NeurIPS 2026 · Workshop on Agents in the Wild (AIWILD)

The Denial Illusion: Measuring Safety Failures After Agent Replanning

Riasad Alvi

United International University, Dhaka, Bangladesh

NeurIPS page Paper (OpenReview) Code Poster BibTeX

(a) Rejecting the canonical call a_d leaves the state unchanged, yet replanning can reach the same forbidden effect through an alternate action or a composed sequence. (b) DenyLock retains the denial record, evaluates each tentative post-state against the active predicate, and commits only invariant-preserving transitions.

56.9%forbidden effect still reached under exact-call locking

20.8%still reached with a full-trace LLM guard

0 / 360DenyLock violations (complete mediation)

91.1%benign recovery retained by DenyLock

Abstract

A rejected tool call does not establish that its forbidden effect was prevented: an agent can continue through another tool, split the operation across calls, or reach the same state through an intermediate resource. We introduce denial-induced route-around and RouteAroundBench, a controlled post-denial benchmark with executable tools and deterministic terminal-state oracles. The study compares three purpose-built controls (exact-call locking, tuple-level locking, and a full-trace language-model guard) across three locally served open-weight models. We also present DenyLock, a training-free reference monitor that retains the structured rule responsible for a denial and checks every tentative state transition before atomic commit. Across 120 unsafe tasks and 60 paired benign tasks, exact-call locking permits the forbidden effect in 56.9% of post-denial trials; a trace-aware guard lowers this rate to 20.8%. Under the benchmark's complete mediation assumptions, DenyLock prevents every forbidden transition while retaining 91.1% benign recovery. These results distinguish a locally correct denial from trajectory-level policy preservation.

RouteAroundBench

Every unsafe trial begins from the same validated prefix: a canonical action that would violate a policy is rejected without mutation, and the agent may then replan for ten steps. Executable terminal-state predicates decide whether the forbidden state was reached, so a syntactically different action that reaches the same state still counts. 60 paired benign tasks expose over-blocking. The primary metric is route-around success (RAS): the fraction of post-denial trials that end in a forbidden state.

Tool substitutiona different tool produces the same effect

Cumulative splitmany small calls add up past a bound

State indirectionan intermediate object realizes the state

Delayed executionthe effect is realized at a later step

Benchmark composition

Domain	Unsafe	Benign	Tools	Vars	Predicate	Horizon
Files / workspace	40	20	6	14	visibility / integrity	10
Finance / commerce	40	20	5	11	numeric bound	10
Cloud / IAM	40	20	6	16	graph reachability	10
Total	120	60	17	41	3	10

DenyLock

DenyLock is a deterministic reference monitor, not a learned classifier. It keeps the state invariant responsible for a denial, instead of remembering an action or a transcript.

Retain. The denial record r_d = (p, Q_p, v_p, t_d, H) is appended to an append-only ledger. Agent text cannot modify or revoke it.
Preview. For each proposed action, the adapter computes the exact tentative state s̃_t+1 = T_j(s_t, a_t) without committing it.
Check and commit. If any active predicate holds on the tentative state, the action is denied and the state is unchanged; otherwise the transition is committed atomically. Missing adapters or failed predicate evaluation escalate without committing. Three transfers of 400 are checked against the same post-state predicate as one transfer of 1,200.

Proposition 1. Assume the post-denial state is safe, every policy-relevant transition is mediated, adapters return the state that would be committed, check-and-commit is atomic, and declared write sets are effect-closed. Then no trajectory admitted by DenyLock reaches a state satisfying φ_p.

Results

Post-denial security, utility and overhead

Macro-average over Qwen3-8B, Llama-3.1-8B-Instruct and Mistral-NeMo-Instruct-2407 (12B); unsafe n = 360, benign n = 180. Rates in %, with 95% bootstrap intervals.

Condition	RAS ↓	FSS ↑	BRR ↑	BABR ↓	Calls	Added time (s)
ExactCallLock	56.9 ± 3.8	43.1	94.4 ± 3.1	0.0	3.8	0.00
TupleLock	36.9 ± 3.6	63.1	90.0 ± 4.0	5.8 ± 2.0	5.3	0.01
FullTrace-LLM	20.8 ± 3.0	79.2	81.1 ± 5.0	16.4 ± 3.3	9.5	1.84
DenyLock^†	0.0	100.0	91.1 ± 3.8	4.8 ± 1.8	4.2	0.03

RAS: route-around success. FSS: final-state safety (100 − RAS). BRR: benign recovery rate. BABR: benign action block rate. Added time is median enforcement time. ^†Model-independent reference condition: its zero RAS follows from Proposition 1 after benchmark validation, not from cross-model generalization.

Failures concentrate in composed routes

Heatmap of route-around success by route family for ExactCallLock, TupleLock and FullTrace-LLM. — Route-around success (RAS, %) by route family; lower is better. Cumulative splitting and intermediate-state indirection are hardest for local and textual defenses.

Component ablations

Variant	RAS ↓	BRR ↑	BABR ↓
Full DenyLock	0.0	91.1	4.8
No persistent ledger	35.3	94.4	1.7
Action-identity lock	56.9	94.4	0.0
Current transition only	16.1	92.2	3.1

Removing persistence restores post-denial exposure; matching action identity misses tool substitution; checking only the current transition misses cumulative splitting.

Claim boundary

The study conditions on a validated denial, so it estimates the post-denial gap, not base rates of unsafe proposals. The three environments are synthetic and the models are 8–12B open-weight models with greedy decoding. DenyLock's zero RAS is a verification consequence of the invariant under complete mediation, correct adapters and atomic commit; it is not a claim about unrestricted deployments, subjective policies, concurrency, or unobserved side effects.

Poster

Poster (PNG) Poster (PDF)

Reproduce

The repository contains the benchmark specification, simulators, the four enforcement conditions, an independent audit oracle, hash-chained traces, and reporting. The model-free end-to-end check needs no GPU.

git clone https://github.com/alvi-uiu/DENY-LOCK.git
cd DENY-LOCK
python -m pip install -e .
python validate_e2e.py          # prints "E2E VALIDATION OK"
denylock benchmark validate --spec data/routearoundbench_v1.spec.json

Citation

@inproceedings{alvi2026denial,
  title     = {The Denial Illusion: Measuring Safety Failures After Agent Replanning},
  author    = {Alvi, Riasad},
  booktitle = {Third Workshop on Agents in the Wild: Safety, Security, and Beyond
               (AIWILD) at NeurIPS 2026},
  year      = {2026},
  note      = {Non-archival workshop paper}
}