Know When to Trust the Skill: Delayed Appraisal and Epistemic Vigilance for Single-Agent LLMs¶

🕒 Published (v1): 2026-04-17 23:55 UTC · Source: Arxiv · link

Why this paper was selected

Delayed appraisal and epistemic vigilance for reliable tool use in LLM agents

Ask a follow-up

Open an assistant pre-loaded with this paper's context.

TL;DR¶

MESA-S (Metacognitive Skills for Agents, Single-agent) introduces a dual-confidence routing framework for tool-augmented LLMs that separates self-confidence (parametric certainty) from source-confidence (trust in external skills), governed by delayed procedural probing and epistemic vigilance. The architecture prevents indiscriminate tool loading, overthinking, and supply-chain attacks from malicious skill repositories. A 150-item static benchmark on Gemini 3.1 Pro shows the full system achieves 1.000 overall accuracy vs. 0.333 for direct and CoT baselines.

Problem¶

Tool-augmented LLMs using naive semantic retrieval suffer from (1) context pollution from stale or malicious skill returns, (2) overthinking—allocating expensive test-time compute to trivial assertions—and (3) offloading-induced confidence inflation, where fluency from external retrieval is mistaken for genuine internal knowledge. Standard routing collapses self-certainty and source-trust into a single scalar, offering no defense against adversarial tools or inappropriate offloading.

Method¶

MESA-S reformulates the standard routing objective:

\[a^* = \arg\max_{a \in A} E[U(a|c)]\]

into a Dual-Confidence utility:

\[a^*_{\text{mesa}} = \arg\max_{a \in A} \left[ \alpha p_{\text{self}} \cdot U(a_{\text{direct}}) + (1-\alpha) \cdot V_a \cdot p_{\text{source}|a} \cdot U(a_{\text{offload}}) - \lambda \cdot \text{Cost}(a) \right]\]

where \(p_{\text{self}}\) is parametric self-confidence, \(p_{\text{source}|a}\) is source-confidence in skill \(a\), \(V_a\) is a vigilance prior (source trust), and \(\lambda\) penalizes compute cost. The framework implements this via structured JSON-prompting rather than explicit AST parsing, through three mechanisms:

Delayed Metacognitive Escalation: A cheap "procedural probe" is run first; full skill body is loaded only if the probe confirms parametric knowledge is insufficient (analogous to delayed Judgments-of-Learning).
Region-of-Proximal Offloading: Tasks are triaged into three classes—procedural (skill/playbook loading), epistemic (retrieval/calculator), evaluative (verifier/unit-test)—routing only to the appropriate offloading tier.
Confidence Decontamination: Post-retrieval fluency increases are discounted unless verification protocols or strict trust priors support the escalation, maintaining a bifurcation between local uncertainty and trajectory-level global confidence.

Routing metadata is encoded in Metacognitive Skill Cards (structured fields: apply_when, cheap_probe, offloading_type, source_trust) enabling \(V_a\) updates before execution. A High-Confidence Control-Failure Bank stores only high-confidence routing errors for targeted skill card updates (exploiting the hypercorrection effect).

Key Contributions¶

Dual-confidence vector \((p_{\text{self}}, p_{\text{source}})\) replacing scalar uncertainty in tool routing
Delayed procedural probe mechanism: decouple skill awareness from token-intensive execution
Metacognitive Skill Cards as structured routing metadata enabling pre-execution trust assessment
Three-class offloading taxonomy (procedural / epistemic / evaluative)
Confidence Decontamination to prevent fluency-induced overconfidence post-retrieval
High-Confidence Control-Failure Bank for selective retrospective skill card updates
In-Context Static Benchmark Evaluation methodology for deterministic, reproducible agentic evaluation

Results¶

All results from a 150-item, 7-condition evaluation on Gemini 3.1 Pro via static cached outputs:

Slice A (Epistemic Boundaries, N=50): MESA-S (all variants) = 1.000; Baseline = 0.500; Reflection/CoT = 0.500
Slice B (Skill Gating / Adversarial Tools, N=50): MESA-S Full = 1.000; w/o Vigilance = 0.500; w/o Probe = 0.800; Baseline = 0.000; Reflection = 0.000
Slice C (Evaluative Overthinking, N=50): MESA-S (all variants) = 1.000; Baseline = 0.500; Reflection = 0.500
Overall: MESA-S Full = 1.000; w/o Decontamination = 1.000; w/o Dual-Confidence = 1.000; w/o Probe = 0.933; w/o Vigilance = 0.833; Baseline = 0.333; Reflection = 0.333
Probe vs. Vigilance ablation difference on Slice B (40/50 vs. 25/50) is significant at \(p < 0.01\) (two-proportion z-test), confirming non-redundancy
Decontamination and Dual-Confidence ablations show no divergence from full model at this scale

Limitations¶

Benchmark is static, single-turn, N=150—no multi-turn or asynchronous skill execution tested
Evaluated on a single model (Gemini 3.1 Pro); generalizability unestablished
Decontamination and Dual-Confidence components produce no measurable effect at this scale; their utility requires larger cascading tool-dependency evaluations
Implementation relies on structured JSON prompting, not intrinsic model weights; transfer to LoRA or native weight representations is future work
Metacognitive psychometric reliability is acknowledged as brittle (citing Rahnev [2025])
No real production deployment; API non-determinism was avoided rather than addressed

Relevance to Harnesses / Meta-Harnesses¶

MESA-S is directly architecturally relevant as a metacognitive orchestration layer sitting above a skill/tool registry—precisely the structural role a meta-harness plays. The Metacognitive Skill Card schema (apply_when, cheap_probe, offloading_type, source_trust) is a concrete proposal for how a harness should represent and gate tool invocations, replacing unstructured documentation with machine-readable routing metadata. The delayed probe mechanism operationalizes lazy tool loading that any harness managing a large skill ecosystem should consider to avoid context bloat. The High-Confidence Control-Failure Bank is a targeted feedback loop for harness-level self-improvement, directly applicable to meta-harnesses that need to evolve their routing policies without indiscriminate behavioral reuse.