Web world models are increasingly used to predict the consequences of candidate actions before an agent acts, but a plausible predicted future may not contain the information needed to make a correct safety decision. That gap is the subject of a new arXiv preprint, "Beyond Plausible Prediction: Safety Sufficiency in Web World Models", which proposes evaluating predictive interfaces on whether they preserve and expose the policy-decisive evidence required for authorisation.
The authors report a matched human evaluation of 3,000 predictions drawn from ten frozen open models, in which 86.1% were judged semantically plausible. Plausibility did not translate into sound authorisation behaviour. Several models displayed highly asymmetric patterns, combining a low rate of false-safe execution with poor recall of clarifiable ASK cases and a strong preference for BLOCK. As an illustration, the preprint cites WebSynthesis-Qwen3-8B, which recorded a 0.08% false-safe execution rate alongside 0.00% Ask recall and 99.90% Block recall. Avoiding unsafe execution on its own therefore does not establish that a model correctly separates permitted, clarifiable and prohibited actions.
The paper frames this as safety sufficiency: whether a predictive interface preserves the policy-decisive information needed downstream. Its central failure mode is the "false-safe future", in which a plausible prediction omits such information and supports Execute when the applicable policy requires Ask or Block. The authors also stress the three-way distinction among Execute, Ask and Block, noting that collapsing Ask into Block is conservative under a binary metric but strips user agency, while collapsing Ask into Execute crosses an unresolved authorisation boundary. An intervention is credited only when its type matches the relevant policy condition.
To measure this, the team built SafeWebWorld, a benchmark spanning five web-safety domains through action-conditioned futures, policy-decisive evidence and policy-conditioned decisions. It covers prompt injection and task hijacking, transaction and permission abuse, malicious download and redirect, phishing and credential theft, and data exfiltration or unintended disclosure, alongside safe controls intended to prevent an always-block policy from appearing adequate. The benchmark contains 30,000 TRAIN, 1,000 DEV and 3,000 audited TEST examples, with the test split comprising 600 safe and 2,400 unsafe cases. Examples are assigned to source-scenario groups before splitting so that variants of a single scenario cannot cross splits. Primary metrics are balanced accuracy and Macro-F1, with False Safe, Safe Utility, authorisation balanced accuracy, Evidence Recall and ESL reported as diagnostics.
Under a controlled Security-Aligned Supervised Fine-Tuning protocol, the authors found that evidence preservation could improve substantially while authorisation-sensitive decisions deteriorated, a dissociation they call Authorisation-Policy Collapse. That result prompted a further question: whether the score structure underpinning authorisation had been lost, or whether it survived but failed to reach the emitted decision.
To separate these possibilities, the preprint introduces Latent Authorisation Recovery (LAR). Frozen-score recalibration revealed substantial but backbone-dependent recovery, with the extent of single-backbone recovery varying considerably by backbone, while paired recovery delivered only a modest additional gain over the strongest calibrated single-backbone readout. Even so, within-family and matched-authorisation evaluations remained poor, indicating that aggregate recoverability does not imply robust fine-grained authorisation behaviour. The authors conclude that plausible prediction, evidence preservation and aggregate recovery are each insufficient on their own to establish robust authorisation.
Sources: arXiv cs.AI.