Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper introduces role-stratified per-field conformal risk control, a novel calibration method that addresses the limitations of existing statistical approaches in managing risks associated with structured tool calls in language-model agents. By setting separate thresholds and risk budgets for different semantic argument roles, the method ensures that high-risk fields are certified directly, rather than being obscured by benign arguments. Empirical results across various language models and scenarios demonstrate that this approach significantly improves role-specific budget compliance and risk management, highlighting the necessity of granular certification in AI tool interactions.
Role-stratified calibration reveals that treating semantic roles separately can dramatically enhance risk management in language model tool calls, ensuring safety where it matters most.
Language-model agents act through structured tool calls whose arguments carry different risks. Untrusted content may safely influence an email body but should not determine a recipient, account, command, or credential. Existing statistical methods typically control risk over the entire action, allowing failures in rare, high-risk fields to be obscured by benign arguments. We introduce role-stratified per-field conformal risk control, a calibration layer that wraps any per-field detector and sets separate thresholds and risk budgets for semantic argument roles. For a role with prevalence $p_r$, aggregate-only certification must use an effective budget of $\alpha p_r$ to guarantee role-specific risk $\alpha$, whereas role-stratified calibration certifies each sufficiently sampled role directly with a finite-sample guarantee; rarer roles are handled by pooled certification. Across AgentDojo and InjecAgent with six language models, the empirical utility gap tracks this predicted price of coarseness, and our method achieves the most consistent role-specific budget compliance under model and attack transfer, detector noise, gradual drift, unseen tool suites, and adaptive attacks. It provides formal per-role guarantees under exchangeability or after recalibration, and empirical compliance under frozen distribution shift. These results suggest that structured tool calls should be certified at the semantic-role level, not the whole action.