On 10 June 2026, three researchers published the result of an experiment designed to answer a narrow question: if you deliberately break one layer of a production LLM agent, does your evaluation suite notice?
It does not. In Sawyer Zhang, Alexander Wang and Sophie Lei's Layer-Isolated Evaluation, a deployed ordering agent was decomposed into a fixed taxonomy of layers — ontology, intent, routing, decomposition, escalation, safety, memory, and a cross-cutting envelope — and then damaged one layer at a time across seven non-safety layers. For six of those injected regressions, the aggregate pass rate moved between 1.7 and 5.9 percentage points. The assertion slice belonging to the layer that had actually been broken fell between 25 and 91 points.
The authors did not set out to measure that. They call it "the effect we did not design in." It is the most important number in agent evaluation right now, and it is a statement about arithmetic rather than about any particular vendor's tooling.
Aggregation is a resolution decision, not a reporting decision
An end-to-end task-success score is a mean. Means are built to discard variance — that is the job. When a single layer of a composite system degrades, most runs still route around it, the failures concentrate in a thin slice of the input distribution, and the mean absorbs the damage. The score is not lying. It is doing exactly what a mean does, which is to answer a different question from the one an engineer debugging a regression is asking.
This is why Layer-Isolated Evaluation's second finding matters more than the headline. Localization held: the injected layer's slice was the single worst-hit in five of seven cases and in the top three in seven of seven, at a mean rank of 1.29 out of 19. The authors are careful to note that a layer's own slice reacting to its own fault is partly true by construction; what the experiment actually establishes is the pair of facts around it — that the aggregate masks the fault, and that the damage stays off the other slices rather than smearing across them. The signal was never absent. It was averaged away before anyone read it.
Their pure suite runs 238 cases across 23 slices, with 225 of them completing in 2.39 seconds — roughly 10ms per case, no model call involved, gated in CI against a per-slice baseline. Localization replicated on a second, structurally different tenant, so this is not an artifact of one product catalog.
The same boundary shows up in the statistics of LLM judges
Three months earlier and from a completely different direction, the same line appeared.
In AgentAssay, published 3 March 2026, Varun Pratap Bhardwaj reports that behavioral fingerprinting — mapping an execution trace to a compact vector and testing for multivariate drift — achieved 86% detection power on a class of regression where binary pass/fail testing achieved 0%. Not weak detection. Zero. The paper runs 7,605 trials across five models and three scenarios, and pairs the fingerprinting result with a three-valued verdict scheme, PASS, FAIL and INCONCLUSIVE, grounded in hypothesis testing rather than in a threshold someone picked. Bhardwaj opens by arguing that no principled methodology yet exists for verifying that an agent has not regressed after a change to its prompts, tools, models or orchestration logic; that framing is the author's, and it is contested territory.
And on 12 May 2026, TensorZero's Alan Mishler published the cleanest statement of the boundary, in the course of arguing something optimistic. Noisy LLM evaluators, he shows, are genuinely reliable for one job: ranking agent variants. Across five environments the agent-level correlation between evaluator score and ground truth beat the output-level correlation every time, often by a wide margin — on Wordle, 0.96 against 0.41. Pairwise, the evaluator picked the better of two variants 97% of the time on Gridworld, 87% and 82% on two others, and 64% on the two hardest. Averaging works.
Then comes the sentence. "Per-output unreliability is what limits noisy evaluators for typical production tasks (e.g. guardrails), all of which hinge on trusting the verdict on any specific output."
That is the same wall, stated affirmatively by someone with no incentive to draw a governance conclusion from it. Aggregate evaluation is reliable for the decision which agent should we ship. It is unreliable for the decision should this specific action have been allowed. Those are not two settings on one dial. They are different measurements, and a guardrail lives entirely on the side where averaging does not help.
Why enforcement is the layer aggregation hides best
Every component in an agent suffers from aggregate masking. A policy layer suffers from it worse, for three structural reasons.
It fires rarely. A budget ceiling, a PII filter, an approval hold on a destructive action — these are exception paths. A test corpus assembled from representative traffic will contain few of them by construction, so the denominator swamps them. A control that fires on 2% of runs cannot move a mean built from the other 98%.
Correct enforcement looks like failure. When a policy halts an agent mid-run, the task does not complete. To an end-to-end task-success metric, a correctly blocked action and a hallucinated tool call are the same event: a zero. Turn governance on and your eval score goes down — which quietly creates an incentive to benchmark with governance off, and then to ship a configuration that was never the one measured.
Its regressions are silent by design. A broken retrieval layer produces visibly wrong answers. A broken escalation rule produces answers that look fine and skip a review that should have happened. Nothing in the output says so. This is precisely the failure shape the layer-isolation experiment quantified, and it is the reason a 25-to-91-point slice collapse can hide inside a six-point aggregate move.
Note what the Layer-Isolated Evaluation authors deliberately did not do: they injected regressions into seven non-safety layers. The safety layer's behaviour under injection is not among their measured results. The paper's own answer to that gap is its third contribution — a coverage-honesty criterion that refuses to score a layer the suite never exercised. Reporting a pass rate for a control you did not test is not a measurement. It is a blank filled in with the average of everything else.
What follows for anyone running agents in production
The practical shift is small and mostly clerical. Stop treating the eval score as the artifact and start treating the per-decision record as the artifact. Score at the granularity of the thing you want to be able to fix: the routing choice, the escalation, the tool call, the policy evaluation. Keep the aggregate — it is genuinely good at variant selection, which is what Mishler's data shows — but stop asking it a localization question it was never built to answer. And never report a number for a layer the suite did not exercise.
None of that is possible if the only thing recorded is the outcome of the run.
How Waxell handles this
Waxell Observe is built around the record rather than the score. Its product page describes capturing "the full anatomy of an agent run — not just the output, but every decision that led to it": LLM calls with tokens, latency and cost; routing decisions with the options considered and the choice made; retrieval queries with relevance scores; tool calls with inputs, outputs and timing — assembled into full execution trees with parent-child span relationships, powered by OpenTelemetry. That is per-layer resolution as the default output of instrumentation, not as a separate harness someone has to build. It installs in two lines of Python and auto-instruments 200+ Python libraries, frameworks and vector databases.
The enforcement half is what closes the loop the papers open. Observe's 50+ policy categories evaluate agent behaviour in real time — before execution, between steps, and after completion — and when a policy triggers, the agent receives structured feedback: retry with adjusted parameters, escalate to a human, or halt. Those evaluations happen at the same decision points Observe is already capturing, which is the part that matters here: the governance signal sits at the granularity of the decision rather than being collapsed into a single end-of-run verdict that moved four points for reasons nobody can decompose.
Our earlier post on why benchmark scores pass while governance policies fail argues that you have to deliberately trip a control to know it works. This post is the measurement precondition for that: tripping the control tells you nothing useful if the only instrument you have reports one number for the whole agent.
FAQ
What is AI agent evaluation?
AI agent evaluation is the practice of measuring whether an agent completed its task correctly and behaved acceptably while doing so. In most implementations it produces an aggregate task-success score across a test corpus. That aggregate is well suited to comparing two versions of an agent and poorly suited to identifying which internal component caused a regression.
Why does an aggregate eval score hide regressions?
Because a mean discards variance by design. When one layer of a composite agent degrades, the failures concentrate in a narrow slice of inputs while most runs succeed, so the overall score barely moves. The June 2026 Layer-Isolated Evaluation study measured this directly: aggregate pass rates shifted 1.7 to 5.9 points while the matching per-layer slice fell 25 to 91 points.
Is LLM-as-a-judge reliable for agent evaluation?
It depends entirely on the granularity of the decision. TensorZero's May 2026 analysis found that noisy evaluators rank agent variants reliably — 0.96 agent-level correlation against 0.41 output-level on one environment — because per-output noise averages out across many samples. The same analysis notes that this per-output unreliability is what limits such evaluators for production tasks like guardrails, where the decision hinges on the verdict for one specific output.
How should I test that a governance policy still works?
Trip it deliberately and confirm the enforcement event appears, rather than checking whether the output looked acceptable. Policy controls fire rarely, and a correct block registers as a task failure in an end-to-end metric, so they are the components an aggregate score is least able to see. If each policy evaluation is captured at the decision point rather than summarised at the end of the run, a control that stopped firing becomes detectable as an absence in the record.
What is per-layer or layer-isolated agent evaluation?
It is the practice of decomposing an agent into named layers — such as intent, routing, decomposition, escalation and memory — and giving each one its own deterministic assertion slice with a locked baseline. Regressions then surface against the specific slice that broke instead of being averaged into a single score. The approach also supports a coverage-honesty rule: a layer the suite never exercised is reported as unexercised rather than assigned a pass rate.
Sources
- arXiv (Sawyer Zhang, Alexander Wang, Sophie Lei), "Layer-Isolated Evaluation: Gating the Deterministic Scaffold of a Production LLM Agent with a No-LLM, Regression-Locked Test Harness", 10 June 2026.
- arXiv (Varun Pratap Bhardwaj), "AgentAssay: Token-Efficient Regression Testing for Non-Deterministic AI Agent Workflows", 3 March 2026.
- TensorZero (Alan Mishler), "Even (very) noisy LLM evaluators are useful for improving AI agents", 12 May 2026.
- Hacker News, "Even (very) noisy LLM evaluators are useful for improving AI agents", discussion thread.
- Waxell, "Waxell Observe — AI Agent Observability & Governance".
- Waxell, "Policies".
Originally published on the Waxell blog.
Start free with Waxell Observe and one governed MCP upstream at waxell.dev/signup — two lines of Python, and every LLM call, tool invocation and agent decision is captured from that point on, at the granularity you need to find the layer that broke.
Top comments (0)