Beyond Aggregate Risk: Role-Stratified Conformal Risk Control for LLM Tool Calls

Source

• Source name: arXiv
• Source kind: paper
• Authors / organization: Md Ashikur Rahman, Md Arifur Rahman, Niamul Hassan Samin, Khandaker Rifah Tasnia, Sifat Rahman Ahona, Juena Ahmed Noshin
• Venue: arXiv: cs.LG
• Published: 2026-07-27
• Collected: 2026-07-28
• URL: http://arxiv.org/abs/2607.24343v1
• PDF: https://arxiv.org/pdf/2607.24343v1
• DOI: UNKNOWN

Plain-Language Brief

Researchers propose a new method for controlling risk in language model agents' actions, which are performed through structured tool calls. The proposed method, called role-stratified per-field conformal risk control, sets separate thresholds and risk budgets for different semantic argument roles to ensure safety. The study shows that this method achieves consistent compliance under various conditions, including model transfer, adaptive attacks, and distribution shift.

What the Document Says

• Language-model agents perform actions through structured tool calls.
• Different arguments in these calls carry varying risks.
• Existing methods control risk for the entire action, potentially obscuring failures in high-risk fields.
• The researchers introduce role-stratified per-field conformal risk control, a calibration layer that sets separate thresholds and risk budgets for semantic argument roles.
• For a role with prevalence pr, aggregate-only certification requires an effective budget of alpha*pr to guarantee role-specific risk alpha.
• Role-stratified calibration certifies each sufficiently sampled role directly with a finite-sample guarantee.
• Rarer roles are handled by pooled certification.
• The study compares the method across AgentDojo and InjecAgent with six language models.
• The empirical utility gap tracks the predicted price of coarseness, and the proposed method achieves consistent role-specific budget compliance under various conditions.
• These conditions include model transfer, adaptive attacks, detector noise, gradual drift, unseen tool suites, and distribution shift.

Key Concepts Mentioned

• Language Model Agents
• Structured Tool Calls
• Risk Control
• Role-Stratified Per-Field Conformal Risk Control
• Semantic Argument Roles
• Budget Compliance
• Model Transfer
• Adaptive Attacks
• Detector Noise
• Gradual Drift
• Unseen Tool Suites
• Distribution Shift

Claims Made by the Document

• Role-stratified per-field conformal risk control is effective in achieving consistent role-specific budget compliance under various conditions.

Evidence Used

• The empirical utility gap tracks this predicted price of coarseness, and our method achieves the most consistent role-specific budget compliance under model and attack transfer, detector noise, gradual drift, unseen tool suites, and adaptive attacks.

Methods / Approach

UNKNOWN

Limitations Stated by the Authors

UNKNOWN

Limitations Noted by the Agent

Agent interpretation — not from the source.

UNKNOWN

Open Questions

UNKNOWN

Notes for Future Q&A

May include interpretation. Labeled where it does.

UNKNOWN

Raw Abstract / Excerpt

Language-model agents act through structured tool calls whose arguments carry different risks. Untrusted content may safely influence an email body but should not determine a recipient, account, command, or credential. Existing statistical methods typically control risk over the entire action, allowing failures in rare, high-risk fields to be obscured by benign arguments. We introduce role-stratified per-field conformal risk control, a calibration layer that wraps any per-field detector and sets separate thresholds and risk budgets for semantic argument roles. For a role with prevalence $p_r$, aggregate-only certification must use an effective budget of $αp_r$ to guarantee role-specific risk $α$, whereas role-stratified calibration certifies each sufficiently sampled role directly with a finite-sample guarantee; rarer roles are handled by pooled certification. Across AgentDojo and InjecAgent with six language models, the empirical utility gap tracks this predicted price of coarseness, and our method achieves the most consistent role-specific budget compliance under model and attack transfer, detector noise, gradual drift, unseen tool suites, and adaptive attacks. It provides formal per-role guarantees under exchangeability or after recalibration, and empirical compliance under frozen distribution shift. These results suggest that structured tool calls should be certified at the semantic-role level, not the whole action.