cs.CLSep 24, 2026

CARGO: Context-Aware Retrieval-Gated Evaluation of Agentic AI in Production

Authors: Mukul Chhabra, Shail Patel, Luigi Medrano

Organizations: Dell Technologies

Read PDF
Ask AI
Cite

Copy citation

DOINot available for this paper

Abstract

Reference-based LLM-as-a-judge evaluation assumes the reference answer is the target. In deployed agentic systems that operate over dynamic entities (support cases, assets, accounts), the closest available reference typically applies the correct procedure to a different entity, so a literal judge penalizes different identifiers, dates, and statuses as errors or hallucinations. We name this failure mode reference-instance divergence (RID). We propose CARGO, a framework that (i) treats retrieved references as procedural exemplars and grounds factual judgments in the live instance's observed context, (ii) assigns each claim a three-way status (supported, contradicted, unverifiable) and penalizes only contradictions, and (iii) gates evaluation by retrieval confidence, casting production evaluation as selective prediction. We introduce CARGO-Bench, a perturbation-based diagnostic suite with ground truth by construction that separates leniency from discrimination. On CARGO-Bench (246 items, two judge models, 7,872 judgments), the standard reference-based judge penalizes 100% of correct entity-transplanted answers and is uninformative (discrimination index DI ~ 0); supplying the live facts without reframing changes nothing. CARGO eliminates these false penalties (0/50) while retaining near-complete contradiction recall (50/50 and 49/50), raising DI to 0.58 [0.48, 0.68]; a rubric-swap control attributes most of the effect to context-grounded dimension definitions. CARGO also exposes a limitation of its own design: the leniency that protects entity values suppresses detection of procedural corruptions (20% recall). A post-hoc fix does not close the gap, and an LLM-as-annotator study with written guidelines and adjudication shows the same blind spot. We release a preregistered protocol for extending the evaluation to expert agreement, risk-coverage, and cost on production traffic.

Figures & tables

Figure 1: Overview of Cargo . A live question is embedded and matched against the golden set; if the retrieval margin clears τ\tau , the retrieved reference is reinterpreted as a procedural exemplar and the answer is judged against it plus the live context; below τ\tau , Cargo abstains. Both paths log to trace diagnostics.
 Should not pen.Should pen.  
ConditionP1P3P2P4DI95% CI
Judge: gpt-oss-120b (mean of 3 seeds)
NoRef.44.64.96.66.24[.13, .35]
Direct1.001.001.001.00.00[.00, .00]
D+Ctx1.001.001.001.00.00[.00, .00]
Cargo+Auth.00.041.00.20.57[.47, .67]
Table 1: Cargo-Bench (246 items, 10 seeds), headline conditions ( D+Ctx = Direct+Ctx ); the three component-ablation conditions ( Cargo −- Ctx/Exemplar/ unv ) are in Table 2 (Appendix E ). Penalty rate per family (lower is better for P1/P3, higher for P2/P4); DI =TP−FP=\mathrm{TP}-\mathrm{FP} with item-level bootstrap CIs (10k). Direct penalizes every instance, including all correct entity transplants, and is therefore uninformative (DI ≈0\approx 0 ); adding the live context without reframing ( Direct+Ctx ) changes nothing. Cargo removes the false penalties and retains contradiction recall, but detects only 20% of procedural corruptions (P4); an explicit authority-split fix ( Cargo ++ Auth , post-hoc) does not improve on this.
Appendix figures & tables2 assets

Supplementary material from the paper’s appendix.

Appendix

 Should not pen.Should pen.  
ConditionP1P3P2P4DI95% CI
Judge: gpt-oss-120b (mean of 3 seeds)
Cargo −- Ctx.00.06.92.20.52[.42, .62]
Cargo −- Ex..00.021.00.20.59[.49, .68]
Cargo −- unv.00.021.00.20.59[.49, .68]
Judge: gpt-oss-20b (1 seed)
Appendix
Table 2: Cargo-Bench component ablations (246 items, 10 seeds), continuing Table 1 . Cargo −- Ex. = Cargo −- Exemplar (drops the “different instance” framing).
PromptRubricP1P3P2P4DI
Directgolden-ref.1.001.001.001.00.00
Directctx-grounded.03.17.90.33.49
Cargogolden-ref..23.401.00.47.39
Cargoctx-grounded.00.021.00.10.54
Appendix
Table 3: Rubric-swap control (gpt-oss-120b, seed 0, 150 items). The context-grounded dimension definitions account for most of the false-penalty reduction; the Cargo preamble adds leniency that removes residual false penalties but also suppresses detection of procedural corruptions.
More in this topic

LLM Evaluation

Large language model evaluation measures what models can do, how reliably they do it, and whether benchmark scores predict real-world performance.

See all 2,427 papers

Explore similar work

CardsList
Jun 19, 2026

Counsel: A Meta-Evaluation Dataset for Agentic Tasks

As agentic systems tackle increasingly complex multi-step tasks, evaluating their trajectories presents a major bottleneck - human annotation of a single trajectory on popular agentic benchmarks can take hours, making it difficult to scale evaluations for measuring performance or curating training data. This has driven widespread reliance on automated approaches such as LLM-as-a-judge (LLMJ) to critique agents at the process and outcome-levels at scale, however, the soundness of LLMJ critiques often goes unmeasured. Here, we introduce Counsel, the first public dataset of meta-evaluations for agentic tasks. Counsel consists of process-level critiques from open-weight LLMJs on two agent benchmarks: tau-bench (customer support agents) and DA-Code (coding agents), and human meta-evaluations of these critiques. Human annotators label critiques on each flagged error as "spot on", "correct location but poor reasoning", or "should not have flagged", achieving reliable inter-annotator agreement (Krippendorff's alpha of 0.78). The resulting dataset stratifies LLMJ critiques by human alignment across both error location within a trajectory and reasoning quality, serving as valuable data to calibrate, improve, or train LLMJs for agents. Comparing open-weight judges, we find that more capable judge models and more reasoning effort both enabled improved human agreement, with the strongest judge reaching ~88% agreement on location and ~65% on reasoning. Counsel is generated using open-weight models and is permissively licensed for broad community use, which we hope will enable rigorous study and improved alignment of LLM-based evaluators for agentic systems.

Sashank Pisupati, Henry Broomfield, Eujeong Choi +5

1Atla AI · 2Cohere AI · 3Mistral AI +1

LLM-as-a-JudgeLLM Agent EvaluationHuman-in-the-Loop EvaluationAutomated Agent Evaluation
AskPDF
Aug 27, 2026

AgentJudgeBench: A Multi-Difficulty Benchmark for Evaluating LLM Judges on Agentic Tool-Calling

LLM judges are widely used to evaluate agentic tool-calling systems, yet their reliability on structured, dependency-driven workflows remains largely unexamined. We present AgentJudgeBench, the first benchmark to systematically study LLM-as-a-judge reliability for agentic tool-calling over workflow DAGs, as distinct from the broader LLM-as-a-judge task of open-ended text or preference evaluation. The benchmark comprises 3,808 instances spanning six DAG topologies and three difficulty tiers, evaluated with five generators (3B-70B open-weight models and GPT-5.4) and six judges (20B to frontier scale) under paired with- and without-ground-truth conditions. Judge alignment degrades monotonically with task difficulty, 1.5x faster without ground truth, and on hard queries without ground truth all six judges converge to a narrow 77-82% band regardless of scale, revealing a structural ceiling driven primarily by task difficulty, though its height is partly prompt-dependent for weaker generators, that model capacity alone cannot overcome. Ground-truth exposure is not uniformly beneficial: it reduces alignment for GPT-5.4 (1.5 pp) and Gemini-2.5-Pro (3.9 pp), consistent with over-anchoring. Among mitigation strategies, chain-of-thought reasoning and judge temperature both have negligible effect, while structured evaluation rubrics improve alignment by up to 6.5 pp but do not generalize uniformly across judge-generator pairs. With ground truth, QwQ-32B best matches the programmatic reference, while a human validation study identifies GPT-OSS-120B as the most human-aligned judge; without it, frontier judges lead only marginally within the shared ceiling. These results expose fundamental limitations of current LLM judges and yield practical guidelines for reliable evaluation in agentic systems.

Abhigya Verma, Amit Kumar Saha, Seganrasan Subramanian +1

ServiceNow AI Hyderabad, India

LLM-as-a-JudgeLLM Agent EvaluationAutomated Agent EvaluationAI Agent BenchmarksTool-Use Evaluation
AskPDF
Jun 22, 2026

GroundEval: A Deterministic Replacement for LLM-as-Judge in Stateful Agent Evaluation

Before letting an agent operate over real context, can you prove it used the right evidence? GroundEval turns that question into a deterministic test of what the agent searched, fetched, cited, and was permitted to access. In one case study, two frontier LLM judges scored a plausible agent response 0.85 and higher. But the trace told a different story: the agent had never retrieved the artifact its answer depended on, yielding a GroundEval score of 0.000. We introduce GroundEval, a judge-free framework for evaluating agents against grounded, time-bounded, and access-controlled evidence. GroundEval uses a domain configuration to generate questions, lets the agent choose how to answer, and then scores both the final answer and the recorded trajectory that produced it. The benchmark targets three failures that LLM-as-judge evaluation struggles to detect: whether an agent checked before claiming absence, reasoned only from evidence available to the actor at the relevant time, and used the correct causal mechanism rather than a plausible one. These correspond to three tracks: Silence, Perspective, and Counterfactual. GroundEval exposes when plausible answers rest on invalid evidence paths, and produces structured per-question diagnostics that pair tool activity with the agent's turn-level narration, making each score inspectable rather than merely reported. Our case studies suggest this failure mode is common rather than exceptional, one that final-answer and judge-based evaluation cannot detect by construction.

Jeffrey Flynt

Independent Researcher

LLM Agent VerificationAI Agent BenchmarksTool-Use EvaluationLLM GroundingTool-Augmented Language Model AgentsLLM-as-a-Judge+8
AskPDF