PQR: A Framework to Generate Diverse and Realistic User Queries that Elicit QA Agent Failures
cs.CL
Submitted: 2026-05-15
Updated: 2026-10-09
License: http://creativecommons.org/licenses/by/4.0/
The gist: Evaluating LLM-based agents remains challenging because identifying meaningful failure cases often requires substantial human effort to design realistic test scenarios.
Abstract
Evaluating LLM-based agents remains challenging because identifying meaningful failure cases often requires substantial human effort to design realistic test scenarios. Prior works primarily focus on automatically discovering agent failures induced by adversarial users, while overlooking queries with real user intents that also trigger agent failures. We introduce PQR, a framework that not only surfaces agent failures with respect to specific objectives (e.g., helpfulness, safety, etc.) but also resembles real users' intents. PQR operates through an iterative interaction between two complementary modules. The query refinement module performs rewrites to explore diverse query variations, while the prompt refinement module uses prior feedback to derive new objective-violating strategies and realism policies for refining prompts, which in turn generate failure-triggering yet realistic queries. We evaluate PQR on detecting an e-commerce QA agent's unhelpful responses. Our method uncovers 23% - 78% more unhelpful responses, and our generated queries are more diverse and realistic compared to previous methods.
Sources
- GEPA: Reflective Prompt Evolution Can Outperform Reinforcement Learning
- Graph of Attacks: Improved Black-Box and Interpretable Jailbreaks for LLMs
- Constitutional AI: Harmlessness from AI Feedback
- Jailbreaking Black Box Large Language Models in Twenty Queries
- Gemini 2.5: Pushing the Frontier with Advanced Reasoning, Multimodality, Long Context, and Next Generation Agentic Capabilities
- DeepSeek-R1: Incentivizing Reasoning Capability in LLMs via Reinforcement Learning
- CRMArena-Pro: Holistic Assessment of LLM Agents Across Diverse Business Scenarios and Interactions
- SECA: Semantically Equivalent and Coherent Attacks for Eliciting LLM Hallucinations
- AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Models
- Tree of Attacks: Jailbreaking Black-Box LLMs Automatically
- SAGE: A Top-Down Bottom-Up Knowledge-Grounded User Simulator for Multi-turn AGent Evaluation
- Auto-Prompt Generation is Not Robust: Prompt Optimization Driven by Pseudo Gradient
- Gemma 3 Technical Report
- Replacing Judges with Juries: Evaluating LLM Generations with a Panel of Diverse Models
- Jailbreak and Guard Aligned Language Models with Only Few In-Context Demonstrations
- An LLM can Fool Itself: A Prompt-Based Adversarial Attack
- Qwen3 Technical Report
- $\tau$-bench: A Benchmark for Tool-Agent-User Interaction in Real-World Domains
- Jailbreak Attacks and Defenses Against Large Language Models: A Survey
- GPTFUZZER: Red Teaming Large Language Models with Auto-Generated Jailbreak Prompts
Related papers
- Exploring Solution Divergence and Its Effect on Large Language Model Problem Solving
- Ishigaki-IDS-Bench: A Benchmark for Generating Information Delivery Specification from BIM Information Requirements
- Subliminal Steering: Stronger Encoding of Hidden Signals
- MedStruct-S: A Benchmark for Key Discovery, Key-Conditioned QA and Semi-Structured Extraction from OCR Clinical Reports
- The End of Transformers? On Challenging Attention and the Rise of Sub-Quadratic Architectures
- Untangling the Mechanisms of Misleading Context in Medical Question Answering