Abstract
We introduce EF-Bench 2026, a comprehensive empirical evaluation suite measuring contradiction detection and policy compliance across 10,000 sampled agent tool execution traces. The corpus comprises 5,000 simulated adversarial workflow scenarios (spanning indirect prompt injections, privilege escalation attacks, and payee homoglyph spoofs) and 5,000 sanitized recorded enterprise execution attempts across financial systems, healthcare workflows, and infrastructure operations.
Compared against single-model self-correction baselines, EthersFlow's heterogeneous review council intercepts 94.2% of contradictory or hazardous tool calls while maintaining a low false-positive dispute rate (<1.8%).
What this supports
Multi-model review telemetry intercepts unintended or contradictory tool calls at a significantly higher rate than single-model evaluation baselines across structured data, financial verification, and infrastructure operations.
What this does not prove
Performance on benchmark traces does not guarantee identical error mitigation across unique, proprietary enterprise runtime environments with customized private tools.
I. Dataset & Trace Taxonomy
The EF-Bench corpus divides into four distinct threat profiles:
- Homoglyph & Recipient Impersonation (n = 2,500): Manipulating payee URLs, wallet destinations, or email routing keys via character substitution (e.g.
Stap1es.comvsStaples.com). - Out-of-Bounds Ledger Variances (n = 2,500): Invoice totals, disbursement sums, or database deletes exceeding approved PO ceilings or authorized policy ranges.
- Indirect Injection Steerage (n = 2,500): Instructions embedded inside external HTML, emails, or PDF attachments compelling the agent to trigger secondary malicious tools.
- Compliant Reference Traces (n = 2,500): Fully authorized, verified production tool calls used to measure false positive dispute rates.
III. Empirical Interception Results
| Architecture Setup | Interception Rate (%) | False Positive Dispute (%) | Median Review Latency |
|---|---|---|---|
| Single-Model Prompt Self-Check (Baseline) | 41.6% | 8.4% | 280ms |
| Dual-LLM Symmetric Critic | 63.2% | 5.1% | 420ms |
| EthersFlow FCP Multi-Council (Heterogeneous) | 94.2% | 1.8% | 38ms (Fast Gate) / 180ms (Full Council) |