Wrong Agent Writes Pass Yes-Checks. Refute Them First.
BlackSwan (arXiv:2611.02950) shows confirmation-style action verification lets wrong writes through. A refute-first expect-suspect-test pass lifts AppWorld challenge TGC by 14.9–25.2 points and WebShop by 12.7.
Most agent safety research tries to validate a proposed write by gathering evidence that supports it. A recent paper from POSTECH argues the framing is the bug: a wrong action often passes every check that asks whether it is right. What you need is a question that can fail the write, then probes before you execute.
Oh, Heo, Noh, Kim, Son, and Ok (POSTECH / National AI Research Lab) introduce BlackSwan, a pre-execution verifier that runs expect → suspect → test on every state-mutating tool call. The agent states what the write is supposed to accomplish, lists concrete falsifiers tied to code elements, and only runs the write if none of those suspicions survive read-only probes. The name is deliberate: more white swans do not prove all swans are white. One black swan can kill the claim.
The confirmation blind spot
Their dinner-bill example is small and sharp. Asked to split last night's dinner among the attendees, an agent can confirm the bill amount and the guest list on the invitation, then charge everyone listed. A canceled guest who messaged after the invite never shows up in those "is this supported?" checks. Confirmation looks for conditions that make the action look ready. Refutation looks for the message that makes it wrong.
BlackSwan keeps the stages separate on purpose. Expecting and suspecting happen before any new probe, so the evidence cannot reshape the hypotheses it is supposed to test. That preregistration matters. An ablation on AppWorld's challenge split (thinking off) finds that refutation helps by 5.6 TGC points when suspicions are written out first, and by only 0.1 when they stay implicit. Explicit suspicions help confirmation-style checking by 3.4 points and refutation by 8.9. Orientation and externalization only pay off together.
Numbers that stick
Primary setup: Qwen3.5-27B FP8, AppWorld ReAct code agent, one in-context example unless noted.
On the challenge split with thinking on, BlackSwan hits 84.7 task goal completion (TGC) and 72.4 scenario goal completion (SGC). That is +14.9 TGC and +19.2 SGC over the strongest baseline in each column. Without thinking, the TGC margin over the strongest baseline grows to +25.2. BlackSwan with thinking off still beats every baseline that has thinking on, by 11.7 TGC points on the hard split.
Demonstrations do not close the gap. With thinking off, BlackSwan stays within about three TGC points from zero to three demos. Even with zero demos it beats every baseline given three, by 9.3 points. Direction of verification beats stacking more chain-of-thought or more few-shot examples.
Transfer is not AppWorld-only. With domain-neutral prompts, BlackSwan lifts WebShop success rate by 12.7 points over the same agent without verification (50.8 vs 38.1). Across Qwen3-4B, MiniMax M2.7, and GLM-5.3-Flash, BlackSwan wins every split. Accord (the confirmation baseline they reimplemented) sometimes falls below bare ReAct.
Burden of proof, flipped
Accord defaults toward approve unless a probe confirms a violation. BlackSwan defaults toward withhold until suspicions are dismissed. On AppWorld challenge with thinking, BlackSwan rejects 54.4% of proposed writes against Accord's 8.4%. It also reads more: about 0.76–0.91 new reads per verification versus Accord's 0.26–0.33. Among failures, no verification read reached the faulted application in 53.1% of Accord's cases, against 11.3% for BlackSwan.
That stricter gate cuts every measured error type more than Accord does. Per 100 tasks, BlackSwan leaves 16.1 required changes undone versus Accord's 24.9, and makes fewer wrong-value and collateral edits too. Omission is still the biggest leftover failure for everyone, because a write that was never proposed cannot be refuted.
What this means for agent stacks
If your guardrail asks whether the preconditions hold, you are measuring readiness, not correctness. Wrong writes can satisfy a checklist of supporting facts. BlackSwan's claim is narrower and more useful: force the agent to name how this specific write could be wrong, freeze those guesses, then go look. The AppWorld and WebShop gains say that capacity is already in the model. The missing piece is the protocol.
Paper: Action Verification through Conjecture and Refutation for Language Model Agents (arXiv:2611.02950).
