Beyond Aggregate Risk: Role-Stratified Conformal Risk Control for LLM Tool Calls

Source

• Source name: arXiv
• Source kind: paper
• Authors / organization: Md Ashikur Rahman, Md Arifur Rahman, Niamul Hassan Samin, Khandaker Rifah Tasnia, Sifat Rahman Ahona, Juena Ahmed Noshin
• Venue: arXiv: cs.LG
• Published: 2026-07-27
• Collected: 2026-07-28
• URL: http://arxiv.org/abs/2607.24343v1
• PDF: https://arxiv.org/pdf/2607.24343v1
• DOI: UNKNOWN

Plain-Language Brief

Researchers introduce a new method called role-stratified per-field conformal risk control for language model agents that perform actions through structured tool calls. This method aims to ensure safety by setting separate thresholds and risk budgets for different semantic argument roles, which can help in managing risks associated with untrusted content. The method shows improved compliance under various conditions compared to existing methods.

What the Document Says

• Language model agents use structured tool calls with arguments carrying different risks.
• Untrusted content should not determine a recipient, account, command, or credential.
• Existing statistical methods control risk over the entire action but may obscure failures in high-risk fields.
• The paper introduces role-stratified per-field conformal risk control as a calibration layer for any per-field detector.
• For a role with prevalence pr, aggregate-only certification must use an effective budget of alpr to guarantee role-specific risk alpha.
• Role-stratified calibration certifies each sufficiently sampled role directly with a finite-sample guarantee.
• Rarer roles are handled by pooled certification.
• The method shows improved compliance under model and attack transfer, detector noise, gradual drift, unseen tool suites, and adaptive attacks.
• It provides formal per-role guarantees under exchangeability or after recalibration, and empirical compliance under frozen distribution shift.
• The results suggest that structured tool calls should be certified at the semantic-role level, not the whole action.

Key Concepts Mentioned

• Language model agents
• Structured tool calls
• Risk control
• Semantic argument roles
• Conformal risk control
• Per-field detector

Claims Made by the Document

• Existing statistical methods may obscure failures in high-risk fields.
• Role-stratified calibration provides a finite-sample guarantee for sufficiently sampled roles.
• The method improves compliance under various conditions compared to existing methods.
• Structured tool calls should be certified at the semantic-role level.

Evidence Used

• The text describes how existing statistical methods may not provide adequate risk control and proposes a new method that addresses this issue.
• The text explains how the new method provides finite-sample guarantees for sufficiently sampled roles.
• The text states that the new method shows improved compliance under various conditions compared to existing methods.

Methods / Approach

UNKNOWN

Limitations Stated by the Authors

UNKNOWN

Limitations Noted by the Agent

Agent interpretation — not from the source.

UNKNOWN

Open Questions

UNKNOWN

Notes for Future Q&A

May include interpretation. Labeled where it does.

UNKNOWN

Raw Abstract / Excerpt

Language-model agents act through structured tool calls whose arguments carry different risks. Untrusted content may safely influence an email body but should not determine a recipient, account, command, or credential. Existing statistical methods typically control risk over the entire action, allowing failures in rare, high-risk fields to be obscured by benign arguments. We introduce role-stratified per-field conformal risk control, a calibration layer that wraps any per-field detector and sets separate thresholds and risk budgets for semantic argument roles. For a role with prevalence $p_r$, aggregate-only certification must use an effective budget of $αp_r$ to guarantee role-specific risk $α$, whereas role-stratified calibration certifies each sufficiently sampled role directly with a finite-sample guarantee; rarer roles are handled by pooled certification. Across AgentDojo and InjecAgent with six language models, the empirical utility gap tracks this predicted price of coarseness, and our method achieves the most consistent role-specific budget compliance under model and attack transfer, detector noise, gradual drift, unseen tool suites, and adaptive attacks. It provides formal per-role guarantees under exchangeability or after recalibration, and empirical compliance under frozen distribution shift. These results suggest that structured tool calls should be certified at the semantic-role level, not the whole action.