TrustDABench: Benchmarking Reliability and Robustness of LLMs for Structured Data Analysis
Organizations: China Mobile Jiutian Artificial Intelligence Technology (Beijing) Co., Ltd. · School of Computer and Cyberspace Security, Communication University of China
Abstract
LLMs are increasingly used to analyze spreadsheets, CSV files, and other structured data, but producing a correct-looking answer is not the same as producing a trustworthy analysis. A trustworthy result should be supported by a valid path from the user question to the relevant data evidence. This requirement creates two diagnostic questions: whether an LLM can refuse to answer or ask for clarification when such a path does not exist, and whether it can preserve the correct analysis when the same evidence is expressed in different table forms. We introduce TrustDABench, a benchmark that operationalizes these questions as reliability and robustness. Starting from the evidence-path view, we derive 19 perturbation operators and instantiate them through an Agentic-LLM-based generation framework. TrustDABench contains 2,340 human-verified perturbed instances, and we evaluate eight representative LLMs. The results show substantial headroom: the best reliability result is only 24.21% average MRS, achieved by GPT-5.5, while the best robustness result still has 9.10% average ASR, achieved by Claude-Sonnet-5. The failures are systematic: models rarely detect conflicting evidence, often continue along executable but unsupported analysis paths, and remain sensitive to perturbations that change observation boundaries or cross-table relations. These findings suggest that stronger evidence-boundary recognition and representation-invariant reasoning are still needed for reliable structured-data analysis.
Figures & tables
| Table profile | |||||||||
|---|---|---|---|---|---|---|---|---|---|
| Dimension | Dataset | #Instances | Sources (coverage) | Avg./source | Excel / CSV | #Perturb. types | #Table files | Rows (avg./max) | Cols (avg./max) |
| Reliability | AIDABench-QA | 562 | 201/226 (88.94%) | 2.8 | 538 / 24 | 7 | 274 | 1,869.8 / 261,726 | 20.2 / 238 |
| DABench | 643 | 242/257 (94.16%) | 2.7 | 2 / 641 | 6 | 244 | 1,578.3 / 16,683 | 10.0 / 19 | |
| Robustness | AIDABench-QA | 672 | 152/226 (67.26%) | 4.4 | 643 / 29 | 12 | 205 | 1,624.3 / 44,648 | 14.6 / 100 |
| DABench | 463 | 221/257 (85.99%) | 2.1 | 0 / 463 | 6 | 405 | 5,016.9 / 133,464 | 8.8 / 251 | |
| AIDABench-QA | DABench | Avg. | |||||||
| Model | FRR ( ) | PRR ( ) | NRR ( ) | MRS ( ) | FRR ( ) | PRR ( ) | NRR ( ) | MRS ( ) | MRS ( ) |
| Qwen3.7-Max | 9.61 | 10.14 | 80.25 | 14.68 | 13.37 | 3.58 | 83.05 | 15.16 | 14.92 |
| DeepSeek-V4-Pro | 6.76 | 11.92 | 81.32 | 12.72 | 9.64 | 3.89 | 86.47 | 11.59 | 12.16 |
| GLM-5.2 | 3.57 | 9.82 | 86.61 | 8.48 | 6.69 | 6.07 | 87.25 | 9.72 | 9.10 |
| Gemini-3.1-Pro | 4.27 | 8.01 | 87.72 | 8.27 | 4.98 | 1.40 | 93.62 | 5.68 | 6.98 |
| Claude-Sonnet-5 | 11.03 | 9.07 | 79.89 | 15.57 | 6.69 | 9.80 | 83.51 | 11.59 | 13.58 |
| AIDABench-QA | DABench | Avg. | |||
| Model | ASR( ) | RAD( ) | ASR( ) | RAD( ) | ASR( ) |
| Qwen3.7-Max | 15.78 | 7.18 | 7.56 | 4.83 | 11.67 |
| GLM-5.2 | 11.27 | 5.62 | 9.85 | 7.13 | 10.56 |
| DeepSeek-V4-Pro | 16.42 | 7.72 | 9.93 | 6.87 | 13.17 |
| Gemini-3.1-Pro | 16.90 | 7.68 | 7.18 | 4.83 | 12.04 |
| Claude-Sonnet-5 | 11.76 | 6.73 | 6.44 | 4.51 | 9.10 |
Appendix figures & tables16 assets
Supplementary material from the paper’s appendix.
Appendix
| Benchmark | Task Setting | Reliability | Robustness | # Perturb. / Failure Types | Workflow |
|---|---|---|---|---|---|
| RobuT ( Zhao et al. 2023 ) | TQA | No | Yes | 10 perturbation types | No |
| FREB-TQA ( Zhou et al. 2024 ) | TQA | No | Yes | 8 perturbations | No |
| ToRR ( Ashury-Tahan et al. 2026 ) | TQA | No | Yes | 11 prompt configurations: 7 serializations + 4 structural perturbations | No |
| ( Wolff and Hulsebos 2025 ) | Data Analysis | No | Yes | 3 variations | No |
| RADAR ( Gu et al. 2025 ) | Data Analysis | No | Yes | 5 data artifact types | Code-based analysis |
| Spider-Syn ( Gan et al. 2021 ) | SQL | No | Yes | 1 synonym-substitution strategy | No |
| Field | Track | Meaning |
|---|---|---|
| sample_id | Both | Identifier of the source instance being screened. |
| eligible_attacks | Both | Operators judged applicable enough to enter construction. |
| attack_type | Both | Closed-set operator name copied from the enabled catalog. |
| confidence | Both | Selector confidence that the operator has a concrete feasible target. |
| reason | Both | Short justification for why the operator is applicable or rejected. |
| required_edit | Reliability | Whether the perturbation changes only the question, modifies files, or removes files from the delivered package. |
| Field | Track | Meaning |
|---|---|---|
| status | Both | Whether the candidate was successfully constructed or rejected. |
| attack_type | Both | Operator executed by the constructor. |
| new_question | Both | Final question text; unchanged for all robustness perturbations and most reliability perturbations. |
| expected_answer | Reliability | Gold refusal or clarification target, including the specific missing or conflicting evidence. |
| file_edit_required | Both | Whether the final package differs from the original files. |
| output_files input_file | Both | Delivered files and the file list exposed to evaluated LLMs. |
| Field | Track | Meaning |
|---|---|---|
| verdict | Both | Final pass/fail decision for accepting the generated instance. |
| independent_check_completed | Reliability | Whether the validator independently inspected the evidence rather than trusting the construction record. |
| original_answerable original_answer | Both | Whether the original task is answerable, or the independently recomputed original answer. |
| attack_rule_valid attack_effective | Both | Whether the perturbation satisfies the intended operator rule and has a real effect. |
| question_preservation_valid | Reliability | Whether the question-change policy for the reliability operator is obeyed. |
| file_edit_scope_valid | Reliability | Whether only allowed files, fields, or package membership were modified. |
| Operator | Track | AIDABench-QA | DABench | Total |
|---|---|---|---|---|
| FDM | Reliability | 175 | 221 | 396 |
| DM | Reliability | 109 | 173 | 282 |
| HC | Reliability | 92 | 116 | 208 |
| EC | Reliability | 78 | 70 | 148 |
| DAM | Reliability | 60 | 61 | 121 |
| FLM | Reliability | 32 | 0 | 32 |
| Failure stage | Operator | Share |
|---|---|---|
| Schema/evidence binding | FDM | 27.1% |
| Schema ambiguity detection | HC | 19.6% |
| Value-sufficiency check | DM | 18.4% |
| Evidence consistency check | EC | 16.7% |
| Multi-step dependency propagation | DAM | 10.3% |
| Input-completeness check | FLM | 4.5% |