Doomed from the Start: Early Abort of LLM Agent Episodes via a Recall-Controlled Probe Cascade Kai Ruan1 , Zihe Huang2 , Ziqi Zhou3 , Qianshan Wei4 , Xuan Wang5 , Hao Sun1∗ 1
Gaoling School of Artificial Intelligence, Renmin University of China 2 Institute of Computing Technology, Chinese Academy of Sciences 3 Duke University 4 Institute of Automation, Chinese Academy of Sciences 5 College of Computer Science, Zhejiang University [email protected]
arXiv:2607.06503v1 [cs.AI] 7 Jul 2026
Abstract Large language model (LLM) agents solving multi-step tasks frequently commit to trajectories that are doomed to fail, yet continue to consume substantial inference compute before the failure becomes observable. We show that failure is predictable early from the agent’s internal representations: lightweight per-round probes on hidden activations anticipate eventual episode failure as early as the first interaction round, where scorers reading only the agent’s observable behavior are barely better than chance. We turn this signal into a practical abort cascade: one distribution-free calibrated gate per round, with per-round recall budgets jointly searched so that eventually-successful episodes survive all gates at a userspecified global rate; this episode-level guarantee is the one that matters in deployment, since false-abort risk accumulates across gates. Across two agent models on TextCraft, the cascade meets every recall target from 90% to 97% and, at the 90% target, saves 47.1% ± 10.3% (Qwen-2.5-7B) and 37.2% ± 8.8% (Llama-3.2-3B) of inference compute, 1.6– 1.7× the best single-gate policy. An otherwise-identical cascade reading only behavior saves roughly half as much, and adding behavioral features to the probe yields no further gain: the hidden states capture what behavior reveals. Finally, we characterize the sample complexity of certifying high recall targets, telling practitioners which recall promises their data can, and provably cannot, back. The code will be released soon.
Introduction LLM-based agents increasingly tackle long-horizon tasks (web navigation, tool use, embodied simulation) in which a single episode spans many rounds of interaction and consumes thousands of generated tokens. A large fraction of this compute is wasted: when an agent has misunderstood the task, entered an unrecoverable state, or begun to loop, the episode is already doomed long before it formally times out or returns a wrong answer. If we could detect such doomed episodes early and abort them, the saved compute could be reallocated to retries, sampling additional trajectories, or simply reducing serving cost. Three obstacles stand in the way. First, we need a signal that distinguishes doomed episodes from eventually-successful ones early in the trajectory, and early is precisely when be∗
Corresponding author.
episode continues while every gate passes round 1 h1 f1 (h1 ) > τ1 ?
round 2 h2 f2 (h2 ) > τ2 ?
round 3
···
y ∈ {0, 1}
h3 f3 (h3 ) > τ3 ?
yes abort: stop episode, save remaining compute C − cr τr : Clopper–Pearson-calibrated so gate r passes ≥ tr of successes (t1 , . . . , tRg ): searched to maximize savings subject to global recall ≥ ρ⋆
Figure 1: Recall-controlled abort cascade. At each of the first Rg rounds, a linear probe fr reads the agent’s hidden state hr and a gate aborts the episode if the failure score exceeds a calibrated threshold τr ; an episode completes only if it survives every gate. Thresholds carry per-round distributionfree recall guarantees, and the per-round budgets tr are jointly searched so that the episode-level success recall meets a userchosen target ρ⋆ .
havioral evidence is scarcest. We find that scorers reading only the agent’s observable behavior are barely better than chance in the first round and become informative only around rounds 3–4, by which time over a third of episodes have already finished and much of the useful remaining compute is gone. Lightweight probes on the agent’s internal activations show the opposite pattern: at the very first round they already match or exceed the surface scorer’s eventual peak, attained only two to three rounds later, and they reach their own peak at round 2 (Figure 3). Second, any abort policy is only usable in deployment if it comes with a controllable guarantee on the harm it causes: aborting an episode that would have succeeded silently destroys task reward, so practitioners need to bound the rate of such false aborts before deployment, not observe it afterwards. Third—and specific to the sequential nature of agent episodes, a monitor that re-evaluates the episode at every round faces accumulating risk: even if each individual check rarely kills a good episode, a successful trajectory must survive all of them, so per-round guarantees do not compose
into the episode-level guarantee that matters. We address these with a recall-controlled cascade (Figure 1): at each of an episode’s first Rg rounds, a gate aborts the episode if its probe score exceeds a threshold τr . Each threshold is calibrated so that an exact binomial (Clopper– Pearson) lower confidence bound on the gate’s survival rate for successful episodes meets a per-round recall budget tr , and the budget vector (t1 , . . . , tRg ) is searched on a disjoint validation split to maximize compute savings subject to the global recall (the fraction of eventually-successful episodes that survive every gate) meeting a user-chosen target. A safety margin makes the search robust to validation noise; a stricter variant replaces the margin with a certificate on the global recall itself, yielding a distribution-free, a priori verifiable guarantee. The cascade is strongly compute-positive. At a 90% global recall target it saves 47.1% ± 10.3% of inference compute for a Qwen-2.5-7B agent and 37.2% ± 8.8% for a Llama-3.23B agent, 1.6–1.7× the best single-gate policy at the same target, confirming that the freedom to distribute recall budget across rounds, rather than spend it all at one decision point, is where much of the practical value lies. At a conservative 95% target the cascade still roughly doubles the single-gate savings, and its achieved recall matches its target in every configuration tested. Swapping the probe for a behavior-only scorer inside the identical cascade cuts savings roughly in half on the stronger agent, and stacking behavioral features onto the probe adds nothing, indicating the internal signal already captures the behavioral one. Finally, we give an honest account of what certified recall control costs in data. With n successful validation episodes, a one-sided certificate at confidence 95% can support recall targets only up to 0.051/n ; at our scale this caps certifiable targets near 0.974, and indeed the certified variant abstains at targets 0.98 and 0.99, which would require roughly 1.3× and 2.6× more successful episodes than we have (Figure 7). We view this not as a weakness of the method but as its point: the same machinery that saves compute also tells the practitioner, before deployment, which promises the available data can and cannot back. Our contributions are: • We demonstrate across two agent models that eventual task failure of an LLM agent is predictable from internal activations within the first interaction rounds, whereas behavior-only scorers become informative only at rounds 3–4, after most recoverable compute is spent. • We propose the first abort policy for LLM agents that controls episode-level success recall across multiple sequential decision points, via per-round distribution-free gates whose recall budgets are jointly optimized under a global constraint, with an optional certificate. • We show the cascade saves up to 47.1% of inference compute at 90% global recall (1.6–1.7× the best singlegate policy) and characterize the data requirements for certifying stricter targets.
Method
Algorithm 1 Recall-Controlled Abort Cascade Input: labeled episodes D, global recall target ρ⋆ , budget grid T , margin rule (margin δ or certificate level αm ) Rg Output: gates {(fr , τr )}r=1 1: Score all episodes by task-grouped cross-fitted probes fr 2: Partition tasks into calibration / validation / test 3: for each candidate budget t ∈ T do 4: for r = 1, . . . , Rg do 5: τr (t) ← smallest threshold whose Clopper– Pearson lower bound on per-round survival of successful calibration episodes at r is ≥ tr 6: end for 7: Simulate cascade on validation split; record global recall ρ̂val and savings 8: end for 9: F ← candidates passing the margin or certificate rule at ρ⋆ 10: if F = ∅ then 11: Abstain (no aborts) 12: else 13: Deploy t⋆ = arg maxt∈F validation savings 14: end if 15: Evaluate once on the test split
Problem Setup An agent episode is a sequence of interaction rounds (s1 , a1 , s2 , a2 , . . . ) between an LLM policy and an environment, terminating with a binary outcome y ∈ {0, 1}. We index rounds from one; episodes run up to Rfull = 20 rounds. Let cr denote the cumulative inference cost incurred through round r and C the total cost of the full episode. An abort cascade places a gate at each of the first Rg rounds (r = 1, . . . , Rg ; we use Rg = 6). At gate r, every episode still running is scored by a per-round scorer fr and aborted if fr (x) > τr , losing any potential success but saving the remaining cost C − cr . Episodes terminate at different rounds; in our data, over a third of episodes finish within the first two rounds (Figure 2), so a gate at a late round sees only the episodes still alive there: late gates are cheap in recall but also guard less remaining compute. This trade-off is exactly what the cascade optimizes. Aborting an episode that would have succeeded is the critical error mode. We target global success recall: among episodes with y = 1, the fraction that survive every gate and run to completion. The design goal is to maximize expected cost savings subject to a user-specified global recall floor ρ⋆ . Note that controlling the recall of each gate in isolation does not control the global recall: false-abort probability accumulates across gates, and the accumulation depends on how many successes each gate sees.
Per-Round Failure Scorers At each gate round r, we extract a feature vector x ∈ Rd from the agent LLM’s internal activations: the residual-stream hidden state at the final token of the agent’s generated action in round r, extracted via a teacher-forced forward pass over the trajectory, at a single layer per model (layer 14 of 28
for Llama-3.2-3B, layer 20 of 28 for Qwen-2.5-7B). Layers were fixed once per model by preliminary per-layer probeAUC sweeps: for Qwen-2.5-7B over layers {0, 2, . . . , 28} on an independent pilot set of rollouts collected before the main experiments (post-generation AUC peaks at layer 20), and for Llama-3.2-3B over layers {6, 10, 14, 18, 22, 26}, where the post-generation sweep selects layer 14 (see the technical appendix, “Per-Layer Probe AUC Sweeps”). A per-round probe fr , a logistic regression on standardized features (L2 regularization, C = 1), is trained to predict eventual failure 1 − y from episodes alive at round r. We compare against two alternative scorers, holding the entire downstream calibration and search pipeline fixed. The surface scorer observes only the agent’s behavior: a logistic model over trajectory features observable from the serving API alone: the mean action-token log-probability of the current round, the mean over preceding rounds, the number of generated tokens, the prefix length, and the count of preceding rounds whose environment feedback contains error keywords (“error”, “invalid”, “fail”, etc.). The stacking scorer concatenates these surface features onto the probe’s activation features, testing whether behavioral evidence adds anything beyond the hidden state.
Per-Round Recall-Calibrated Gates Each gate’s threshold is set on a calibration split so that the gate provably passes at least a tr fraction of successful episodes. Given a per-round recall budget tr , let Sr = {fr (xi ) : yi = 1, i alive at r} be the scores of the nr successful calibration episodes alive at round r. For a candidate threshold τ , let k(τ ) = |{s ∈ Sr : s ≤ τ }| be the number of survivors; the exact binomial (Clopper–Pearson) lower confidence bound on the gate’s true survival rate is the Beta quantile p(τ ) = Beta−1 (α; k(τ ), nr − k(τ ) + 1) ,
(1)
and we set τr to the smallest calibration score with p(τr ) ≥ tr , at per-gate confidence level 1 − α with α = 0.05. This is deliberately stronger than a marginal conformal quantile: the per-round guarantee holds with high confidence over the calibration draw, at the price of conservatism when nr is small (a gate whose nr cannot support tr abstains, i.e., aborts nothing). A conformal-quantile variant (τr = Quantile⌈(nr +1)tr ⌉/nr (Sr )) is compared in the technical appendix (“Conformal-Quantile Gates”). A budget of tr = 1 disables the gate.
Recall Budget Search Under a Global Constraint Per-round guarantees do not compose multiplicatively in any useful way: a union bound over gates is valid but hopelessly conservative, because it ignores that late gates expose few successes and that per-gate false-abort events are far from disjoint. We therefore treat the budget vector t = (t1 , . . . , tRg ) as a hyperparameter and select it empirically on a validation split disjoint from calibration. Concretely, probe scores are produced by task-grouped cross-fitting (stratified group k-fold), so every episode is scored by a probe that never saw its task during training.
Tasks are then partitioned into a calibration set for gate thresholds (20% of tasks), a validation set for budget search (20%), and a held-out test set (60%). Grouping by task throughout ensures no task contributes episodes to two sides of any split. For each candidate t on the grid tr ∈ {0.85, 0.90, 0.95, 0.98, 0.99, 1.0} (66 = 46,656 candidates), we calibrate all gates on the calibration split, simulate the full cascade on the validation split, and record its global recall ρ̂val (t) and compute savings. The deployed budget maximizes validation savings subject to a feasibility condition, for which we study two variants: • Margin (default): require ρ̂val (t) ≥ ρ⋆ + δ with a fixed safety margin δ = 0.02. This is a heuristic guard against selection bias from searching over many candidates; it carries no formal guarantee, and we validate it empirically. • Certificate: require that the Clopper–Pearson lower bound at level 1 − αm (αm = 0.05) on the global recall, computed from the npos successful validation episodes, exceed ρ⋆ . This yields a distribution-free guarantee that holds despite the search, at the price of conservatism analyzed below. If no candidate is feasible, the policy abstains and aborts nothing. Two fixed budget allocations serve as structural baselines: single-gate, which spends the entire recall budget at a single round, with both the round and its budget selected by the same validation search (recovering the singledecision-point policies of prior monitoring work as a special case of our framework), and uniform, which sets the same tr at every gate. Sample complexity of certification. The certificate makes visible a fundamental data requirement. Even a candidate that aborts nothing has a validation lower bound of 1/n Beta−1 (αm ; npos , 1) = αm pos (the “rule of three”), so targets above this level are unattainable regardless of scorer quality. Our splits yield npos = 113 (Llama) and 115 (Qwen), capping certifiable targets near 0.974; the resulting sample complexity of stricter targets is analyzed in the Results (Figure 7) and extends directly when recalibrated on more data.
Experimental Setup Environment and Agents. We use TextCraft (Prasad et al. 2024), a text-based crafting environment from the AgentGym suite (Xi et al. 2024) in which an agent must synthesize a target item by navigating multi-step crafting recipes, with binary task success. We collect 800 episodes over 100 tasks for each of two agent policies: Llama-3.2-3B (Meta AI 2024) (task success rate 63.0%) and Qwen-2.5-7B (Qwen Team 2025) (74.8%), sampling at temperature 1.0 (8 episodes per task). Episodes run up to Rfull = 20 rounds; gates are placed at rounds 1–6. The population still alive at each gate decays quickly (Figure 2): 35% (Llama) and 39% (Qwen) of episodes already finish within two rounds, and 53%/69% before the last gate, quantifying how sharply late gates’ exposure decays. Compute savings are reported as the fraction
Surface Qwen-2.5-7B
Llama-3.2-3B 0.9
0.5
0
0.8
Llama-3.2-3B Qwen-2.5-7B 1
2
AUC
Fraction of episodes alive
Probe 1
3
4
5
6
Gate round
Figure 2: Fraction of episodes still running at each gate round. Exposure decays sharply: over a third of episodes finish within two rounds, so late gates guard little remaining compute; this is the structural trade-off the budget search exploits. of total generated tokens saved by aborts, counting only each aborted episode’s remaining computation. Protocol. Probes are per-round logistic regressions (C = 1, standardized features) on layer-14 (Llama) / layer-20 (Qwen) activations. The entire pipeline (task-level splitting, probe cross-fitting, gate calibration, budget search, evaluation) is repeated over 20 random seeds; we report testsplit mean ± standard deviation. All scorers and all budgetallocation baselines share identical splits, calibration machinery, and search procedure, so differences isolate the quality of the underlying signal (scorer comparisons) or the value of distributing the recall budget (allocation comparisons).
Results Internal States Predict Failure Before Behavior Does Figure 3 plots the cross-fitted AUC of each per-round scorer for predicting eventual failure among episodes alive at that round. The behavior-only surface scorer is barely better than chance at the first gate and becomes informative only around rounds 3–4, consistent with behavioral evidence (repetitions, lack of progress, invalid actions) needing time to accumulate. The probe shows the opposite timing pattern: its first-round AUC already matches or exceeds the surface scorer’s peak, which the latter attains only two to three rounds later, and the probe peaks at round 2, an absolute advantage of 0.12– 0.21 AUC over the surface scorer in precisely the rounds where most of the episode’s compute is still unspent. The two signals converge only at round 6, by which point the majority of episodes have already ended (Figure 2). The probe’s decline after round 2 reflects population filtering rather than fading signal: episodes that terminate early leave the alive-set, concentrating the harder, longer-running cases at later gates. This timing difference matters more than peak values: discriminative power at rounds 1–2 protects far more useful remaining compute than the same power at rounds 3–4, a point the cascade results below make quantitative.
Main Results: Cascade vs. Single Gate Table 1 reports the compute savings of the abort cascade at four global recall targets for both agents, against the singlegate and uniform budget allocations; Figure 4 plots the recall
0.7 0.6 0.5
1
2
3
4
5
6
Gate round
1
2
3
4
5
6
Gate round
Figure 3: Cross-fitted AUC for predicting eventual episode failure at each gate round (among episodes alive at that round). Probes on internal activations peak at round 2; the behavior-only surface scorer starts near chance and peaks only at rounds 3–4, after over a third of episodes have already finished. Target
Compute saved (%)
Agent
recall
Cascade
Single
Uniform
Llama
0.90 0.92 0.95 0.97
37.2 ± 8.8 31.7 ± 8.1 19.9 ± 9.2 9.3 ± 7.7
23.6 ± 5.3 18.9 ± 4.9 10.4 ± 3.9 4.1 ± 3.6
3.1 ± 2.5 0.1 ± 0.4 0.0 ± 0.0 0.0 ± 0.0
Qwen
0.90 0.92 0.95 0.97
47.1 ± 10.3 44.0 ± 8.9 32.0 ± 12.2 18.2 ± 12.5
27.6 ± 5.6 24.2 ± 5.5 17.4 ± 5.5 10.8 ± 4.3
6.9 ± 5.7 6.6 ± 5.9 0.0 ± 0.0 0.0 ± 0.0
Table 1: Probe-based abort cascade with Clopper–Pearson gates and margin-based budget search (δ = 0.02; 20 seeds, test split). Achieved global recall matches its target within one standard deviation in every row (Figure 4); the single-gate and uniform baselines also meet their targets while staying on the conservative side.
each cascade actually achieves against its target, and Figure 5 traces the savings–target frontier. Three observations stand out. First, achieved recall matches its target in every configuration (Figure 4): across all eight agent–target pairs the cascade’s mean test recall deviates from its target by at most 0.027, always within one standard deviation, and errs above the target in seven of eight cases. The savings in Table 1 are thus attained under honest risk control rather than post-hoc threshold tuning. Second, distributing the recall budget across rounds is worth 1.6–2.3× over the best single decision point, at every target and for both agents (Figure 5); for Llama the ratio widens as the target tightens (up to 2.3× at 0.97), while for Qwen it holds near 1.7–1.8×. The searched budgets explain why: the modal allocation at Llama’s 0.90 target is (0.95, 0.85, 0.85, 1.0, 1.0, 1.0): it spends recall aggressively at rounds 1–3, where doomed episodes are identifiable and most of their cost is still unspent, and disables late gates entirely. The uniform allocation, forced to be equally strict at
Llama-3.2-3B Qwen-2.5-7B
Cascade
Qwen-2.5-7B
0.95 40 0.9
0.9
0.92
0.95
0.97
Target global recall ρ⋆
Cascade
Single-gate
Uniform Qwen-2.5-7B
Llama-3.2-3B 40 20
0. 97
95 0.
9
92 0.
0.
97 0.
95 0.
92 0.
0. 9
0
Recall target ρ⋆
20
0
be Pro
Figure 4: Achieved global success recall of the cascade vs. its target (mean ± one standard deviation over 20 seeds; points horizontally jittered for legibility). The diagonal marks exact targeting; every configuration lands on or above its target within one standard deviation.
Saved (%)
Single-gate
Llama-3.2-3B
Saved (%)
Achieved test recall
1
Recall target ρ⋆
Figure 5: Compute savings versus global recall target for the three budget allocations (test split, mean over 20 seeds). The cascade dominates at every target; the uniform allocation collapses at strict targets.
the recall-expensive early gates and the low-yield late ones, saves almost nothing, confirming that where the budget is spent, not just how much, drives the savings. Third, the stronger agent yields larger savings. Qwen’s cascade saves more than Llama’s at every target despite Qwen’s higher success rate leaving fewer doomed episodes to abort. Two factors contribute: Qwen’s failure signal is simply stronger at every gate (Figure 3), and its episodes finish earlier (Figure 2), concentrating surviving failures into an increasingly separable population at mid-trajectory gates.
Does the Signal Require Internal Access? Figure 6 fixes the target at 0.95 and swaps the scorer inside the otherwise-identical pipeline, for both the cascade and single-gate allocations. Three conclusions emerge. First, internal access roughly doubles the savings of the strongest configuration on Qwen (32.0% for the probe cascade vs. 17.0% for the surface cascade); on Llama the gap is present but narrower. Second, stacking behavioral features onto the probe adds nothing: savings land within noise of the probe alone, indicating that whatever the surface scorer knows, the hidden states already encode; the converse is clearly false. Third, the cascade structure amplifies weak scorers even more than strong ones: moving from single
Sur
face
king Stac
be
Pro
Sur
face
king Stac
Figure 6: Scorer ablation at target global recall 0.95 (mean ± one standard deviation over 20 seeds). “Stacking” concatenates surface features onto the probe. All configurations meet the recall target (achieved recall 0.954–0.970).
gate to cascade multiplies surface savings by roughly 3.6×, versus about 1.9× for the probe. The per-round AUCs of Figure 3 explain this asymmetry: the surface signal only matures at rounds 3–4, so a single early gate cannot exploit it at all, whereas the cascade can defer part of the budget to the rounds where the behavioral evidence finally arrives. Notably, the surface single gate remains weak at every round—even at its best placement it saves less than the probe single gate at round 1, so the cascade is a complement to, not a substitute for, a signal that arrives early.
The Limits of Certification at High Recall Replacing the empirical margin with the global certificate (αm = 0.05) makes the guarantee formal, and its cost explicit. Figure 7 plots the minimum number of successful validation episodes required to certify a given target, the “rule of three” bound npos ≥ ln αm / ln ρ⋆ , against the npos = 113/115 our splits provide. Targets up to ≈ 0.974 lie below the curve and are certifiable; 0.98 and 0.99 lie above it, so no candidate, including the no-op, can be certified, and the policy abstains with zero savings by construction. This is not the scorer’s failure but the target’s data cost: even the margin-based single gate at 0.98 (with the margin in meanminus-one-σ form at these targets) saves only 1.5%–5.5% across the two agents, confirming that near-perfect recall leaves little room for any abort policy at this data scale. We regard this transparency as a feature: the method reports, before deployment, that 800 episodes suffice to back a 0.95– 0.97 promise but not a 0.99 one, and Figure 7 prescribes exactly how much additional data the stricter promise costs.
Does the Margin Actually Protect the Target? The margin rule is a heuristic, so we test it directly. Across the eight main configurations, the searched budget’s validation recall exceeds its test recall by 0.008–0.030, precisely the selection optimism the δ = 0.02 margin is sized to absorb. The margin absorbs it almost exactly and no more: in the worst case (Llama at 0.92) the mean test recall lands 0.001 under the nominal target, well within seed noise, while in all other configurations it lands above. Figure 8 visualizes this per seed. Removing the margin entirely (δ = 0) confirms it is
Required npos
300
299
ln αm / ln ρ⋆
200 149
our scale (npos = 113/115) 100
0 0.9
0.92
0.94
0.96
0.98
Recall target ρ⋆
Figure 7: Sample complexity of the global recall certificate (αm = 0.05): minimum number of successful validation episodes below which even the no-op policy cannot be certified. Our splits (dashed) support targets up to ≈ 0.974; targets of 0.98 and 0.99 (dots) require substantially more data, independent of scorer quality. 1
Test recall
0.95
0.9
0.85 Llama-3.2-3B Qwen-2.5-7B
0.8 0.9
0.92
0.94
0.96
0.98
1
Validation recall
Figure 8: Validation vs. test global recall of the searched budget, for all 20 seeds and four targets. Points below the diagonal (solid) exhibit selection optimism; the dashed line marks the δ = 0.02 margin sized to absorb it. load-bearing: at the 0.95 target the same search lands at test recall 0.943±0.032 (Qwen) and 0.942±0.024 (Llama), both below target, while saving more (41.0%/26.3%), quantifying exactly the savings the margin trades for reliability.
Related Work Predicting success from internal representations. Lightweight probes on frozen activations decode properties that a model does not reliably verbalize (Alain and Bengio 2016; Belinkov 2022). For LLMs, such probes predict whether the model knows an answer (Kadavath et al. 2022), whether a statement is true (Azaria and Mitchell 2023; Burns et al. 2023; Marks and Tegmark 2024), and whether a generation is hallucinated (Orgad et al. 2025; Kossen et al. 2024; Ji et al. 2024), with the relevant signal repeatedly found to be linearly decodable (Marks and Tegmark 2024; Burns et al. 2023). Closer to our setting, internal states anticipate chainof-thought success before completion (Afzal et al. 2025) and encode self-verification signals in reasoning models (Zhang et al. 2025). For agents specifically, Padhi et al. (2026) recover linearly separable success/failure directions in the acti-
vations of LLM agents in ScienceWorld and AlfWorld, using conformal prediction upstream to label step-level representations from sparse episode rewards, with representation steering as the downstream application. Mehta (2026) probe a related but distinct quantity: representational commitment, the early convergence of an agent’s hidden states across resampled continuations, and find it deliberately orthogonal to correctness, with committed-correct and committed-wrong runs indistinguishable, whereas our probes predict the outcome itself. These results establish that outcome-relevant signal exists in the residual stream and is linearly accessible; none of them ask when in an episode the signal becomes actionable, nor turn it into a stopping rule with a controllable error rate. Both questions are the subject of this paper. Failure detection and monitoring of LLM agents. Failure analyses consistently find that decisive errors arise early and cascade through the remaining trajectory (Zhu et al. 2025; Li et al. 2026), motivating online monitoring over posthoc attribution; AgentRx (Barke et al. 2026) localizes the decisive failure step from completed execution trajectories, a source of step-level supervision that per-round probes like ours could in principle exploit. Existing online monitors read trajectory text or derived trajectory embeddings: AgentForesight (Zhang et al. 2026) trains a separate 7B auditor with reinforcement learning to localize the earliest decisive error in multi-agent systems, Baidya et al. (2026) fit a weakly supervised text-encoder alerter with a tunable accuracy–earliness trade-off, and MASC (Shen et al. 2026) anomaly-scores step embeddings against prototype-guided next-execution reconstructions to trigger self-correction in multi-agent systems. Chen et al. (2026) compute inexpensive behavioral statistics over agent interactions, but for offline triage of logged trajectories rather than online intervention. An alternative is to ask the agent itself: BAGEN (Lin et al. 2026) formalizes budget awareness as verbalized interval prediction of remaining cost, but finds that frontier agents are systematically overoptimistic on doomed tasks and that even after SFT and RL the intervals reach at most 47% coverage, leaving calibration as an open problem; prompted early exit likewise trades success for cost without controlling the loss (Lu et al. 2025). Our monitor differs on the two axes that matter for deployment: the signal is read from the agent’s own activations at negligible cost, requiring neither an auxiliary LLM pass per step nor trust in the agent’s self-reports, and the abort decision carries an episode-level, a priori verifiable bound on the rate of falsely terminated successes, which no existing monitor provides; existing alerters control at best a per-check error rate, which degrades over the length of the episode. Conformal prediction and risk control for LLMs. Split conformal prediction and related distribution-free calibration give finite-sample guarantees under exchangeability (Vovk, Gammerman, and Shafer 2005; Papadopoulos et al. 2002; Lei et al. 2018; Angelopoulos and Bates 2023), with extensions to general risks (Bates et al. 2021; Angelopoulos et al. 2025, 2024). For LLMs, these tools calibrate prediction sets and factuality filters (Quach et al. 2024; Mohri and Hashimoto 2024; Cherian, Gibbs, and Candès 2024) and let planners ask for help with statistical guarantees on task completion (Ren
et al. 2023). Davidov et al. (2026) give a complementary formal treatment of when to quit, casting abstention as an explicit action in a regularized reinforcement-learning objective and deriving value-function conditions under which quitting is optimal; their guarantee is tied to the quality of a learned value estimate, whereas ours is finite-sample and distribution-free, and controls an episode-level error rate across a sequence of gates. Closest in spirit is CALM (Schuster et al. 2022), which calibrates per-token early-exit thresholds so that sequence-level quality constraints hold with high probability; this is the same pattern of composing many local decisions under one global constraint that our cascade instantiates, at a different granularity and for a different risk: rather than skipping decoder layers under a text quality constraint, we terminate entire agent episodes under a constraint on global success recall. Adaptive allocation of inference compute. Reinforcement learning with verifiable rewards (RLVR) is an adjacent source of motivation: modern reasoning systems optimize sampled rollouts from task-level correctness signals. DeepSeekMath introduced Group Relative Policy Optimization (GRPO) for mathematical reasoning (Shao et al. 2024), and DeepSeek-R1 showed that large-scale RL on verifiable tasks can elicit self-reflection, verification, and strategy adaptation (DeepSeek-AI 2025). Our setting uses the same kind of episode-level success signal, but at inference time: rather than updating the policy, we decide whether a running rollout should continue while preserving global success recall. A complementary literature adapts compute to instance difficulty: adaptive and early-stopping self-consistency truncate sampling once answers agree (Aggarwal et al. 2023; Li et al. 2024; Manvi, Singh, and Ermon 2024), cascades route queries from cheap to expensive models (Chen, Zaharia, and Zou 2023), optionally abstaining early when the large model is also likely to fail (Zellinger, Liu, and Thomson 2025), and overthinking mitigation stops chain-of-thought once further reasoning is redundant (Sun et al. 2025; Mao et al. 2025), terminating computation that has already succeeded, the mirror image of our problem. Atropos (Kim and Yoo 2026) is closest to ours in goal: a graph network over a semantic flow graph of sampled reasoning paths predicts whether an ongoing self-consistency run will succeed, triggering early termination and a hotswap to a stronger model; the predictor reads generated text rather than internal states and provides no control on the rate of falsely terminated successes. At the systems level, early-exit architectures realize per-token adaptive depth and expose the serving-stack considerations any activation-reading monitor inherits (Chen et al. 2023; Miao et al. 2024). In multi-step settings, process reward models score partial trajectories to prune search branches (Lightman et al. 2024; Zhang et al. 2024; Xia et al. 2025), precisely because waiting for complete rollouts is costly. These methods allocate compute across samples, models, or branches, generally without guarantees on the induced loss of task reward; we address the orthogonal single-trajectory decision of whether a running episode is worth finishing at all, with recall control built in, so that the reported compute savings are honest by construction.
Discussion and Limitations Margin vs. certificate. Our default policy controls global recall through an empirically validated margin, not a theorem; the certified variant closes this gap but, at our data scale, only up to targets of ≈ 0.97. This mirrors the state of practice in selective prediction: formal episode-level guarantees over sequential gates with searched budgets require either more calibration data or sharper multiple-testing machinery (e.g., fixed-sequence or e-value methods) than the one-shot bound we certify with. We see tightening this loop as the main methodological open problem our results motivate. Search granularity and margin size. The budget grid is deliberately coarse. A finer or continuous search could only improve validation savings, and its failure mode is conservative (an infeasible or suboptimal grid point gives up savings, never recall), so grid resolution trades efficiency, not safety. The margin δ = 0.02 was fixed a priori and happens to match the recall at our scale, p binomial standard error of validation ρ⋆ (1 − ρ⋆ )/npos ≈ 0.02 for ρ⋆ = 0.95 and npos ≈ 114; this gives a data-driven recipe for sizing δ in a new domain, with the certificate available whenever a heuristic margin is unacceptable. Scope. Our evidence comes from one environment (TextCraft) with two agent models and 800 episodes each; the exchangeability assumption underlying the gates can be violated under distribution shift (e.g., new task types at deployment). Recalibration on a small labeled sample restores the guarantee at modest cost. Gates are placed at the first six rounds: beyond round 6 only a minority of episodes remain alive (Figure 2), per-round AUC recedes toward its round-1 level, and the searched budgets at strict targets already disable rounds 5–6, indicating little headroom further out. Finally, our activations are extracted via an offline teacher-forced rerun; a deployed cascade would read them from the serving stack at generation time. Since the feature is the activation at the final generated token of the round, no extra forward pass is required, but exposing intermediate activations inside optimized serving stacks (fused attention kernels, paged KV caches) is a real engineering task in its own right, as the early-exit inference literature documents (Chen et al. 2023; Miao et al. 2024). Relatedly, we measure savings in generated tokens; realized wall-clock or dollar savings depend additionally on batching, prefill–decode asymmetry, and whether the freed capacity is actually reused. What aborted compute buys. We report savings, not what to do with them. The natural next step is closing the loop: reallocating aborted compute to retries of the same task turns recall-controlled abort into a test-time-scaling policy whose reward effect can be measured end-to-end.
Conclusion We showed that eventual failure of an LLM agent episode is predictable from internal activations within the first interaction rounds (before behavior-only monitors become informative) across two agent models, and that a cascade of recall-calibrated gates, with per-round budgets searched under a global constraint, converts this signal into compute
savings of up to 47.1% at a 90% global success-recall target, 1.6–1.7× what any single decision point achieves. The same framework tells practitioners which recall promises their data can certify and which it cannot. Together these suggest a practical, honest route to cutting the inference cost of agentic LLM systems without silently sacrificing task success.
References Afzal, A.; Matthes, F.; Chechik, G.; and Ziser, Y. 2025. Knowing Before Saying: LLM Representations Encode Information About Chain-of-Thought Success Before Completion. In Findings of the Association for Computational Linguistics: ACL. Aggarwal, P.; Madaan, A.; Yang, Y.; and Mausam. 2023. Let’s Sample Step by Step: Adaptive-Consistency for Efficient Reasoning and Coding with LLMs. In Empirical Methods in Natural Language Processing. Alain, G.; and Bengio, Y. 2016. Understanding Intermediate Layers Using Linear Classifier Probes. arXiv preprint arXiv:1610.01644. Angelopoulos, A. N.; and Bates, S. 2023. Conformal Prediction: A Gentle Introduction. Foundations and Trends in Machine Learning, 16(4): 494–591. Angelopoulos, A. N.; Bates, S.; Candès, E. J.; Jordan, M. I.; and Lei, L. 2025. Learn then Test: Calibrating Predictive Algorithms to Achieve Risk Control. The Annals of Applied Statistics, 19(2): 1641–1662. Angelopoulos, A. N.; Bates, S.; Fisch, A.; Lei, L.; and Schuster, T. 2024. Conformal Risk Control. In International Conference on Learning Representations. Azaria, A.; and Mitchell, T. 2023. The Internal State of an LLM Knows When It’s Lying. In Findings of the Association for Computational Linguistics: EMNLP. Baidya, A.; Liang, X.; Guo, R.; Gao, X.; and Das, K. 2026. When Evidence is Sparse: Weakly Supervised Early Failure Alerting in Dialogs and LLM-Agent Trajectories. arXiv preprint arXiv:2606.05414. Barke, S.; Goyal, A.; Khare, A.; Singh, A.; Nath, S.; and Bansal, C. 2026. AgentRx: Diagnosing AI Agent Failures from Execution Trajectories. arXiv preprint arXiv:2602.02475. Bates, S.; Angelopoulos, A.; Lei, L.; Malik, J.; and Jordan, M. I. 2021. Distribution-Free, Risk-Controlling Prediction Sets. Journal of the ACM, 68(6): 1–34. Belinkov, Y. 2022. Probing Classifiers: Promises, Shortcomings, and Advances. Computational Linguistics, 48(1): 207–219. Burns, C.; Ye, H.; Klein, D.; and Steinhardt, J. 2023. Discovering Latent Knowledge in Language Models Without Supervision. In International Conference on Learning Representations. Chen, L.; Zaharia, M.; and Zou, J. 2023. FrugalGPT: How to Use Large Language Models While Reducing Cost and Improving Performance. arXiv preprint arXiv:2305.05176.
Chen, S.; et al. 2026. Signals: Trajectory Sampling and Triage for Agentic Interactions. arXiv preprint arXiv:2604.00356. Chen, Y.; et al. 2023. EE-LLM: Large-Scale Training and Inference of Early-Exit Large Language Models with 3D Parallelism. arXiv preprint arXiv:2312.04916. Cherian, J. J.; Gibbs, I.; and Candès, E. J. 2024. Large Language Model Validity via Enhanced Conformal Prediction Methods. In Advances in Neural Information Processing Systems. Davidov, H.; Cohen, N.; Kalinsky, O.; Fairstein, Y.; Kushilevitz, G.; Yazdi, R.; and Rebeschini, P. 2026. Knowing When to Quit: A Principled Framework for Dynamic Abstention in LLM Reasoning. arXiv preprint arXiv:2604.18419. DeepSeek-AI. 2025. DeepSeek-R1: Incentivizing Reasoning Capability in LLMs via Reinforcement Learning. Nature, 645: 633–638. Ji, Z.; Chen, D.; Ishii, E.; Cahyawijaya, S.; Bang, Y.; Wilie, B.; and Fung, P. 2024. LLM Internal States Reveal Hallucination Risk Faced With a Query. In Proceedings of the 7th BlackboxNLP Workshop: Analyzing and Interpreting Neural Networks for NLP. Kadavath, S.; Conerly, T.; Askell, A.; Henighan, T.; Drain, D.; et al. 2022. Language Models (Mostly) Know What They Know. arXiv preprint arXiv:2207.05221. Kim, N.; and Yoo, S. 2026. Atropos: Improving Cost-Benefit Trade-off of LLM-based Agents under Self-Consistency with Early Termination and Model Hotswap. arXiv preprint arXiv:2604.15075. Kossen, J.; Han, J.; Razzak, M.; Schut, L.; Malik, S.; and Gal, Y. 2024. Semantic Entropy Probes: Robust and Cheap Hallucination Detection in LLMs. arXiv preprint arXiv:2406.15927. Lei, J.; G’Sell, M.; Rinaldo, A.; Tibshirani, R. J.; and Wasserman, L. 2018. Distribution-Free Predictive Inference for Regression. Journal of the American Statistical Association, 113(523): 1094–1111. Li, X.; Yan, W.; Wu, Y.; Liang, P.; Yuan, M.; Liu, J.; and Yang, J. 2026. Early Diagnosis of Wasted Computation in Multi-Agent LLM Systems via Failure-Aware Observability. arXiv preprint arXiv:2606.01365. Li, Y.; Yuan, P.; Feng, S.; Pan, B.; Wang, X.; Sun, B.; Wang, H.; and Li, K. 2024. Escape Sky-High Cost: Early-Stopping Self-Consistency for Multi-Step Reasoning. In International Conference on Learning Representations. Lightman, H.; Kosaraju, V.; Burda, Y.; Edwards, H.; Baker, B.; Lee, T.; Leike, J.; Schulman, J.; Sutskever, I.; and Cobbe, K. 2024. Let’s Verify Step by Step. In International Conference on Learning Representations. Lin, Y.; Wang, Z.; Liu, M.; Shan, Y.; Bai, L.; Zhang, J.; Jin, X.; Chen, B.; Su, J.; Wang, X.; Pei, J.; and Li, M. 2026. BAGEN: Are LLM Agents Budget-Aware? arXiv preprint arXiv:2606.00198. Lu, Q.; Ding, L.; Cao, S.; Liu, X.; Zhang, K.; Zhang, J.; and Tao, D. 2025. Runaway is Ashamed, But Helpful: On the Early-Exit Behavior of Large Language Model-based Agents
in Embodied Environments. In Findings of the Association for Computational Linguistics: EMNLP. Manvi, R.; Singh, A.; and Ermon, S. 2024. Adaptive Inference-Time Compute: LLMs Can Predict If They Can Do Better, Even Mid-Generation. arXiv preprint arXiv:2410.02725. Mao, M.; Yin, B.; Zhu, Y.; and Fang, X. 2025. Early Stopping Chain-of-Thoughts in Large Language Models. arXiv preprint arXiv:2509.14004. Marks, S.; and Tegmark, M. 2024. The Geometry of Truth: Emergent Linear Structure in Large Language Model Representations of True/False Datasets. In Conference on Language Modeling. Mehta, A. 2026. When Agents Commit Too Soon: Diagnosing Premature Commitment in LLM Agents. arXiv preprint arXiv:2606.22936. Meta AI. 2024. Llama 3.2: Revolutionizing edge AI and vision with open, customizable models. https://ai.meta.com/blog/llama-3-2-connect-2024-visionedge-mobile-devices/. Miao, R.; Yan, Y.; Yao, X.; and Yang, T. 2024. An Efficient Inference Framework for Early-Exit Large Language Models. arXiv preprint arXiv:2407.20272. Mohri, C.; and Hashimoto, T. 2024. Language Models with Conformal Factuality Guarantees. In International Conference on Machine Learning. Orgad, H.; Toker, M.; Gekhman, Z.; Reichart, R.; Szpektor, I.; Kotek, H.; and Belinkov, Y. 2025. LLMs Know More Than They Show: On the Intrinsic Representation of LLM Hallucinations. In International Conference on Learning Representations. Padhi, T.; Kaur, R.; Agarwal, K.; Cobb, A. D.; Elenius, D.; Acharya, M.; Samplawski, C.; Berenbeim, A. M.; Bastian, N. D.; Jha, S.; and Roy, A. 2026. From Actions to Understanding: Conformal Interpretability of Temporal Concepts in LLM Agents. arXiv preprint arXiv:2604.19775. Papadopoulos, H.; Proedrou, K.; Vovk, V.; and Gammerman, A. 2002. Inductive Confidence Machines for Regression. In European Conference on Machine Learning. Prasad, A.; Koller, A.; Hartmann, M.; Clark, P.; Sabharwal, A.; Bansal, M.; and Khot, T. 2024. ADaPT: As-Needed Decomposition and Planning with Language Models. In Findings of the Association for Computational Linguistics: NAACL 2024. Quach, V.; Fisch, A.; Schuster, T.; Yala, A.; Sohn, J. H.; Jaakkola, T. S.; and Barzilay, R. 2024. Conformal Language Modeling. In International Conference on Learning Representations. Qwen Team. 2025. Qwen2.5 Technical Report. arXiv preprint arXiv:2412.15115. Ren, A. Z.; Dixit, A.; Bodrova, A.; Singh, S.; Tu, S.; Brown, N.; Xu, P.; Takayama, L.; Xia, F.; Varley, J.; Xu, Z.; Sadigh, D.; Zeng, A.; and Majumdar, A. 2023. Robots That Ask for Help: Uncertainty Alignment for Large Language Model Planners. In Conference on Robot Learning.
Schuster, T.; Fisch, A.; Gupta, J.; Dehghani, M.; Bahri, D.; Tran, V. Q.; Tay, Y.; and Metzler, D. 2022. Confident Adaptive Language Modeling. In Advances in Neural Information Processing Systems. Shao, Z.; Wang, P.; Zhu, Q.; Xu, R.; Song, J.; Bi, X.; Zhang, H.; Zhang, M.; Li, Y. K.; Wu, Y.; and Guo, D. 2024. DeepSeekMath: Pushing the Limits of Mathematical Reasoning in Open Language Models. arXiv preprint arXiv:2402.03300. Shen, X.; Zhang, Q.; Wang, S.; Tan, Z.; Zhao, X.; Yao, L.; Tadiparthi, V.; Mahjoub, H. N.; Moradi Pari, E.; Lee, K.; and Chen, T. 2026. Metacognitive Self-Correction for MultiAgent System via Prototype-Guided Next-Execution Reconstruction. In Findings of the Association for Computational Linguistics: ACL 2026. Sun, R.; Cheng, W.; Li, D.; Chen, H.; and Wang, W. 2025. Stop When Enough: Adaptive Early-Stopping for Chain-ofThought Reasoning. arXiv preprint arXiv:2510.10103. Vovk, V.; Gammerman, A.; and Shafer, G. 2005. Algorithmic Learning in a Random World. Springer. Xi, Z.; Ding, Y.; Chen, W.; Hong, B.; Guo, H.; Wang, J.; Yang, D.; Liao, C.; Guo, X.; He, W.; Gao, S.; Chen, L.; Zheng, R.; Zou, Y.; Gui, T.; Zhang, Q.; Qiu, X.; Huang, X.; Wu, Z.; and Jiang, Y.-G. 2024. AgentGym: Evolving Large Language Model-based Agents across Diverse Environments. arXiv preprint arXiv:2406.04151. Xia, Y.; Fan, J.; Chen, W.; Yan, S.; Cong, X.; Zhang, Z.; Lu, Y.; Lin, Y.; Liu, Z.; and Sun, M. 2025. AgentRM: Enhancing Agent Generalization with Reward Modeling. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers). Zellinger, M. J.; Liu, R.; and Thomson, M. 2025. CostSaving LLM Cascades with Early Abstention. arXiv preprint arXiv:2502.09054. Zhang, A.; Chen, Y.; Pan, J.; Zhao, C.; Panda, A.; Li, J.; and He, H. 2025. Reasoning Models Know When They’re Right: Probing Hidden States for Self-Verification. arXiv preprint arXiv:2504.05419. Zhang, B.; Zhu, J.; Shi, Z.; Liu, D.; and Tang, R. 2026. AgentForesight: Online Auditing for Early Failure Prediction in Multi-Agent Systems. arXiv preprint arXiv:2605.08715. Zhang, D.; Zhoubian, S.; Hu, Z.; Yue, Y.; Dong, Y.; and Tang, J. 2024. ReST-MCTS*: LLM Self-Training via Process Reward Guided Tree Search. In Advances in Neural Information Processing Systems. Zhu, K.; Liu, Z.; Li, B.; Tian, M.; Yang, Y.; Zhang, J.; Han, P.; Xie, Q.; Cui, F.; Zhang, W.; Ma, X.; Yu, X.; Ramesh, G.; Wu, J.; Liu, Z.; Lu, P.; Zou, J.; and You, J. 2025. Where LLM Agents Fail and How They Can Learn from Failures. arXiv preprint arXiv:2509.25370.
Appendix A. Per-Layer Probe AUC Sweeps
B. Conformal-Quantile Gates
Probe layers were fixed once per model and used unchanged in all experiments. For Qwen-2.5-7B, a per-layer sweep of the same logistic probe over layers {0, 2, . . . , 28} was run on an independent pilot set of rollouts collected before the main experiments; the post-generation AUC peaks at layer 20. For Llama-3.2-3B, the sweep covered layers {6, 10, 14, 18, 22, 26}; the post-generation sweep selects layer 14.
Table 2 compares the Clopper–Pearson gate of the main text against the conformal-quantile variant, for a single probebased gate at round 1 with per-round target 0.95 (20 seeds). The quantile gate controls recall only on average over the calibration draw, so with the small per-round calibration sets available here its realized recall fluctuates below target, violating it for Llama (0.933 vs. 0.95) while saving more compute. The Clopper–Pearson gate is conservative (recall 0.972–0.977 at target 0.95) but never violates. This is the trade the main text accepts: the cascade’s budget search recovers much of the conservatism by spending recall where it is cheap, while retaining a high-confidence per-gate guarantee.
Qwen-2.5-7B (pilot set)
AUC
0.8 0.7 0.6
post-gen 0
4
8
12
16
20
24
28
Model
Calibration
Llama Qwen
Llama-3.2-3B
AUC
0.8 0.75 post-gen
0.7 6
10
14
18
22
26
Layer
Figure 9: Per-layer probe-AUC sweeps used to fix the probe layer for each agent. Qwen-2.5-7B: independent pilot set, layer 20. Llama-3.2-3B: post-generation sweep, layer 14.
Recall
Saved (%)
Clopper–Pearson Quantile
0.972 ± 0.013 0.933 ± 0.029
10.4 ± 3.9 20.7 ± 5.6
Clopper–Pearson Quantile
0.977 ± 0.011 0.954 ± 0.020
17.4 ± 5.5 24.7 ± 4.8
Table 2: Single gate at round 1, per-round recall target 0.95, probe scorer, 20 seeds. Quantile calibration saves more but violates the target on Llama; Clopper–Pearson is conservative and always meets it.