons are normalized entropy, self-reported confidence, semantic entropy, and SAUP. The contribution is the combination of signals and aggregation, rather than temporal reasoning being absent from all prior work.

Observe uncertainty, repetition, and coherence

Measure uncertainty in the generation and in its relationship to the world.

U

Content uncertainty

Surprisal over selected content-bearing tokens

Ut=1∣It∣∑j∈It−log⁡pt(wt,j)U_t=\frac{1}{|I_t|}\sum_{j\in I_t}-\log p_t(w_{t,j})
Dₐ

Repetition

Semantic similarity × lexical overlap in a local window

Da(t)=max⁡t′∈W(t)sim⁡sem(ut,ut′)sim⁡lex(ut,ut′)D_a(t)=\max_{t'\in W(t)}\operatorname{sim}_{sem}(u_t,u_{t'})\operatorname{sim}_{lex}(u_t,u_{t'})
Dᴬₒ

Action–observation gap

Does the tool response align with the action?

DoA(t)=1−cos⁡ ⁣(ϕ(xt),ϕ(ot))D_o^A(t)=1-\cos\!\left(\phi(x_t),\phi(o_t)\right)
Dᵁₒ

User coordination gap

Does the user response align with the preceding agent turn?

DoU(t)=1−cos⁡ ⁣(ϕ(xt−1),ϕ(xt))D_o^U(t)=1-\cos\!\left(\phi(x_{t-1}),\phi(x_t)\right)

Content filter: exclude stop words, numeric tokens, and highly predictable tokens. φ embeds the textual event or observation.

25 / 45
Speaker notes · 1:30
  1. TRACER measures four complementary signals. Content uncertainty averages negative log probability over selected content-bearing tokens. The filter removes stop words, numeric tokens, and highly probable tokens so that predictable structure does not dominate. Normalization uses the number of retained tokens; this is an uncertainty score, not a probability constrained to the interval from zero to one.
  2. Repetition compares the current agent turn with a local window of earlier turns. For each comparison, semantic similarity is multiplied by lexical overlap, and the strongest match is retained. This helps distinguish a repeated action from related actions involving different entities.
  3. The action–observation gap compares an action with the tool response it produces. Cosine distance between their text embeddings supplies a proxy for mismatch: does the observation remain aligned with what the agent attempted?
  4. The user coordination gap compares an agent turn with the subsequent user response. Actor masks apply the signals where they are meaningful. When token probabilities are unavailable, these behavioral channels can still be used. The distances provide evidence of possible incoherence, rather than definitive semantic judgments.

Let critical episodes determine trajectory risk

A brief failure signal should remain visible inside a long interaction.

Schematic step risks · synthetic values

Higher riskWhole-trajectory meanMean of the top 3 stepsMaximum step riskTrajectory steps →

Tail mean captures critical episodes; maximum preserves the strongest alarm.

1. Keep the strongest signal

rt=max⁡ ⁣{Ut,αDa,βDoA,γDoU}r_t=\max\!\left\{U_t,\alpha D_a,\beta D_o^A,\gamma D_o^U\right\}

Actor masks select the applicable signals.

2. Select the high-risk tail

TMk=1K∑i=1Kr(i)\mathrm{TM}_k=\frac1K\sum_{i=1}^{K}r_{(i)}

K = max(1, ⌊kN⌋); risks sorted descending.

3. Combine tail and maximum

TRACER=(1−w)TMk+wmax⁡trt\mathrm{TRACER}=(1-w)\mathrm{TM}_k+w\max_t r_t
26 / 45
Speaker notes · 1:30
  1. There are two aggregation scales. Within a step, TRACER takes the maximum of the weighted content, repetition, and coherence signals. One strong warning can therefore raise the step risk even if the other channels look normal. The weights are tuned using labeled trajectories.
  2. Across the trajectory, the step risks are sorted from largest to smallest. A tail fraction determines K, and the top K values are averaged. The bars are a synthetic illustration of this operation.
  3. An average over every step gives many uneventful steps substantial influence. The tail mean instead concentrates the assessment on the episodes most likely to matter. It retains several warnings without requiring the entire interaction to look uncertain.
  4. The final score combines this tail mean with the single maximum using weight w. The tail captures a cluster of concerning episodes; the maximum preserves the strongest alarm. The result is a trajectory score whose stability and failure-ranking value can be evaluated separately.

A stable risk score, with conditional failure control

Stable to local perturbations

If every step changes by at most ε, the trajectory score changes by at most ε.

∣ρ(r)−ρ(s)∣≤∥r−s∥∞\big|\rho(r)-\rho(s)\big|\leq\lVert r-s\rVert_\infty

Monotone · positively homogeneous · subadditive

Failure-risk control is conditional.

Risk dominates hazardCritical risk is tail-sparse
P(B)≤cK E[TMk(r)]+cηP(B)\leq cK\,\mathbb{E}[\mathrm{TM}_k(r)]+c\eta
TRACER is a trajectory risk score.

The theorem does not turn an individual score into a calibrated probability of failure.

ρ acts on nonnegative step risks. B: breakdown event; c: hazard-dominance constant; η: risk outside the selected tail.

27 / 45
Speaker notes · 1:00
  1. The aggregation has a useful stability property. If every step risk changes by at most ε, the trajectory score changes by at most ε. Both the maximum and the ordered tail mean are Lipschitz under the infinity norm.
  2. On the nonnegative risk vectors used here, the construction also preserves monotonicity and subadditivity. These properties describe how the score behaves when its inputs change.
  3. A failure-probability bound requires stronger assumptions: the measured risk must dominate the conditional hazard up to a constant, and the risk outside the selected tail must be bounded. A union bound then yields the displayed inequality.
  4. The constants c and η are assumptions, not experimentally calibrated probabilities. I therefore interpret TRACER as a structured risk score and evaluate its usefulness through failure ranking, selective accuracy, and warning timing.

Failures become more separable across domains

τ²-bench · 3 models × airline, retail, telecom · highest score in all 9 settings

AUROC · failure ranking ↑

0.00.250.50.751.0Baseline → TRACERGemini 2.5ProAirline0.603 → 0.735gemini-2.5-pro, Airline: SemEnt 0.603; TRACER 0.735. Table 2, PDF p. 7.Retail0.556 → 0.673gemini-2.5-pro, Retail: SemEnt 0.556; TRACER 0.673. Table 2, PDF p. 7.Telecom0.651 → 0.691gemini-2.5-pro, Telecom: SemEnt 0.651; TRACER 0.691. Table 2, PDF p. 7.Gemini 2.5FlashAirline0.666 → 0.725gemini-2.5-flash, Airline: SemEnt 0.666; TRACER 0.725. Table 2, PDF p. 7.Retail0.533 → 0.707gemini-2.5-flash, Retail: SemEnt 0.533; TRACER 0.707. Table 2, PDF p. 7.Telecom0.673 → 0.809gemini-2.5-flash, Telecom: SAUP 0.673; TRACER 0.809. Table 2, PDF p. 7.GPT-4.1MiniAirline0.541 → 0.742gpt-4.1-mini, Airline: SemEnt 0.541; TRACER 0.742. Table 2, PDF p. 7.Retail0.620 → 0.689gpt-4.1-mini, Retail: SemEnt 0.620; TRACER 0.689. Table 2, PDF p. 7.Telecom0.686 → 0.765gpt-4.1-mini, Telecom: SemEnt 0.686; TRACER 0.765. Table 2, PDF p. 7.

AUARC · selective accuracy ↑

0.00.250.50.751.0Baseline → TRACERGemini 2.5ProAirline0.517 → 0.629gemini-2.5-pro, Airline: SAUP 0.517; TRACER 0.629. Table 2, PDF p. 7.Retail0.684 → 0.725gemini-2.5-pro, Retail: SAUP 0.684; TRACER 0.725. Table 2, PDF p. 7.Telecom0.395 → 0.517gemini-2.5-pro, Telecom: SemEnt 0.395; TRACER 0.517. Table 2, PDF p. 7.Gemini 2.5FlashAirline0.648 → 0.697gemini-2.5-flash, Airline: SemEnt 0.648; TRACER 0.697. Table 2, PDF p. 7.Retail0.547 → 0.670gemini-2.5-flash, Retail: SemEnt 0.547; TRACER 0.670. Table 2, PDF p. 7.Telecom0.446 → 0.520gemini-2.5-flash, Telecom: SAUP 0.446; TRACER 0.520. Table 2, PDF p. 7.GPT-4.1MiniAirline0.427 → 0.615gpt-4.1-mini, Airline: SemEnt 0.427; TRACER 0.615. Table 2, PDF p. 7.Retail0.584 → 0.632gpt-4.1-mini, Retail: SAUP 0.584; TRACER 0.632. Table 2, PDF p. 7.Telecom0.394 → 0.613gpt-4.1-mini, Telecom: SemEnt 0.394; TRACER 0.613. Table 2, PDF p. 7.
Strongest baseline per row and metricTRACER

Baselines: normalized entropy, self-reported confidence, semantic entropy, SAUP. Table 2 values; no confidence intervals reported.

28 / 45
Speaker notes · 1:30
  1. The results shown here use τ²-bench in airline, retail, and telecom with Gemini 2.5 Pro, Gemini 2.5 Flash, and GPT-4.1 Mini. The reported task counts are 50, 115, and 114 respectively. Runs use temperature zero with log probabilities enabled.
  2. Each gray point is the strongest of the four baselines for that particular row and metric. AUROC asks whether failed trajectories receive higher risk scores than successful ones. TRACER leads in all nine model–domain settings.
  3. For GPT-4.1 Mini on airline, AUROC increases from semantic entropy’s 0.541 to 0.742, an absolute difference of 0.201. This is a substantial improvement in separating the two outcome classes.
  4. AUARC evaluates accuracy as increasingly risky trajectories are rejected. TRACER also leads in all nine settings on this metric; for Mini on telecom, the comparison is 0.394 versus 0.613.
  5. These results establish better ranking and selective accuracy under the reported protocol. They do not measure an improvement in the underlying agent’s task success, and confidence intervals are not reported for these comparisons.

Warnings arrive early in failed trajectories

Gemini 2.5 Pro · failures detected by the first 20% of trajectory progress

Failed tasks detected (%)025507510056.068.0Airline+12.0 pp66.297.3Retail+31.1 pp82.197.4Telecom+15.3 pp
Semantic EntropyTRACER

Retail · absolute gain

+31.1 pp

Earlier warnings leave more of the interaction available for corrective action.

This experiment measures detection timing; it does not evaluate successful intervention.

Failed tasks only · paper operating thresholds; a common false-positive rate is not reported. Progress uses final trajectory length.
29 / 45
Speaker notes · 1:15
  1. Runtime use depends on when a warning arrives. The evaluation finds the first risk-threshold crossing in each failed trajectory and normalizes it by the trajectory’s eventual length.
  2. For Gemini 2.5 Pro, by 20% of the trajectory, TRACER detects 68.0% of airline failures, 97.3% of retail failures, and 97.4% of telecom failures. Semantic entropy detects 56.0%, 66.2%, and 82.1%, respectively.
  3. The retail improvement is 31.1 percentage points. These are the numerical rates reported in the early-warning discussion, so the comparison does not depend on estimating coordinates from a plot.
  4. The rates are conditional on failed tasks and on the selected thresholds. A common false-positive rate is not specified, which limits operating-point comparisons. Earlier warning provides an opportunity for intervention; whether an intervention actually improves the outcome requires a separate experiment.

Both sides of the interaction carry evidence

Gemini 2.5 Flash · Telecom · AUROC ↑

Agent and user signals complement each other

0.00.51.00.672Agent only0.602User only0.809Combined

Table 5 actor ablations; combined score from Table 2.

MAX preserves the strongest local evidence

0.00.51.00.795Additive0.785Multiply0.764Separate0.809MAX

Table 6 · all variants tuned on validation episodes.

Detection creates an opportunity to adapt. What evidence should a correction need before it persists?
30 / 45
Speaker notes · 1:15
  1. The actor ablation holds the model and domain fixed: Gemini 2.5 Flash on telecom. Agent-only TRACER reaches AUROC 0.672, user-only reaches 0.602, and their combination reaches 0.809.
  2. Each participant contributes evidence about the interaction. An agent may remain locally consistent while the user’s response exposes unresolved coordination. Across the reported settings, the full score exceeds the corresponding actor-only variants.
  3. For the same Flash–telecom setting, additive, multiplicative, separate-channel, and MAX aggregation reach 0.795, 0.785, 0.764, and 0.809. The variants are tuned on held-out validation episodes. MAX leads across all nine reported settings, supporting this choice within the tested distributions.
  4. The next question follows from detection: once an agent proposes a correction, what evidence should permit it to persist? Improving the triggering failure is only one part of that decision, because the change may affect other tasks.

Require evidence before behavioral changes persist.

31 / 45
Speaker notes · 0:10
  1. A correction can improve one failure and disrupt other tasks. The final contribution asks what evidence should be required before that correction persists.

Learning from failure changes the next execution

Execution failsAgent writes a lessonFuture behavior changesFailure observedExperienceLESSON

Reflection

Can the agent repair this answer?

Persistent memory

What knowledge should it reuse?

Empirical selection

Which modifications improve performance?

My question: which self-authored changes should receive persistent authority?

Runtime triggering + protected-case non-regression + oversight of the accumulated rules.

32 / 45
Speaker notes · 0:50
  1. A detected failure can become a lesson for later executions. Self-Refine, Reflexion, and CRITIC develop feedback-driven revision; Voyager, ExpeL, AutoManual, Agent Workflow Memory, and A-MEM carry experience across episodes.
  2. STOP and the Darwin Gödel Machine also evaluate self-modifications empirically. My contribution combines runtime degradation detection, checks against previously successful behavior, and re-testing of the accumulated rules.
  3. The Harness gives the agent freedom to propose a correction while reserving the decision to retain it for an external runtime. This extends the research question beyond TRACER; the Harness uses its own detector rather than embedding the TRACER algorithm.

A useful repair can also create a regression

Success on the motivating failure is insufficient evidence for persistent adoption.

CANDIDATE REPAIR · EXAMPLE“Verify the target pathbefore a destructive action.”TRIGGERING CASETriggering failure improvesPROTECTED CASEPreviously successful behavior regresses
55%

211 / 383 rejections

Among replay-decided retirements

211172Improves target;regresses protected behaviorNo target improvement

A target-only retention rule would have admitted all 211 under the observed replay evidence.

Detected conflicts under sparse protection: ≤2 protected cases per validation round. This is not the incidence among all proposals.

33 / 45
Speaker notes · 1:00
  1. A correction can solve the motivating failure and still be harmful elsewhere. The file-path example illustrates how a reasonable verification instruction can disrupt another workflow; it is a conceptual example rather than an experimental trace.
  2. Replay validation rejected 383 proposals. Of those, 211—55%—improved the triggering failure but degraded protected behavior. Their local benefit was insufficient to pass the non-regression requirement.
  3. Accepting every observed target improvement would have admitted those 211 proposals. The replay gate detected a conflict that testing only the triggering failure would miss.
  4. The denominator is replay-rejected proposals, not all proposals, and each round tested at most two protected cases. The finding establishes detected collateral regressions under that evidence; it does not estimate every harmful change or the outcome of a separately run ungated system.

The agent proposes; the runtime grants persistence

An external runtime surrounds an unmodified agent.

Weights stay fixed · rules evolve

DETECT DEGRADATION → PROPOSE A CORRECTIONEXTERNAL ADMISSIONDetect01Score every turnStall or regressionNotice02Write to mailboxAgent pulls evidenceHeal03Agent writes a ruleCandidate is provisionalValidate04Replay or a weaker forward trialPromote · keep pending · retireOnly validated rules persistWORKSPACENotices · rule files · replay cases · journalRules return through explicit retrievalPer-turn barrier: evaluate → post evidence → allow the next turn
c(R)=c0⊕ι(R)c(R)=c_0\oplus\iota(R)

Standing protocol + compact rule index. Rule bodies enter context only when retrieved.

The agent cannot edit the evaluator, admission gate, replay corpus, or promotion record. Assumes a non-adversarial agent.

34 / 45
Speaker notes · 1:30
  1. The Harness surrounds an otherwise unmodified agent with four operations. Detect evaluates traces; Notice writes a finding to an external mailbox; Heal lets the agent retrieve the evidence and propose a behavioral rule; Validate decides whether that rule receives persistent authority.
  2. A candidate can influence execution provisionally while being tested. Passing validation changes its persistence status. The evolving state is an explicit rule corpus; the underlying model weights remain fixed.
  3. The standing context contains a protocol and compact directory. Notices and rule text are retrieved when needed, rather than placing the entire corpus in every prompt. A per-turn barrier makes evaluation findings available before the next turn.
  4. The evaluator, replay corpus, admission gate, and promotion record sit outside the agent’s editable tool surface. This separates proposing a change from approving its lasting use and makes updates inspectable and reversible. The design assumes a non-adversarial agent operating within that workspace boundary.

Detect a stall or regression in the trajectory

Judge the trajectory of progress, then diagnose the latest step.

Low, but improving1.00.50.0Allow progressturn →Stalled below target1.00.50.010 traces without a meaningful gainturn →Falls from its peak1.00.50.0Drop greater than 0.15turn →

Schematic trajectories; no experimental measurements are plotted. M₁: task completion and coherence, evaluated on every trace.

Stall

zj≥10∧pkj<0.5z_j\geq 10\quad\land\quad pk_j<0.5

A gain of ≥0.02 raises the peak and resets the counter.

Regression

mj(xi)<pkj−0.15m_j(x_i)<pk_j-0.15

Compare the current score with the best observed state.

Trigger → check tool / argument correctness → breach if corroborated; otherwise an advisory trend.

Only corroborated breaches are captured for replay. This is the Harness’s own detector; TRACER is a conceptual precursor.

35 / 45
Speaker notes · 1:30
  1. A low intermediate score is common during a long task. The detector therefore tracks progress over time rather than treating every low value as failure. These curves illustrate the mechanism schematically.
  2. For task completion and coherence, it maintains the best observed score and counts traces since a meaningful improvement. A gain of at least 0.02 updates the peak and resets the count. A stall is 10 traces without such a gain while the peak remains below 0.5.
  3. A regression is a current score more than 0.15 below the peak. Once a stall or regression triggers the gate, the Harness evaluates tool-call and argument correctness on the latest trace, with a direct outcome verifier when one is available.
  4. Corroborated findings become breaches that can supply replay cases. Uncorroborated trends remain advisory. This distinction limits the evidence used to motivate persistent changes: slow progress alone does not automatically justify a lasting correction.

Require target improvement and protected-case non-regression

Persistent authority requires external evidence.

Replay · matched evidence

Improve a failure. Preserve protected behavior.

≤3 matching failures≤2 protected cases
01

At least one triggering failure improves

∃i:  Δj^(si)≥0.05\exists i:\;\Delta_{\hat j}(s_i)\geq 0.05
AND
02

Every measured metric on every replayed case

∀i,j:  Δj(si)>−0.05\forall i,j:\;\Delta_j(s_i)>-0.05

Any violation rejects the candidate, even when its target improves.

Δ = replay score − captured score.

Target priority: verifier outcome → rule metric → triggering metric.

Forward trial · weaker fallback

Observe the next 3 sessions

When replay is unavailable or remains inconclusive after ≤3 attempts.

Triggering failure stops or becomes less frequent

p^=0  ∨  p^≤p0−0.05\hat p=0\;\lor\;\hat p\leq p_0-0.05

Without history, p₀ = 1.

Unmatched sessions.No protected-case test.

The candidate acts provisionally during evaluation. Promotion grants persistence.

Bounded empirical evidence, not a guarantee against unseen regressions. Protected cases are not ranked for relevance.

36 / 45
Speaker notes · 1:45
  1. Replay evaluates a candidate on at most three matching failure cases and two protected cases. Protection can apply to a metric that succeeded even when another metric failed in the same session.
  2. Admission requires at least a 0.05 target improvement on one failure case. Every measured metric on every replayed case must also change by strictly more than −0.05. Any non-regression violation overrides a target improvement.
  3. The target is a direct verifier outcome when available, otherwise the rule’s declared metric or the triggering metric. These are bounded empirical checks on stochastic executions, so passing depends on the cases and measurements available.
  4. When replay is unavailable or still inconclusive after three attempts, the fallback observes three subsequent sessions. It promotes a candidate if the triggering failure disappears or its rate drops by at least 0.05. Those sessions are unmatched, and this path has no protected-case check.
  5. A candidate can act provisionally during either evaluation path. Passing grants persistence under the observed evidence; it cannot guarantee the absence of regressions on untested behavior.

Evaluate reliability across 16 matched settings

16 matched comparisons

4 models

4 trials per task

100 turn budget

Benchmark / native splitEnvironmentTasksModels × arms
AppWorld · test_normalApplication and API tasks1684 × Baseline / Harness
Terminal-Bench · sample@2.0Command-line tasks104 × Baseline / Harness
τ²-bench · airlineTool-using dialogue504 × Baseline / Harness
τ²-bench · retailTool-using dialogue1144 × Baseline / Harness

Models: gpt-5.6-terra · gpt-5.6-luna · claude-haiku-4.5 · claude-sonnet-5

First-trial success

pass@1=1∣T∣∑t∈TXt,1\mathrm{pass@1}=\frac{1}{|T|}\sum_{t\in T}X_{t,1}

All four trials succeed

pass4=1∣T∣∑t∈T∏i=14Xt,i\mathrm{pass}^{4}=\frac{1}{|T|}\sum_{t\in T}\prod_{i=1}^{4}X_{t,i}

Benchmark-native outcomes assess reliability; trace evaluations drive adaptation.

Same task order · seed 1 · continuous online adaptation · no held-out transfer test. Results use matched completed task-trials.

37 / 45
Speaker notes · 0:45
  1. The paired evaluation spans four models and four splits from three benchmark families. Baseline and Harness use the same agent, prompts, tasks, and order. Each task has four trials and a 100-turn budget.
  2. The split is an online adaptation stream with seed 1. Benchmark-native graders determine reported outcomes; trace evaluations guide adaptation. The primary metric is a continuous completion score between zero and one.
  3. I also distinguish first-trial success from success on all four trials. The latter is not the at-least-one-success pass@k metric. Only matched completed task-trials contribute. The study measures adaptation within the stream; held-out transfer remains a separate question.

Completion improves; most effects remain uncertain

16/16 score deltas positive

2/16 95% CIs exclude zero

12/16 pass⁴ improves; 4 ties

95% percentile bootstrap CIs · 10,000 task-level resamples · score on [0, 1]. Green intervals exclude zero.

BENCHMARK / MODELno differenceΔ SCORE−0.4−0.20.0+0.2+0.4AppWorldterra+0.022luna+0.004haiku+0.024sonnet+0.013Terminal-Benchterra+0.075luna+0.025haiku+0.146sonnet+0.019τ² airlineterra+0.017luna+0.014haiku+0.014sonnet+0.030τ² retailterra+0.023luna+0.012haiku+0.019sonnet+0.032Task-completion score difference: Harness − Baseline

Consistent direction across settings; 14 of 16 effects remain statistically unresolved.

38 / 45
Speaker notes · 1:45
  1. Each point is the paired Harness-minus-Baseline change in continuous completion score. The 95% percentile-bootstrap intervals use 10,000 task-level resamples, keeping repeated trials of each task together.
  2. All 16 point estimates are positive. Two intervals exclude zero: AppWorld with terra increases from 0.701 to 0.723, with a difference interval of [0.006, 0.040] and p = 0.01; retail with sonnet increases from 0.669 to 0.701, with interval [0.003, 0.061] and p = 0.03.
  3. The remaining intervals include zero, so those improvements are directional and uncertain. The results support a qualified claim of improved completion across the tested settings, with clearer evidence in those two pairs.
  4. All-four-trials success improves in 12 pairs and ties in four. Only three pairs improve that measure more than first-trial success, so the evaluation does not isolate a distinctive repeatability benefit.
  5. These comparisons evaluate the complete Harness. They do not isolate pre-admission gating, because an immediate-admission arm with the same downstream corpus guard was not run.

Individually valid rules can accumulate into drift

AppWorld / luna: an early advantage becomes a late deficit as admitted rules accumulate.

Paired task-completion difference, Harness − Baseline−0.02+0.00+0.02+0.017Q1+0.009Q2+0.006Q3−0.016Q4
13 → 70mean active rules, Q1 → Q4
1.50× → 2.52×input tokens / turn vs Baseline

Slope −0.27 × 10⁻³ per task
Permutation p = .022

Individual admission does not establish reliability of the accumulated rule set.

Coverage

Guard replays captured breaches, not the full task stream.

Granularity

Per-case drops ≥.05 can miss smaller aggregate shifts.

Live context

Replay may not reproduce retrieval dilution.

39 / 45
Speaker notes · 1:30
  1. A candidate can pass a local test while the accumulated rule set creates a different problem. AppWorld with luna provides an example: the paired completion advantage falls from +0.017 in the first quartile to −0.016 in the fourth.
  2. Over the same progression, mean active rules increase from 13 to 70, and input tokens per turn increase from 1.5× to 2.52× Baseline. The reported permutation test gives p = 0.022 for the trend. This is one configuration, rather than a decline observed across every run.
  3. The corpus guard re-tests the active rules, but did not detect this aggregate drift. Its evidence is limited to captured breach cases, a 0.05 per-metric threshold, and replay conditions that may not recreate the live retrieval state.
  4. Context dilution and rule conflicts are possible mechanisms; the experiment does not establish which caused the decline. The result motivates two distinct controls: evaluating a candidate at admission and monitoring the reliability of the accumulated adaptation state.

The scope of reliability follows the scope of evidence

External evidence makes behavioral adaptation inspectable and reversible.

Object

What the mechanism checks

What remains outside that check

Candidate

Target gain + non-regression on sampled replay cases

Unseen cases, noisy judgments, provisional execution

Rule corpus

Re-test accumulated rules on the captured evaluation corpus

Uncaptured behavior, small aggregate drift, retrieval effects

Deployment

Audit trail and reversible text rules; fixed model weights

Adversarial circumvention and unmeasured properties

Key causal comparison still open

Gated vs immediate admission, with the same downstream corpus guard.

Generalization and practical cost

Freeze rules and test held-out transfer; reduce 1.7–7× latency.

Reliable autonomy must govern both execution and the authority to change future behavior.

40 / 45
Speaker notes · 1:15
  1. The central design contribution is an explicit authority boundary for persistent changes. The agent generates corrections; an external process determines whether the evidence supports retaining them.
  2. The strength of that decision follows the evidence. Replay protects sampled cases and measured metrics. Corpus testing examines accumulated rules but inherits the limits of the captured corpus and evaluator. Explicit text rules make changes auditable and reversible, within the non-adversarial threat model.
  3. Two experiments would strengthen the claim: comparing gated with immediate admission while keeping the same corpus guard, and freezing a learned corpus before evaluating held-out transfer. These would separate the contribution of admission control from other effects of online adaptation.
  4. Deployment also requires reducing the reported latency overhead of roughly 1.7–7×. The current evidence concerns measured task reliability. It extends the thesis from judging a decision or trajectory to governing the changes that affect future behavior.

Reliability at four scales

Reliability must be assessed at the scale where a failure changes the outcome.

01

Observation

Recover useful structure from partial physical observations.

R-MAE / ICASSP 2025

02

Decision

Learn how uncertainty changes the response policy.

CAP / ACML 2025

03

Trajectory

Surface sparse critical episodes across an interaction.

TRACER / ICML 2026

04

Adaptation

Require external evidence before retaining a behavioral rule.

HARNESS / AAAI · under review

The final step extends oversight to how experience changes future behavior.

41 / 45
Speaker notes · 1:30
  1. The four contributions address reliability at progressively broader scales. Generative Sensing uses learned structure to make incomplete physical observations useful, with evidence from downstream detection and an energy estimate that includes reconstruction.
  2. CAP makes uncertainty actionable for an individual decision: answer, retain alternatives, or abstain. TRACER then evaluates the interaction, combining content and behavioral signals so that sparse critical episodes can determine the trajectory score.
  3. The Harness addresses persistence. It separates an agent’s proposal from the runtime decision to retain it, checks for collateral regressions, and exposes the additional problem of accumulated rule drift.
  4. The progression is the thesis contribution: every expansion in autonomy creates another commitment to evaluate. A useful generated output still needs a decision policy; a plausible decision can belong to a failing trajectory; and a successful local repair can change future behavior in harmful ways.
  5. Reliable adaptation therefore requires evidence at the scale of the commitment being made. That principle connects the four studies while preserving the distinct methods, assumptions, and limits of each.

Open questions for reliable adaptation

Adaptive guarantees

How can a learned risk policy retain coverage under changing conditions?

Intervention

When does an early warning translate into a successful recovery?

Persistent adaptation

Which evidence predicts transfer without accumulated regression?

Reliable autonomy requires evidence for its next commitment.

42 / 45
Speaker notes · 1:00
  1. At the decision level, the open problem is combining a learned risk policy with stronger coverage guarantees under changing conditions. CAP provides empirical utility and a way to estimate a fixed policy’s coverage; adaptive risk selection still needs its own validity conditions.
  2. At the trajectory level, the next experiment connects warning to action. Earlier detection matters operationally when an intervention improves task outcomes at an acceptable cost. TRACER establishes useful warning signals, and that intervention benefit remains to be measured.
  3. At the adaptation level, the priorities are isolating admission gating from the corpus guard, testing a frozen corpus on held-out tasks, and understanding how rule interactions and context growth affect long-run reliability.
  4. These questions follow directly from the evidence and limitations of the four studies. They are proposed directions, not completed experiments. My thesis develops the principle that a system’s decisions—and the changes it retains—should be supported by evidence at the appropriate scale.

First author papers

  1. Tayebati, Sina, Theja Tulabandhula, and Amit R. Trivedi.

    Sense less, generate more: Pre-training LiDAR perception with masked autoencoders for ultra-efficient 3D sensing.

    arXiv preprint arXiv:2406.07833 (2024).

  2. Tayebati, Sina, et al.

    CAP: Conformalized abstention policies for context-adaptive risk management for LLMs and VLMs.

    The 17th Asian Conference on Machine Learning (Conference Track). 2025.

  3. Tayebati, Sina, et al.

    TRACER: Trajectory risk aggregation for critical episodes in agentic reasoning.

    International Conference on Machine Learning (ICML). PMLR 306, 2026.

43 / 45
Speaker notes · 0:10
  1. These are the four first-author papers that form the basis of this thesis and the research progression I have presented.

Collaborative papers

2023–2025

2025–2026

2026

44 / 45
Speaker notes · 0:10
  1. Alongside the four first-author papers, I have collaborated on sensing, uncertainty estimation, robust foundation models, and agent reliability. These publications are ordered from 2023 to 2026, reading down each column and then across.
  2. The earlier collaborations focus on sensor trustworthiness and efficient edge autonomy. The later work develops conformal prediction, robustness, uncertainty decomposition, and runtime reliability for agents.
Speaker notes · 0:10
  1. Thank you. I’m happy to discuss the methods, assumptions, and next steps. My contact email is stayeb3@uic.edu.

Technical appendix

Additional sensing and transfer results

Transfer to KITTI

SECONDCarPed.Cyc.
SECOND baseline79.0844.5264.49
Waymo pretraining79.3048.6166.62
nuScenes pretraining79.3246.0568.27

AP (%), moderate difficulty, 40 recall positions. Pretrain on source dataset and fine-tune on KITTI.

Waymo Level 2 · PV-RCNN mAPH

60.86 → 66.45

+5.59 percentage points in heading-aware AP.

Masking experiments

Original Figure 2 showing PointPillars accuracy under masking ratio and angular group size changes.

Original Figure 2. Curves are preserved from the paper; plotted coordinates have not been digitized.

Energy results are estimates. The paper does not establish calibrated uncertainty or safety guarantees for reconstructed regions.

A01 / 10
Technical notes
  1. The KITTI transfer results use SECOND, moderate difficulty, and 40 recall positions. With Waymo pretraining, pedestrian AP rises from the 44.52 baseline to 48.61, a gain of 4.09 percentage points.
  2. For PV-RCNN on Waymo, mAPH rises from 60.86 to 66.45 after R-MAE pretraining, a gain of 5.59 points. This supplements the main slide’s mAP comparison with a heading-aware metric.
  3. The masking-ratio curve is the original Figure 2. Exact curve coordinates are not tabulated, so I use it to discuss the reported trend rather than treating visually estimated coordinates as new numerical measurements.

CAP: assumptions behind the coverage statements

The guarantee depends on what is fixed and which probability is being bounded.

Standard split conformal

Pr⁡Dcal,(X,Y) ⁣{Y∈Γα(X)}≥1−α\Pr_{D_{\mathrm{cal}},(X,Y)}\!\{Y\in\Gamma_\alpha(X)\}\geq1-\alpha

Fixed α; exchangeable examples; fixed score construction. This is a marginal statement over calibration and test draws.

Input-dependent risk selection

α=α(X)\alpha=\alpha(X)

Marginal validity alone does not imply coverage conditional on every input or validity after arbitrary adaptive risk selection.

Proposition 2 · evaluation of a fixed policy

Cov^m=1m∑i=1m1{Yi∈Γ(Xi;α(Xi))}\widehat{\mathrm{Cov}}_m=\frac1m\sum_{i=1}^{m}\mathbf1\{Y_i\in\Gamma(X_i;\alpha(X_i))\}
Pr⁡ ⁣{∣Cov^m−Covπ∣≤log⁡(2/δ)2m}≥1−δ\Pr\!\left\{\left|\widehat{\mathrm{Cov}}_m-\mathrm{Cov}_{\pi}\right|\leq\sqrt{\frac{\log(2/\delta)}{2m}}\right\}\geq1-\delta

Freeze the policy and calibration mechanism; evaluate on fresh i.i.d. data.

This bounds estimation error around true policy coverage. It does not certify 90% coverage or the conditional claims in Eqs. 6–7.

A02 / 10
Technical notes
  1. The standard split conformal result assumes exchangeability, a fixed α, and an appropriately independent score construction. Its guarantee is marginal over calibration and test examples. Exchangeability alone does not imply input-conditional validity.
  2. Equations 6–7 and the sketch of Proposition 1 extend that language to adaptive per-input selection. The standard marginal result is insufficient to establish that extension, so I do not use it as a conditional guarantee in this presentation.
  3. Proposition 2 concerns a fixed learned mechanism evaluated on fresh i.i.d. test examples. Hoeffding’s inequality bounds the empirical coverage error around that mechanism’s population coverage. The bound does not determine the value of that population coverage or certify the nominal target.
  4. This is why I report reward optimization, observed coverage, and statistical guarantees separately. Independent evaluation is essential when a risk policy has been learned from data.

CAP: calibration and empirical coverage

Expected calibration error ↓

Table 4 · reported five-task averages

ModelAPSLACBenchCAP
LLaVA-v1.6-34B0.170.110.140.03
LLaVA-v1.6-13B0.200.170.060.03
LLaVA-v1.6-7B0.210.180.070.04
Yi-34B0.210.160.180.08
Qwen-14B0.190.150.170.04
Qwen-7B0.340.300.320.07

Reported empirical coverage

Table 2 · selected individual cells

Model / taskCAP (%)
LLaVA-v1.6-7B / MMBench92.96
LLaVA-v1.6-7B / OODCV91.63
LLaVA-v1.6-7B / ScienceQA90.49
LLaVA-v1.6-7B / SEEDBench91.23
Qwen-7B / HellaSwag91.96
Qwen-7B / HaluDial91.70
Qwen-7B / CosmosQA95.68
Qwen-7B / MMLU91.32

The paper’s coverage metric includes abstaining from incorrect explicit predictions. These empirical values are distinct from a formal set-inclusion guarantee.

Bench: VLM-Bench (Kostumov et al., 2024); LLM-Bench (Ye et al., 2024). ECE averages are reproduced as printed; coverage uses individual cells.

A03 / 10
Technical notes
  1. The left table reports expected calibration error averaged across five tasks per model. Lower ECE means that binned confidence is closer to empirical accuracy. The values are the published model averages.
  2. The right table shows individual coverage cells for LLaVA-7B and Qwen-7B. Each selected value exceeds the stated 90% target. The metric also credits abstention from an incorrect explicit prediction, so its interpretation differs from ordinary prediction-set inclusion coverage.
  3. I use individual task cells here because Table 2’s average column does not reconcile with the four visible task columns. These data support the empirical coverage discussion without relying on that inconsistent average.
  4. Together, the tables describe confidence calibration and measured policy coverage. The preceding assumptions determine what statistical conclusions can be drawn from them.

TRACER: assumptions behind the failure-risk bound

1. Hazard dominance

λt=P(Ct>0∣Ft−1)\lambda_t=P(C_t>0\mid\mathcal F_{t-1})
λt≤min⁡{1,c rt},c>0\lambda_t\leq\min\{1,c\,r_t\},\qquad c>0

The observed score must dominate the conditional hazard up to a constant.

2. Sparse risk outside the tail

∑i=K+1Nr(i)≤η\sum_{i=K+1}^{N}r_{(i)}\leq\eta
K=max⁡{1,⌊kN⌋}K=\max\{1,\lfloor kN\rfloor\}

Risk omitted by the top-K tail is bounded by η.

Union bound + the two assumptions

P(B)≤E ⁣[∑tλt]≤cK E[TMk(r)]+cηP(B)\leq\mathbb{E}\!\left[\sum_t\lambda_t\right]\leq cK\,\mathbb{E}[\mathrm{TM}_k(r)]+c\eta
P(B)≤cK1−w E[TRACER(T)]+cη(w<1)P(B)\leq\frac{cK}{1-w}\,\mathbb{E}[\mathrm{TRACER}(T)]+c\eta\qquad(w<1)
An expectation bound under assumptions, not per-trajectory probability calibration. The paper does not estimate c or η empirically.

B = {maxₜ Cₜ > 0}. Use the maximum on the nonnegative risk domain for the coherence statement; Appendix A.3–A.5.

A04 / 10
Technical notes
  1. The conditional hazard is the probability of a failure-inducing condition given the history before a step. The first assumption bounds that hazard using the measured risk and a positive constant c.
  2. The second assumption bounds the total risk outside the top-K tail by η. Applying a union bound to breakdown and substituting these assumptions gives the tail-mean inequality. Since TRACER is at least (1 − w) times the tail mean, the second inequality follows for w < 1.
  3. This argument concerns the fixed-length risk-vector setting in the theorem. The evaluation does not empirically certify hazard domination or the tail remainder, so the inequality is conditional rather than an estimated probability for an individual trajectory.
  4. For the coherence properties, I use the maximum functional on the nonnegative risk vectors produced by the method. Extending that wording to an unrestricted real-vector infinity norm would require additional qualification.

TRACER: actor and aggregation ablations

AUROC ↑ · actor evidence and aggregation strategy across all nine settings

ModelDomainAgent onlyUser onlyCombinedAdditiveMultiplySeparateMAX
gemini-2.5-proAirline0.6780.5820.7350.7260.6610.7110.735
Retail0.6370.4890.6730.6600.5820.6230.673
Telecom0.6470.6220.6910.6780.6810.6720.691
gemini-2.5-flashAirline0.6500.5910.7250.6200.6320.6750.725
Retail0.6920.46820.7070.6770.5000.6380.707
Telecom0.6720.6020.8090.7950.7850.7640.809
gpt-4.1-miniAirline0.6020.7250.7420.7310.6430.6480.742
Retail0.5790.6360.6890.6680.6270.6790.689
Telecom0.6740.6720.7650.7610.6890.7530.765

Agent/user: Table 5. Combined: Table 2. Aggregation variants: Table 6. Combined and MAX refer to the full TRACER configuration.

A05 / 10
Technical notes
  1. All entries are AUROC. Actor-only scores come from Table 5, full scores from Table 2, and aggregation variants from Table 6. The combined and MAX columns represent the same full configuration.
  2. Combining agent and user evidence improves on either corresponding actor-only variant in every row. Either actor-only variant can still lose to other methods, so that stronger claim is not supported.
  3. MAX leads the reported aggregation comparisons, with the size of the advantage varying by setting. The table retains the reported precision, including 0.4682 for the Flash retail user-only result. Confidence intervals and repeated-run variance are not reported.

Harness: all matched results

B = Baseline · H = Harness. Task-completion score on [0, 1]; pass⁴ requires success on every trial.

Benchmark / modelnScore BScore HΔ95% paired CIppass@1 B → Hpass⁴ B → H
AppWorld / terra1660.7010.723+0.022[+.006, +.040].010.018 → 0.0540.000 → 0.000
AppWorld / luna1680.6580.662+0.004[−.01, +.02].540.000 → 0.0060.000 → 0.000
AppWorld / haiku1680.5660.590+0.024[−.06, +.10].580.000 → 0.1430.000 → 0.143
AppWorld / sonnet1660.7140.727+0.013[−.005, +.032].170.030 → 0.0480.006 → 0.012
Terminal-Bench / terra100.4500.525+0.075[−.13, +.33].650.444 → 0.5560.333 → 0.444
Terminal-Bench / luna100.2750.300+0.025[−.10, +.15].720.300 → 0.4000.100 → 0.200
Terminal-Bench / haiku100.2290.375+0.146[−.28, +.52].420.600 → 0.6000.000 → 0.200
Terminal-Bench / sonnet100.3980.417+0.019[−.41, +.43].900.571 → 0.4290.000 → 0.333
τ² retail / terra1140.6810.704+0.023[−.004, +.050].090.384 → 0.4110.125 → 0.143
τ² airline / terra500.7240.741+0.017[−.019, +.054].340.500 → 0.5400.360 → 0.400
τ² retail / luna1140.6500.662+0.012[−.02, +.04].470.339 → 0.3570.099 → 0.117
τ² airline / luna500.6900.704+0.014[−.02, +.05].420.460 → 0.4800.280 → 0.320
τ² retail / haiku1140.6320.651+0.019[−.009, +.047].180.304 → 0.3210.071 → 0.080
τ² airline / haiku500.6820.696+0.014[−.02, +.05].440.440 → 0.4600.320 → 0.340
τ² retail / sonnet1140.6690.701+0.032[+.003, +.061].030.366 → 0.3840.107 → 0.107
τ² airline / sonnet500.7100.740+0.030[−.006, +.066].100.440 → 0.4800.320 → 0.320

10,000 task-level bootstrap resamples; two intervals exclude zero. Rates use matched completed task-trials, so pass@1 and pass⁴ denominators can differ within a row.

A06 / 10
Technical notes
  1. This table contains all matched results from Table 1. Completion is a passing-test fraction in AppWorld and Terminal-Bench, and a per-component reward in τ²-bench. The highlighted cells identify the two paired completion intervals that exclude zero.
  2. Only matched completed task-trials contribute. The n column is not necessarily the denominator for both binary rates, and rounded rates do not identify exact integer success counts. First-trial success and all-four-trials success therefore need their own denominator interpretation.
  3. The model labels are abbreviated; the main evaluation slide gives the full model names and protocol. I use the tabulated results as the quantitative basis because the Terminal-Bench values in the paper’s Figure 2 are inconsistent with Table 1.

Validation strength depends on replay availability

Replay share indicates how much validation received the protected-case test.

Replay share
R / F = replay / forward events		terralunahaikusonnet
AppWorld87%104 / 1590%189 / 2184%168 / 3286%93 / 15
Terminal-Bench0%0 / 2060%0 / 3240%0 / 2800%0 / 230
τ² airline72%118 / 4669%151 / 6864%132 / 7458%59 / 43
τ² retail89%246 / 3092%357 / 2988%332 / 4591%211 / 21

Terminal-Bench: no replay support

Rebuilding task environments was not supported. All 70 proposed rules were promoted through forward evidence.

Airline: replay-budget mismatch

Agent-turn budgets were consumed as message hops, truncating some replays before relevant behavior.

Natural variation, not an ablation: path shares are confounded by benchmark and model. Validation events are not one-to-one with rule counts.

A07 / 10
Technical notes
  1. The table reports validation events and replay shares. An event is not the same unit as a rule: replay and forward counts cannot be added to reconstruct promotion or retirement totals.
  2. Terminal-Bench had no replay support because candidate evaluation would require rebuilding and rerunning task environments. Its four runs used forward evidence and recorded no retirements. That also means these candidates received no replay-based protected-case test.
  3. In airline, a budget-unit mismatch caused some replays to end early: a configured agent-turn budget was consumed as message hops. This reduced the available replay evidence.
  4. The differences are observational and confounded with model and benchmark. A higher replay share does not by itself establish that replay causally outperforms forward validation. It does establish that candidates were admitted under different strengths of evidence.

Oversight adds context, evaluation cost, and latency

1.25× mean context

1.72× total spend incl. repair

1.7–7× wall-clock latency

Benchmark / modelTokens / turn B → HRatioTurns / trial B → HExecution $ B → HRepair $Seconds / trial B → H
AppWorld / terra5215 → 75041.44×10.1 → 11.926.47 → 34.458.2617 → 109
AppWorld / luna5172 → 89861.74×9.9 → 11.62.57 → 4.191.7917 → 114
AppWorld / haiku5580 → 75901.36×10.0 → 11.45.80 → 7.604.2018 → 112
AppWorld / sonnet7110 → 93101.31×10.2 → 11.528.00 → 34.0011.0020 → 120
Terminal-Bench / terra6837 → 61510.90×8.5 → 9.13.67 → 2.370.61101 → 202
Terminal-Bench / luna3968 → 49841.26×7.2 → 8.30.16 → 0.170.1497 → 209
Terminal-Bench / haiku5210 → 60901.17×7.8 → 8.61.15 → 1.350.4295 → 198
Terminal-Bench / sonnet6610 → 70101.06×8.1 → 8.54.10 → 4.300.7599 → 205
τ² airline / terra5920 → 65101.10×7.6 → 7.95.50 → 6.202.2024 → 145
τ² airline / luna3982 → 46551.17×8.2 → 8.70.41 → 0.530.8419 → 133
τ² airline / haiku5670 → 61001.08×7.0 → 7.19.75 → 10.469.1426 → 125
τ² airline / sonnet7243 → 77321.07×7.1 → 7.126.00 → 27.7115.0241 → 173
τ² retail / terra5510 → 72201.31×9.8 → 10.98.40 → 10.605.4025 → 166
τ² retail / luna4198 → 60561.44×10.3 → 11.71.08 → 2.533.6320 → 175
τ² retail / haiku6010 → 81201.35×9.9 → 11.118.00 → 22.0011.5029 → 168
τ² retail / sonnet7610 → 98201.29×9.6 → 10.736.00 → 43.0018.0042 → 190

Run totals: $177.06 Baseline → $211.46 Harness execution, plus $92.90 repair. Repair is additional to the Harness execution column.

Dominant overhead: synchronous trace evaluation. Agent-turn increases range from 0.0 to 1.8 per trial.

A08 / 10
Technical notes
  1. Overall cost includes both ordinary Harness execution and additional repair work. Across the 16 pairs, Baseline execution costs $177.06; Harness execution costs $211.46, with another $92.90 for repair. Together, these give the reported total ratio of 1.72×.
  2. The mean input-context ratio is 1.25×. Terminal-Bench with terra is the one setting with fewer input tokens per turn under the Harness.
  3. Synchronous model-judged trace evaluation produces a larger latency increase, reported at roughly 1.7–7×. This is a practical constraint on runtime oversight and motivates studying evaluation scheduling and barrier placement.
  4. These are measurements of the complete system. They account for additional repair spend, but they do not isolate the independent cost of each component.

Selected foundations and related work

Generative sensing

He et al. Masked Autoencoders Are Scalable Vision Learners. CVPR 2022.

Pang et al. Masked Autoencoders for Point Cloud Self-supervised Learning. ECCV 2022.

Min et al. Occupancy-MAE. IEEE T-IV, 2023.

Krispel et al. MAELi. WACV 2024.

Decision uncertainty

Vovk, Gammerman, Shafer. Algorithmic Learning in a Random World. 2005.

Angelopoulos & Bates. A Gentle Introduction to Conformal Prediction. 2021.

Romano, Sesia, Candès. Classification with Valid and Adaptive Coverage. NeurIPS 2020.

Mohri & Hashimoto. Language Models with Conformal Factuality Guarantees. ICML 2024.

Trajectory uncertainty

Kuhn, Gal, Farquhar. Semantic Uncertainty. ICLR 2023.

Farquhar et al. Detecting Hallucinations Using Semantic Entropy. Nature 2024.

Zhao et al. Uncertainty Propagation on LLM Agent (SAUP). ACL 2025.

Barres et al. τ²-bench: Evaluating Conversational Agents in a Dual-Control Environment. 2025.

Persistent adaptation

Madaan et al. Self-Refine. NeurIPS 2023.

Shinn et al. Reflexion. NeurIPS 2023.

Zelikman et al. Self-Taught Optimizer (STOP). 2024.

Zhang et al. Darwin Gödel Machine. 2025.

A09 / 10
Technical notes
  1. The selected foundations follow the four parts of the talk: masked reconstruction for perception, conformal and selective prediction, uncertainty over agent interactions, and learning from experience through persistent changes. Each paper’s bibliography contains the complete references.
  2. For the coverage discussion, the key foundation is the distinction between marginal and conditional validity in Angelopoulos and Bates, Section 3.1. Adaptive decisions require care about which of those claims the assumptions support.
  3. For self-modification, STOP and the Darwin Gödel Machine already use empirical evaluation. The Harness contribution combines runtime triggering, protected-case admission checks, and oversight of accumulated rules within an external authority boundary.

Experiments that would strengthen the evidence

QuestionProposed experimentWhat it would establish
Does admission control help?Gated vs immediate admission,
with the corpus guard held fixed		Separate the gate from the
rest of the Harness
Do retained rules transfer?Freeze the adapted corpus;
evaluate on held-out tasks		Generalization beyond the
online adaptation stream
Why does drift accumulate?Vary rule count and retrieval budget;
measure context and interference		Distinguish dilution from
conflicting instructions
Can oversight be cheaper?Compare synchronous barriers
and selective evaluation schedules		Reliability–latency trade-off

These are open experiments. The supplied Harness paper does not report these controls.

Additional limits: one seed, bounded replay coverage, judge sensitivity, and non-adversarial access assumptions.

A10 / 10
Technical notes
  1. The most direct control compares gated admission with immediate admission while retaining the same downstream corpus guard. A further immediate-admission arm without that guard would separate the two protection mechanisms.
  2. Freezing the learned rule corpus before evaluating held-out tasks would test transfer, separately from performance in the path-dependent online adaptation stream.
  3. Rule-count and retrieval-budget sweeps would help distinguish context dilution from rule interference. Varying the barrier and evaluation schedule would measure the reliability–latency trade-off.
  4. These experiments were not run in the current study. They are the controls needed to strengthen the causal and generalization claims raised by the reported results.