<?xml version="1.0" encoding="UTF-8"?>
<modsCollection xmlns="http://www.loc.gov/mods/v3">
<mods ID="ghebreselassie-li-2026-prior">
    <titleInfo>
        <title>Prior-History Sensitivity in Agentic Safety Evaluations</title>
    </titleInfo>
    <name type="personal">
        <namePart type="given">Melat</namePart>
        <namePart type="family">Ghebreselassie</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <name type="personal">
        <namePart type="given">Melissa</namePart>
        <namePart type="family">Li</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <originInfo>
        <dateIssued>2026-10</dateIssued>
    </originInfo>
    <typeOfResource>text</typeOfResource>
    <relatedItem type="host">
        <titleInfo>
            <title>Proceedings of the Second Workshop for REsearch on Agent Language Models (REALM 2026)</title>
        </titleInfo>
        <name type="personal">
            <namePart type="given">Ehsan</namePart>
            <namePart type="family">Kamalloo</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Nicolas</namePart>
            <namePart type="family">Gontier</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Nikolai</namePart>
            <namePart type="family">Rozanov</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Maryam</namePart>
            <namePart type="family">Hashemzadeh</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Akhil</namePart>
            <namePart type="family">Arora</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <originInfo>
            <publisher>Association for Computational Linguistics</publisher>
            <place>
                <placeTerm type="text">Budapest, Hungary</placeTerm>
            </place>
        </originInfo>
        <genre authority="marcgt">conference publication</genre>
        <identifier type="isbn">979-8-89176-485-9</identifier>
    </relatedItem>
    <abstract>Stateful agents increasingly leverage execution logs, tool outputs, feedback, and summaries from prior interactions to inform future behavior. Despite this, safety evaluations typically evaluate agents using either a singular fixed prior history or an empty baseline, via a uniform history rendering. We argue that such evaluations only illustrate a conditional snapshot of model behavior and fail to demonstrate whether these conclusions generalize across plausible prior histories and history renderings. We use the Inspect Evals agentic misalignment benchmark, finding that among eight benign prior histories, a single Opus 4.1 history significantly and repeatedly increased harmful-action rates, whereas the remaining seven alternatives exhibited no such increase relative to the empty history condition. While additional rollout replications improved statistical confidence, they did not improve the representativeness of the overall sample. Conversely, all eight Qwen3-30B histories resulted in an average decrease of 26.3 percentage points in observed harmful actions. Furthermore, we examined four distinct history renderings of 15 benign prior histories across 900 Opus blackmail rollouts. History renderings with tool results and neutral summaries reduced mean harmful-action rates by 10.0 and 15.0 percentage points, respectively. These results emphasize the necessity for evaluations to incorporate diverse, plausible prior histories and history renderings to establish that their findings generalize.</abstract>
    <identifier type="citekey">ghebreselassie-li-2026-prior</identifier>
    <location>
        <url>https://aclanthology.org/2026.realm-1.79/</url>
    </location>
    <part>
        <date>2026-10</date>
        <extent unit="page">
            <start>1160</start>
            <end>1170</end>
        </extent>
    </part>
</mods>
</modsCollection>

%0 Conference Proceedings
%T Prior-History Sensitivity in Agentic Safety Evaluations
%A Ghebreselassie, Melat
%A Li, Melissa
%Y Kamalloo, Ehsan
%Y Gontier, Nicolas
%Y Rozanov, Nikolai
%Y Hashemzadeh, Maryam
%Y Arora, Akhil
%S Proceedings of the Second Workshop for REsearch on Agent Language Models (REALM 2026)
%D 2026
%8 October
%I Association for Computational Linguistics
%C Budapest, Hungary
%@ 979-8-89176-485-9
%F ghebreselassie-li-2026-prior
%X Stateful agents increasingly leverage execution logs, tool outputs, feedback, and summaries from prior interactions to inform future behavior. Despite this, safety evaluations typically evaluate agents using either a singular fixed prior history or an empty baseline, via a uniform history rendering. We argue that such evaluations only illustrate a conditional snapshot of model behavior and fail to demonstrate whether these conclusions generalize across plausible prior histories and history renderings. We use the Inspect Evals agentic misalignment benchmark, finding that among eight benign prior histories, a single Opus 4.1 history significantly and repeatedly increased harmful-action rates, whereas the remaining seven alternatives exhibited no such increase relative to the empty history condition. While additional rollout replications improved statistical confidence, they did not improve the representativeness of the overall sample. Conversely, all eight Qwen3-30B histories resulted in an average decrease of 26.3 percentage points in observed harmful actions. Furthermore, we examined four distinct history renderings of 15 benign prior histories across 900 Opus blackmail rollouts. History renderings with tool results and neutral summaries reduced mean harmful-action rates by 10.0 and 15.0 percentage points, respectively. These results emphasize the necessity for evaluations to incorporate diverse, plausible prior histories and history renderings to establish that their findings generalize.
%U https://aclanthology.org/2026.realm-1.79/
%P 1160-1170

Markdown (Informal)

[Prior-History Sensitivity in Agentic Safety Evaluations](https://aclanthology.org/2026.realm-1.79/) (Ghebreselassie & Li, REALM 2026)

• Prior-History Sensitivity in Agentic Safety Evaluations (Ghebreselassie & Li, REALM 2026)

ACL

• Melat Ghebreselassie and Melissa Li. 2026. Prior-History Sensitivity in Agentic Safety Evaluations. In Proceedings of the Second Workshop for REsearch on Agent Language Models (REALM 2026), pages 1160–1170, Budapest, Hungary. Association for Computational Linguistics.