Sensitivity or Criterion? Measuring and Moving When Language Models Act

Sixun Dong; Yebowen Hu; Ming Yin; Yiran Chen; Fei Liu; Chen Chen

cs.CLOct 11, 2026

Sensitivity or Criterion? Measuring and Moving When Language Models Act

Authors: Sixun Dong, Yebowen Hu, Ming Yin, Yiran Chen, Fei Liu, Chen Chen

Organizations: University of Central Florida · Zoom Communications · Duke University · Emory University

Abstract

Before an agent acts, it must decide whether action is warranted. A single accuracy cannot distinguish failure to recognize a warranted action from reluctance to act. Signal-detection theory separates sensitivity from criterion, but criteria estimated from authored binary labels depend on each benchmark's example mix. We introduce FlipAct, a diagnostic of tool use in physical states. A rule over annotated tool properties computes each answer and a graded evidence score, fixing the Yes/No boundary at zero across models. Questions form 2-by-2 quads that hold required knowledge fixed while the state flips. The slope of the fitted Yes-rate curve measures sensitivity; its crossing at one half measures criterion. Across 44 open models, sensitivity rises with size within a family, and its ranking agrees with three of four external when-to-act benchmarks. Models respond to evidence sign rather than magnitude, accepting actions that leave the state no better about as often as helpful ones. When Yes means act, most models are conservative across rephrasings; in some, this partly reflects a preference for No. Criterion is not determined by size. Activation steering shifts criterion with weights fixed; distillation from a model's own steered copy puts the shift into its weights without a significant sensitivity change. The distilled shift transfers to six external benchmarks, including two without Yes/No answers, while criterion-free AUC is preserved on the five benchmarks where it is available. Accuracy improves where models start conservative and declines or remains within error where they start permissive. Project page: https://sixundong.com/projects/flipact

Figures & tables

Panel of Figure 1 — Figure 1: (a) Share of should-call and of should-not-call When2Call examples that each model calls. (b) Schematic: at one sensitivity $d^{\prime}$ , the two models’ criteria trade hits for false alarms at the same accuracy. (c) The quad of Figure 2 on the evidence scale $\Delta U$ that FlipAct computes by rule, with the Yes/No boundary fixed at zero.

Panel of Figure 2 — Figure 2: The question template (left) and one quad (right) with each question’s answer and evidence score $\Delta U$ . The slot [<supply>] states that a prerequisite is met, for tools that have one.

Panel of Figure 3 — Figure 3: The FlipAct construction pipeline. Language models are used only in the orange steps, which annotate and screen tool properties; answers and evidence scores are computed by rule.

Figure 4: Yes-rate at each evidence score for the

21

reasoning-off models with a well-determined criterion (gray), with their median and interquartile band.

Figure 5: Sensitivity against criterion for the

27

reasoning-off models with an estimable criterion, with the distribution of the well-determined criteria on the right. Hollow markers at the edges are criteria beyond

\pm 3

. The line joins the two same-size Mistral-Small-24B releases.

Figure 6: (a) Correlation across the panel between FlipAct sensitivity

a

and external

d^{\prime}

, with bootstrap intervals; the hollow point is not significant. (b) Criterion against model size for the families with three or more estimable members, one line per generation. Hollow markers with an arrow are criteria beyond

+3

Model	unsteered	$+$ steering	unsteered	$+$ steering	$\Delta$ acc.
	call rate $\uparrow$		criterion $c$ $\downarrow$
Qwen3-8B	$0.56$	$\mathbf{0.60}$	$-0.18$	$\mathbf{-0.32}$	$-0.022$
Qwen3.5-27B	$0.47$	$\mathbf{0.50}$	$+0.10$	$\mathbf{+0.01}$	$+0.005$
gemma-2-9b	$0.24$	$\mathbf{0.29}$	$+0.78$	$\mathbf{+0.59}$	$+0.002$
Mistral-24B	$0.37$	$\mathbf{0.55}$	$+0.39$	$\mathbf{-0.13}$	$-0.032$
phi-4	$0.57$	$\mathbf{0.59}$	$-0.30$	$\mathbf{-0.33}$	$-0.038$

Table 1: Steering on When2Call, unsteered and at the selected strength, both measured on the same

600

examples. Arrows mark a move toward acting, and bold a change in that direction.

Student	$a$	$\tau$	Acc.	$a$	$\tau$ $\downarrow$	Acc. $\uparrow$	$a$ $\uparrow$	$\tau$	Acc. $\uparrow$
	Baseline			Criterion distillation			Sensitivity learning
Qwen3-8B	$0.47$	$+2.33$	$0.60$	$0.55$	$\mathbf{-2.11}$	$\mathbf{0.64}$	$\mathbf{1.09}$	$-0.02$	$\mathbf{0.78}$
control				$+0.02$	$+0.04$	$+0.00$	$-0.19$	–	$-0.04$
Qwen3.5-9B	$0.75$	$+1.88$	$0.65$	$0.73$	$\mathbf{+0.86}$	$\mathbf{0.70}$	$\mathbf{1.22}$	$+0.18$	$\mathbf{0.83}$
control				$+0.00$	$+0.20$	$-0.01$	$-0.30$	–	$-0.04$
gemma-3-12b	$0.36$	$+2.17$	$0.59$	$0.35$	$\mathbf{+0.30}$	$\mathbf{0.61}$	$\mathbf{1.56}$	$-0.41$	$\mathbf{0.83}$

Table 2: Held-out coordinates and accuracy of each student before training, after criterion distillation and after sensitivity learning (§ 5.4 ), seed means; shaded rows give the change under each control. Bold marks a change in the targeted direction (arrows). –: not estimable in every seed. † Beyond

\pm 3

Figure 7: Criterion shift on six external benchmarks after criterion distillation (filled) and under the random-direction control (hollow), seed means

\pm

SD. Each benchmark has its own scale; negative is toward acting. Qwen3.5-9B on BFCL-miss-func is left out because its baseline does not reproduce.

Table 10

Appendix figures & tables38 assets

Supplementary material from the paper’s appendix.

Appendix

			Example tool
Axis	Quantity	Problem poles	adds ( $\delta=+1$ )	removes ( $\delta=-1$ )
Thermal transfer	temperature	cold / hot	pocket hand warmer	ice pack
Radiant emission	visible light	dark / glaringly bright	electric lamp	blackout curtain
Mechanical cohesion	connectedness	loose / jammed	thread lock compound	puller
Spatial containment	seal	exposed / sealed shut	lid	cap opener
Electromagnetism	circuit continuity	without power / overloaded	ac adapter	emergency stop button

Appendix

Table 5: The annotation schema: the six physical axes, each with its two problem poles as the questions word them and an example tool in each direction, and the other fields of a tool record.

State		Tool			Outcome
	$v$		$\delta$	$\mu$	$v+\delta\mu$	$\Delta U$	Type	Answer
$A$ : slightly cold	$-1$	blanket	$+1$	$1$	$0$	$+1$	solution	Yes
	$-1$	ice bath	$-1$	$2$	$-3$	$-2$	destructive	No
$B$ : very hot	$+2$	ice bath	$-1$	$2$	$0$	$+2$	solution	Yes
	$+2$	blanket	$+1$	$1$	$+3$	$-1$	destructive	No
slightly hot	$+1$	ice bath	$-1$	$2$	$-1$	$0$	redundant	No

Appendix

Table 6: One tool pair: the four questions of the quad and the ice bath’s redundant question, with the rule’s computation for each.

Question type		Physical axis		Evidence score $\|\Delta U\|$
solution	$940$	Mechanical cohesion	$564$	$0$	$231$
destructive	$705$	Thermal transfer	$476$	$1$	$798$
redundant	$235$	Electromagnetism	$234$	$2$	$719$
		Spatial containment	$226$	$3$	$132$
		Moisture level	$212$
		Radiant emission	$168$

Appendix

Table 7: Number of questions in the main set by question type, physical axis and evidence score.

Figure 8: Counts at each stage of the FlipAct construction. A1: the ten entity sources. A2: the six filter levels that produce the entity pool. B: the pool through tool-property annotation and the screens to tool records, then tool pairs, situations and questions. A1 and B use a log scale, A2 a linear one.

Sensitivity and ranking
	N1 uniform	N2 empirical	N3 stress
Answers flipped	$10.7\%$	$15.7\%$	$26.0\%$
$\rho(a)$ , median	$0.992$	$0.991$	$0.984$
$\rho(\tau)$ , median	$0.996$	$0.995$	$0.990$
$a$ ratio, perturbed / unperturbed, median	$0.980$	$0.965$	$0.976$
Criterion

Appendix

Table 8: Coordinates under three levels of annotation noise,

300

replicates per condition. The last block is the criterion recovered for a synthetic observer.

Constant policies
	Coordinates		FlipAct scores					When2Call
Model	$a$	$\tau$	ACC	SQPR	$F_{1}$	TNR	MCC	$d^{\prime}$	$c$	Panel
Always-No	n/a	n/a	$0.50$	$0.18$	n/a	$1.00$	n/a	n/a	n/a
Always-Yes	n/a	n/a	$0.50$	$0.35$	$0.67$	$0.00$	n/a	n/a	n/a
Qwen3.5
Qwen3.5-0.8B	$-0.52$ †	n/a	$0.50$	$0.19$	$0.07$	$0.95$	$-0.02$	$0.27$	$+0.22$

Appendix

Table 9: Coordinates of all

44

models on FlipAct and their When2Call

d^{\prime}

and

c

, grouped by family with the reasoning-on entries last, and two constant policies for reference. Checkpoints are in Table 10 .

Entry	Checkpoint	Weights
Qwen3.5 ( Qwen Team, 2026 )
Qwen3.5-0.8B	Qwen/Qwen3.5-0.8B	bf16
Qwen3.5-2B	Qwen/Qwen3.5-2B	bf16
Qwen3.5-4B	Qwen/Qwen3.5-4B	bf16
Qwen3.5-9B	Qwen/Qwen3.5-9B	bf16
Qwen3.5-27B	Qwen/Qwen3.5-27B	bf16

Appendix

Table 10: The Hugging Face checkpoint behind each entry and the precision of its weights, grouped by family with the family’s reference. The reasoning-mode comparison of App. B.7 also runs the listed checkpoints with reasoning on.

Benchmark	Act / withhold	Act example (withhold example)	Reply format
Panel comparison (§ 4.2 )
BFCL v3 live simple, live irrelevance	$80$ / $36$	a query its one listed function answers (a query no listed function fits)	free-form; CALL: f(…) acts
Panel comparison and transfer test (§ 4.2 , § 5.3 )
QuestBench Logic-Q ( $500$ of $1{,}150$ tasks), GSM-Q CSP ( $151$ ), GSM-Q verbal ( $288$ )	$939$ / $939$	a fully specified task (the same task with one variable removed); acting is Yes to “Do you already have enough information to give a single correct final answer …?”	Yes/No
When2Call test, multiple choice	$1{,}295$ / $2{,}357$	a request whose correct reply is a tool call (one whose correct reply asks for missing information, $1{,}062$ , or says no tool can answer, $1{,}295$ ); acting is choosing the tool-call reply	one letter for four replies: call, ask, cannot answer, answer directly
When2Tool single-hop test, $15$ environments	$750$ / $750$	a hard-tier task, built to need a tool (an easy-tier task, solvable without one; the $750$ medium-tier tasks are not scored); acting is Yes to “would you need to use one of the tools?”	Yes/No

Appendix

Table 11: The external benchmarks, grouped by the comparison that uses them: source split, number of examples in each class, the act and withhold examples, and the reply format.

$\Delta U$	$-3$	$-2$	$-1$	$0$	$+1$	$+2$	$+3$
Median Yes-rate	$0.14$	$0.17$	$0.13$	$0.40$	$0.43$	$0.52$	$0.46$

Appendix

Table 12: Median Yes-rate at each evidence score over the

21

models with a well-determined criterion, the median line of Figure 4 .

Main set
Questions	Answer	Median Yes-rate	Range
destructive, $\Delta U<0$	No	$0.15$	$[0.03,0.51]$
slight overshoot, $\Delta U=0$	No	$0.40$	$[0.18,0.70]$
helpful, $\Delta U>0$	Yes	$0.47$	$[0.30,0.76]$
Already satisfied
state at its goal	No	$0.08$	$[0.01,0.68]$

Appendix

Table 13: Yes-rate on the main set by evidence sign and on the two supplementary sets, median and range over the

21

models with a well-determined criterion. Each supplementary question is paired with a matched question whose answer is Yes.

	Rank agreement		Criterion	$r$ (sensitivity, external $d^{\prime}$ )
Readout	$\rho$ (sens.)	$\rho$ (crit.)	interval $>0$	BFCL	QuestBench	When2Call
Logistic, all questions ( $a$ , $\tau$ )	$1.00$	$1.00$	$16$	$+0.70$	$+0.69$	$+0.67$
Logistic, $\Delta U=0$ left out	$0.98$	$1.00$	$17$	$+0.69$	$+0.65$	$+0.65$
Signal detection, $d^{\prime}$ and $c$	$0.99$	$0.77$	$18$	$+0.70$	$+0.65$	$+0.65$
Signal detection, $d^{\prime}$ and $c/d^{\prime}$	$0.99$	$0.99$	$18$	$+0.70$	$+0.65$	$+0.65$

Appendix

Table 14: The logistic coordinates beside a signal-detection readout that leaves out

\Delta U=0

. Rank agreement with the logistic fit and the count of criteria with an interval above zero are over the

21

models with a well-determined criterion, and

r

is over the panel. Shaded: the fit of the main text.

	Sensitivity $a$ vs. $d^{\prime}$			Criterion $\tau$ vs. $c$
Benchmark	$r$	$p$	95% interval	$r$	$p$
BFCL ( Patil et al., 2025 )	$+0.70$	$0.0013$	$[+0.39,+0.90]$	$+0.51$	$0.030$
QuestBench ( Li et al., 2026 )	$+0.69$	$0.0015$	$[+0.46,+0.88]$	$-0.02$	$0.930$
When2Call ( Ross et al., 2025 )	$+0.67$	$0.0024$	$[+0.40,+0.87]$	$-0.01$	$0.954$
When2Tool ( Sun et al., 2026 )	$+0.02$	$0.9324$	$[-0.50,+0.57]$	$+0.19$	$0.439$

Appendix

Table 15: Each FlipAct coordinate against its counterpart on the four external benchmarks of § 4.2 , over the panel of

18

models.

Figure 9: The two coordinates against their external counterparts for the panel models, on the three benchmarks where sensitivity converges. Top: sensitivity against

d^{\prime}

. Bottom: criterion against

c

, with the number of models in each quadrant in gray. A dashed line marks a significant correlation.

Cutoff $a\geq$	$n$	$r$	$p$	$r$	$p$
		$a$ vs. $d^{\prime}$		$\tau$ vs. $c$
$0.25$	$20$	$+0.77$	$0.0001$	$-0.46$	$0.041$
$0.30$	$18$	$+0.67$	$0.0024$	$-0.01$	$0.95$
$0.35$	$16$	$+0.53$	$0.033$	$-0.29$	$0.28$

Appendix

Table 16: The When2Call correlations of both coordinates at three panel cutoffs, over nested panels. Shaded: the cutoff of the main text.

Partialed out	BFCL	QuestBench	When2Call	When2Tool
none	$+0.70$	$+0.69$	$+0.67$	$+0.02$
none, $15$ models with MMLU	$+0.71$	$+0.75$	$+0.72$	$-0.27$
log parameters	$+0.64$	$+0.63$	$+0.62$	$-0.18$
MMLU ( $n=15$ )	$+0.53$	$+0.55$	$+0.52$	$-0.67$
FlipAct accuracy	$+0.54$	$+0.54$	$+0.56$	$-0.20$
FlipAct $d^{\prime}$	$+0.19$	$-0.11$	$+0.08$	$-0.37$

Appendix

Table 17: Correlation of

a

with external

d^{\prime}

on the panel of

18

models, raw and with each indicator partialed out. The shaded row repeats the raw correlation on the

15

models with MMLU.

Line	Size	Model	Released	$a$	$\tau$
Qwen	4B	Qwen3-4B	2025-04	$0.34$	${>}{+}3$
		Qwen3.5-4B	2026-03	$0.55$	$+2.93$
	8–9B	Qwen3-8B	2025-04	$0.44$	$+2.78$
		Qwen3.5-9B	2026-03	$0.66$	$+2.88$
	27–32B	Qwen3-32B	2025-04	$0.58$	$+0.14$
		Qwen3.5-27B	2026-02	$0.57$	$+2.68$

Appendix

Table 18: Coordinates of the Qwen and Gemma generations at comparable sizes, with the month the weights were released. A

\tau

beyond the score range is shown as a bound.

4B and below
	$a$			$\tau$
Model	off	on	$\Delta$	off	on	$\Delta$
Qwen3-1.7B	$0.04$	$0.42$	$\mathbf{+0.38}$	–	$+1.05$	–
Qwen3-4B	$0.32$	$0.45$	$\mathbf{+0.13}$	–	–	–
Nemotron-3-Nano-4B	$0.28$	$0.49$	$\mathbf{+0.21}$	–	$+2.42$	–
Qwen3.5-4B	$0.56$	$0.66$	$\mathbf{+0.10}$	$+2.87$	$+1.91$	$\mathbf{-0.96}$

Appendix

Table 19: Reasoning mode off and on. Bold marks a significant rise in

a

or fall in

\tau

	Canonical wording		Sign kept under			Decomposition
Model	$\tau$	Yes-rate	unwise	avoid	mistake	$\tau_{d}$	$b$
Sign kept under all three wordings
Yi-1.5-34B	$+0.32$	$0.48$	✓	✓	✓	$+0.62$	$-0.30$
Qwen3-14B	$+2.62$	$0.23$	✓	✓	✓	$+2.04$	$+0.58$
gemma-2-9b	$+3.65$ †	$0.21$	✓	✓	✓	$+4.55$ †	$-0.90$
gemma-2-27b	$+2.50$	$0.25$	✓	✓	✓	$+2.80$	$-0.30$

Appendix

Table 20: Sign of the criterion under the three reversed wordings, and its split into a threshold on the evidence

\tau_{d}

and an answer preference

b

Rephrasing	$\tau>0$	$\rho(\tau)$	Median $\Delta\tau$	$\rho(a)$
“appropriate”	$16$	$0.86$	$-0.63$	$0.90$
“should use”	$15$	$0.89$	$-0.54$	$0.91$
“the right tool”	$16$	$0.77$	$-0.08$	$0.94$
“makes sense”	$16$	$0.96$	$-0.87$	$0.88$
“would recommend”	$16$	$0.88$	$-0.15$	$0.88$

Appendix

Table 21: Both coordinates under five same-polarity rephrasings of the canonical question,

16

panel models. Rank correlations are with the canonical wording asked in the same run, on which all

16

criteria are positive.

				Against controls
Model	$\lambda^{\star}$	Fitted $\Delta c$	$q$	Ratio	Retained
Significant, three times the largest control, half retained, monotone in $\lambda$
Command-R-08-2024	$32$	$-1.04$	$<0.001$	$4.8$	$1.01$
Mistral-24B ∗	$64$	$-1.14$	$<0.001$	$4.9$	$1.09$
Qwen3-8B ∗	$16$	$-0.27$	$<0.001$	$3.7$	$0.91$
gemma-2-9b ∗	$64$	$-0.65$	$0.004$	$3.4$	$0.69$

Appendix

Table 22: Steering on When2Call for all

16

models, grouped by the tests the shift passes. Negative shift is toward acting, and ∗ marks a model of Table 1 .

Figure 10: When2Call criterion

c

(top) and

d^{\prime}

(bottom) against the injected strength

\lambda

for the five models of Table 1 . Each column has its own range of

\lambda

. Gray marks strengths outside the

d^{\prime}

-stable range, and circles mark

\lambda^{\star}

	Criterion $c$			Accuracy
Model	before	$+$ steering	$\Delta d^{\prime}$	before	$\Delta$
Qwen3.5-9B	$+0.75$	$+0.42$	$-0.02$	$0.654$	$+0.026$
Qwen3.5-27B	$+0.57$	$+0.39$	$+0.03$	$0.642$	$+0.016$

Appendix

Table 23: Steering on the held-out half of FlipAct , with the direction and strength fit on the other half.

		gemma-2-9b	Mistral-24B	phi-4	Qwen3.5-27B	Qwen3-8B
$\Delta c$	full	$-.18$	$-.53$	$-.03$	$-.10$	$-.14$
	held-out	$-.18$	$-.53$	$-.01$	$-.08$	$-.14$
	[2.5, 97.5]	$[-.25,-.13]$	$[-.61,-.29]$	$[-.06,+.11]$	$[-.11,-.04]$	$[-.21,-.08]$
$\Delta$ call rate	full	$+.052$	$+.178$	$+.019$	$+.025$	$+.045$
	held-out	$+.048$	$+.175$	$+.012$	$+.022$	$+.047$
	[2.5, 97.5]	$[+.035,+.068]$	$[+.096,+.210]$	$[-.026,+.027]$	$[+.010,+.027]$	$[+.028,+.067]$

Appendix

Table 24: Split-half check of the When2Call steering shift:

\lambda^{\star}

chosen on one half and read on the other, beside the full-set value.

Model	When2Tool	BFCL-miss-func	ACPBench	CaT-Bench
Qwen3-8B	$-1.08$ $\bullet$	$-0.54$ $\bullet$	$-1.11$ $\bullet$	$-0.80$ $\bullet$
Mistral-24B	no stable $\lambda$	$-1.95$ $\bullet$	$-1.94$ $\bullet$	no stable $\lambda$
Qwen3.5-27B	$-1.09$	$-0.24$	$-0.47$	$-0.74$ $\bullet$

Appendix

Table 25: The FlipAct criterion direction on four further benchmarks with the weights fixed: shift in

c

inside the

d^{\prime}

-stable range, negative toward acting.

Both schemes
Split	$63$ connected components: $940$ training and $940$ held-out questions ( $247$ and $248$ state flips)
Adapter	LoRA with $r=16$ , $\alpha=32$ and dropout $0.05$ on the q, k, v, o, gate, up and down projections (on gemma-3-12b, of the language-model layers only)
Precision	bf16 weights
Clipping	gradient norm $1$
Seeds	$0$ , $1$ and $2$
	Criterion distillation	Sensitivity learning

Appendix

Table 26: Training settings of the two schemes.

Student	teacher	same-norm random	Ratio
	Mean $\|\Delta\|$ Yes–No margin
Qwen3-8B	$18.70$	$1.18$	$15.8$
Qwen3.5-9B	$2.48$	$0.31$	$7.9$
gemma-3-12b	$4.22$	$0.46$	$9.2$
Mistral-24B	$3.24$	$0.08$	$40.4$

Appendix

Table 27: Perturbation of the Yes–No logit margin at each student’s selected strength, by the criterion teacher and by a random direction of the same norm.

Student	Base $\tau$	$\|\Delta\|$ margin	$\tau$		$\|\Delta\|$ margin	$\tau$	$d^{\prime}$	Yes-rate
		Criterion teacher		Matched random direction
Qwen3-8B	$+2.67$	$18.70$	$-2.11$	random dir. 1	$16.41$	–	$0.00$	$0.00$
				random dir. 2	$17.16$	–	$0.00$	$1.00$
Qwen3.5-9B	$+2.19$	$2.48$	$+1.08$	random dir. 1	$2.62$	–	$0.00$	$0.00$
				random dir. 2	$2.46$	$+2.16$	$1.00$	$0.24$
gemma-3-12b	$+2.50$	$4.22$	$+0.83$	random dir. 1	$4.35$	$+2.87$	$0.64$	$0.26$

Appendix

Table 28: The criterion teacher beside two random directions per student, each scaled until it perturbs the Yes–No logit margin as much as the teacher does, with both coordinates refit at that strength.

Student	Condition	$\Delta a$		$\Delta\tau$		$\Delta$ acc.
Criterion distillation
Qwen3-8B	distilled	$+0.09$	${}\pm{}$ $0.08$	$-4.44$	${}\pm{}$ $0.69$	$+0.033$	${}\pm{}$ $0.018$
	random direction	$+0.02$	${}\pm{}$ $0.01$	$+0.04$	${}\pm{}$ $0.05$	$+0.003$	${}\pm{}$ $0.004$
Qwen3.5-9B	distilled	$-0.01$	${}\pm{}$ $0.06$	$-1.02$	${}\pm{}$ $0.22$	$+0.045$	${}\pm{}$ $0.011$
	random direction	$+0.00$	${}\pm{}$ $0.02$	$+0.20$	${}\pm{}$ $0.06$	$-0.009$	${}\pm{}$ $0.005$
gemma-3-12b	distilled	$-0.02$	${}\pm{}$ $0.04$	$-1.86$	${}\pm{}$ $0.98$	$+0.014$	${}\pm{}$ $0.012$

Appendix

Table 29: Held-out change for every training condition of Table 2 , as the seed mean

\pm

the largest per-seed paired bootstrap error. Bold marks a change toward acting in

\tau

, a rise in

a

after sensitivity learning and a rise in accuracy. A

\ddagger

marks a cell with two usable seeds, and n/a one with fewer. Shaded: control.

Distilled student
	Benchmark	Qwen3-8B	Qwen3.5-9B	gemma-3-12b	Mistral-24B
Act now	When2Call	$-0.05\pm 0.01$	$-0.06\pm 0.01$	$-0.04\pm 0.01$	$-0.07\pm 0.01$
	QuestBench	$-1.97\pm 0.05$	$-0.55\pm 0.03$	$-0.82\pm 0.03$	$-0.86\pm 0.04$
	When2Tool	$-0.58\pm 0.03$	$-0.34\pm 0.03$	$-0.32\pm 0.10$	$-0.52\pm 0.11$
	BFCL-miss-func	$-0.21\pm 0.05$	–	$-0.05\pm 0.03$	$-0.14\pm 0.04$
Planning	ACPBench	$-0.81\pm 0.12$	$-0.31\pm 0.10$	$-0.21\pm 0.07$	$-0.32\pm 0.10$

Appendix

Table 30: Values behind Figure 7 : criterion shift on six external benchmarks for the distilled student and its random-direction control, seed mean

\pm

paired error. Negative is toward acting. Shaded: control.

Started conservative ( $c>0$ )
Student	Benchmark	Start $c$	$\Delta$ bal. acc.
Qwen3-8B	When2Tool	$+0.42$	$+0.014$
	QuestBench	$+0.71$	$+0.041$
	ACPBench	$+0.40$	$+0.025$
Qwen3.5-9B	When2Tool	$+0.73$	$+0.046$
	ACPBench	$+0.65$	$+0.052$

Appendix

Table 31: Change in balanced accuracy after criterion distillation, seed means, grouped by the starting criterion on each benchmark. Qwen3.5-9B on BFCL-miss-func is left out, as in Figure 7 .

	Qwen3-8B		Qwen3.5-9B		gemma-3-12b		Mistral-24B
Benchmark	distilled	control	distilled	control	distilled	control	distilled	control
When2Call	$-0.008$	$0.000$	$-0.006$	$+0.001$	$+0.001$	$+0.001$	$-0.002$	$0.000$
When2Tool	$+0.004$	$-0.001$	$-0.001$	$0.000$	$+0.011$	$+0.003$	$+0.001$	$0.000$
QuestBench	$-0.012$	$0.000$	$-0.002$	$0.000$	$-0.005$	$-0.001$	$+0.002$	$0.000$
ACPBench	$+0.001$	$+0.001$	$+0.001$	$-0.001$	$+0.004$	$+0.001$	$-0.003$	$0.000$
CaT-Bench	$+0.001$	$0.000$	$+0.008$	$-0.001$	$-0.003$	$-0.001$	$+0.002$	$+0.001$

Appendix

Table 32: Change in criterion-free AUC after criterion distillation and for its random-direction control, seed mean against the base model: the values of Table 4 with the control beside them.

Benchmark	$\|\Delta c\|$	$\Delta d^{\prime}$	$\Delta\mathrm{AUC}$	$s$
QuestBench	$1.99$	$+0.720$	$-0.0117$	$1.42$
ACPBench	$0.82$	$+0.162$	$+0.0007$	$0.91$
CaT-Bench	$0.59$	$-0.142$	$+0.0013$	$0.80$
When2Tool	$0.58$	$-0.010$	$+0.0037$	$1.15$
When2Call	$0.05$	$-0.067$	$-0.0077$	$1.00$

Appendix

Table 33: Criterion distillation on Qwen3-8B, seed mean against the base model: size of the criterion shift, change in single-point

d^{\prime}

and in criterion-free AUC, and the base model’s fitted ROC slope

s

. Rows are ordered by the size of the criterion shift.

	Change in act-rate		Parts
Student	canonical	reversed	shared	flipping
Qwen3-8B	$+0.30$	$-0.11$	$+0.09$	$+0.20$
Qwen3.5-9B	$+0.07$	$-0.03$	$+0.02$	$+0.05$
gemma-3-12b	$+0.09$	$-0.11$	$-0.01$	$+0.10$
Mistral-24B	$+0.21$	$-0.03$	$+0.09$	$+0.12$

Appendix

Table 34: Change in the held-out act-rate after criterion distillation under the canonical wording and under the three reversed wordings (their mean), and its shared and flipping parts, as seed means.

Student	Benchmark	distilled	random	Yes-bias	mean		seed 0	seed 1	seed 2
		$\Delta c$ , seed mean			distilled $-$ Yes-bias
Qwen3-8B	When2Call	$-0.051$	$+0.004$	$-0.026$	$-0.025$ ${}\pm{}$	$0.005$	$-0.024$	$-0.018$	$-0.031$
	BFCL-miss-func	$-0.208$	$+0.017$	$-0.159$	$-0.050$ ${}\pm{}$	$0.025$	$-0.072$	$-0.072$	$-0.005$
gemma-3-12b	When2Call	$-0.043$	$-0.006$	$-0.006$	$-0.037$ ${}\pm{}$	$0.006$	$-0.047$	$-0.026$	$-0.037$
	BFCL-miss-func	$-0.053$	$+0.008$	$+0.021$	$-0.074$ ${}\pm{}$	$0.022$	$-0.113$	$-0.069$	$-0.040$

Appendix

Table 35: Criterion shift on the two benchmarks without a Yes answer for the distilled, random-direction and Yes-bias students, and the difference between the distilled and the Yes-bias student, paired on examples, overall and per seed. Negative is toward acting.

(a) Condition	Pairs	Improved	Unchanged	Degraded
Fixed push toward acting	$25$	$2$	$11$	$12$
Per-benchmark push	$25$	$5$	$19$	$1$
Answer-token bias	$20$	$5$	$15$	$0$

Appendix

Table 36: Choosing the push on fifty examples of each benchmark. (a) Outcomes over model–benchmark pairs, with the fixed push for comparison (shaded). (b) Median change in balanced accuracy over twenty splits for the per-benchmark steering push and for an answer-token bias chosen by the same rule.

	FlipAct (c)	QuestBench (d)
Pairs	$354$	$288$
Question that warrants acting above its twin
base model	$69\%$	$92\%$
distilled student	$68$ – $69\%$	$93$ – $94\%$
random-direction control	$68$ – $69\%$	$92\%$
Pairs the base model answers No to twice	$189$	$187$

Appendix

Table 37: Pair counts behind boxes (c) and (d): how often the question that warrants acting keeps the higher margin, and how the distilled student answers the pairs the base model answers No to twice. Shaded: base model and control.

Readout	$a$	95% interval	$\tau$	95% interval	AUC
Statement, binarized at one half	$0.62$	$[0.47,0.80]$	$+1.35$	$[+0.83,+2.02]$	$0.748$
Choice between use and avoid	$0.61$		$+1.29$		$0.750$

Appendix

Table 38: JEV on FlipAct under two readouts of the same decision, which give the same coordinates and the same criterion-free AUC.

Benchmark	Decision	Ground truth	Ctrl. neg.	Graded	Sens./crit.
When2Call ( Ross et al., 2025 )	tool call/abstain	LLM+human	$\sim$	✗	✗
BFCL ( Patil et al., 2025 )	function applies?	human	$\sim$	✗	✗
MetaTool ( Huang et al., 2024 )	tool needed?	human/template	$\sim$	✗	✗
When2Tool ( Sun et al., 2026 )	call vs. no-call	env-computed	✓	$\sim$ (diff.)	✗
Shi et al. (2026)	tool call/abstain	LLM judge	✗	$\sim$ (SAE)	$\sim$ (offset)
AgentAbstain ( Liu et al., 2026 )	act vs. abstain	pipeline+judge	✓	✗	$\sim$ (paired)

Appendix

Table 39: When-to-act benchmarks on the design choices of § 2 : ✓ full,

\sim

partial, ✗ absent.

Agent Evaluation

Agent evaluation measures how reliably AI systems act, use tools, and complete tasks across interactive environments.

See all 144 papers

Oct 22, 2026

Prompt Sensitivity in Tool-Augmented Model Comparisons

Language models are compared on question-answering benchmarks that pose each question in one wording, and a reworded question can change which of two models scores higher. We ask whether giving the models tools makes such comparisons more stable. An accuracy gain cannot answer this, because tools change several steps between the question and the scored answer at once. We propose a matched protocol that separates those steps: the answer readout, reasoning, the decision to call, the tool's answer, and the report supplied without a call. We apply it to six open models in five domains under five wordings. We find that tools raise accuracy where a program answers the question and widen the wording sensitivity of many pairwise comparisons. The widening follows how often a model calls, and call frequency follows the wording for some models and not others. It also depends on the interface and the instructions: a native tool-calling interface and a second tool description leave no detected widening in molecules, and sensitivity persists where tools return intermediate results. These findings show that deterministic reports do not guarantee stable comparisons. We recommend reporting call frequency and comparison stability under several wordings beside accuracy.

Mateusz Modrzejewski, Tomasz Radzikowski

Institute of Computer Science, Warsaw University of Technology

LLM Evaluation Prompt Sensitivity LLM Tool Use Language Model Robustness

Ask PDF

May 27, 2026

When Context Flips, Safety Breaks: Diagnosing Brittle Safety in Aligned Language Models

Safety benchmark scores provide incomplete evidence of deployment readiness: aligned language models often adhere to rigid rules even when a situational update flips which action is safe. We term this failure brittle safety. To diagnose it, we introduce context-flip evaluation, testing 12 models across a safety benchmark (PacifAIst) and two commonsense controls using paired variants where the nominally safe action produces harm. Three findings emerge. First, brittle safety is safety-specific: all 12 models exhibit a safety-commonsense gap (mean +17.4 pp). Baseline accuracy fails to predict brittleness: among models above 90% baseline accuracy, brittleness rates range from 13.7% to 90.0%. Second, failures stem from policy override rather than miscomprehension: despite acknowledging the context change in every case, models persist via three distinct mechanisms that vary by update type and model family. Third, on a hand-audited probe of catastrophic consequence-flip scenarios, standard action-level guardrails catch none, while a state-aware validator catches all without false alarms on correct interventions. This indicates that action-level content moderation is systematically blind to consequence-flips, motivating state-aware architectural alternatives. We release our protocol, perturbed benchmarks, and deployment probe.

Dasol Choi, Alex Kwon

AIM Intelligence · Independent Researcher

LLM Safety Benchmarks Counterfactual Evaluation Language Model Safety Evaluation LLM Guardrails AI Agent Safety Benchmarks

Ask PDF

Sep 28, 2026

Nudgeability: Reasoning Models Follow Confidence Signals Without Tracking Their Own Competence

Reasoning language models that can call tools must decide during inference whether to answer unaided or delegate. Any self-reflection mechanism for this must answer three questions: where the reflective signal comes from (verbal reports, output distributions, hidden states, a separate predictor), how it is presented to the model (numerical prediction, confidence token, prompt injection), and whether it changes the model's subsequent action. We isolate the third question. At a fixed point in otherwise identical reasoning trajectories, we insert a single first-person sentence expressing either confidence or doubt; the model then continues reasoning and chooses whether to answer directly or call a tool. Comparing these counterfactual continuations measures the causal effect of the reflective signal on delegation. We call this behavioral response Nudgeability and measure it along two dimensions: sensitivity, how strongly confidence and doubt change delegation rates, and targeting, whether delegation increases for problems the model cannot solve unaided and decreases for those it can. Across nine small-to-medium open-weight reasoning models from three families (Qwen, Gemma, and GLM) and two tasks, models are consistently sensitive: doubt increases delegation and confidence decreases it, with a median confidence-to-doubt swing of 20.6 percentage points, and 53 to 70 points for the larger provider-served models. This responsiveness is poorly targeted: a median 42% of induced flips are well-targeted, only a +2 percentage-point lift over a random-selection baseline. Confidence language is thus a strong control surface for delegation, but current models use it only weakly in accordance with their actual competence. Nudgeability offers a simple, post-training-free way to evaluate both sensitivity and targeting as endogenous self-reflection mechanisms mature.

Rohit Saxena, Utkarsh Upadhyay

Language Model Self-Assessment LLM Tool Use Causal Interventions in Language Models Metacognition in Language Models Self-Reflection in Language Model Agents

Ask PDF

Abstract

Agent Evaluation

Explore similar work

Prompt Sensitivity in Tool-Augmented Model Comparisons

When Context Flips, Safety Breaks: Diagnosing Brittle Safety in Aligned Language Models

Nudgeability: Reasoning Models Follow Confidence Signals Without Tracking Their Own Competence