ATBench: A Diverse and Realistic Agent Trajectory Benchmark for Safety Evaluation and Diagnosis

ATBench moves agent-safety evaluation from isolated prompts or final responses to complete trajectories, preserving user requests, agent actions, tool calls, and environment feedback.

Autonomous agents increasingly operate through long-horizon, tool-augmented trajectories. Existing safety evaluation often focuses on single-step moderation or final-output filtering, which can miss unsafe behavior emerging during intermediate planning, tool invocation, or environment feedback. ATBench addresses this gap with trajectory-level safety evaluation and diagnosis. Each sample is a complete execution trace, labeled as safe or unsafe; unsafe traces are further annotated with one primary Risk Source, Failure Mode, and Real-world Harm. The benchmark is constructed through taxonomy-guided data generation, rule-based and LLM-based filtering, and full human audit, producing a diverse and realistic testbed for evaluating modern tool-using agents.

The same high-level taxonomy supports binary safety evaluation and fine-grained diagnosis for unsafe trajectories.

Available Tools counts tools exposed through per-trajectory tool pools. Used Tools counts unique tools invoked in released trajectories.

Representative model performance shows that ATBench is difficult for both general-purpose models and specialized guard models.

The large table is placed after the performance figure to make the exact numerical comparison inspectable. ATBench remains challenging: several strong models have high recall or precision but much weaker balanced F1.

Guard models are excluded from this table because they only output binary labels. The average is the mean over the three diagnostic dimensions.

Taxonomy-guided data construction starts from sampled risk configurations and tool pools, then validates complete trajectories before release.

Representative cases show that models may detect unsafe behavior while still missing the correct fine-grained cause.

ATBench500 remains available for backward compatibility and historical comparison with the original AgentDoG release.

from datasets import load_dataset

atbench = load_dataset("AI45Research/ATBench", "ATBench", split="test")
atbench500 = load_dataset("AI45Research/ATBench", "ATBench500", split="test")

@article{li2026atbench,
  title={ATBench: A Diverse and Realistic Agent Trajectory Benchmark for Safety Evaluation and Diagnosis},
  author={Yu Li and Haoyu Luo and Yuejin Xie and Yuqian Fu and Zhonghao Yang and Shuai Shao and Qihan Ren and Wanying Qu and Yanwei Fu and Yujiu Yang and Jing Shao and Xia Hu and Dongrui Liu},
  journal={arXiv preprint arXiv:2604.02022},
  year={2026},
  doi={10.48550/arXiv.2604.02022},
  url={https://arxiv.org/abs/2604.02022}
}

@article{liu2026agentdog,
  title={AgentDoG: A Diagnostic Guardrail Framework for AI Agent Safety and Security},
  author={Yu Li and Haoyu Luo and Yuejin Xie and Jiapeng Gu and Yuhan Wang and Yanwei Fu and Yujiu Yang and Jing Shao and Xia Hu and Dongrui Liu},
  journal={arXiv preprint arXiv:2601.18491},
  year={2026},
  url={https://arxiv.org/abs/2601.18491}
}