Verification

How to measure agent output quality, design evaluation suites, and use evals to drive development.

Measuring Quality

• Enumerate Every Visible Exit Before Scoring Containment — List every requester-visible and external exit before the test runs and score against the union; re-scoring 245 sessions, an expected-outlet-only view missed 46.9% of the exposure the full set found
• RAG/Agent Reliability Problem Map — Structured 16-domain failure taxonomy for systematic diagnosis of RAG and agent failures across retrieval, reasoning, state, and deployment layers
• Against-Prior Accuracy: Score the Rules That Fight Defaults — Aggregate instruction-compliance scores count rules the agent would have followed anyway; withhold each rule, keep only the ones that change behavior, and rescore
• Benchmark Contamination as Eval Risk — Static benchmarks inflate model scores as training data overlaps with test sets — decontaminated pipelines restore honest measurement
• Control Lexical Leakage in Agent-Memory Retrieval Evals (Entity-Collision) — A single hit@k confounds semantic retrieval with lexical overlap; pin BM25 with shared-entity distractors and stratify queries by tag so embedder lift is attributable rather than averaged
• Controlled Benchmark Rewriting for Agent Safety Judgment — Rewrite unsafe trajectories into deceptive variants while preserving risk labels to measure judgment robustness on out-of-distribution surface forms
• Black-Box Agent Risk Scoring by Domain — Scoring an agent through its own interface across seven risk domains ranks which risks to design against; the percentage is a composite over an adversarially-selected pool and does not transfer across models
• Decomposed Red-Teaming for Agent Monitors — Split attack construction into strategy, execution, and refinement stages so monitor evaluations expose the conceive-execute gap; drops Opus 4.5 catch rate from 94.9% to 60.3%
• Overeager-Behavior Elicitation: Scope + Trap Fragments — Compose benign scenarios from reusable scope and trap fragments, score with a judge-free filesystem-delta oracle, and use Thompson sampling to elicit overeager tool calls task-completion and jailbreak benchmarks both miss
• Grade Agent Outcomes, Not Execution Paths — Evaluate agents by the final state they produce, not the sequence of steps they took to get there
• Use pass@k and pass^k to Separate Agent Capability from Consistency — pass@k measures capability ceiling; pass^k measures consistency — report both to distinguish agents that sometimes succeed from those that reliably do
• Comparative Judging for Agent Configuration Ranking — Rank agent configs by best-worst (MaxDiff) elicitation plus a Plackett-Luce utility model instead of averaging noisy absolute scores — for bake-offs where the goal is picking the winner, not clearing a threshold
• PASS@(k,T): Evaluate RL for Agents Along Sampling and Interaction Depth — Vary sampling budget k and interaction depth T jointly to separate capability expansion from efficiency gains when evaluating RL post-training for tool-use agents
• Markov-Chain Reliability for LLM Agents: Audit the Abstraction Before You Trust the Metric — pass@k, pass^k, and the reliability decay curve are projections of one first-passage distribution; fit an absorbing DTMC to traces and report a goodness-of-fit certificate to make any of those numbers defensible
• Decomposing Agent Output Variability by Layer (Sampling vs Orchestration State) — Separate run-to-run agent variability into token-sampling, infrastructure, and orchestration-state layers so the mitigation matches the layer; a single trajectory cannot distinguish them
• Size Agent Comparisons by Run-to-Run Variance — Measure one pairing's run-to-run SD and size each arm on the smallest gap that would change the decision; three-run comparisons ranked same-model pairings wrongly 28 to 44 percent of the time on one task
• Gate Best-of-k Selection on Compliance Before Score — Reject the attempts that broke a rule before you rank on score; across 312 runs the ten violators held the seven highest scores, and excluding them moved the best score from 0.8293 to 0.7695
• Trajectory Decomposition: Diagnose Where Coding Agents Fail — Decompose agent trajectories into search, read, and edit stages with per-stage precision and recall to pinpoint where and why an agent went wrong
• Action-Class Decomposition for Tool-Calling Evals — Split a multi-turn tool-calling score into call, ask, refuse, and confirm; an end-state grader passes trajectories that chose the wrong class, and the per-class recall column is what surfaces them
• Repository Perturbation as Context-Reasoning Diagnosis (RepoMirage) — Apply semantics-preserving repository perturbations before an agent runs to isolate context reasoning from end-to-end issue-resolution shortcuts; average score drops 66.8% to 25.3% on the explicit-task formulation
• Static Difficulty Estimation for Agent Issue Triage — Structural task features predict agent success at AUC 0.863, but the top features are computed on the gold patch, so only the repository group survives to triage time
• Pre-Generation Complexity Scoring for Code Reliability — Complexity read off generated code is caused by the failure it explains; score the task from the prompt on a fixed rubric before the run, and publish the rater disagreement rather than a cutoff
• Canary Tools for Diagnosing Tool-Selection Reasoning — Plant one deliberately flawed decoy per weakness in a staging tool set, then read a trap rate per type; capability mirage was the only strongly active probe on six hosted models
• Precise Debugging: Measure Edit Precision, Not Just Test Pass Rate — Frontier LLMs pass unit tests on debugging tasks by regenerating large chunks of code rather than making targeted edits — edit-level precision and bug-level recall expose the gap
• Review Constraint Tests as a Second Acceptance Gate — A functional suite built from the bug report cannot see a constraint separable from it; run review-derived constraints as a second executable suite, scored on its own
• Nonstandard Errors in AI Agents — Agents analyzing identical data diverge systematically by model family; treat single-run outputs as one point from an unsampled distribution
• Benchmark-Driven Tool Selection for Code Generation — Use realistic, telemetry-derived benchmarks to evaluate AI coding tools — synthetic puzzles hide language-specific and task-specific weaknesses
• Ambiguity Stability as a Model-Selection Criterion — Benchmark rank scores synthesis on requirements with one intended reading; rank candidates on the paired clear-versus-ambiguous drop over your own tasks, with a paraphrase control arm
• Frozen-Stimulus Panels for Cross-Vendor Behavior Measurement — Send one unchanged stimulus to every candidate model and harness and re-run it on each release; the source study priced the API assays at a median of three cents per model at September 2026 list prices
• Purpose-Built Eval Suites for Model and Harness Swaps — Build a small suite over your own tasks to compare model, prompt, and harness as one configuration — and size it to the decision before trusting the ranking
• Rank Resolution: Reading a Converged Coding-Agent Leaderboard — Count the instances on which two entries actually disagree before reading a leaderboard gap as an order; 164 of 500 distinguish the SWE-bench Verified top ten and no adjacent top-thirty pair separates
• Review-Comment-Derived Benchmarks for Code Review Agents — Curate comments trusted reviewers left on merged PRs into frozen-context tasks with a verifier, so the benchmark scores the codebase-specific contracts public benchmarks never encode
• Scoring a Code Review Agent on an Open Benchmark Suite — Use an open benchmark such as GitHub's ReviewBench to compare reviewers on public pull requests; its golden set is mostly machine-produced, so it says little about your own codebase
• Frozen-Base Task Mining for Repository Instruction Files — Reverse-apply merged pull requests at one shared base commit so an optimizer cannot learn module paths and APIs that were true months ago; roughly one PR in five survives, and the resulting split is still too small to settle the question
• Policy-Graded Evaluation of Coding Agents — Score agents at each enforced security tier and report success rate and token cost as separate columns; under a NIST-derived policy success fell up to 18.3 points and cost rose up to 167.3%, on different models
• Head-to-Head Evaluation of Competing MCP Servers — Score competing MCP servers under one fixed agent configuration and decide on consistency, duration, and cost per quality point, because a small eval rarely separates them on quality
• Reading a Coding-Agent Vendor's Security Certificate — A certificate attests organizational controls, product behavior, or both; read the scope statement for which half, which surfaces, which configuration, and how recently
• Completion Failure Taxonomy — Two-thirds of code completion failures are model errors, but one quarter are integration failures — fix both to improve acceptance rates
• LLM Agent Bug Fix Taxonomy — 23 recurrent fix patterns from 930 real LLM-agent bugs; the tools component dominates and framework version churn drives most fixes
• Symptom-First Bug Triage for Agent Code — 1,268 annotated agent bugs put 57.1% in the agent core and map non-terminating runs to planning and amnesiac runs to memory, for single-agent framework codebases
• CausalFlow: Counterfactual Repair for Failed Agent Trajectories — Score each step in a failed run by counterfactual lift; the step whose oracle-guided replacement flips the outcome is the failure cause, and the replacement is a validated repair — applicable when replay is isolated, success is binary, and the failure is not a cascade
• Constraint Decay in Backend Code Generation — Multi-file backend agents drop ~30 percentage points in assertion pass rate as architectural, ORM, and framework constraints accumulate — convention-heavy frameworks take the largest hit
• Eval Blind Spots: Structural Gaps in Measurement Methodology — Four measurement-methodology gaps (held-out, trajectory-opaque, skill-retrieval, test-evolution) a stronger model cannot close — each needs a harness fix, not a better model
• Dominator-Graph Trajectory Invariants for Non-Deterministic Agents — Validate branching agent runs by checking which states must dominate success — compiler-theory dominance over trajectory graphs replaces brittle scripted assertions when 2–10 successful traces are available
• Multi-Turn Conversation Evaluation — Pair per-turn scoring with a trace-level resolution check so the two layers catch context loss, intent drift, and circular exchange that single-turn metrics miss
• Inferring Agent Failure from Conversation Evidence (Perceived Error) — Grade production threads for in-transcript evidence the agent got it wrong when no exception fired and no rating arrived; a triage filter, not a defect rate, and blind to errors the user never notices
• Stateful Agent Evals via State Snapshots and Transition Assertions — Assert on intermediate state and transitions, not just final output, to catch the four state-drift failures (wrong-but-consistent narrative, mid-context amnesia, stale assumptions, state corruption) that outcome-only and per-turn scorers structurally miss in side-effecting agents
• Macro Evals for Agentic Systems — Aggregate per-trace findings across a corpus of agent runs to surface recurring behavior patterns that single-trace evals cannot expose — when volume, judge quality, and selection bias permit
• Variance-Based RL Sample Selection — Profile training samples by score variance before RL fine-tuning to identify the productive subset where the model sometimes succeeds and sometimes fails
• Adaptive Validation Task Selection — Concentrate each harness-tuning round on the validation tasks candidate harnesses disagree about, then reweight that subset score into a full-set estimate — worth it only on large pools with per-task outcome history
• CoT Robustness in Code Generation — Chain-of-thought is not a universal win for code generation; measure Pass@1 and Pass^k with and without CoT before enabling it as a default
• Distillation-Induced Similarity Metrics for Tool-Use Agents — Quantify how much two models share non-mandatory tool-use behavior with Response Pattern Similarity and Action Graph Similarity to surface correlated failure modes before routing or ensembling treats them as independent
• Learned Prefix Monitors for Agent Traces — Online failure-warning monitors learn an event abstraction and a prefix-risk score from terminal outcomes; useful complement to deterministic guardrails, but high AUPRC does not imply usable alerts
• ComplexMCP: Three Bottlenecks in Large Interdependent Tool Sandboxes — 300+ MCP tools across stateful sandboxes expose tool retrieval saturation, over-confidence skipping verification, and strategic defeatism — each maps to a deployment choice
• Action-Graded Severity for Agent Red-Team Outcomes — Grade red-team outcomes on an L0 to L6 harm scale over reversibility, scope, and privilege so evals surface how harmful a compromise was, not just whether one occurred — a defense can report 0% attack success while still leaking cross-scope
• Equivalence Testing for Agent Configuration Changes — Bound how far a config change could have moved behavior against a margin fixed in advance; a zero-event run states an upper limit computed from n, never an absence
• Profile Your Agent Test Suite Against Measured Practice — Label your agent tests by level, objective, data pattern, and assertion target, then compare the distribution against two published baselines showing effort concentrates on deterministic components
• Seed-Variance Reporting and Measurable-Range Eval Design — Report the spread of a result across seeds rather than the favorable run, and treat any accuracy cell pinned at a floor or ceiling as a design fault to fix before drawing a verdict
• Multi-Run, Shuffled-Order Evaluation for Self-Improving Agents — Memory-based agents amplify run-to-run variance and inherit a hidden easy-to-hard curriculum from the benchmark's default order; repeat the suite and shuffle before believing a reported gain
• Audit the Noise Floor Before Trusting a Benchmark Gap — Repeat runs and semantics-preserving prompt rewrites give two noise floors 11x to 58x apart; measure both, then compare any reported gap against the wider one
• Recover the Six Measurement Choices Behind an Attack Success Rate — Attack success rate is a family of metrics set by six design choices; four of them shift the number system-dependently, and across 259 agentic-security papers 65.3% report neither variance nor repeated runs
• Measure the Judge Before You Freeze a Gate on It — Byte-identical judge requests replayed a day later reproduced the ranking 78 times out of 100 against a preregistered 0.99; replay the instrument and measure its noise floor before a ranking gate depends on it
• Capability-Ladder Probe: Calibrate an Eval Before You Trust Its Score — Where longer reasoning helps a task, a stronger model at higher effort should score higher; a flat reading there puts the fault in the eval rather than the system, and a baseline with no headroom cannot reliably attribute the next change
• Specification-Path Testing: Same Contract, Different History — Contract-equivalent requirement histories leave the pass rate flat while flipping which individual tasks succeed; report per-item conditional agreement rather than rate parity
• Severity-Stratified Evaluation of Security Prompts — Security-oriented prompts move GPT-4o findings from 20.8% high severity to 13.6% while low severity rises 32.0% to 43.5%; report per-band counts and condition on generation compliance, or a refusal-rate fix scores as a security fix

Behavioral Testing

• Behavioral Testing for Agents — Test decision quality and end-state for non-deterministic agent systems using capability matrices, three grading methods, and acceptable variance thresholds
• Behavior Specs: Grading the Trajectory, Not the Result — Declare expected agent conduct in a BEHAVIOR.md file the agent never sees, then grade whole trajectories against it — worth the judging cost only on long runs whose outcome resists verification
• FLARE: Coverage-Guided Fuzzing for Multi-Agent LLM Systems — Apply coverage-guided fuzzing to multi-agent systems using interaction path coverage as the exploration signal to surface coordination failures and emergent failure modes
• Structural Coverage Criteria for Agent Workflows — Represent multi-agent workflows as a typed coordination graph and derive coverage obligations over reachable agents, allowed tool edges, restricted tool edges, and delegation edges — a test-adequacy layer that complements end-to-end success scores
• Skill Test Coverage as a Release Gate — Extract operational obligations from a skill's natural-language workflow and gate release on how many of them any testcase activates; 36.3% of 157 production skills failed an 80% threshold on first measurement
• Mutation Testing as a Quality Gate for AI-Generated Test Suites — Coverage proves a line ran; mutation testing proves the suite would notice a regression — the discriminator that separates ceremonial agent-written tests from load-bearing ones
• Code Health as a Signal for Agent-Generated Test Quality — Maintainability of the file under test weakly predicts how good an agent's generated tests are; the signal shows up in mutation score and barely registers in line coverage
• Audit Your Test Suite With an Agent, Then Certify Each Flag — An agent generates inputs your suite wrongly accepts, and a four-gate certification chain proves each flagged failure genuine before a human triages it — usable only where an oracle independent of the code under test exists
• Planted-Bug Methodology: Deliberate Bugs as Observability Calibration — Plant deterministic bugs and check that captured signals lead an agent to the responsible layer — if they don't, the gap is in the instrumentation, not the bug
• LLM API Fault Injection at the HTTP Layer (AgentChaos) — Corrupt named LLM response fields at the HTTP client to score agent robustness; the ranking tracks architecture across all four backbones, and truncation is the fault diagnosis misses at 4.3% accuracy
• Handoff-Boundary Fault Injection (llmmas-otel) — Delay a message between two agents and diff the faulted trace against a structurally aligned baseline; the amplification it reports is heavy-tailed runtime, reading 59.2 mean against 6.6 median on ChatDev
• Recovery as a Separate Eval Axis (UndoBench) — Pair every faulted run with an identical-seed control and report recovery only over pairs whose control passed; nominal success read 83.54% against 46.72% conditional recovery, and one fixed method moved 56.96 pp across fault boundaries
• Behavior-Partitioned Security Tests as Executable Specs — Split security cases by attack mechanism, show one set to the model as its spec, and hold the rest out; showing tests upfront lifts joint success 19.3 pp but raises the visible-pass-but-hidden-fail rate from 5.6% to 18.8%
• Route-Parity Auditing of Agent Safeguards — Audit safeguards by protected asset rather than by interface, then test that each route's check fails when its control is removed; route inconsistency was coded in 152 of 157 surveyed agent projects
• Timeout Oracles for Agent-Written Code — Agent-written C utilities produced fewer fuzz failures than their human originals, and every failure from the agent's own code was a hang, so add a timeout-and-memory oracle beside the crash oracle
• Auditing Agent Tool Chains for Silent Partial Success — Diff a tool's richest surface against its API and wrapper to find calls that return success with fields missing; 51 of 91 audited failures sat at the API layer
• Red-Team Your Blocking Monitor Before You Trust It — Run a live, monitor-aware agent at your action-approval gate; production gates allowed over 55% of attacks, and the fixes are serializer, coverage, and staging changes
• Test Adequacy of LLM-Dependent Harness Code — Scope coverage and mutation to the harness statements that depend on model output; across ten agent codebases that slice averaged 44.27% line coverage and a 33.60% mutation score

Regression Testing

• Golden Query Pairs as Continuous Regression Tests for Agents — Maintain curated question-answer pairs with known-good outputs and run them continuously using semantic grading to catch capability regressions
• Human-Review-Driven Curation of Golden Eval Datasets — Sample production traces on intent, attribute each disagreement to scorer or agent, and feed only agent-failure labels back into the golden set to keep an LLM-judge suite aligned with a moving production distribution
• Pre-Change Impact Analysis — Build a code-to-test dependency map and deliver it as a lightweight agent skill so agents verify at-risk tests before committing, cutting regressions by 70%
• Minimum-Cost Evidence Selection for Agent Changes (Assurance Envelopes) — Pick which prior tests, type checks and proofs to restore for a change by naming its obligations, and accept the selection only when forward chaining from it reaches every one
• Baseline-Aware Test Evaluation for Multi-Agent Issue Resolution (Phoenix) — Run the test suite twice (baseline + patched) and gate the PR on the diff, not the absolute pass rate — under specific preconditions on test-suite strength, planner localization, and CI determinism
• Bug-Discriminating Validation Evidence for Repair Agents (BSG-VA) — Replay a repair agent's own passing test against the unfixed code; 46.0% of positive validation events pass there too and carry no information about the bug
• Re-Run the Original Test Suite After Every Refinement Turn — Multi-turn LLM code refinement silently breaks previously-passing code (Phi 0.089 between instruction adherence and functional correctness); pin the original suite, re-execute every turn, and gate on the pass-set diff
• Cut-Point Replay: Test a Fix Against a Recorded Agent Run — Serve a recorded agent run's unchanged boundaries from the record and run the changed ones live, so one production incident becomes a deterministic regression test
• Trajectory-Aware Benchmark Subset Selection for Agents — Keep the pass-count strata and replace the random draw inside each with the instances nearest that stratum's trajectory-embedding centroid; worth the pipeline only below a 20% subset
• Per-Change Deploy Monitors: Report the Verdict, Don't Act on It — Attach a monitor to each pull request, derive its checks from that diff, report health per environment in three states, and keep it off the rollback control because attribution is weaker than detection

Eval-Driven Development

• Eval-Driven Development: Write Evals Before Building Agent Features — Define correctness criteria before implementation so every agent change is validated against a stable, reusable test suite
• Skill Evals — Treat each skill as an evaluable unit with a labeled dataset, paired with-skill vs baseline runs, and a benchmark that quantifies pass-rate, time, and token trade-offs
• Skill Lift: Measuring What a Skill Adds at Runtime — Grade a release-candidate skill on the paired with-versus-without delta, because structural and LLM-judge scan scores correlate with live lift at ρ = −0.0181 and ρ = −0.0266
• Skill-Use Gates: Trigger, Compliance and Boundary — Score skill use as three independent gates instead of one pass rate, because retrieval failure, procedure drift, and prohibition breaches need opposite fixes
• Skill Utility Depends on Model and Harness Configuration — A skill's pass-rate gain belongs to one model and harness pair; rerun the paired with-and-without test on your own pair for narrow, high-stakes, or weak-model work
• Emulated APIs for Agent Skill Evals — Run an API-calling skill's evals against a transparent emulator at the real URL so cost, live-data mutation, and shared-state non-determinism stay out of the score without rewriting the skill under test
• Emulate Agent-Experience Changes Before Shipping — Stand up a proposed documentation, API, or MCP change in a local emulator and measure its effect on agent behavior against a baseline before shipping, because most AX changes fail
• AX Evals: Measure the Agent-Facing Surface, Not the Model — Score your library, CLI, MCP server, or docs with the model held fixed, and design the criteria, judge, and environment so the with-versus-without delta is attributable to that surface
• Measure Agent Experience Against a Bare Baseline — Read an AX result as a triple: which question it answers, what it cost beside what it scored, and the agent profile it belongs to; then fix the surface the run's trail shows the agent already reading before shipping an extension
• Agent-Driven Eval Flywheel: Prove a Fix Generalizes — Drive the eval-generation loop from your coding agent so each fix is graded against the whole accumulated case set, proving it generalizes instead of patching one case
• Eval Difficulty as a Product Smell — Hard-to-write evals usually signal a product that was not designed for users to verify; redesign the artifact for checkability before scaling the scorer
• Agent-Authored Eval Suites From Repo Context and Traces — Let a coding agent map the agent surface and scaffold a runnable task from repo and traces, while capability selection and verifier auditing stay human
• Building Agent Eval Environments With a World Spec — Hold the domain knowledge every eval task shares in one versioned world spec so task construction parallelizes, worth doing for a dataset rather than a handful of cases and only with an audit budget for what the pipeline emits

Review Techniques

• Five-Pass Blunder Hunt — Run the same critique prompt five times in sequence on a plan or spec; each pass normalizes the issues it finds, forcing later passes deeper into structural and logical problems
• Pre-Completion Checklists — Block agent completion signals with a mandatory verification sequence
• Golden Journeys: Restartability as a First-Class Verification Primitive — Name a small set of end-to-end paths with explicit failure signals per step and gate completion on the system restarting cleanly afterward
• Test-Driven Intent Clarification — Use AI-generated tests to surface specification ambiguity before code review — validate tests instead of code to clarify intent with lower cognitive cost
• Decision Pins: Confirm an Acceptance Example Discriminates — Run two throwaway implementations that differ only at the named ambiguous point and keep the input where they disagree; 42.7% of 600 generated test suites contained no test that distinguished the readings at all
• Probing Unstated Constraints in Generated Code (Intent Violation Rate) — A stated suite only checks the constraints your prompt named; two frontier models passed over 92% of stated tests while violating a hidden constraint in more than half of problems, and the violations are deterministic per problem rather than sampled
• Unstated-Contract Bugs: Sort Tickets by Information Gap — Agents fixed two hard bugs 16/16 and failed an easy one 12/12 because the correct answer lived in user data rather than the repository, so triage tickets by where the information sits and enrich the ticket before the agent starts
• Source-Grounded Test Plan with Pre-Action Assertion Annotation — Before a UI-driving agent verifies its change, have it write a source-read test plan and annotate each step's expected behavior upfront so it cannot rationalize an unexpected result as a pass
• Agent-Recorded Video Demos as a Verification Artifact — The agent drives the running app and records a screencast as proof-of-work for human PR reviewers — a visual modality that complements tests where they are weakest, under stated conditions
• Agent-Generated Verification Reports: A Structured Round-Trip for Human Review — Each parallel agent emits a per-sub-task report with the request quoted verbatim and exact test steps, and the human's verified or not-fixed verdict routes back as the completion signal
• Spec-Derived Execution as a Correctness Oracle — Judge candidate code against a natural-language spec by deriving inputs from the spec, executing them, and grading the I/O pairs — ground the LLM judge in real execution traces instead of asking it to reason over the code
• Specification-Grounded Test Writing — Give an agent's test writer the specification as enumerated rules so it catches the missing-validation and boundary bugs its own tests otherwise pass — grounding in intent, not test count, drives a +38pp correct-code gain on spec-completeness defects
• Deriving a Specification From Buggy Code Before Generating Tests — When no written specification exists and the code under test may be wrong, have the model write a behavioral docstring first and generate tests from that with the implementation removed — recovers part of the lost bug-detection power, not all of it
• Spec-Driven Test Generation: Contract Coverage Is the Lever — Having the agent document pre-conditions, post-conditions and undefined behaviors before writing tests lifted bug detection from 53.4% to 63.2% across five runs, but only when the extracted contract named the condition the bug violated — 54.9% detection with that coverage against 19.4% without
• Natural-Language Documentation as a Code-Review Intermediate (Verifiable Literate Programming) — Translate LLM code into a deterministic natural-language documentation layer and review that prose, so intent-code mismatches surface where a human can judge them
• Audit-Budget Allocation for Agent Fleets — Screen an agent's self-reported confidence for discrimination before ranking a review queue by it; past a mimicry threshold the ranked queue does worse than random, and a larger audit budget flips first
• Evidence-Chain Run Logs: Bracket the Reported Symptom — Pair every agent tool call with its actual result and bracket the change with one machine-readable measurement of the reported symptom, taken identically before and after — a gate, never a signal the agent iterates against
• Evidence-Bundled Agent PRs: Sizing the Reviewer's Effort — Attach the reproduction, failing probe, and executed test the agent already ran so a reviewer picks a depth per change; the artifacts carry the value, and the agent's own risk grade carries none
• Claim-to-Evidence Trace Graphs for Auditing Agent Runs — Rebuild a finished session as a layered graph with typed edges so a reviewer traverses backward from a claim to its artifacts and checks; the record layer is deterministic, the graph above it is inferred
• Post-Merge Fix Signals for Agent Merges — Agent merges draw a verified follow-up fix at 1.62 times the odds of human merges in the same repositories; watch the first week and rank by the commits it took to land, because review duration carries no within-repository effect
• Name the Check That Passed Before Accepting AI Code — Across 506 coded accounts of AI use in research code, evaluation confidence tracked trust in the tool (r=.33) rather than the checks actually run (r=.05), so gate acceptance on a recorded check instead
• Reject on a Failing Check, Never Accept on a Passing One — After a fail-on-base check, a generated test still failing on an agent's patch rejected it at 0.82 precision in the test stage of a 121-trace held-out Python run, while the same test passing accepted at only 0.30, so give the reject arm a mechanical decision and the accept arm none
• Require the Metric the Optimization Should Move — Validation evidence appears in 82.3% of agentic and 80.6% of human performance PRs, but only 34.5% report a metric the applied optimization is expected to improve and 17.7% of caching gains report the memory cost, so name both numbers instead of asking whether the change was validated
• Transcript-Measured Review Coverage — Agents skipped at least one in-scope file in 67.9% of 1,140 review runs and 80.4% of those runs did not disclose it; derive coverage from the tool-call trace and flag the mismatch with what the report claims
• Verify Agent Diagnoses and Fix Proposals Before Acting — In a Claude-built codebase, design-fix proposals scored 79.4% accurate against 94.3% for checkable facts, narrowing to 93.4% once rejected proposals are excluded; run the check before you adopt a diagnosis or proposal, since it predicts rather than reports
• Task Category as the Security Review Routing Key — Generated-code security findings varied three to six times more by task category than by which tool wrote the code, so route review depth by task and grade model choice separately
• When a Second Model Helps in LLM Review — Same-model fresh-session review leads on code (F1 40.7% vs 37.2%) and cross-model review on documents (42.1% vs 24.5%); pairing a same-model review with a top-tier cross-model one matched 56.7% of 150 planted errors against 42.7% for two same-model reviews
• Auditing an Instruction File for Interference Between Its Own Rules — Check rule pairs for mandates another section prohibits; 20 of 21 findings on one vendor prompt needed no model call, and the pairs worth fixing are the ones no action satisfies

Rubric Design

• Anti-Reward-Hacking: Rubrics That Resist Gaming — Design eval rubrics with orthogonal signals so no single metric is gameable by agents
• Symptom-Reduction-as-Root-Cause: Why Oracle Tests Alone Miss Architectural Drift — Agents iterating against fiducial-point oracle tests will adjust coefficients inside an architecture that cannot represent the target — diverse-parameter tests, cross-session changelogs, and an anti-fudge-factor rule catch what oracles miss
• Eval Awareness: Designing Evals Agents Cannot Recognize — Frontier models detect eval-shaped prompts and shift behavior between evaluation and production — remove the signals that cue recognition
• Evaluator Templates: Portable Primitives for Agent Eval Suites — Reusable judge templates cover the portable subset of eval questions — security, PII, format, trajectory — while domain quality still needs custom evaluators
• Meta-Evaluate the LLM Judge Before Trusting Rubric Verdicts — An LLM judge's rubric verdict hides its own error rate; measure it against human labels before scaling, because reliability varies by domain, model, and prompt (RuVerBench: 94.7 down to 51.6 balanced accuracy)
• Mutation Testing for LLM Judges: Scoring an Evaluator on Injected Defects — Inject defects you named into accepted inputs and score the judge on kill ratio when the task has no ground truth, then pair it with a precision measure because kill ratio is blind to over-flagging
• Detecting Self-Preference in a Single LLM Judge — A judge scoring output from its own model family inflates pass rates; stratify verdicts by generator and measure the flip rate, because aggregate human-agreement averages the biased and unbiased halves together
• Choosing the Judge Model That Grades Your Agent Evals — Replay frozen traces past every candidate judge against human labels, hold decoding fixed across arms, and read each dimension only as far as the oracle supports — five items settle cost and latency, not accuracy
• Contract-Domain Tracing for Rubric Credit — Label each criterion with the contract requirement it tests, then run that requirement: a safety domain at 10/10 full credit held a guard accepting the parent directory
• Typed Judge Scorers and the Cost of Each Extra Label — Return the judge's grade as a constrained choice with per-choice probabilities where the question is already a classification; each extra label costs agreement with expert graders (76% to 57% moving from 2-way to 5-way in one short-answer grading study) and makes a confidence gate withhold more cases

Guardrails

• Verification Capacity as the Agent Quality Ceiling — Agent generation scales with compute and verification throughput does not; measure the two rates and pick deliberately between scaling verification, throttling generation, and lowering the bar
• Verification Capacity Saturation: Three Levers, One Default — When changes arrive faster than a gate clears them, a genuinely saturated station admits only three responses, and a gate that degrades rather than blocks picks the third on its own
• Diff-Coverage Gating for Agent-Authored Pull Requests — Gate an agent's PR on the coverage of its changed lines, not the whole-repo percentage, because agents test under half of code-touching PRs and existing suites cover a minority of what they change
• Deterministic Guardrails Around Probabilistic Agents — Wrap agent output in hard, deterministic checks — linting, schema validation, CI gates — that enforce correctness regardless of what the agent produces
• Verification as a Tool, Not an Instruction — Prompting an agent to verify its answer moved reference-based checking from 19% to 22%; a callable scoring tool roughly tripled that share at every prompt level, and improved score and calibration with it
• Zero Violations Is Not Evidence Your Hook Works — A blocking hook writes output only when it denies something, so record a firing trace and run a directed attempt against the locked path before reading a clean run as enforcement
• Per-Layer Suppression Accounting in Acceptance Gates — Record which layer discarded each item, because a composite count hides whether the deterministic half is filtering at all; in one pre-registered 40-run ablation it never fired
• Choose Agent Gate Layers by Mechanism Class, Then Measure — Two LLM judges over 560 agent actions labeled block composed to 1.2 to 1.4 independent layers and a rule layer plus one judge to 1.9 to 2.1; a 20% solo-accuracy gain added no coverage at all
• Slop Detectors Fail as Per-Item Review Gates — Model-free AI-content signals are corpus-level estimators whose strongest code features an autoformatter erases; gate on build, test, diff-versus-description, and changed-line coverage instead
• Evidence-Conditioned Execution: Gate Edits on Observations — Hold an agent's edit or patch submission until its trajectory satisfies machine-checked conditions naming the repository entities it should have observed first; the gain shrinks as the model strengthens
• Pre-Execution Failure Scoring with a Draft Model (Speculative Uncertainty) — A 4B draft model scores a black-box agent's emitted tokens in one forward pass and vetoes actions likely to fail; it cut token cost 14-19% and cut SWE-Bench Verified resolve rate from 49% to 44%, so it buys cost and not quality
• Evidence-Gated Lifecycle Control for Coding Agents (Proof-or-Stop) — Advance an agent's lifecycle states (reviewed, tested, done, ready-to-merge) only when fresh, source-bound, mechanically verifiable evidence clears the gate — the agent's own assertion never advances the state
• Non-Compensatory Readiness Gates Before Agent Release — Score release evidence on separate axes (evaluation, context, compliance, governance) and aggregate so a failure on one cannot be averaged away — the blocking rules do the work, not the composite score
• Staged Evidence Gates for Agentic Program Repair — Order cheap evidence gates ahead of expensive ones in agentic repair loops — retrieval-grounded context, compile gate, target-test gate, then full regression — to filter invalid candidates before paying full-suite cost
• Execution Budgeting in Agentic Program Repair — Cap test executions in generate-run-revise loops on frontier commercial agents; prohibiting execution drops resolve rate ~1.25 pp on SWE-bench Verified — applies only under specific preconditions on model strength, codebase familiarity, and execution cost
• Bounded Repair-Loop Iterations — Cap generate-validate-repair loops near three to four rounds; most gains land early and later rounds mostly burn tokens — prefer stop-on-plateau, and watch strong-model late gains, thin-oracle overfitting, and self-critique loops
• Profiler-Guided Optimization Loops for Coding Agents — Feed the agent a summarized profile and gate every iteration on a behavior-preserving test run; the profiler and the gate only pay off shipped together, and profiler evidence is itself fallible
• Validity-Estimate Stopping for Noisy Verify-Repair Loops (VRR-Stop) — When the verifier is noisy, its acceptance rate rises while true validity falls as repair damages correct plans — estimate validity from repeated votes and stop on the sign of expected marginal gain, not on acceptance
• Dual Executable Specifications for Long-Horizon Features — Compile a feature design into an architecture spec (do the required components exist and stay connected) and a behavior spec (does data flow through them correctly) that re-run after every edit — the gain appears only past roughly 3,000-word instructions or 200 agent turns
• State-Bound Evidence and Typed Revision Contracts for Repair Loops — A repair loop can find a correct patch and then destroy it (0.847 ever-correct against 0.673 submitted); bind every test result to the code state that produced it, preserve the last verified candidate, and admit only typed revision actions
• Dependency Gap Validation for AI-Generated Code — AI coding agents declare a fraction of the dependencies their code actually needs at runtime — validate in clean environments before trusting the manifest
• Verify Observability in Agent-Generated Code — Agent-generated systems pass functional tests but expose fault signals for under 14% of failures despite having logging — verify runtime fault-signal coverage with fault injection, not the mere presence of logging
• Phantom Symbol Detection for LLM API Migration — Verify symbols in LLM-generated migration code against a documentation-derived knowledge base — a deterministic check that catches fabricated imports, constructors, and methods that probabilistic judges miss
• Generative Provenance Records for Tool-Using Agents — Emit a structured record (tool turn, evidence span, relation) alongside each output sentence so a mechanical verifier can check claim-level grounding before the answer leaves the loop
• Per-Line Requirement Citations for Hallucination Detection — Cite a requirement ID on every generated line so a set-difference check flags any citation to a requirement absent from the spec as a hallucination — detection at a determinism cost
• Typed Generation Contracts for Grounded Extraction — Split a wrong grounded answer by context sufficiency first, then make the extraction half checkable with typed fields, verbatim evidence spans, and a validator that runs
• Semantic Validation for Schema-Valid Agent Output — Schema conformance proves shape and says nothing about values; check identifiers against a register, values against a real bound, and fields against each other, and escalate where no anchor exists
• Post-Failure Evidence Contracts for Tool-Using Agents — Requiring status, evidence, limitation, and next action on the final report tracks pooled false success at 0.8% against 22.8% under a plain request, and forced-choice framing concentrates the baseline error that a neutral request barely shows
• Defense-in-Depth Against Coding Agent Fabrication (Honesty Harness) — Four uncorrelated layers — instruction-level honesty rules, verify-before-write, real-time hooks that feed output back, and an external-tool fact-checker subagent — that reduce fabrication survival without claiming elimination
• Layered Oracle Stack for Agent IaC Security Repair (TerraProbe) — Stack scanner-pass, full-scanner, validate, plan, and plan-diff oracles so LLM-generated infrastructure-as-code security fixes have to clear behavioral checks — first-pass agent repairs cleared the targeted Checkov finding 83.3 percent of the time but 71.4 percent of plan-compared repairs were deceptive fixes
• Explained Feedback for LLM Vulnerability Repair — Pass the raw scanner diagnostic back first; rewriting it into an attack mechanism plus ordered repair steps adds roughly 1 to 1.5 points, and reverses on weak instruction-followers, multi-CWE tasks, and the self-explained variant
• Classification Before Repair in an Analyzer Backlog — Handing a static-analysis backlog to an agent puts the expensive errors in deciding whether each finding is real, not in the patch; gate the queue on classification and read a falling finding count as fixed-or-silenced
• False-Pass Liability Decides the Next Harness Component — Price an erroneous accept before choosing between a planner and a terminal completion check; the ordering flips with that liability, and the check withholds correct work rather than improving it
• Hash-Pinned Command Approval for Non-Interactive Plugin Installs — Claude Code 2.1.271 accepts the sha256 of a command a previous --json run displayed, binding the approval to the command that was read; the acceptance covers command, plugin and catalog, not what the command produces
• Behavioral Preflight: Replay Tool-Call Rules Before Enforcing — Replay each tool-call rule over recorded passing runs and flag any that would have refused most of its calls; one flagged rule on a development domain, and a high firing rate alone is not a defect

Tooling

• Eval Environment Containment for Cyber-Capable Agents — An agent that cannot reach its fictional target attacks a real one; enforce isolation at the network layer and verify egress from inside the environment, because a scope statement in the prompt is not a boundary
• Per-Attempt Sandboxes for Agents That Change the Filesystem — Give every trial its own clean container when the result is workspace state, emit the dataset, rows, scores and trajectory that keep runs comparable, and keep the verifier outside the container the agent controlled
• Rented Sandboxes for Coding-Agent Benchmark Runs — Rent a sandbox per trial when the sum of trial durations blocks the decision, and record the provider and plan alongside the dataset version because no submission rule pins them
• Test Harness Design for LLM Context Windows — Terse stdout, verbose log files, and grep-friendly error lines that keep agent context clean and actionable during evaluation runs
• Runnable Documentation as Agent Verification — Extract inline code examples into standalone files that CI executes on every build so doc rot fails the build the same way broken code does
• Verification Surface: Match the Tool to the Failure — A controlled study of 1,116 agent builds ranks self-check tools by reach and token cost: a boot probe costs less than no tool at all, a shell costs 2.35x, a linter bought nothing

Last reviewed: 2026-05-27