<?xml version="1.0" encoding="UTF-8"?>
<modsCollection xmlns="http://www.loc.gov/mods/v3">
<mods ID="he-etal-2026-traceprobe">
    <titleInfo>
        <title>TraceProbe: An Execution-Based Benchmark for Diagnosing Safety Failures in LLM Agents</title>
    </titleInfo>
    <name type="personal">
        <namePart type="given">Yuxiang</namePart>
        <namePart type="family">He</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <name type="personal">
        <namePart type="given">Jian</namePart>
        <namePart type="family">Zhao</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <name type="personal">
        <namePart type="given">Yufei</namePart>
        <namePart type="family">Liu</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <name type="personal">
        <namePart type="given">Yuchen</namePart>
        <namePart type="family">Yuan</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <name type="personal">
        <namePart type="given">Xuelong</namePart>
        <namePart type="family">Li</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <originInfo>
        <dateIssued>2026-10</dateIssued>
    </originInfo>
    <typeOfResource>text</typeOfResource>
    <relatedItem type="host">
        <titleInfo>
            <title>Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing</title>
        </titleInfo>
        <name type="personal">
            <namePart type="given">Hung-Yi</namePart>
            <namePart type="family">Lee</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Sunipa</namePart>
            <namePart type="family">Dev</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Jessy</namePart>
            <namePart type="family">Li</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Desmond</namePart>
            <namePart type="family">Elliott</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <originInfo>
            <publisher>Association for Computational Linguistics</publisher>
            <place>
                <placeTerm type="text">Budapest, Hungary</placeTerm>
            </place>
        </originInfo>
        <genre authority="marcgt">conference publication</genre>
        <identifier type="isbn">979-8-89176-459-0</identifier>
    </relatedItem>
    <abstract>Large language model (LLM) agents increasingly act through files, tools, memory, retrieved content, and other agents, which can trigger safety failures during execution. Existing benchmarks mostly focus on endpoint outcome evaluation or model-assisted moderation of pre-constructed trajectories, leaving limited evidence about where risks enter and how they propagate. To address this issue, we introduce TraceProbe, an execution-based benchmark for agent safety diagnosis. TraceProbe places agents in executable sandbox scenarios, scores endpoint and latent rule violations based on normalized traces and structured evidence, and replays recorded tool actions for step-level risk localization. Our benchmark contains 155 scenarios across three risk-source categories: non-adversarial failures, internal authority compromise, and external attacks. Across 12 contemporary LLMs, the mean attack success rate (ASR) is 0.347, indicating substantial residual risk, especially under internal authority compromise. Our analysis also demonstrates that endpoint-safe runs can contain unsafe intermediate actions, and the actual execution paths of agents may differ from the intended hazards of the testing scenarios. The TraceProbe benchmark and our findings support a more actionable form of agent safety evaluation: beyond assessing ASR or final outcomes, evaluators can also ask what went wrong, where it occurred, and where an intervention could be placed.</abstract>
    <identifier type="citekey">he-etal-2026-traceprobe</identifier>
    <location>
        <url>https://aclanthology.org/2026.emnlp-main.1233/</url>
    </location>
    <part>
        <date>2026-10</date>
        <extent unit="page">
            <start>28121</start>
            <end>28140</end>
        </extent>
    </part>
</mods>
</modsCollection>

%0 Conference Proceedings
%T TraceProbe: An Execution-Based Benchmark for Diagnosing Safety Failures in LLM Agents
%A He, Yuxiang
%A Zhao, Jian
%A Liu, Yufei
%A Yuan, Yuchen
%A Li, Xuelong
%Y Lee, Hung-Yi
%Y Dev, Sunipa
%Y Li, Jessy
%Y Elliott, Desmond
%S Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing
%D 2026
%8 October
%I Association for Computational Linguistics
%C Budapest, Hungary
%@ 979-8-89176-459-0
%F he-etal-2026-traceprobe
%X Large language model (LLM) agents increasingly act through files, tools, memory, retrieved content, and other agents, which can trigger safety failures during execution. Existing benchmarks mostly focus on endpoint outcome evaluation or model-assisted moderation of pre-constructed trajectories, leaving limited evidence about where risks enter and how they propagate. To address this issue, we introduce TraceProbe, an execution-based benchmark for agent safety diagnosis. TraceProbe places agents in executable sandbox scenarios, scores endpoint and latent rule violations based on normalized traces and structured evidence, and replays recorded tool actions for step-level risk localization. Our benchmark contains 155 scenarios across three risk-source categories: non-adversarial failures, internal authority compromise, and external attacks. Across 12 contemporary LLMs, the mean attack success rate (ASR) is 0.347, indicating substantial residual risk, especially under internal authority compromise. Our analysis also demonstrates that endpoint-safe runs can contain unsafe intermediate actions, and the actual execution paths of agents may differ from the intended hazards of the testing scenarios. The TraceProbe benchmark and our findings support a more actionable form of agent safety evaluation: beyond assessing ASR or final outcomes, evaluators can also ask what went wrong, where it occurred, and where an intervention could be placed.
%U https://aclanthology.org/2026.emnlp-main.1233/
%P 28121-28140

Markdown (Informal)

[TraceProbe: An Execution-Based Benchmark for Diagnosing Safety Failures in LLM Agents](https://aclanthology.org/2026.emnlp-main.1233/) (He et al., EMNLP 2026)

• TraceProbe: An Execution-Based Benchmark for Diagnosing Safety Failures in LLM Agents (He et al., EMNLP 2026)

ACL

• Yuxiang He, Jian Zhao, Yufei Liu, Yuchen Yuan, and Xuelong Li. 2026. TraceProbe: An Execution-Based Benchmark for Diagnosing Safety Failures in LLM Agents. In Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing, pages 28121–28140, Budapest, Hungary. Association for Computational Linguistics.