Uncovering Robustness Weaknesses in LLM Agents via Persona Evolution with Task-Integrity Constraints

Yutao Xie; Jingbo Yang; Guanyu Yao; Xiaoyu Yang; Duo Ding; Shiyu Chang

cs.AIOct 12, 2026

Uncovering Robustness Weaknesses in LLM Agents via Persona Evolution with Task-Integrity Constraints

Authors: Yutao Xie, Jingbo Yang, Guanyu Yao, Xiaoyu Yang, Duo Ding, Shiyu Chang

Organizations: University of California, Santa Barbara · Cresta

Abstract

Interactive-agent evaluations commonly rely on standardized LLM-based user simulators that exhibit broadly cooperative behavior, potentially overlooking failures that arise under diverse but realistic user interactions. This can lead to overly optimistic estimates of agent robustness and provide limited failure signals for training agents that generalize across users. Existing approaches largely rely on predefined user behaviors, which may miss agent- or domain-specific weaknesses, while failure-oriented search can reduce task success by invalidating the underlying task rather than exposing genuine robustness failures. To fill this gap, we introduce TIPER, a task-integrity-preserving persona evolution method that automatically discovers agent-specific user policies exposing robustness weaknesses while keeping the underlying task valid and solvable. TIPER evolves persistent user personas through reflection-guided behavioral mutations and task-wise Pareto selection under a task-integrity constraint. Across four interactive-agent benchmarks, TIPER yields lower held-out avg@3 scores in all 12 GPT-5.4 settings, with observed reductions of 5.8 to 33.7 percentage points, and in all 28 agent-domain pairs spanning seven agents, with a median observed reduction of 22.9 points. Further analysis yields a behavior-to-failure taxonomy that connects discovered user behaviors to recurring agent failure modes. Together, these results show that TIPER enables more diagnostic robustness evaluation of interactive agents and provides informative failure analysis for future agent robustness improvement. Code repository: https://github.com/UCSB-NLP-Chang/TIPER.

Figures & tables

Figure 1: Predefined user-behavior controls versus task-integrity-constrained persona evolution.

Figure 2: Overview of the task-integrity-preserving persona evolution procedure. Each generation reflects and mutates a parent using search trajectories. The child undergoes text-level checks and the rollout-based search-time integrity gate before task-wise Pareto selection updates $\mathcal{A}_{g+1}$ .

Setting		avg@3		pass 1		pass 2		pass 3
Benchmark	Domain	default	Tiper	default	Tiper	default	Tiper	default	Tiper
	Telecom	81.5	56.2 ↓25.3	94.4	77.8 ↓16.6	79.6	55.6 ↓24.0	70.4	35.2 ↓35.2
	Banking	33.3	27.5 ↓5.8	45.6	43.9 ↓1.7	35.1	22.8 ↓12.3	19.3	15.8 ↓3.5
	Retail	78.4	71.6 ↓6.8	92.6	83.3 ↓9.3	85.2	75.9 ↓9.3	57.4	55.6 ↓1.8
$\tau^{3}$ -bench ( Barres et al., 2025 )	Airline	86.7	76.7 ↓10.0	92.0	82.0 ↓10.0	90.0	78.0 ↓12.0	78.0	70.0 ↓8.0
	Math	89.9	56.2 ↓33.7	97.7	82.5 ↓15.2	93.0	60.0 ↓33.0	79.1	25.0 ↓54.1

Table 1: Held-out failure exposure across benchmarks for GPT-5.4. We compare the benchmark-default user simulator with the rank-selected Tiper persona on 12 test settings. All values are percentages. The orange numbers indicate the decrease from the corresponding default scores in percentage points. Differences are computed from the displayed rounded scores.

Setting		avg@3		pass 1		pass 2		pass 3
Domain	Agent model	default	Tiper	default	Tiper	default	Tiper	default	Tiper
	GPT-5.4	81.5	56.2 ↓25.3	94.4	77.8 ↓16.6	79.6	55.6 ↓24.0	70.4	35.2 ↓35.2
	GLM-5.2	95.1	69.8 ↓25.3	100.0	83.3 ↓16.7	100.0	74.1 ↓25.9	85.2	51.9 ↓33.3
	Claude-Sonnet-5	69.8	44.4 ↓25.4	83.3	51.9 ↓31.4	74.1	48.1 ↓26.0	51.9	33.3 ↓18.6
	DS-V4-Flash	90.7	77.7 ↓13.0	98.1	94.4 ↓3.7	96.3	83.3 ↓13.0	77.8	55.6 ↓22.2
	MiniMax-M3	90.1	53.1 ↓37.0	100.0	61.1 ↓38.9	94.4	55.6 ↓38.8	75.9	42.6 ↓33.3

Table 2: Cross-agent held-out failure exposure on four representative domains. For each agent and domain, we rerun the same Tiper search. All values are percentages. The orange numbers indicate the decrease from the corresponding default scores in percentage points. Differences are computed from the displayed rounded scores.

Domain	Telecom		Airline		Retail		Delivery
Policy	GPT-5.4	DS-V4-Flash	GPT-5.4	DS-V4-Flash	GPT-5.4	DS-V4-Flash	GPT-5.4	DS-V4-Flash
Default setting	— (0.0%)	— (0.0%)	— (0.0%)	— ( 16.7% )	— (3.1%)	— ( 8.3% )	— (0.0%)	— (0.0%)
Emotional	$\downarrow 6.2$ (2.5%)	$\uparrow 0.6$ ( 21.4% )	$\downarrow 9.0$ ( 10.0% )	0.0 (0.0%)	0.0 (2.9%)	$\uparrow 0.6$ (0.0%)	$\downarrow 9.2$ (2.0%)	$\uparrow 3.3$ (2.9%)
Tangential	$\downarrow 14.2$ (1.9%)	$\downarrow 10.2$ (0.0%)	$\downarrow 2.0$ (0.0%)	$\uparrow 6.7$ (0.0%)	$\uparrow 6.2$ (4.0%)	$\downarrow 0.6$ (0.0%)	$\downarrow 5.8$ (4.3%)	$\downarrow 3.3$ (0.0%)
Fragment	$\downarrow 5.6$ (0.0%)	$\downarrow 3.1$ (0.0%)	$\downarrow 1.3$ (0.0%)	$\uparrow 3.3$ ( 6.7% )	$\uparrow 4.9$ (3.7%)	$\downarrow 1.2$ (3.8%)	$\downarrow 5.8$ (2.1%)	$\downarrow 7.5$ (2.1%)
Unavailable	$\uparrow 2.5$ (0.0%)	$\uparrow 3.7$ (0.0%)	$\downarrow 5.3$ (0.0%)	$\uparrow 10.0$ (0.0%)	$\uparrow 4.3$ (3.6%)	0.0 (4.2%)	$\downarrow 9.2$ ( 7.8% )	$\downarrow 0.8$ (2.6%)

Table 3: Policy comparison across four domains and two agents. Entries show changes in avg@3 from the default setting in percentage points (

\downarrow

lower,

\uparrow

higher), followed in parentheses by the percentage of failed rollouts with task-critical simulator errors under the

\tau^{2}

-Bench rubric ( Barres et al., 2025 ) . Error rates above 5% are shown in red.

(a) Search component ablation (Telecom)
	GPT-5.4		DS-V4-Flash
Method	avg@3	pass 3	avg@3	pass 3
Tiper	$\mathbf{-25.3}$	$\mathbf{-35.2}$	$\mathbf{-13.0}$	$\mathbf{-22.2}$
w/o integrity gate	$-10.5$	$-14.8$	$-8.0$	$-14.1$
w/o persona check	$-4.3$	$-8.1$	$-4.9$	$-8.5$

Table 4: Search ablation and component sensitivity. Percentage-point changes from default; more negative values indicate stronger failure exposure. Panel (a) removes the integrity gate or post-proposal persona check; panels (b) and (c) vary the mutation model and simulator backbone. In panel (c), each simulator backbone is compared against its own default-persona baseline.

Figure 3: Behavioral alignment and discovered user behaviors. Left: User-Sim Index profiles on Airline and Retail; farther outward indicates closer Sim2Real alignment. $\mathrm{ECE}^{*}=(1-\mathrm{ECE})\times 100$ . Right: Normalized behavior shares among integrity-valid contrastive failures exposed by Tiper .

Figure 4: Behavior-to-failure pathways for the contrastive pairs retained after judge-agreement and avoidability filtering. Ribbons connect domains, user behaviors, and agent failure modes.

Appendix figures & tables10 assets

Supplementary material from the paper’s appendix.

Appendix

User policy	Airline	Retail
Human	90.7	92.5
Benchmark default	67.5	72.0
Emotional	60.2	66.6
Tangential	60.3	62.2
Fragment	72.0	79.6
Unavailable	60.3	66.5

Appendix

Table 5: Aggregate User-Sim Index (USI) on the Airline and Retail domains. The Sim2Real human-reference trajectories define the reference; Emotional, Tangential, Fragment, and Unavailable are the four fixed NCUser behavior programs.

Role	Model	Temperature	Top- $p$	Max output tokens	Reasoning effort
Evaluated agent	GPT-5.4	provider default / unset a	provider default / unset	provider default / unset a	high
User simulator	GPT-5.4	provider default / unset a	provider default / unset	provider default / unset a	high
Mutation model	GPT-5.5	provider default / unset	provider default / unset	32,768 b	xhigh
Text linter	GPT-5.4-mini	provider default / unset	provider default / unset	512	provider default / unset
Search-time integrity judge	GPT-5.2 / GLM-5.2	provider default / unset	provider default / unset	provider default / unset	medium
Analysis-time integrity judges	GPT-5.2 / GLM-5.2	provider default / unset	provider default / unset	provider default / unset	medium

Appendix

Table 6: Generation hyperparameters for the main experiments. “Provider default / unset” denotes a field absent from the saved configuration and call.

Benchmark	Domain	Search	Rank	Test
$\tau^{3}$ -bench	Telecom	30	30	54
$\tau^{3}$ -bench	Banking	20	20	57
$\tau^{3}$ -bench	Retail	30	30	54
$\tau^{3}$ -bench	Airline	20	30	50
Lost-in-Conversation	Math	30	30	43
Lost-in-Conversation	Database	30	30	47

Appendix

Table 7: Task split sizes used by the main experiment family.

Setting	Reduction	95% CI
Telecom	25.3	$[12.3,\ 38.9]$
Banking	5.8	$[-8.2,\ 19.9]$
Retail	6.8	$[-5.6,\ 19.8]$
Airline	10.0	$[-7.2,\ 27.8]$
Math	33.7	$[21.1,\ 46.1]$
Database	14.8	$[4.3,\ 25.5]$

Appendix

Table 8: Task-level 95% bootstrap CIs for GPT-5.4 avg@3 reductions, in percentage points.

Domain	Agent	Reduction	95% CI
Telecom	GPT-5.4	25.3	$[12.3,\ 38.9]$
	GLM-5.2	25.3	$[15.4,\ 35.8]$
	Claude-Sonnet-5	25.4	$[9.4,\ 40.8]$
	DS-V4-Flash	13.0	$[3.7,\ 22.8]$
	MiniMax-M3	37.0	$[24.1,\ 50.0]$
	Qwen3.7-Plus	39.5	$[27.8,\ 51.9]$

Appendix

Table 9: Task-level 95% bootstrap CIs for cross-agent avg@3 reductions, in percentage points.

Policy	Full set	Common-valid	$N$
Emotional	9.0	9.5	49
Tangential	2.0	2.0	50
Fragment	1.3	1.3	50
Unavailable	5.3	5.3	50

Appendix

Table 10: Common-valid-task sensitivity for Airline avg@3 reductions.

N

is the number of tasks with all three trials valid in both compared conditions.

Benchmark	Domain	Rollouts	Model calls
Lost-in-Conversation	Math	248	2,394
	Database	282	2,114
	Actions	270	2,774
ColBench	Coding	300	1,190
VitaBench	Delivery	240	$\geq$ 2,069
	In-store	240	$\geq$ 2,100

Appendix

Table 11: VitaBench model-call counts and all logged dollar values are lower bounds.

Scope	Estimated cost (USD)
Primary 12 GPT-5.4 settings	1.5K–2.5K
Priced reported experiments	$\approx$ 7.3K (5K–15K)

Appendix

Table 12: Estimated API cost for the priced part of the reported experiments. These values are planning estimates rather than reconstructed bills.

Trait	Missing constraint	Conversation structure	Ungrounded reference	Total labels	Any violation	Excess labels
Skeptical	35 (16.1%)	31 (14.2%)	15 (6.9%)	81 (37.2%)	68 (31.2%)	13
Confusion	32 (14.7%)	24 (11.0%)	2 (0.9%)	58 (26.6%)	55 (25.2%)	3
Impatience	46 (21.1%)	9 (4.1%)	4 (1.8%)	59 (27.1%)	56 (25.7%)	3
Incoherence	43 (19.7%)	30 (13.8%)	6 (2.8%)	79 (36.2%)	65 (29.8%)	14
All four traits	156 (17.9%)	94 (10.8%)	27 (3.1%)	277 (31.8%)	244 (28.0%)	33

Appendix

Table 13: Task-integrity audit of

\tau

-Trait trajectories ( He et al., 2026 ) . Each trait contains 218 conversations; the final row pools all 872. Cells in the three error-type columns report count (rate). Total labels may exceed unique violations because a conversation can receive multiple labels; excess labels is the difference between these two counts and is not the number of distinct multi-label conversations.

Domain	Audited	Valid	Invalid	Uncertain	Agent-attributed
Telecom	30	30	0	0	29
Banking	30	29	0	1	28
Math	30	30	0	0	29
Coding	30	29	1	0	28
Delivery	30	30	0	0	29
Total	150	148	1	1	143

Appendix

Table 14: Human audit of held-out TIPER failures accepted by the automated integrity check. Agent-attributed counts are subsets of integrity-valid trajectories.

LLM Agent Evaluation

Large language model agent evaluation measures whether tool-using systems complete tasks reliably, safely, and efficiently.

See all 1,179 papers

Oct 15, 2026

AgentPerturb: Evaluating LLM Agent Robustness under Controlled Interaction Perturbations

Real-world tasks are often complex and noisy, posing substantial challenges for LLM agents. Yet existing evaluations lack a systematic framework for jointly characterizing potential perturbation targets and types. We use this two-dimensional view to conduct a unified study that quantifies the robustness of current frontier models, traces the mechanisms behind perturbation-induced failures, and draws implications for robustness-oriented training. Through controlled evaluations on APEX-Agents and Toolathlon, we find that perturbations consistently degrade performance, while the dominant vulnerabilities vary across task environments. Trajectory-level analysis reveals that agents rarely recognize altered inputs and often propagate corrupted information without verification. A focused cost analysis further shows that successful perturbed trajectories can require substantially more computation. These findings motivate training objectives that cover diverse forms of noise and reward verification, uncertainty awareness, and recovery. We provide a rigorous benchmark-construction pipeline. Code and data will be released at https://github.com/xuyj233/AgentPerturb.

Yuanjian Xu, Jinyi Han, Jianing Hao +5

The Hong Kong University of Science and Technology (Guangzhou) · East China Normal University · University College London +1

LLM Agent Evaluation LLM Agent Reliability AI Agent Benchmarks

Ask PDF

May 13, 2026

Beyond Cooperative Simulators: Generating Realistic User Personas for Robust Evaluation of LLM Agents

Large Language Model (LLM) agents are increasingly deployed in settings where they interact with diverse users, including those who are unclear, impatient, or reluctant to share information. However, collecting real interaction data at scale remains expensive. The field has turned to LLM-based user simulators as stand-ins, but these simulators inherit the behavior of their underlying models: cooperative and homogeneous. As a result, agents that appear strong in simulation often fail in real human interactions. To narrow this gap, we introduce Persona Policies (PPol), a plug-and-play control layer that induces realistic behavioral variation in user simulators while preserving original task goals. Rather than hand-crafting personas, we employ an evolutionary coding agent to discover persona generation programs optimized for human-likeness and behavioral coverage over real user conversations. The evolved program generates diverse, human-like personas for any task in the domain. Across 4 benchmarks--including

τ^2

-bench Retail and Airline, ColBench, and WildChat--evolved PPol yield 28-72% absolute gains in fitness score over the baseline simulator. In blinded evaluations, annotators judged PPol users as 'human' 80.4% of the time, nearly 2x more than the baseline simulators. Training agents with PPol also improves real-world performance: our user study with live human-agent interactions showed that fine-tuning with our method boosted task success by +23% over default baselines. PPol thus offers a novel approach to strengthen simulator-based evaluation and training without changing underlying tasks.

Harshita Chopra, Kshitish Ghate, Aylin Caliskan +3

University of Washington, Seattle · Georgetown University, Washington DC

Human Behavior Simulation LLM Agent Evaluation LLM Agent Training Persona-Conditioned Generation User Simulation

Ask PDF

Oct 14, 2026

$τ$ -Emotion-Bench: Exposing the Interaction Fragility of LLM Agents through Real-World User Emotions

In long-horizon tool-calling tasks, LLM agents can fail not only because of tool-use errors, but also because of ineffective interaction with users. Yet existing benchmarks largely assume cooperative and behaviorally stable users, leaving the effect of emotional variation on agent reliability underexplored. We introduce

τ

-Emotion-Bench, a ten-domain benchmark for evaluating tool-calling agents under controlled emotion-conditioned user interactions while preserving the underlying task objective. To scale both benchmark construction and agent training, we introduce Tracer, a scalable agentic data-generation pipeline that constructs grounded, policy-valid tasks and collects trajectories through an interactive agent--user--environment harness. By allowing dissatisfied users to terminate inefficient interactions, the harness provides an interaction-aware signal that filters trajectories with excessive user dependence and favors effective tool use. Experiments with two user simulators show that frontier agents remain unreliable, with substantial gaps between average task success and consistent task completion. Tracer-generated supervision consistently improves Qwen3 models across scales, generalizes to unseen domains, and transfers to

τ

-Bench and

τ

-Trait. Behavioral analyses further show that higher task success is associated with a better balance between tool execution and necessary user follow-up. Overall,

τ

-Emotion-Bench and Tracer provide a scalable framework for evaluating agent reliability under diverse user behaviors and improving tool-calling agents through interaction-aware supervision.

Rishitosh Kumar Singh, Amir Saeidi, Shamanthak Hegde +2

Arizona State University

LLM Agent Evaluation Tool-Using Agents LLM Agents LLM Agent Reliability Long-Horizon LLM Agents LLM Agent Training

Ask PDF

Abstract

LLM Agent Evaluation

Explore similar work

AgentPerturb: Evaluating LLM Agent Robustness under Controlled Interaction Perturbations

Beyond Cooperative Simulators: Generating Realistic User Personas for Robust Evaluation of LLM Agents

τττ-Emotion-Bench: Exposing the Interaction Fragility of LLM Agents through Real-World User Emotions

$τ$ -Emotion-Bench: Exposing the Interaction Fragility of LLM Agents through Real-World User Emotions