Uncovering Robustness Weaknesses in LLM Agents via Persona Evolution with Task-Integrity Constraints

Yutao Xie; Jingbo Yang; Guanyu Yao; Xiaoyu Yang; Duo Ding; Shiyu Chang

cs.AIOct 12, 2026

Uncovering Robustness Weaknesses in LLM Agents via Persona Evolution with Task-Integrity Constraints

Authors: Yutao Xie, Jingbo Yang, Guanyu Yao, Xiaoyu Yang, Duo Ding, Shiyu Chang

Organizations: University of California, Santa Barbara · Cresta

Abstract

Interactive-agent evaluations commonly rely on standardized LLM-based user simulators that exhibit broadly cooperative behavior, potentially overlooking failures that arise under diverse but realistic user interactions. This can lead to overly optimistic estimates of agent robustness and provide limited failure signals for training agents that generalize across users. Existing approaches largely rely on predefined user behaviors, which may miss agent- or domain-specific weaknesses, while failure-oriented search can reduce task success by invalidating the underlying task rather than exposing genuine robustness failures. To fill this gap, we introduce TIPER, a task-integrity-preserving persona evolution method that automatically discovers agent-specific user policies exposing robustness weaknesses while keeping the underlying task valid and solvable. TIPER evolves persistent user personas through reflection-guided behavioral mutations and task-wise Pareto selection under a task-integrity constraint. Across four interactive-agent benchmarks, TIPER yields lower held-out avg@3 scores in all 12 GPT-5.4 settings, with observed reductions of 5.8 to 33.7 percentage points, and in all 28 agent-domain pairs spanning seven agents, with a median observed reduction of 22.9 points. Further analysis yields a behavior-to-failure taxonomy that connects discovered user behaviors to recurring agent failure modes. Together, these results show that TIPER enables more diagnostic robustness evaluation of interactive agents and provides informative failure analysis for future agent robustness improvement. Code repository: https://github.com/UCSB-NLP-Chang/TIPER.

Figures & tables

Figure 1: Predefined user-behavior controls versus task-integrity-constrained persona evolution.

Figure 2: Overview of the task-integrity-preserving persona evolution procedure. Each generation reflects and mutates a parent using search trajectories. The child undergoes text-level checks and the rollout-based search-time integrity gate before task-wise Pareto selection updates $\mathcal{A}_{g+1}$ .

Setting		avg@3		pass 1		pass 2		pass 3
Benchmark	Domain	default	Tiper	default	Tiper	default	Tiper	default	Tiper
	Telecom	81.5	56.2 ↓25.3	94.4	77.8 ↓16.6	79.6	55.6 ↓24.0	70.4	35.2 ↓35.2
	Banking	33.3	27.5 ↓5.8	45.6	43.9 ↓1.7	35.1	22.8 ↓12.3	19.3	15.8 ↓3.5
	Retail	78.4	71.6 ↓6.8	92.6	83.3 ↓9.3	85.2	75.9 ↓9.3	57.4	55.6 ↓1.8
$\tau^{3}$ -bench ( Barres et al., 2025 )	Airline	86.7	76.7 ↓10.0	92.0	82.0 ↓10.0	90.0	78.0 ↓12.0	78.0	70.0 ↓8.0
	Math	89.9	56.2 ↓33.7	97.7	82.5 ↓15.2	93.0	60.0 ↓33.0	79.1	25.0 ↓54.1

Table 1: Held-out failure exposure across benchmarks for GPT-5.4. We compare the benchmark-default user simulator with the rank-selected Tiper persona on 12 test settings. All values are percentages. The orange numbers indicate the decrease from the corresponding default scores in percentage points. Differences are computed from the displayed rounded scores.

Setting		avg@3		pass 1		pass 2		pass 3
Domain	Agent model	default	Tiper	default	Tiper	default	Tiper	default	Tiper
	GPT-5.4	81.5	56.2 ↓25.3	94.4	77.8 ↓16.6	79.6	55.6 ↓24.0	70.4	35.2 ↓35.2
	GLM-5.2	95.1	69.8 ↓25.3	100.0	83.3 ↓16.7	100.0	74.1 ↓25.9	85.2	51.9 ↓33.3
	Claude-Sonnet-5	69.8	44.4 ↓25.4	83.3	51.9 ↓31.4	74.1	48.1 ↓26.0	51.9	33.3 ↓18.6
	DS-V4-Flash	90.7	77.7 ↓13.0	98.1	94.4 ↓3.7	96.3	83.3 ↓13.0	77.8	55.6 ↓22.2
	MiniMax-M3	90.1	53.1 ↓37.0	100.0	61.1 ↓38.9	94.4	55.6 ↓38.8	75.9	42.6 ↓33.3

Table 2: Cross-agent held-out failure exposure on four representative domains. For each agent and domain, we rerun the same Tiper search. All values are percentages. The orange numbers indicate the decrease from the corresponding default scores in percentage points. Differences are computed from the displayed rounded scores.

Domain	Telecom		Airline		Retail		Delivery
Policy	GPT-5.4	DS-V4-Flash	GPT-5.4	DS-V4-Flash	GPT-5.4	DS-V4-Flash	GPT-5.4	DS-V4-Flash
Default setting	— (0.0%)	— (0.0%)	— (0.0%)	— ( 16.7% )	— (3.1%)	— ( 8.3% )	— (0.0%)	— (0.0%)
Emotional	$\downarrow 6.2$ (2.5%)	$\uparrow 0.6$ ( 21.4% )	$\downarrow 9.0$ ( 10.0% )	0.0 (0.0%)	0.0 (2.9%)	$\uparrow 0.6$ (0.0%)	$\downarrow 9.2$ (2.0%)	$\uparrow 3.3$ (2.9%)
Tangential	$\downarrow 14.2$ (1.9%)	$\downarrow 10.2$ (0.0%)	$\downarrow 2.0$ (0.0%)	$\uparrow 6.7$ (0.0%)	$\uparrow 6.2$ (4.0%)	$\downarrow 0.6$ (0.0%)	$\downarrow 5.8$ (4.3%)	$\downarrow 3.3$ (0.0%)
Fragment	$\downarrow 5.6$ (0.0%)	$\downarrow 3.1$ (0.0%)	$\downarrow 1.3$ (0.0%)	$\uparrow 3.3$ ( 6.7% )	$\uparrow 4.9$ (3.7%)	$\downarrow 1.2$ (3.8%)	$\downarrow 5.8$ (2.1%)	$\downarrow 7.5$ (2.1%)
Unavailable	$\uparrow 2.5$ (0.0%)	$\uparrow 3.7$ (0.0%)	$\downarrow 5.3$ (0.0%)	$\uparrow 10.0$ (0.0%)	$\uparrow 4.3$ (3.6%)	0.0 (4.2%)	$\downarrow 9.2$ ( 7.8% )	$\downarrow 0.8$ (2.6%)

Table 3: Policy comparison across four domains and two agents. Entries show changes in avg@3 from the default setting in percentage points (

\downarrow

lower,

\uparrow

higher), followed in parentheses by the percentage of failed rollouts with task-critical simulator errors under the

\tau^{2}

-Bench rubric ( Barres et al., 2025 ) . Error rates above 5% are shown in red.

(a) Search component ablation (Telecom)
	GPT-5.4		DS-V4-Flash
Method	avg@3	pass 3	avg@3	pass 3
Tiper	$\mathbf{-25.3}$	$\mathbf{-35.2}$	$\mathbf{-13.0}$	$\mathbf{-22.2}$
w/o integrity gate	$-10.5$	$-14.8$	$-8.0$	$-14.1$
w/o persona check	$-4.3$	$-8.1$	$-4.9$	$-8.5$

Table 4: Search ablation and component sensitivity. Percentage-point changes from default; more negative values indicate stronger failure exposure. Panel (a) removes the integrity gate or post-proposal persona check; panels (b) and (c) vary the mutation model and simulator backbone. In panel (c), each simulator backbone is compared against its own default-persona baseline.

Figure 3: Behavioral alignment and discovered user behaviors. Left: User-Sim Index profiles on Airline and Retail; farther outward indicates closer Sim2Real alignment. $\mathrm{ECE}^{*}=(1-\mathrm{ECE})\times 100$ . Right: Normalized behavior shares among integrity-valid contrastive failures exposed by Tiper .

Figure 4: Behavior-to-failure pathways for the contrastive pairs retained after judge-agreement and avoidability filtering. Ribbons connect domains, user behaviors, and agent failure modes.

Appendix figures & tables10 assets

Supplementary material from the paper’s appendix.

Appendix

User policy	Airline	Retail
Human	90.7	92.5
Benchmark default	67.5	72.0
Emotional	60.2	66.6
Tangential	60.3	62.2
Fragment	72.0	79.6
Unavailable	60.3	66.5

Appendix

Table 5: Aggregate User-Sim Index (USI) on the Airline and Retail domains. The Sim2Real human-reference trajectories define the reference; Emotional, Tangential, Fragment, and Unavailable are the four fixed NCUser behavior programs.

Role	Model	Temperature	Top- $p$	Max output tokens	Reasoning effort
Evaluated agent	GPT-5.4	provider default / unset a	provider default / unset	provider default / unset a	high
User simulator	GPT-5.4	provider default / unset a	provider default / unset	provider default / unset a	high
Mutation model	GPT-5.5	provider default / unset	provider default / unset	32,768 b	xhigh
Text linter	GPT-5.4-mini	provider default / unset	provider default / unset	512	provider default / unset
Search-time integrity judge	GPT-5.2 / GLM-5.2	provider default / unset	provider default / unset	provider default / unset	medium
Analysis-time integrity judges	GPT-5.2 / GLM-5.2	provider default / unset	provider default / unset	provider default / unset	medium

Appendix

Table 6: Generation hyperparameters for the main experiments. “Provider default / unset” denotes a field absent from the saved configuration and call.

Benchmark	Domain	Search	Rank	Test
$\tau^{3}$ -bench	Telecom	30	30	54
$\tau^{3}$ -bench	Banking	20	20	57
$\tau^{3}$ -bench	Retail	30	30	54
$\tau^{3}$ -bench	Airline	20	30	50
Lost-in-Conversation	Math	30	30	43
Lost-in-Conversation	Database	30	30	47

Appendix

Table 7: Task split sizes used by the main experiment family.

Setting	Reduction	95% CI
Telecom	25.3	$[12.3,\ 38.9]$
Banking	5.8	$[-8.2,\ 19.9]$
Retail	6.8	$[-5.6,\ 19.8]$
Airline	10.0	$[-7.2,\ 27.8]$
Math	33.7	$[21.1,\ 46.1]$
Database	14.8	$[4.3,\ 25.5]$

Appendix

Table 8: Task-level 95% bootstrap CIs for GPT-5.4 avg@3 reductions, in percentage points.

Domain	Agent	Reduction	95% CI
Telecom	GPT-5.4	25.3	$[12.3,\ 38.9]$
	GLM-5.2	25.3	$[15.4,\ 35.8]$
	Claude-Sonnet-5	25.4	$[9.4,\ 40.8]$
	DS-V4-Flash	13.0	$[3.7,\ 22.8]$
	MiniMax-M3	37.0	$[24.1,\ 50.0]$
	Qwen3.7-Plus	39.5	$[27.8,\ 51.9]$

Appendix

Table 9: Task-level 95% bootstrap CIs for cross-agent avg@3 reductions, in percentage points.

Policy	Full set	Common-valid	$N$
Emotional	9.0	9.5	49
Tangential	2.0	2.0	50
Fragment	1.3	1.3	50
Unavailable	5.3	5.3	50

Appendix

Table 10: Common-valid-task sensitivity for Airline avg@3 reductions.

N

is the number of tasks with all three trials valid in both compared conditions.

Benchmark	Domain	Rollouts	Model calls
Lost-in-Conversation	Math	248	2,394
	Database	282	2,114
	Actions	270	2,774
ColBench	Coding	300	1,190
VitaBench	Delivery	240	$\geq$ 2,069
	In-store	240	$\geq$ 2,100

Appendix

Table 11: VitaBench model-call counts and all logged dollar values are lower bounds.

Scope	Estimated cost (USD)
Primary 12 GPT-5.4 settings	1.5K–2.5K
Priced reported experiments	$\approx$ 7.3K (5K–15K)

Appendix

Table 12: Estimated API cost for the priced part of the reported experiments. These values are planning estimates rather than reconstructed bills.

Trait	Missing constraint	Conversation structure	Ungrounded reference	Total labels	Any violation	Excess labels
Skeptical	35 (16.1%)	31 (14.2%)	15 (6.9%)	81 (37.2%)	68 (31.2%)	13
Confusion	32 (14.7%)	24 (11.0%)	2 (0.9%)	58 (26.6%)	55 (25.2%)	3
Impatience	46 (21.1%)	9 (4.1%)	4 (1.8%)	59 (27.1%)	56 (25.7%)	3
Incoherence	43 (19.7%)	30 (13.8%)	6 (2.8%)	79 (36.2%)	65 (29.8%)	14
All four traits	156 (17.9%)	94 (10.8%)	27 (3.1%)	277 (31.8%)	244 (28.0%)	33

Appendix

Table 13: Task-integrity audit of

\tau

-Trait trajectories ( He et al., 2026 ) . Each trait contains 218 conversations; the final row pools all 872. Cells in the three error-type columns report count (rate). Total labels may exceed unique violations because a conversation can receive multiple labels; excess labels is the difference between these two counts and is not the number of distinct multi-label conversations.

Domain	Audited	Valid	Invalid	Uncertain	Agent-attributed
Telecom	30	30	0	0	29
Banking	30	29	0	1	28
Math	30	30	0	0	29
Coding	30	29	1	0	28
Delivery	30	30	0	0	29
Total	150	148	1	1	143

Appendix

Table 14: Human audit of held-out TIPER failures accepted by the automated integrity check. Agent-attributed counts are subsets of integrity-valid trajectories.

LLM Agent Evaluation

Large language model agent evaluation measures whether tool-using systems complete tasks reliably, safely, and efficiently.

See all 1,179 papers

AgentPerturb: Evaluating LLM Agent Robustness under Controlled Interaction Perturbations
Oct 15, 2026Yuanjian Xu, Jinyi Han, Jianing Hao +5LLM Agent Evaluation LLM Agent Reliability
The Hong Kong University of Science and Technology (Guangzhou) · East China Normal University · University College London +1
Beyond Cooperative Simulators: Generating Realistic User Personas for Robust Evaluation of LLM Agents
May 13, 2026Harshita Chopra, Kshitish Ghate, Aylin Caliskan +3Human Behavior Simulation LLM Agent Evaluation
University of Washington, Seattle · Georgetown University, Washington DC
$τ$ -Emotion-Bench: Exposing the Interaction Fragility of LLM Agents through Real-World User Emotions
Oct 14, 2026Rishitosh Kumar Singh, Amir Saeidi, Shamanthak Hegde +2LLM Agent Evaluation Tool-Using Agents
Arizona State University

Oct 15, 2026J/K move · Enter open · S save

AgentPerturb: Evaluating LLM Agent Robustness under Controlled Interaction Perturbations

Yuanjian Xu, Jinyi Han, Jianing Hao, Yuxuan Sun+4

The Hong Kong University of Science and Technology (Guangzhou) · East China Normal University · University College London+1

LLM Agent Evaluation LLM Agent Reliability AI Agent Benchmarks

Open paper AskPDF arXiv

Real-world tasks are often complex and noisy, posing substantial challenges for LLM agents. Yet existing evaluations lack a systematic framework for jointly characterizing potential perturbation targets and types. We use this two-dimensional view to conduct a unified study that quantifies the robustness of current frontier models, traces the mechanisms behind perturbation-induced failures, and draws implications for robustness-oriented training. Through controlled evaluations on APEX-Agents and Toolathlon, we find that perturbations consistently degrade performance, while the dominant vulnerabilities vary across task environments. Trajectory-level analysis reveals that agents rarely recognize altered inputs and often propagate corrupted information without verification. A focused cost analysis further shows that successful perturbed trajectories can require substantially more computation. These findings motivate training objectives that cover diverse forms of noise and reward verification, uncertainty awareness, and recovery. We provide a rigorous benchmark-construction pipeline. Code and data will be released at https://github.com/xuyj233/AgentPerturb.

Abstract

LLM Agent Evaluation

Explore similar work

AgentPerturb: Evaluating LLM Agent Robustness under Controlled Interaction Perturbations

Beyond Cooperative Simulators: Generating Realistic User Personas for Robust Evaluation of LLM Agents

τττ-Emotion-Bench: Exposing the Interaction Fragility of LLM Agents through Real-World User Emotions

$τ$ -Emotion-Bench: Exposing the Interaction Fragility of LLM Agents through Real-World User Emotions