Behavior Beyond Text: Evaluating Refusal Transfer Failure in LLM Agents

[arXiv] Ekagra Gupta, Raj Saha, Aniekan-Abasi Inyang and Adam Al Gharib published a paper arguing that when large models act as tool-calling agents, safety evaluations still mostly focus on text refusals. The authors built a benchmark containing 2,304 prompts covering four domains, used matched triples to compare pure-text, standard-tool and adversarial-tool scenarios, and measured tool-calling safety with 20 categories of prohibited actions. Across five models of different sizes and families, the authors report that 10% to 52% of harmful requests that the models had already refused in text still produced unsafe tool calls under standard tool prompts; activation in the refusal-related direction in the residual stream decreased in tool scenarios in four of the five models, and lower activation predicted unsafe calls (AUC 0.76 to 0.86), but activation patching and steering along the refusal direction only partially worked and were often accompanied by suppression of benign tool use or degraded output quality. The paper argues that evaluating the safety of tool-calling agents requires examining both actions and text responses.