Why AI failure explanations need a replay test, researchers argue

From a plausible explanation to a causal test

In an arXiv preprint posted on November 3, 2026, Salesforce AI Research authors Egor Pakhomov and Erik Nijkamp propose a reporting standard for attributing agent failures to their histories. Their central distinction is between identifying something suspicious in a completed transcript and testing whether changing it alters subsequent behavior.

The authors argue that labels such as accumulated history errors cannot, by themselves, distinguish causes from features that merely accompany failure. Their proposal is methodological, not an adopted standard or a demonstrated solution to long-running agents’ reliability problems.

What an executed alternative requires

The proposed experiment pauses an agent at an intermediate point, preserves its executable state, changes a specified part of the history it sees, and resumes it under the same policy. Researchers then compare continuations with and without that change.

Executable state includes both the environment and relevant process details, such as random-number streams. The authors call for a measured “replay certificate”: evidence that restoration reproduces the reference execution closely enough for the particular causal question. Matching saved-file hashes alone is insufficient.

They distinguish exact replay, where execution paths match under controlled randomness, from distributional agreement, where repeated continuations must demonstrate equivalent behavior on a specified metric within a predetermined margin. A certificate applies to the tested policy and configuration, not automatically to every use of that environment.

Four intervention classes organize the proposal: repairing erroneous history, changing the attributed source of otherwise identical content, substituting length-matched synthetic history, and injecting a controlled error or summary. The authors acknowledge precedents for all four. Their claimed contribution is narrower: requiring measured replay validation and an unedited-history comparison between live and restored execution.

There is also a causal boundary. Editing history while preserving an already damaged environment tests the effect of what the agent sees in that realized world. It does not measure the original error’s total effect. That requires branching before the event or changing history and environment together.

A striking percentage that did not establish a cause

The first cautionary measurement analyzed ActBench, an agent-safety corpus containing 300 task pairs and 24,000 trajectories. Deterministic rules assigned payload-carrier categories to 266 pairs; smaller categories were combined, leaving service responses and a mixed local-file/state category.

Service responses accounted for 84.9% of attack-positive trajectories among the labeled pairs. But they also represented 84.6% of those task pairs. The apparent concentration closely followed benchmark composition.

After adjustment for behavior category and attack method, the estimated odds ratio was about 1.15, with a 95% interval of approximately 0.63–2.02. That interval crossed 1, and the data provided limited overlap between carrier classes across attack methods. Exposure detection also differed substantially between classes.

The analysis failed its amended, pre-outcome evaluation criteria. The authors therefore treat the share as descriptive, not evidence that service-delivered payloads are more—or less—causally effective than local ones.

Identical snapshots, different continuations

The second measurement used the authors’ own snapshot layer over AgentCE-Bench. Its key replay experiment involved 24 selected states, a fixed ground-truth continuation policy, and no language model making decisions.

In a seeded replication, restored snapshots agreed with one another in all 24 states. Nevertheless, their continuations differed from the live reference in 9 of 24 states at a 5% tool-failure rate and 20 of 24 at a 20% rate, using one seed per state.

The missing ingredient was the random stream’s position. Restarting with the same seed did not return the process to the point reached during the original run. Capturing and restoring that position eliminated the observed divergences in these tests.

Crucially, final task grades agreed throughout: the fixed policy retried failed calls. An outcome-only check would therefore have missed the execution differences. Conversely, the experiment does not establish that those differences would change a language-model-driven agent’s behavior, nor prove that the restored state was complete for every possible probe.

A proposal with explicit limits

Neither cautionary measurement implements the full proposed standard. The authors also disclose protocol amendments, including additional replication arms introduced after initial results and selection of the primary seed regime after both result sets were known.

Their literature census is limited too: two LLM coders assessed secondhand summaries from a convenience sample and disagreed about intervention boundaries. It cannot establish a field-wide absence of suitable methods. The paper discusses existing intervention approaches but reports that the examined methods lack the measured replay certificate it advocates.

An appendix proposes matched history experiments but explicitly states they have not been run; its power analysis also finds the planned design insufficient for some proposed equivalence tests. The practical recommendation remains an evidence requirement: claims that history caused failure should carry intervention results, or an estimator validated against representative intervention-verified cases, with replay fidelity and uncertainty reported.