Plausible Futures Are Not Enough for Safe Web Agents

Introduction

Web agents increasingly simulate the result of an action before clicking, submitting, purchasing, or changing a setting. This is the role of a web world model: predict what the interface and surrounding state may look like after a candidate action. Existing evaluations often ask whether that future is coherent and plausible. For safety-critical agents, however, plausibility is only the first test.

The more important question is whether the prediction preserves the information needed to decide what should happen next: execute the action, ask the user for clarification, or block it. A future can sound realistic while omitting the very detail that determines authorization. A new arXiv paper, Beyond Plausible Prediction: Safety Sufficiency in Web World Models, calls this property safety sufficiency.

Main findings

• Plausible language does not guarantee safe authorization. The researchers conducted a matched human evaluation of 3,000 predictions produced by ten frozen open models. Although 86.1% were judged semantically plausible, that result did not establish that the models could make reliable policy decisions.
• Conservatism can hide important failures. Several models combined a low rate of false-safe execution with weak recall on cases that should have led to ASK. They also showed a strong preference for BLOCK. Such behavior may reduce one type of danger, but it can make the agent unnecessarily unusable and prevent it from resolving ambiguity through clarification.
• SafeWebWorld evaluates the full decision chain. The benchmark covers five web-safety domains and examines three connected capabilities: producing action-conditioned futures, preserving policy-decisive evidence, and making policy-conditioned decisions. This moves evaluation beyond whether an output merely reads as a coherent scenario.
• Better evidence retention can coincide with worse authorization decisions. Under a controlled Security-Aligned Supervised Fine-Tuning protocol, models could improve substantially at preserving relevant evidence while deteriorating on authorization-sensitive decisions. The result suggests that representing more information and applying a policy correctly are separate capabilities.
• Recoverable scores are not the same as robust behavior. The paper introduces Latent Authorisation Recovery, or LAR, to determine whether degraded results reflect lost authorization structure or a weak decision readout. Recalibrating frozen scores recovered a substantial amount for some backbones, but the amount varied by backbone. Paired recovery added only a modest improvement. Within-family and matched-authorization evaluations remained poor, showing that aggregate recoverability does not imply reliable fine-grained behavior.

Why it matters

Safety failures are not limited to dangerous actions being allowed. An agent that blocks every ambiguous request may look cautious while failing to complete legitimate work or ask the one question that would resolve uncertainty. Conversely, treating missing context as permission to execute can create a more serious failure. A useful evaluation therefore needs to measure false-safe execution, ASK recall, evidence completeness, and the stability of decision boundaries—not just an overall accuracy score or the realism of a predicted future.

The study also offers a warning for safety tuning. A model may describe the state of a page more completely after fine-tuning without becoming better at authorization. A post-hoc calibration step may improve an aggregate metric without making decisions reliable on nearby or previously unseen cases. For deployment, prediction, evidence extraction, and authorization readout should be tested as distinct components, including within-family and matched-condition evaluations.

The paper’s central shift is from asking whether a model can imagine a believable future to asking whether that future exposes enough information for a safe decision. That distinction provides a useful baseline for evaluating web agents and other systems that predict before acting.

Source: arXiv