Intent-Preserving Adversarial User Simulation for Multi-Turn Agent Evaluation: what it means for business leaders

A per-task genetic search over user-simulator prompts finds difficult but goal-preserving customers that cut frontier agents' repeated-success rates by up to 69 percent, where standard and hand-written simulators do not.

1. What the method is

StressSim is a user simulator that stress-tests a multi-turn agent by searching, for each task, for the hardest valid conversation a plausible customer could hold. The user's goal never changes. What the optimiser changes is only the instruction prompt of a turn-level planner that decides what the simulated user discloses, asks or withholds on each turn. Candidate prompts are evolved with a genetic prompt-optimisation loop over 20 rollouts per task, scored on how far the agent's task completion falls and penalised whenever an LLM judge finds the conversation invalid: goal information not supplied by the user, or a user who is unnatural, self-contradictory, obstructive, repetitive or no longer pursuing the goal. The method is black-box with respect to the agent, needs no fine-tuning, and runs on an off-the-shelf model, gpt-5.4-nano, for all simulator roles. Its output is a per-task adversarial prompt and the transcripts in which the agent failed.

2. Why the method was developed

Conversational agents are mostly evaluated against LLM-simulated users, and assistant-trained LLMs make agreeable, low-diversity users, so the numbers we see before launch overstate what happens with real customers. Two earlier fixes exist. One fine-tunes a user model on human utterances, which lowers measured agent performance but ties the test to that training data. The other, from Shim and colleagues this year, hand-writes four non-collaborative behaviours such as emotional outbursts or dumping fragments of information. A fixed catalogue only covers behaviours its designers anticipated, and this paper shows that the behaviours that break one agent often do nothing to another, so a catalogue still returns an optimistic estimate. The harder problem is telling an agent failure from a simulator that quietly changed the task. Without a validity constraint an optimiser would win by making the user impossible rather than difficult. StressSim exists to search adaptively while holding that line.

3. Who should care

Anyone who ships or buys a customer-facing agent with side effects, meaning support, bookings, returns, exchanges and account changes, should read this. Quality and evaluation leads get a pre-release test that finds failure modes specific to the model we deploy rather than a generic checklist. Product owners who quote reliability figures should note that the damage appears in repeated-success rates, not in whether the agent can succeed once, which is what most vendor demos show. Procurement should treat a supplier's standard-simulator scores as an upper bound and ask for results under adversarial but valid users. Risk and compliance should read the transcripts: in one example the agent cancelled a valid restaurant reservation because a terse follow-up about trains was read as a change request. Platform engineering owns the cost: 20 rollouts per task plus judge calls, repeated at every model upgrade, since optimised strategies did not transfer across models.

4. How the method works

The simulator has three modules. A goal-state tracker decomposes the task into sub-goals and after each turn labels each one not attempted, in progress, completed, failed or user error. A planner reads that ledger, the dialogue so far and its instruction prompt, and emits a structured plan for the next turn: what to disclose, what to ask, tone, any deliberate user slip, and whether to stop. A generator turns the plan into one utterance and sees nothing else, so the planner carries all the strategy. The objective rewards lowering the agent's final success and its granular sub-task completions, both read deterministically from environment state, minus a penalty whenever the judges mark the trajectory invalid. A reflection LLM proposes initial prompts and then mutates the fittest parents using the failed sub-goals, validity failures and transcript snippets, over four generations with duplicates removed and elitist replacement. Prompts may describe tactics but may not contain task facts, so the search learns strategy, not answers.

5. How it was evaluated

The authors ran 50 tasks each from MultiWOZ and from the retail and airline domains of tau-bench, all with deterministic validators that read the final environment state. Target agents were gpt-5.4-nano, kimi-k2.6 and gemini-3.8-flash, queried at low reasoning effort, with gpt-5.6-sol added in a transfer study on retail. The simulator, judges and optimiser all used gpt-5.4-nano. Baselines were a standard user initialised with the goal and the four hand-designed non-collaborative users from Shim and colleagues. Each setting reports pass@4, the chance that at least one of four valid trials succeeds, and pass^4, the chance that all four do. Invalid conversations are discarded and retried, and Initial Goal Alignment records the share judged valid at first attempt. The optimiser ran four generations within 20 rollouts per task. Two human annotators labelled 100 sampled conversations against the judge's rubric, and the discovered strategies were clustered into a taxonomy.

6. How it performed

On tau-bench retail StressSim drove pass^4 to zero for gpt-5.4-nano and kimi-k2.6 and from 0.320 to 0.100 for gemini-3.8-flash, a 69 percent drop, below every hand-written baseline at equal or better validity. Optimising directly against gpt-5.6-sol took it from 0.296 to 0.112. On MultiWOZ pass^4 fell by 0.30 to 0.44 absolute with first-attempt validity of 0.94 to 1.00, and the one baseline that went lower did so by breaking validity. Pass@4 stayed far above pass^4 everywhere, so the gap is in repeatability, not one-shot ability. Prompts tuned on small models had no effect on gpt-5.6-sol, so each model needs its own search. The judge agreed well with humans on behaviour but was weak and conservative on goal coverage. The authors tested only low reasoning budgets and only tasks with deterministic rewards, and warn that judged rewards invite reward hacking. Our call: pilot it on one deployed agent before its next model upgrade. (Source: arXiv 2610.35426, 2026)