Long-Horizon Agent Trajectory Attribution: A Unified Benchmark and Fine-Grained Annotation Framework

Jie Shi; Jing Chen; Lin Xu; Li Zhang; Yang Sun

REVIEW 4 major objections 4 minor 20 references

Long-Horizon Agent Trajectory Attribution: A Unified Benchmark and Fine-Grained Annotation Framework

T0 review · 4 major / 4 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper introduces trajectory attribution as a benchmarkable evaluation problem for LLM agents, with a unified component schema and over 1,300 annotated trajectories spanning task-aligned actions, unsafe actions, and safety refusals.

desk verdict A sensible protocol for trajectory attribution; the benchmark's validity currently rests on unreleased, unquantified LLM-produced labels. read the letter →

arxiv 2608.06909 v1 pith:QDB74NID submitted 2026-08-07 cs.AI

Jing Chen , Yang Sun , Li Zhang , Lin Xu , Jie Shi This is my paper · ORCID

classification cs.AI

keywords trajectoryattributionLLMagentscomponent-levelschemabenchmarkattackchainsexecutionsafetyrefusallong-horizonagentevaluation

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that explaining an LLM agent's behavior requires looking at the whole execution trail, not just the final answer, and that this act—trajectory attribution—can be a standardized evaluation problem. It builds a benchmark by converting heterogeneous agent traces into one component-level schema, labeling each target behavior with exactly one primary cause and, where relevant, an ordered attack or execution chain. Across three existing agent environments this yields 1,351 annotated trajectories spanning task-aligned actions, unsafe actions, and safety refusals. The paper also defines two evaluation tasks, primary-attribution localization and attribution-chain recovery, and shows that reference baselines find long-range and chain-structured cases measurably harder. If the framework holds, future agent models can be scored on how well their actions can be explained, alongside how well the actions succeed.

What carries the argument

The load-bearing object is the reference attribution structure $A=(P,H^*)$ defined over an ordered component trajectory $\tau=(c_1,\dots,c_T)$: for a target component $c_t$, the candidate set is all earlier components, $P=\{c^*\}$ is the single annotated root cause, and $H^*=(c_{i_1},\dots,c_{i_m})$ is the optional ordered chain of contributing components, with attack and execution chains as two specialized chain types for unsafe actions. The construction protocol carries the argument: it standardizes raw traces into this schema, identifies the target behavior as task-aligned, unsafe, or a safety refusal, annotates the primary cause and chains, then validates the annotations structurally and semantically with an LLM reviewer and a repair loop. This protocol is what lets trajectories from different agent systems be compared under one attribution standard.

What would settle it

Take a random sample of trajectories from the published benchmark, have independent annotators who have never seen the labels re-apply the protocol, and measure agreement on the primary component and on chain membership; if pairwise agreement on primary attribution is not high, for example below roughly 80 percent, the labels and the performance gaps reported in Tables 5 to 7 cannot be treated as a stable ground truth.

Watch

Extended reading notes

Core claim

The central claim is that trajectory attribution can be made into a reproducible evaluation task: any agent trajectory is an ordered sequence of components, such as system instructions, user messages, reasoning steps, tool calls, observations, and memory, and for a chosen target behavior the job is to rank the earlier components by causal contribution. The reference annotation gives every target one primary attribution component, the annotated root cause, and, for unsafe actions with distributed causation, an ordered attack chain showing how adversarial influence propagated and an execution chain showing how the unsafe act was carried out. The paper instantiates this protocol on trajectories from three existing agent environments, producing more than 1,300 standardized trajectories, and evaluates incremental and leave-one-out baselines under two metrics: Hit@1 and MRR for root-cause localization, and Recall@K and MAP for chain recovery. The substantial performance differences across local and long-range settings are offered as evidence that the benchmark captures real attribution difficulty rather than a single easy level.

Load-bearing premise

The framework assumes every target behavior has exactly one primary cause and that LLM-assisted annotation, after structural and semantic validation, reliably finds that cause and the optional chains; if behaviors are often jointly caused or the labels are inconsistent, the ground-truth annotations and all difficulty measurements lose their foundation.

Editorial extensions

If this is right

Attribution becomes a continuous evaluation axis for LLM agents, so a model's decisions can be scored for explainability rather than only for success or safety.
The benchmark's local-versus-long-range gap quantifies a concrete failure mode: methods that rely on immediately preceding context will miss root causes separated by many steps.
Because chain recovery is consistently harder than root-cause localization, unsafe behaviors that arise through multi-step influence are flagged as a distinct challenge for attribution methods.
The reusable annotation protocol means trajectories from future agent models can be standardized, annotated, and evaluated under the same schema, making benchmarks comparable as agent systems evolve.
The reported baseline scores provide a reference point for comparing future trajectory attribution methods on the same trajectories.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

If real agent behaviors are often multicausal, the one-primary-cause assumption may make the benchmark systematically easier than real-world attribution; a natural extension is to allow weighted or multiple primary causes and measure how baselines behave on them.
The same protocol could be reused as a quality gate during agent development: trajectories whose attributed cause is far from the intended instruction could be flagged for debugging before deployment.
A direct test of the annotation's reliability would be double-annotation of a sample by independent annotators; agreement statistics would show how much of the benchmark's difficulty is inherent versus an artifact of labeling choices.
The chain annotations suggest a path toward counterfactual intervention: replacing or removing the primary component should predictably change the target behavior, which would convert static labels into testable causal claims.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Colleague — the short version: this is a decent benchmark-design paper whose central artifact, the 1,351 annotated trajectories, is not yet available and whose label reliability is not established. The protocol itself is well thought out; the gap is empirical, not mathematical.

What's actually new: the paper proposes trajectory attribution as a distinct evaluation problem and provides a unified component schema, a behavior-aware annotation process with one primary cause plus optional attack/execution chains, two evaluation tasks, and two likelihood-based baselines. That combination is not present in the prior work they cite. They also reuse execution-derived trajectories from AgentDojo and Agent3Sigma, which is good practice. The examples in Figures 3 and 4 are clear, and the distance-based analysis (local vs long-range) is a sensible way to characterize difficulty. The math is simple and internally consistent; there are no fitted parameters or circular derivations. The baselines do what they claim.

The soft spots are where the stress-test note lands. The labels — the benchmark's ground truth — come from an LLM-assisted annotation pipeline with only deterministic structural checks and an LLM-based semantic review. No inter-annotator agreement is reported, and the 'human review' in the contributions is not quantified anywhere. The limitations section admits that alternative plausible explanations can exist, yet Section 3.2 forces exactly one primary component per trajectory. That is acceptable only if the annotation procedure is consistent, and we have no evidence of it. Worse, the repository says 'future releases,' so the annotated data is not currently available to audit. That is a deal-breaker for immediate use as a benchmark.

The circularity concern is minor: yes, both the labels and baselines use LLM likelihoods, but the annotation is based on reasoning over causal roles, not on the same scoring function, and the baselines are only provided as references. I would not call that a fatal flaw.

Who this is for: researchers working on agent interpretability, failure diagnosis, or AI safety evaluation. If they ship the data and report agreement, this could become a useful standard. Right now it's a promising protocol in search of evidence.

I'd send it to peer review — the problem is timely and the framework is clean enough to deserve referee time — but I'd make release of data and reliability statistics a precondition for acceptance. A serious referee should ask for that.

Would I cite it in the next year? Not until the artifacts are out. Worth reading now, citing later.

Referee Report

4 major / 4 minor

Summary. The paper introduces trajectory attribution as an evaluation problem for LLM agents and proposes a benchmark plus annotation framework. It standardizes heterogeneous execution traces from AgentDojo and two Agent3Sigma settings into a unified component schema, annotates one primary attribution component per target behavior, and adds attack/execution chains for a subset of unsafe-action trajectories. The claimed instantiation contains 1,351 trajectories across task-aligned actions, unsafe actions, and safety refusals. Two reference baselines (incremental trajectory contribution and leave-one-out perturbation) are evaluated with Hit@1/MRR and Recall@K/MAP, and the paper reports substantial difficulty variation across target types, source benchmarks, attribution distance, and chain structure. A reusable annotation skill is promised for future trajectories. The central artifact is the annotated ground truth, and the paper's validity hinges on the consistency and availability of those labels.

Significance. If the annotation protocol is reliable and the labels are released, this would be a useful contribution: the unified component schema, the explicit distinction between primary attribution and structured chains, and the cross-behavior coverage (task-aligned, unsafe, refusal) address a real gap in agent evaluation, which currently focuses on outcomes rather than process. The two evaluation tasks and the reference baselines provide a concrete starting point for comparing attribution methods. The paper also gives credit for proposing a reusable protocol rather than a fixed dataset. However, the contribution is currently empirical rather than formal: there are no machine-checked proofs or parameter-free derivations, and the benchmark's value depends on the validity of human/LLM-produced labels, which is not yet demonstrated.

major comments (4)

[§4.4, §9] The load-bearing claim is that the 1,351 trajectories carry reliable component-level ground-truth attribution labels, but the paper reports no inter-annotator agreement, no error analysis, and no quantitative assessment of annotation reliability. Section 4.4 describes only deterministic structural checks and an LLM-based semantic reviewer with iterative repair, and Section 9 explicitly concedes that 'some trajectories may admit alternative plausible attribution explanations.' Because Sections 3.2 and 4.3 force exactly one primary attribution component per target, genuinely multicausal trajectories would receive arbitrary labels under this protocol. I ask the authors to report agreement statistics (e.g., Cohen's kappa or Krippendorff's alpha) on primary-component selection and chain membership, to provide an error analysis of the validation stage, and to quantify how often the LLM-based reviewer changed or rejected annotations.
[§1, §4.4] The contributions section states that annotations are 'verified through human review,' but Section 4.4 describes no human review step; the semantic validation is performed by an LLM-based reviewer. This is a discrepancy in a claim that directly supports the benchmark's credibility. The authors should either document the human review procedure (number of annotators, sample size, adjudication process, and measured agreement with the LLM-assisted annotations) or remove the 'human review' claim from the contributions.
[Tables 4, 5, and 7] The paper contains numeric inconsistencies that undermine the reproducibility of the reported statistics. Table 3 reports 1,351 total trajectories, but Table 5's 'All Targets Overall' N is 1,349. For Agent3Sigma Stage unsafe actions, Table 4 lists 187 trajectories while Table 5 lists N=186; for safety refusals, Table 4 lists 309 Stage trajectories while Table 5 lists N=308. In Table 7, Stage execution-chain coverage is 71 in Table 4 but 70 in Table 7, making the summed execution-chain N (214) disagree with Table 4 (215). The authors should reconcile these counts and state explicitly which trajectories are excluded from the evaluation and why.
[§4.5, repository description] The benchmark's core artifact, the annotated dataset, is not currently available: the abstract and Section 10 refer to 'project resources and future releases,' and the GitHub description mentions future releases. Without the actual labels, independent audit of the ground truth is impossible, and the paper's benchmark claims cannot be verified. I ask the authors to release the full annotated dataset, the standardized trajectories, and the annotation prompts/skill as part of the review or revision process, or to clearly state a concrete release date and embargo policy.

minor comments (4)

[§3.2, Eq. (4)] The notation is inconsistent: the prose defines the primary attribution as the set P = {c*}, but Eq. (4) writes P = c*. Please align the notation, since the evaluation metrics use rank(c*) and the set notation clarifies that P contains exactly one element.
[§4.4] The description of the semantic validation criteria is too vague to be reproducible; the authors should provide the actual evaluation criteria or the prompt template used by the LLM reviewer, including how 'root cause' is distinguished from 'necessary context' and 'supporting evidence.'
[§6.2, Eq. (11)] In the leave-one-out score, the first average log-likelihood term is identical for every candidate component and therefore does not affect the ranking. The authors could simplify the formula or state explicitly that ranking depends only on the second term.
[§7.2, Table 6] The perfect Hit@1 and MRR of 1.000 for local task-aligned cases are described as a calibration setting, but the paper does not report whether these cases are excluded from the aggregate difficulty claims; please clarify how these degenerate cases affect the overall conclusions.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the benchmark, annotation protocol, and baseline evaluations are self-contained; no prediction reduces to fitted inputs or self-citation.

full rationale

The paper's central products are an annotation framework and a benchmark instantiated from externally collected trajectories (AgentDojo, Agent3Sigma Stage/Canary). No parameter is fitted to a subset of data and then renamed as a prediction: the two baselines (incremental likelihood and leave-one-out) are defined directly from trajectory components and the annotated target, and the reported Hit@1/MRR and Recall/MAP numbers are raw evaluation measurements rather than quantities forced by the construction. The primary-attribution and chain definitions in Section 3.2 are deliberate schema conventions, not derivations from hidden inputs, and the structural-validation rules in Section 4.4 merely check that annotations obey those conventions. The references to Qian et al. (2026) and Kim et al. (2026) for baseline formulations are not load-bearing self-citations and do not import an unverified uniqueness result. The acknowledged limitation that 'some trajectories may admit alternative plausible attribution explanations' (Section 9) and the absence of inter-annotator agreement statistics are real empirical-validity concerns about ground-truth quality, but they do not constitute circularity: the benchmark's difficulty measurements could be confounded by annotator-model agreement, yet they are not equivalent by construction to the inputs. Hence the appropriate finding is no significant circularity.

Assumptions & free parameters 0 free parameters · 4 assumptions · 2 invented entities

The benchmark rests on a small number of design assumptions: exactly one primary cause per target, composite tool components, and LLM-assisted annotation quality. The paper provides no independent evidence for the attack and execution chain labels, and the evaluation baselines require an underspecified LLM likelihood estimator.

assumptions (4)

ad hoc to paper Each target behavior has exactly one primary attribution component.
Section 3.2 defines P = {c*} as a single component, and Section 4.1 argues against flat multi-cause annotations. The entire benchmark and Hit@1 evaluation depend on this uniqueness assumption, but multicausal behaviors are common in real agent trajectories.
domain assumption A tool invocation and its observation form one composite component.
Section 3.1 states this to define atomic attribution units. If the tool call and observation can independently cause the target, this schema merges them and may hide the true cause.
domain assumption LLM-assisted annotation with structural and semantic validation yields reliable ground truth.
Section 4.4 describes validation but reports no inter-annotator agreement or error rate. Section 9 admits some trajectories may admit alternative plausible explanations.
domain assumption The target behavior's token-level log-likelihood is computable under trajectory prefixes with a single LLM.
Section 6 defines incremental and leave-one-out scores in terms of log p(y | ...), but the paper does not specify the model, decoding procedure, or prompt template used to estimate these probabilities.

invented entities (2)

Attack chain
purpose: Annotated ordered sequence of components through which adversarial influence propagates to the unsafe target.
Defined in Section 4.3 and illustrated in Figure 3. It has no external validation that these components are the true causal pathway; the label is produced by the paper's annotation protocol.
Execution chain
purpose: Annotated ordered sequence of components that carry out the unsafe behavior after the primary cause.
Also defined in Section 4.3. Same lack of independent evidence; chain membership is an annotation judgment, not a measured quantity.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Long-Horizon Agent Trajectory Attribution: A Unified Benchmark and Fine-Grained Annotation Framework." pith.science (2026). https://pith.science/paper/QDB74NID

@misc{pith2026260806909,
  author       = {Pith},
  title        = {Pith review of: Long-Horizon Agent Trajectory Attribution: A Unified Benchmark and Fine-Grained Annotation Framework},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/QDB74NID}},
  note         = {Machine review of arXiv:2608.06909}
}

read the original abstract

Large language model (LLM) agents increasingly operate through long-horizon trajectories involving user instructions, tool use, external observations, and memory. Existing benchmarks primarily evaluate behavioral outcomes but provide limited support for fine-grained attribution analysis. We introduce trajectory attribution and develop a benchmark and annotation framework for this task. The benchmark organizes heterogeneous trajectories under a unified component schema and provides annotations of the primary attribution component, together with attack and execution chains where applicable. Instantiating the benchmark with trajectories from AgentDojo and the Stage and Canary settings of Agent3Sigma yields more than 1,300 annotated trajectories covering task-aligned actions, unsafe actions, and safety refusals. The benchmark defines two evaluation tasks, primary attribution localization and attribution-chain recovery, and provides reference baselines based on incremental trajectory contribution and component-level leave-one-out perturbation. It captures diverse attribution settings, including local and long-range attribution as well as structured attribution chains. Reference baseline results exhibit substantial performance differences across these settings, providing an initial characterization of the benchmark's attribution challenges. Beyond this initial instantiation, we release a reusable annotation skill that enables trajectories generated by new agent models to be standardized, annotated, and evaluated under the same framework. Project resources and future releases are available at https://github.com/chenjing-2024/agent-trajectory-attribution.

Figures

Figures reproduced from arXiv: 2608.06909 by the authors.

**Figure 2.** Overview of the benchmark construction protocol. Raw trajectories from AgentDojo, Agent3Sigma Stage, and [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗

**Figure 3.** Representative unsafe-action attribution examples. Panel (a) shows memory-induced disclosure of banking [PITH_FULL_IMAGE:figures/full_fig_p010_3.png] view at source ↗

Figures from the paper (1 more)

**Figure 4.** Figure 4: Representative safe-behavior attribution examples. Panel (a) shows refusal to execute a poisoned skill. Panel [PITH_FULL_IMAGE:figures/full_fig_p011_4.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

20 extracted references · 14 canonical work pages

[1]

2024 , url =

Liu, Xiao and Yu, Hao and Zhang, Hanchen and Xu, Yifan and Lei, Xuanyu and Lai, Hanyu and Gu, Yu and Ding, Hangliang and Men, Kaiwen and Yang, Kejuan and Zhang, Shudan and Deng, Xiang and Zeng, Aohan and Du, Zhengxiao and Zhang, Chenhui and Shen, Sheng and Zhang, Tianjun and Su, Yu and Sun, Huan and Huang, Minlie and Dong, Yuxiao and Tang, Jie , booktitle...

2024
[2]

2025 , url =

Zhu, Kunlun and Du, Hongyi and Hong, Zhaochen and Yang, Xiaocheng and Guo, Shuyi and Wang, Zhe and Wang, Zhenhailong and Qian, Cheng and Tang, Xiangru and Ji, Heng and You, Jiaxuan , booktitle =. 2025 , url =

work page 2025
[3]

Advances in Neural Information Processing Systems: Datasets and Benchmarks Track , year =

Debenedetti, Edoardo and Zhang, Jie and Balunovic, Mislav and Beurer-Kellner, Luca and Fischer, Marc and Tram. Advances in Neural Information Processing Systems: Datasets and Benchmarks Track , year =

work page
[4]

2024 , url =

Zhang, Zhexin and Cui, Shiyao and Lu, Yida and Zhou, Jingzhuo and Yang, Junxiao and Wang, Hongning and Huang, Minlie , journal =. 2024 , url =

2024
[5]

Zico and Fredrikson, Matt and Winsor, Eric and Wynne, Jerome and Gal, Yarin and Davies, Xander , booktitle =

Andriushchenko, Maksym and Souly, Alexandra and Dziemian, Mateusz and Duenas, Derek and Lin, Maxwell and Wang, Justin and Hendrycks, Dan and Zou, Andy and Kolter, J. Zico and Fredrikson, Matt and Winsor, Eric and Wynne, Jerome and Gal, Yarin and Davies, Xander , booktitle =. 2025 , url =

work page 2025
[6]

2026 , url =

Li, Yu and Luo, Haoyu and Xie, Yuejin and Fu, Yuqian and Yang, Zhonghao and Shao, Shuai and Ren, Qihan and Qu, Wanying and Fu, Yanwei and Yang, Yujiu and Shao, Jing and Hu, Xia and Liu, Dongrui , journal =. 2026 , url =

work page 2026
[7]

arXiv preprint arXiv:2601.15075 , year =

The Why Behind the Action: Unveiling Internal Drivers via Agentic Attribution , author =. arXiv preprint arXiv:2601.15075 , year =

arXiv
[8]

Which Agent Causes Task Failures and When? On Automated Failure Attribution of

Zhang, Shaokun and Yin, Ming and Zhang, Jieyu and Liu, Jiale and Han, Zhiguang and Zhang, Jingyang and Li, Beibin and Wang, Chi and Wang, Huazheng and Chen, Yiran and Wu, Qingyun , booktitle =. Which Agent Causes Task Failures and When? On Automated Failure Attribution of. 2025 , url =

work page 2025

Show all 20 references

[9]

Seeing the Whole Elephant: A Benchmark for Failure Attribution in

Chen, Mengzhuo and Wang, Junjie and Mu, Fangwen and Wang, Yawen and Liu, Zhe and Feng, Huanxiang and Wang, Qing , journal =. Seeing the Whole Elephant: A Benchmark for Failure Attribution in. 2026 , url =

2026
[10]

2026 , url =

Barke, Shraddha and Goyal, Arnav and Khare, Alind and Singh, Avaljot and Nath, Suman and Bansal, Chetan , journal =. 2026 , url =

2026
[11]

arXiv preprint arXiv:2603.25001 , year =

Rethinking Failure Attribution in Multi-Agent Systems: A Multi-Perspective Benchmark and Evaluation , author =. arXiv preprint arXiv:2603.25001 , year =
[12]

Causal Agent Replay: Counterfactual Attribution for

Shah, Jaineet , journal =. Causal Agent Replay: Counterfactual Attribution for. 2026 , url =

2026
[13]

and Pfister, Tomas , journal =

Kim, Minbeom and Parmar, Mihir and Wallis, Phillip and Miculicich, Lesly and Jung, Kyomin and Dvijotham, Krishnamurthy Dj and Le, Long T. and Pfister, Tomas , journal =. 2026 , url =

2026
[14]

2026 , url =

He, Yu and Zhu, Haozhe and Li, Yiming and Shao, Shuo and Yao, Hongwei and Liu, Zhihao and Qin, Zhan , journal =. 2026 , url =

2026
[15]

2026 , url =

Zhang, Tian and Xu, Yiwei and Wang, Juan and Guo, Keyan and Xu, Xiaoyang and Xiao, Bowen and Guan, Quanlong and Fan, Jinlin and Liu, Jiawei and Liu, Zhiquan and Hu, Hongxin , journal =. 2026 , url =

2026
[16]

2023 , url =

Yao, Shunyu and Zhao, Jeffrey and Yu, Dian and Du, Nan and Shafran, Izhak and Narasimhan, Karthik and Cao, Yuan , booktitle =. 2023 , url =

2023
[17]

Frontiers of Computer Science , volume =

A Survey on Large Language Model Based Autonomous Agents , author =. Frontiers of Computer Science , volume =. 2024 , doi =

2024
[18]

arXiv preprint arXiv:2605.22321 , year =

Benchmarking Autonomous Agents against Temporal, Spatial, and Semantic Evasions , author =. arXiv preprint arXiv:2605.22321 , year =

arXiv
[19]

arXiv preprint arXiv:2606.10484 , year =

AgentCanary: A Security Evaluation Framework for Autonomous AI Agents in Real Executable Environments , author =. arXiv preprint arXiv:2606.10484 , year =

arXiv
[20]

2026 , eprint=

HINTBench: Horizon-agent Intrinsic Non-attack Trajectory Benchmark , author=. 2026 , eprint=

2026

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.

[1] [1]

2024 , url =

Liu, Xiao and Yu, Hao and Zhang, Hanchen and Xu, Yifan and Lei, Xuanyu and Lai, Hanyu and Gu, Yu and Ding, Hangliang and Men, Kaiwen and Yang, Kejuan and Zhang, Shudan and Deng, Xiang and Zeng, Aohan and Du, Zhengxiao and Zhang, Chenhui and Shen, Sheng and Zhang, Tianjun and Su, Yu and Sun, Huan and Huang, Minlie and Dong, Yuxiao and Tang, Jie , booktitle...

2024

[2] [2]

2025 , url =

Zhu, Kunlun and Du, Hongyi and Hong, Zhaochen and Yang, Xiaocheng and Guo, Shuyi and Wang, Zhe and Wang, Zhenhailong and Qian, Cheng and Tang, Xiangru and Ji, Heng and You, Jiaxuan , booktitle =. 2025 , url =

work page 2025

[3] [3]

Advances in Neural Information Processing Systems: Datasets and Benchmarks Track , year =

Debenedetti, Edoardo and Zhang, Jie and Balunovic, Mislav and Beurer-Kellner, Luca and Fischer, Marc and Tram. Advances in Neural Information Processing Systems: Datasets and Benchmarks Track , year =

work page

[4] [4]

2024 , url =

Zhang, Zhexin and Cui, Shiyao and Lu, Yida and Zhou, Jingzhuo and Yang, Junxiao and Wang, Hongning and Huang, Minlie , journal =. 2024 , url =

2024

[5] [5]

Zico and Fredrikson, Matt and Winsor, Eric and Wynne, Jerome and Gal, Yarin and Davies, Xander , booktitle =

Andriushchenko, Maksym and Souly, Alexandra and Dziemian, Mateusz and Duenas, Derek and Lin, Maxwell and Wang, Justin and Hendrycks, Dan and Zou, Andy and Kolter, J. Zico and Fredrikson, Matt and Winsor, Eric and Wynne, Jerome and Gal, Yarin and Davies, Xander , booktitle =. 2025 , url =

work page 2025

[6] [6]

2026 , url =

Li, Yu and Luo, Haoyu and Xie, Yuejin and Fu, Yuqian and Yang, Zhonghao and Shao, Shuai and Ren, Qihan and Qu, Wanying and Fu, Yanwei and Yang, Yujiu and Shao, Jing and Hu, Xia and Liu, Dongrui , journal =. 2026 , url =

work page 2026

[7] [7]

arXiv preprint arXiv:2601.15075 , year =

The Why Behind the Action: Unveiling Internal Drivers via Agentic Attribution , author =. arXiv preprint arXiv:2601.15075 , year =

arXiv

[8] [8]

Which Agent Causes Task Failures and When? On Automated Failure Attribution of

Zhang, Shaokun and Yin, Ming and Zhang, Jieyu and Liu, Jiale and Han, Zhiguang and Zhang, Jingyang and Li, Beibin and Wang, Chi and Wang, Huazheng and Chen, Yiran and Wu, Qingyun , booktitle =. Which Agent Causes Task Failures and When? On Automated Failure Attribution of. 2025 , url =

work page 2025