Model or Harness? An Interaction-Centric Taxonomy for Localizing Agent Failures

arXiv:2607.288022026-07-29

一套判断AI智能体失败究竟是模型的锅、工具框架的锅还是环境的锅的分类法

当编程助手、个人助理、多智能体系统等AI智能体出现失败时，仅凭表面结果往往看不出该修哪里。这篇论文把每次失败表示为模型与另一个组件之间的一次互动，并标注互动中哪一方有责任，由此整理出41种失败模式的分类体系。用四个前沿模型作为独立裁判，与人工标注对比，表现最好的裁判在类别判断上达到了Cohen's κ=0.76的一致度。

METAL LAB 解读图

用'互动边加责任方'来定位失败

证据状态已报告实测结果

定义组件把智能体表示为模型、任务方（owner）、评分方（grader）、第三方、工具框架（含上下文、记忆、工具）和环境（本地、外部）。
互动边把模型与另一组件之间的具体关系（如模型-工具、模型-记忆）作为分析的基本单位。
根因回溯当错误连续发生时，向前追溯到最早那个未被恢复的失败并在该处打标签，而不是标在后续症状上。
41种失败模式每条互动边都标注责任方，共整理出41种失败模式，其中36种归为模型一方，5种归为周边组件。
AI裁判验证让GPT-5.5和Claude Opus 4.6/4.7/4.8在40个案例上作为独立裁判，用Cohen's κ与人工标签对比。

这是 METAL LAB 制作的解读图，并非论文作者提供的原图。

他们做了什么

论文指出，把智能体失败简化为系统层面的结果，会掩盖失败真正起源于哪里，导致同一个可见失败可能需要重新训练模型、修改工具框架（harness）或重新设计环境，取决于其真实成因。
论文把智能体表示为一组相互作用的组件：模型、任务方（owner）、评分方（grader）、第三方、工具框架（包含上下文、记忆、工具）以及环境（本地和外部），并将每次失败标注为两个组件之间的一条互动边加上责任方，整理出41种失败模式。
当多个错误连续发生时，作者采用固定规则，向前追溯到最早那个未被恢复的失败并在该处打标签，而不是标在后续的表面症状上。
研究者从公开基准、模型系统卡、已发表报告和实际记录的智能体运行轨迹中挑选了40个案例做验证，让GPT-5.5以及Claude Opus 4.6、4.7、4.8作为独立裁判，用Cohen's κ衡量它们与人工标签的一致程度。
在类别层面（互动边加责任方）的一致度上，GPT-5.5与人工标注的κ值最高，达到0.76，Claude Opus 4.6和4.7各为0.71，Opus 4.8为0.70；四个裁判彼此之间的最高两两一致度出现在Opus 4.6和4.8之间，κ=0.84。

Figure 1: Radial interaction map. The model is the hub, the User, Harness, and Environment families form the inner ring, and their components appear on the outer ring. Each failure is represented by an edge between two components. Since a model interacts with another model through its own harness, model–model interactions are grouped under Harness alongside Context, Memory, and Tool. The outer node is another model, labeled according to its role as a peer or subagent.

Table 1: Component vocabulary used to localize agent failures. Each row defines a component that can form an endpoint of an interaction edge. In multi-agent settings, peer and subagent describe the role of the other model. In subagent interactions, the focal model acts as the orchestrator, while in peer interactions, neither model directs the other.
Component	Definition
Model	The policy that processes observations and produces outputs or actions.
Owner	The human or upstream system that gives the agent its task and defines what counts as success.
Grader	The mechanism used to evaluate whether the agent completed the task successfully; it is usually not visible to the agent.
Third party	An actor encountered during execution that does not act on behalf of the owner. The actor can be a human, organization, or agent, and the interaction may be adversarial, persuasive, or cooperative.
Context	The information available to the model during the current interaction, including instructions, conversation history, observations, and summaries.
Memory	A persistent store that outlives the active context, within or across sessions.
Tool	The bidirectional interface through which the model exchanges requests, messages, actions, observations, and responses with other components. This includes callable tools, communication channels, and wrappers that relay inputs and outputs.
Local env.	The agent’s immediate execution environment, such as the operating system, shell, filesystem, and runtimes.
External env.	Systems outside the agent’s immediate execution environment, such as remote services, websites, APIs, databases, and model-provider infrastructure.

Figure 2: Interaction-centric taxonomy of 41 failure modes. Failures are organized by the family of the component interacting with the model: User, Harness, or Environment, and then by the specific component within that family. Each branch represents an interaction edge between the model and that component. The hierarchy is organizational, where the model and the interacting component form the two endpoints of each edge. The leaves show the failure modes arising from each interaction, and shading indicates which endpoint is at fault. Of the 41 role-specific failure modes, 36 are assigned to a model and five to surrounding components.

Table 2: Agreement of each judge with the human labels on the 40 worked examples. Category scores require the correct interaction edge and fault side. Failure-mode scores additionally require the correct named failure. Acc denotes exact-match accuracy and F1 is macro-averaged.
	Category	Failure mode
Model	Acc	F1	Acc	F1
GPT-5.5	0.80	0.69	0.72	0.64
Claude-Opus-4.6	0.75	0.61	0.70	0.57
Claude-Opus-4.7	0.75	0.63	0.62	0.53
Claude-Opus-4.8	0.75	0.62	0.68	0.58

Figure 3: Pairwise Cohen’s κ among the four LLM judges and the human annotator, with category labels on the left and complete failure-mode labels on the right. The bold outline marks agreement with the human annotator.

Table 3: Failure-mode agreement for the four judges on the 40 worked examples. Under Predicted cat., the judge predicts both the category and failure mode; under Gold cat., it selects the failure mode given the human-assigned category. Acc is exact-match accuracy, and F1 is macro-averaged.
	Predicted cat.	Gold cat.
Model	Acc	F1	Acc	F1
GPT-5.5	0.72	0.64	0.72	0.62
Claude-Opus-4.6	0.70	0.57	0.80	0.70
Claude-Opus-4.7	0.62	0.53	0.70	0.58
Claude-Opus-4.8	0.68	0.58	0.78	0.69

Table 4: Selective-voting ensemble of the four judges at increasing category-agreement thresholds. At each threshold, the ensemble assigns a category label only when the required number of judges agree and abstains otherwise. Coverage is the proportion of all examples that receive a label. Precision is computed over labeled examples, whereas recall is computed over the full evaluation set. After selecting a category, the ensemble assigns the failure mode by majority vote among only the judges that predicted that category.
		Category	Failure mode
Agreement	Cov	P	R	F1	P	R	F1
≥2 of 4	1.00	0.78	0.78	0.78	0.70	0.70	0.70
≥3 of 4	0.90	0.83	0.75	0.79	0.75	0.68	0.71
4 of 4	0.68	0.96	0.65	0.78	0.89	0.60	0.72

Table 5: Safety-risk categories used to annotate the worked examples. Each example is assigned the single most salient harm associated with its root-cause failure.
Risk category	Source	Trajectory-observable harm	Examples
Excessive Agency	OWASP LLM06	acted beyond granted permission, or took an unconfirmed risky/irreversible step	E2, E4, E6, E39
Unbounded Consumption	OWASP LLM10	looped or exhausted its budget without making progress	E19, E32, E33
Rogue Agents	OWASP ASI10	gamed its own grader / reward-hacked, deviating from the set objective	E12, E13
Agent Goal Hijack	OWASP ASI01	untrusted third-party input hijacked the agent’s goal or control flow	E15, E16
Misinformation	OWASP LLM09	fabricated content presented as genuine, completed work	E11, E28, E31
Sensitive Information Disclosure	OWASP LLM02	exposed or over-shared private data	E10

研究结果

在类别层面（互动边加责任方）的复现上，GPT-5.5与人工标注的一致度最高，达到Cohen's κ=0.76，Claude Opus 4.6和4.7各为0.71，Opus 4.8为0.70。
四个裁判彼此之间的一致度与它们各自和人工标注的一致度相当，最高的两两一致度出现在Claude Opus 4.6和4.8之间，κ=0.84。
在需要准确匹配具体失败模式名称的评估上，各裁判之间的一致度普遍低于类别层面的一致度。
在41种角色相关的失败模式中，36种被归为模型一方的责任，5种被归为周边组件（用户、工具框架、环境）的责任。

可应用场景

在编程助手、长时运行的个人助理、多智能体系统等不同架构中，用这套共同框架分析失败日志，判断该重新训练模型、修复工具集成，还是重新设计运行环境。
以AI模型作为裁判，构建自动化流水线对大规模智能体运行日志中的失败原因进行分类。
结合OWASP的LLM风险分类，为失败案例同时标注安全与安全影响。

局限与待验证事项

用于验证的40个案例是为展示分类体系覆盖面而精心挑选的，不能用来估计各类失败模式在实际场景中出现的频率。
在需要准确匹配具体失败模式的评估上，一致度普遍低于类别层面，说明细粒度标签的自动化仍需进一步验证。
当原始材料不完整（比如只是一份问题报告或博客文章，而非完整执行轨迹）时，裁判和人工标注者都可能对根本原因得出不同解读。
根本原因的追溯本身在某些情况下依然困难，例如需要追踪延迟或缺失的下游事件的因果路径，这留下了自动裁判把标签打在表面症状而非真实原因上的风险。

为什么重要

构建智能体系统的团队需要一套共同语言，来判断某条失败日志究竟该重新训练模型、修补工具集成代码，还是重新设计评估环境。AI裁判能较好复现人工标签这一结果，也说明这类失败分类工作本身未来有可能被自动化。

本文术语

harness（工具框架） · 负责管理模型的上下文、记忆和工具访问的软件外壳，即驱动智能体运行的代码框架
Cohen's κ · 衡量两个评判者（如人类与AI）标注结果一致程度的统计指标，已扣除纯属偶然一致的部分
互动边（interaction edge） · 模型与另一个组件（用户、工具、环境等）之间的关系连线，失败被定位到这条连线上
agent-as-a-judge · 一种评估方式，让AI智能体自行调查证据、重建事件经过后再做出判断，而不是直接读取候选答案打分

论文原文摘要（英文）

Existing evaluations often reduce agent failures to system-level outcomes, obscuring where the fault originated and which intervention would improve the agent system. This creates a repair-assignment problem: the same visible failure may call for model post-training, harness engineering, environment redesign, or benchmark repair depending on its source. Because agent behavior emerges from interactions among models, harnesses, users, tools, memory, and environments, outcome-level labels are often insufficient for improvement. Most failure taxonomies do little to resolve this problem because they are benchmark-specific and lack a shared structure. We introduce an interaction-centric taxonomy that localizes failures to the interactions in which they originate and identifies the responsible component. It organizes 41 failure modes by assigning each to an edge between two components and a fault side indicating where the repair belongs. This makes the taxonomy actionable: model-side failures identify targets for post-training, harness-side failures point to scaffolding and tool-integration fixes, and environment or grader failures reveal evaluation conditions requiring redesign. The schema applies across agent architectures, from coding assistants to long-horizon personal assistants and multi-agent systems. We ground the taxonomy in worked examples from public benchmarks, model system cards, published reports, and logged agent trajectories, and evaluate its reproducibility using independent reasoning agents as judges. Across four frontier models, the strongest judge reaches Cohen's $\kappa=0.76$ against human category labels, suggesting that the categories capture shared structure rather than annotator-specific preferences.

作者 · Harsh Raj

在 arXiv 阅读

METAL LAB 最新报道

图片来源： Harsh Raj et al., arXiv:2607.28802, CC BY 4.0