BLINDSPOT: A Benchmark for Safety and Refusal Calibration in Long-Horizon Tool-Using Agents

Researchers introduced Blindspot, a benchmark for trajectory-level safety calibration of long-horizon tool-using LLM agents, containing 22 attack families and 35 scenarios across seven domains that yield more than 2,500 trajectories averaging 14.7 turns each. Evaluating 13 proprietary and open-weight LLMs across eight metrics, the benchmark assigns each trajectory one of five outcomes — Safe Completion, Correct Refusal, Unsafe Completion, Over-Refusal, or Indeterminate — and found substantial differences in safety-utility calibration, with failures emerging only after several initially safe interaction steps. The authors argue these results motivate treating agent safety as a trajectory-level property rather than a single-turn or binary success criterion.

arXiv:2609.16305v1 Announce Type: new Abstract: Large language model LLM agents increasingly operate over long-horizon interactions involving tool use, persistent state, evolving authorization, and external environment feedback. In such settings, safety failures may emerge only after multiple turns, yet existing evaluations often reduce agent behavior to task or attack success, obscuring whether an agent acts, refuses, or remains appropriately calibrated as the interaction evolves. We introduce Blindspot, a benchmark for trajectory-level safety calibration of long-horizon tool-using agents. Blindspot evaluates complete user-agent-environment trajectories through adaptive adversarial interaction, stateful tool execution, and execution-grounded adjudication. Its current instantiation contains 22 attack families and 35 scenarios across seven domains, yielding more than 2,500 long-horizon trajectories with an average interaction length of 14.7 turns. Each trajectory is assigned one of five outcomes: Safe Completion, Correct Refusal, Unsafe Completion, Over-Refusal, or Indeterminate. Unlike fixed attack datasets, Blindspot is an extensible live-simulation framework in which attacks, scenarios, tools, policies, domains, and agent configurations can be added without redesigning the evaluation pipeline. We evaluate 13 proprietary and open-weight LLMs using eight metrics covering unsafe completion, appropriate refusal, benign utility, over-refusal, repeated-run robustness, and post-refusal failure. Preliminary results reveal substantial differences in safety-utility calibration across models and show that failures can emerge only after several initially safe interaction steps. These findings motivate treating agent safety as a trajectory-level property rather than a single-turn or binary success criterion.