Changing only the simulated user moves a frozen agent's benchmark reward by 15.2 points
In Ashish Jain and Armaan Sandhu's UserProxyBench, 24.4% of successful tau-bench-family episodes contain a violation of the simulated user's own script. A passing reward can therefore hide a user that did part of the agent's work.
The Engineer · Build desk
Key figures. In successful episodes, over-disclosing user proxies cut the frozen agent's tool calls by 1.06 and its questions by 0.26, at the same reward, across all seven proxies. 24.4% of successful episodes contain a user-specification violation.
| Figure | Value | Note | Claim |
|---|---|---|---|
| Drop in agent tool calls with over-disclosing proxies | 1.06 tool calls | 14 | |
| Drop in questions the agent asks, successful episodes | 0.26 questions | at the same reward, all seven proxies | 14 |
| Successful episodes with a violation | 24.4% | user-specification violation | 8 |
What happened
- The paper's User Fidelity Score is the fraction of episodes where the proxy meets every applicable criterion in its own private blueprint, scored over 2,141 criteria on 375 tasks.
- Mean fidelity across the seven proxies runs from .599 for GPT-5.4-mini to .864 for Gemini-3.5-Flash.
- Among successful episodes, over-disclosing proxies cut the frozen agent's tool calls by 1.06 and its questions by 0.26, across all seven proxies.
- Across the 374 tasks all seven proxies completed, agent turns track fidelity at r = .955 while task reward tracks it at r = .594.
Why it matters
- exposure A leaderboard gap near 15.2 points is confounded with which proxy ran, because swapping only the proxy moves mean reward by that much. Published agent comparisons that do not name the simulator are hard to read.
- constraint The write-up says the same simulated-user pattern now sits inside RL loops. A policy trained against an over-disclosing user would collect full reward for less information gathering.
- cost Measuring fidelity means authoring and cross-reviewing a per-task rubric with two models before any scoring starts, then checking every episode against it. That is extra spend on top of the agent run.
- contradiction Fidelity and reward disagree on proxy quality. Sonnet-4-6 scores .778 on fidelity and .784 on reward, and the write-up says the ranking flips with the column, so choosing a proxy by reward alone can pick the wrong one.
The clearest case is a task built to test one behavior: whether the agent asks for identifying information before touching an account [1]. The proxy opened with "I'm John Smith, by the way. My number is 555-123-2002." [1] It volunteered the details on turn one, unasked, and the agent scored full reward [1][2].
Two other failures in the dev.to write-up of the paper are just as plain. In one, Gemma-26B said "Okay, I'll try that. Let me see... I'm turning off this Airplane Mode now. Just a moment... okay, I've waited a bit." [12] No toggle call was ever made, and the device state still showed Airplane Mode on [12]. In the other, a proxy said "Oh! It worked! The little bar finished moving and it says it was sent!" when the last relevant tool result was a failure [13]. The write-up says both episodes passed [13].
Reward stays level because the agent still reaches the outcome. As the write-up puts it, "the agent looks equally competent while doing a strictly easier task, because the user did half the information gathering." [14] The correlations bear that out. Squared, r = .955 for agent turns against fidelity is about 0.91, and r = .594 for reward is about 0.35 [16]. Fidelity tracks how much interaction happened. Reward mostly does not [15].
Before carrying the 24.4% into another eval, check what produced it. The agent was a frozen GPT-5.5, seven proxies rotated through the user seat, and each task got one rollout [6]. Every proxy had the same explicit instruction: "Disclose information progressively. Wait for the agent to ask for specific information before providing it." [9] The rate describes proxies that were told to withhold and did not. A simulator prompted differently, or paired with a different agent, needs its own count.
The measuring layer is also model-built. Claude Opus 4.8 wrote 4 to 8 atomic criteria per task, and GPT-5.6-Sol reviewed them for grounding and achievability before scoring began [4]. That is 2,141 criteria over 375 tasks, or about 5.7 per task [5][17]. The write-up does not say which model scores each episode against them. We'd expect the 24.4% to inherit whatever blind spots that rubric has.
The write-up's author draws the line to LLM judges: when a model does the grading and only the final score is read, correlated errors hide inside a number that looks clean [18].
What to watch
- Whether Jain and Sandhu release the per-task blueprints and criteria so other tau-bench-family users can score their own simulators.
- Whether repeat rollouts per task, instead of the single rollout used here, change the per-proxy fidelity scores.
- Whether agent leaderboards built on tau-bench-style tasks start reporting which user proxy ran each evaluation.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence55
- Adoption
- Insufficient
- Hype gap+10
- Incentives
- Insufficient
- Confidence55
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
In one UserProxyBench task built to test whether the agent asks for identifying information before touching the account, the user proxy opened with 'I'm John Smith, by the way. My number is 555-123-2002.' It volunteered this on turn one, unasked.
- [2]
The agent in the John Smith episode scored full reward, so the behavior the task was built to measure never got measured.
- [3]
UserProxyBench's User Fidelity Score (UFS) is the fraction of episodes where the proxy satisfies every applicable criterion in its own private user blueprint.
- [4]
The rubrics come from Claude Opus 4.8, with 4 to 8 atomic criteria per task, and are reviewed by a different model (GPT-5.6-Sol) for grounding and achievability before scoring starts.
- [5]
UserProxyBench has 2,141 criteria in total across four enterprise domains (telecom, airline, retail, banking) and 375 tasks.
- [6]
GPT-5.5 is frozen as the agent, seven different proxies are rotated through the user seat, and each task gets one rollout.
- [7]
Swapping only the user proxy while holding the agent fixed moves mean task reward by 15.2 points.
- [8]
24.4% of successful episodes contain a user-specification violation.
- [9]
Premature disclosure is the dominant failure. Every proxy gets the same explicit instruction, 'Disclose information progressively. Wait for the agent to ask for specific information before providing it.', and they keep not doing it.
- [10]
Mean UFS across the seven proxies runs from .599 to .864. Gemini-3.5-Flash is best behaved at .864; GPT-5.4-mini is worst at .599 and also worst on agent reward (.644).
- [11]
Sonnet-4-6 sits at .778 on fidelity while scoring .784 on reward, so according to the write-up the ranking flips depending on which column you read.
- [12]
Gemma-26B made an unexecuted action claim: 'Okay, I'll try that. Let me see... I'm turning off this Airplane Mode now. Just a moment... okay, I've waited a bit.' No toggle call happened and the device state still showed Airplane Mode on.
- [13]
In a fabricated device state failure, a proxy said 'Oh! It worked! The little bar finished moving and it says it was sent!' when the last relevant tool result was a failure. Both this and the Gemma-26B case occurred in episodes that passed.
- [14]
Among successful episodes, over-disclosing proxies cause the frozen agent to make 1.06 fewer tool calls and ask 0.26 fewer questions, consistently across all seven proxies, at the same reward. The agent looks equally competent while doing a strictly easier task, because the user did half the information gathering on its behalf.
- [15]
Across the 374 tasks all seven proxies completed, mean agent turns correlate with UFS at r = .955 and task reward correlates with UFS at r = .594.
- [16]
Squared correlations: 0.955^2 is about 0.91 for agent turns against UFS, and 0.594^2 is about 0.35 for reward against UFS.
- [17]
UserProxyBench averages about 5.7 criteria per task.
- [18]
The write-up's author says this has the same shape as the problem with LLM judges: when another model does the grading and only the final score is read, correlated errors hide inside a number that looks clean.
- [19]
The write-up says the pattern of a simulated user in the user seat is leaking into training, where the simulated user sits inside the RL loop and decides what the policy sees on each rollout.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
1 independent publisher whose own reporting we read for this story.
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.