A 90% failure monitor can make an agent worse

A failure monitor is a classifier: it watches an AI agent and predicts whether the current attempt will fail. But the intervention is a decision. If an alarm discards useful work and launches a fresh attempt, the replacement still has to solve the task with the remaining budget. Jain and Vedam show that classifier accuracy alone cannot tell us whether that action helps.

Let q be the chance that the live attempt succeeds if allowed to continue. Let p be restartability: the chance that one independent clean restart succeeds using the same residual budget. The monitor catches a fraction τ of eventual failures and falsely alarms on a fraction φ of eventual successes.

Correct alarms rescue failures with probability p. False alarms destroy successes unless the restart succeeds anyway. The difference is the paper's exact alarm-to-action identity:

gain = (1 − q)τp − qφ(1 − p).

def restart_gain(q, p, true_positive, false_positive):
    rescued = (1.0 - q) * true_positive * p
    destroyed = q * false_positive * (1.0 - p)
    return rescued - destroyed

def restart_threshold(q, true_positive, false_positive):
    alarm = (1.0 - q) * true_positive + q * false_positive
    return None if alarm == 0.0 else q * false_positive / alarm

The running TypeScript core and all three displayed languages implement those same two terms line for line. The threshold divides the expected false-alarm loss by the total alarm rate; below it, restart harms success.

The paper sets q = 0.5, τ = 0.9, and φ = 0.1. Accuracy is therefore 90% for every restartability value. Yet gain simplifies to 0.5p − 0.05, crossing zero at 10%.

The authors ran 194 externally evaluated agent executions on 19 selected SymPy issues from SWE-bench Verified. The apparent 2.29-point benefit of restarting at call 16 comes from one eligible failed trajectory on one task. A second model shows a 42.29-point disadvantage for the same fixed restart, and the prospective cohorts do not reproduce a positive gain.

For every task–time comparison, the audit builds two-sided exact binomial intervals for continuation and restart, then applies a union bound across the predeclared family. It certifies restart only when the restart lower bound exceeds the continuation upper bound, certifies continuation for the reverse separation, and otherwise abstains.

The clean restart must restore the original task state, consume no monitoring budget, and produce an outcome independent of the alarm and live attempt within the fixed task and runtime. A context reset that keeps edits is a different intervention. Across mixed tasks, the fresh outcome can also become dependent even when independent within each task. In the general case, the exact target is E[A(Y_R − Y_C)], which requires outcomes for the action actually deployed.

Start by estimating restartability at the same decision time, budget, task, and runtime as the monitor. Then score the full controller on success, calls, latency, and cost; preregister thresholds; and test state-preserving recovery as its own action. A logistic-regression monitor can be perfectly well calibrated and still support the wrong intervention if its label omits the replacement attempt's value.