When a safety intervention lowers an agent’s attack-success rate, two different things may have happened: the intervention removed a load-bearing failure route, or the agent learned the measured attacks while the route survived. Frequency metrics are necessary, but they do not by themselves identify which behavioural structures persist as adversarial pressure rises. We propose a measurement framework that represents LLM-agent conduct as a finite metric space filtered by engineered adversarial pressure. Within this framework we define three objects: pressure-persistent robustness at a fixed agent version, held-out structural hardening after an intervention, and the Masking Index (MI), a scalar diagnostic that is high when development-suite frequency improves while held-out unsafe structure is retained. The mathematical claims are deliberately scoped: we prove fixed-complex stability of the summaries under perturbation of the pressure assignment, give the exact margin and interleaving conditions under which embedding perturbations are controlled, and state the correspondence assumptions under which cross-version comparisons are licensed. In a synthetic instrument-validation experiment with 5,760 generated traces, 32 repetitions per cell, Wilson intervals for frequency estimates, and a planted frequency-clean but structure-dirty masked agent, structural MI is high for the masked intervention (0.49, 95% bootstrap interval [0.44, 0.55]) while a held-out frequency-only analogue is low (0.03, [0.01, 0.04]); the hardened intervention has low MI (0.05, [0.03, 0.07]). The experiment validates the detector on known ground truth, not predictive value on real agents. We therefore prospectively specify an external protocol on public agent benchmarks with fixed falsification conditions for that operational claim.
When a safety intervention lowers an agent's attack-success rate, it may have removed a load-bearing failure route or merely masked it while the route survives.
2.Contribution
Represents LLM-agent conduct as a finite metric space filtered by engineered adversarial pressure.
Defines pressure-persistent robustness, held-out structural hardening, and the Masking Index (MI).
Proves fixed-complex stability of the summaries and states conditions licensing cross-version comparison.
3.Architecture, methodology & evidence status
Evidence & statusThis is a preprint hosted on Research Square and has not undergone peer review. It is an independent research contribution; its claims and any reported experiments should be read as such. The reported experiment is a synthetic instrument-validation study with 5,760 generated traces. Per the authors, it validates the detector on known ground truth, not predictive value on real agents; an external protocol with fixed falsification conditions is prospectively specified.
The abstract above is the authoritative summary of the work as posted at the official source. This archival record does not add results, figures or claims beyond those in the published/posted manuscript. For the complete methodology, results and references, consult the official record.
Choose a format below. BibTeX and RIS files are also downloadable directly.
Shirbint, E., & Rybalov, A. (2026). Measuring What Survives: Pressure-Filtered Persistence and a Masking Index for LLM-Agent Safety Evaluation. Research Square. https://doi.org/10.21203/rs.3.rs-10026792/v1
Emanuel Shirbint, and Alexander Rybalov. 2026. “Measuring What Survives: Pressure-Filtered Persistence and a Masking Index for LLM-Agent Safety Evaluation.” Research Square. https://doi.org/10.21203/rs.3.rs-10026792/v1.
@misc{shirbint2026measuringwhatsurvives,
title = {Measuring What Survives: Pressure-Filtered Persistence and a Masking Index for LLM-Agent Safety Evaluation},
author = {Emanuel Shirbint and Alexander Rybalov},
year = {2026},
doi = {10.21203/rs.3.rs-10026792/v1},
url = {https://doi.org/10.21203/rs.3.rs-10026792/v1},
note = {Not peer-reviewed}
}
TY - PREPRINT
AU - Emanuel Shirbint
AU - Alexander Rybalov
TI - Measuring What Survives: Pressure-Filtered Persistence and a Masking Index for LLM-Agent Safety Evaluation
PY - 2026
DO - 10.21203/rs.3.rs-10026792/v1
UR - https://doi.org/10.21203/rs.3.rs-10026792/v1
N1 - Not peer-reviewed
ER -