TRACER: Trajectory Risk Aggregation for Critical Episodes in Agentic Reasoning

Estimating uncertainty for AI agents in real-world multi-turn tool-using interaction with humans is difficult because failures are often triggered by sparse critical episodes (e.g., looping, incoherent tool use, or user-agent miscoordination) even when local generation appears confident. Existing uncertainty proxies focus on single-shot text generation and therefore miss these trajectory-level breakdown signals. We introduce TRACER, a trajectory-level uncertainty metric for dual-control Tool-Agent-User interaction. TRACER combines content-aware surprisal with situational-awareness signals, semantic and lexical repetition, and tool-grounded coherence gaps, and aggregates them using a tail-focused risk functional with a MAX-composite step risk to surface decisive anomalies. We evaluate TRACER on $τ^2$-bench by predicting task failure and selective task execution. To this end, TRACER improves AUROC by up to 37.1% and AUARC by up to 55% over baselines, enabling earlier and more accurate detection of uncertainty in complex conversational tool-use settings. Our code and benchmark are available at https://github.com/sinatayebati/agent-tracer.

💡 Research Summary

The paper tackles a pressing problem in the deployment of large‑language‑model (LLM) agents that interact with humans over multiple turns while invoking external tools. In such “dual‑control” settings, failures are rarely caused by a single token‑level mistake; instead, they emerge from sparse but decisive episodes such as infinite loops, incoherent tool usage, or breakdowns in user‑agent coordination. Conventional uncertainty proxies—predictive entropy, self‑consistency, likelihood‑based scores—operate on single‑shot or token‑level outputs and therefore miss the trajectory‑level signals that actually drive failure.

TRACER (Trajectory Risk Aggregation for Critical Episodes in agentic Reasoning) is introduced as a trajectory‑level uncertainty metric designed specifically for these environments. Its architecture consists of three main components:

1. Content‑aware Normalized Surprisal (Uₜ) – At each step the model’s token probabilities are filtered to keep only content‑bearing tokens (excluding stop‑words, pure numbers, and highly predictable structural tokens). The average negative log‑probability over this filtered set yields a surprisal that reflects true epistemic uncertainty rather than being diluted by function words.

2. Situational‑awareness Indicators – Three complementary signals capture failure modes that token‑level surprisal cannot see:

   • Hybrid Local Repetition (D_rep) combines semantic similarity (cosine of sentence embeddings) with lexical Jaccard overlap, detecting genuine loops where both meaning and wording repeat.
   • Agent‑Observation Coherence Gap (D_Ao) measures the semantic distance between a tool‑calling action and the tool’s returned observation, flagging mis‑interpretations or ignored outputs.
   • User‑Agent Coordination Gap (D_Uo) measures the semantic distance between a user’s last utterance and the agent’s immediate response, exposing coordination breakdowns.

3. MAX‑Composite Step Risk and Tail‑Focused Aggregation – Each step’s risk is the maximum of the four component risks (Uₜ, α·D_rep, β·D_Ao·1{agent turn}, γ·D_Uo·1{user turn}). This “max” operation ensures that a single dominant signal is not washed out by weaker ones. The sequence of step risks is then aggregated using a tail‑risk functional: a weighted combination of the top‑k mean (CVaR) and the overall maximum, controlled by a weight w. This captures both chronic uncertainty patterns (through the tail mean) and acute catastrophic spikes (through the max).

The authors provide a rigorous theoretical grounding. They show that the filtered surprisal is an unbiased estimator of a cross‑entropy that decomposes into intrinsic content uncertainty and a KL term representing epistemic mismatch. The tail‑risk functional is proved to be coherent (monotone, translation‑invariant, positively homogeneous, subadditive) and 1‑Lipschitz under ℓ∞, guaranteeing stability against small perturbations. Under a sparse‑hazard failure model, they derive a bound linking the expected TRACER score to the probability of a breakdown, assuming (i) risk dominates hazard (λₜ ≤ c·rₜ) and (ii) tail sparsity (the sum of risks beyond the top‑k is bounded). This establishes TRACER as a conservative upper bound on failure probability.

Empirically, TRACER is evaluated on τ²‑Bench, a benchmark suite that couples multi‑turn dialogue with tool use (web search, database queries, file manipulation, etc.). The task is to predict whether a given interaction will ultimately succeed and to decide when to abort early. Compared against baselines such as token‑level entropy, sampling variance, and self‑consistency, TRACER improves AUROC by up to 37.1 % and AUARC by up to 55 %. Notably, the metric detects rising risk 2–3 turns before the actual failure, demonstrating strong early‑warning capability. Ablation studies confirm that each component (content surprisal, repetition, coherence gaps) contributes positively, and the method remains robust across a range of hyper‑parameters (α, β, γ, k, w).

In summary, the paper makes four key contributions:

1. Introduces a content‑aware surprisal that isolates meaningful uncertainty at the token level.
2. Defines three trajectory‑consistent situational‑awareness signals that capture looping, tool‑output mismatch, and coordination failures.
3. Proposes a MAX‑composite step risk combined with a coherent tail‑risk aggregation, backed by formal risk‑theoretic properties.
4. Demonstrates substantial empirical gains on a realistic multi‑turn tool‑using benchmark, and releases code and data for reproducibility.

TRACER thus offers a principled, theoretically sound, and practically effective way to quantify uncertainty in agentic reasoning systems, enabling safer deployment of LLM agents that must maintain long‑horizon coherence while interacting with tools and humans.