Reproducible Evaluation as the Substrate for Safe Prompt Compression in Production Agents

AI summary

Overview

Research area: Evaluation methodology and prompt optimization for production LLM agents — specifically, reproducible offline evaluation of conversational agents that read and write live enterprise data, combined with correctness-gated prompt compression.

Technical level: Intermediate. The paper uses formal notation for compound agent systems and assumes familiarity with prompt optimizers (GEPA, DSPy, APE), but its central argument is accessible to anyone who has tried to benchmark an agent against changing backend data.

Scope: A single production merchant-facing conversational agent at DoorDash, evaluated with a regenerable sandbox harness and compressed via GEPA across three subject-model families, with a held-out confirmatory set reporting the final numbers.

What This Paper Is About

Teams that ship conversational agents face a measurement problem: the ground truth moves. A sales question has a different correct answer every day, and a write action changes the state the next evaluation run would read, so naive session replay against a live backend produces results that cannot be compared across runs. The paper builds an offline evaluation harness that stays reproducible despite drifting production data (and can be regenerated on demand once it goes stale), then uses that harness as the fitness function for a prompt-compression method that is hard-gated against trading correctness for size.

Key Contributions

1. A reproducibility-matched sandbox. A harness that generates and scores benchmark data against live production state, assigning each tool a mutability class — settled, current, or write — and matching it to a mechanism: stage the clock for reads immutable once settled, freeze the observed payload for current-state-dependent reads, and seed-then-read-back for tools that write. Write tools are graded on the end state they leave behind, not on transcript text.
2. A regenerable generation pipeline. Datapoints are admitted only if a generator agent's tool-call trace executes end to end and the ground truth follows from it (the existence property), then pass human review for whether the task is well-posed and the answer matches the product spec rather than the generator's incidental phrasing (the sense property). Because generation is a repeatable pipeline over a state slice rather than a one-off authoring pass, a stale benchmark can be re-run in full — trace, human review, and all — to refresh it.
3. Correctness-gated prompt compression. GEPA optimizes one joint candidate spanning the base system prompt, all ten skill bodies, and all shared tool descriptions, under a lexicographic objective where token count only breaks exact Score ties. A hard critical-rule gate returns zero fitness for any rule-violating candidate, described as a prompt-optimization analogue of reward hacking.
4. A production validation across three model families. The harness is applied to a merchant-facing agent already in production, with seed and winner each scored on a 196-point held-out set as the mean of 5 rollouts per datapoint.

Main Findings

• Compression without regression: Across all three subject-model families, correctness-gated compression shrank the agent's full prompt surface by 3.5–7.6% without regressing held-out task correctness, measured on a 196-point confirmatory held-out set.

• Anthropic (claude-sonnet-4.6): 36,336 → 33,567 tokens, a 7.6% reduction, with a paired held-out difference of +0.118 (95% CI [+0.073, +0.164]) — the only family whose interval excludes zero, meaning the winner is both smaller and a statistically distinguishable improvement over its seed.

• Gemini (gemini-3.7-flash): 36,336 → 34,380 tokens, a 5.4% reduction, with Δ +0.016 (95% CI [−0.001, +0.035]) — smaller with no detectable change in quality, not a proven gain.

• OpenAI (gpt-5.6-sol): 36,336 → 35,077 tokens, a 3.5% reduction, with Δ +0.006 (95% CI [−0.007, +0.021]) — likewise smaller with no detectable quality change.

• Gain size depends on the model, not just the harness: The authors state explicitly that the benefit appears to depend on the model optimized rather than solely on the harness.

• A reward-hacking near-miss was caught after the fact: In Appendix B, an intermediate candidate's only edit was dropping a frozen store_id_handling block; its own no-harm check zeroed it, but a later candidate in the same lineage inherited the deletion and slipped through. The no-harm gate is computed per-iteration against whichever batch is sampled that round, and the text-coverage judge checks for the rule's text anywhere in the candidate — it found the same instruction duplicated elsewhere in the skill body and passed the candidate. Only a broader diagnostic pass checking the sales skill specifically surfaced the drop (0.90 → 0.00), motivating the deterministic critical-rule gate.

• Lossless rewording is what the harness rewards: Appendix C shows a financials skill excerpt where a two-bullet Overview collapses into one sentence and two redundant display rules ("NEVER output text lists" and "Never output markdown tables or plain text lists") merge into a single rule without dropping a distinct constraint.

Methodology in Plain English

The agent is treated as a compound system: a core module whose prompt is assembled from a base system prompt plus whichever skills are active on a given turn, with each skill pairing instruction text and a set of tools.

Making evaluation reproducible. Each benchmark datapoint carries the task, its ground truth, and a slice of production state. For each tool, the authors ask how the data it touches behaves: some reads are immutable once settled (stage the clock), some depend on current state (freeze the payload as observed), and some write (seed the state, then read it back to verify). This lets the same datapoint replay identically even though the underlying production data keeps moving. One caveat the authors flag: the mechanism only covers a datapoint's staged scope, and a call routed outside it hits live unstaged state and goes unflagged rather than being hard-gated to zero like a failed seed.

Generating test cases. A generator agent, given exactly what the core module sees on that turn, attempts a task, a tool-call trace, and an expected answer against a sampled state slice. A slot survives only if the trace executes end to end and the answer follows from it; otherwise it is discarded and resampled. A human then reviews each survivor for being well-posed and spec-conformant. Archetypes stratify generation across each skill's capability surface so the dataset does not collapse onto a few easy shapes.

Compressing the prompt. GEPA edits the whole textual surface jointly each iteration, because compressing any single component alone can only relocate duplicated text elsewhere. Fitness is the validation score minus a small token penalty (ε = 10⁻⁶), sized to break only exact ties, and exactly zero for any candidate that violates a mandatory rule. Mutation parents come from a hybrid Pareto frontier — candidates non-dominated on per-datapoint performance unioned with those non-dominated on aggregate objective scores — so search can explore trade-offs. The candidate actually reported is the one maximizing aggregate fitness on validation; the disjoint held-out set reports the honest result.

Experimental setup. 10 skills, seed 42, stratified by skill–archetype pair: 302 training datapoints, 99 validation, 196 held-out. A 36,336-token seed, rollout budget of 800, module selector set to edit all components in one reflection step, and an additional no-harm gate zeroing any candidate whose per-skill mean falls more than 0.02 below the seed's. Confidence intervals come from a 10,000-sample bootstrap.

Why This Matters

For research: The paper argues that prompt optimizers (APE, DSPy, GEPA) treat their evaluation signal as given rather than asking what makes it reproducible or fresh. It also distinguishes its staleness problem from prior work: static benchmarks like ToolLLM assume a frozen corpus, interactive benchmarks like AgentBench, WebArena, and τ-bench score end state inside simulated environments rather than live drifting production data, and Dynabench and LiveBench refresh against saturation and contamination rather than against referent data moving. That reframing — staleness caused by the data itself changing — is the paper's most transferable idea.

Real-world applications:

• Merchant- or seller-facing assistants that answer questions about revenue, payouts, refunds, and fees, where the correct answer changes daily and a stale benchmark silently misleads.
• Any agent with write tools, where grading the end state rather than the response text is the only meaningful correctness signal.
• Serving-cost and latency reduction: shorter prompts directly reduce inference latency and serving cost, so a few percent of prompt surface is worth optimizing even after correctness is met.
• Continuous evaluation infrastructure for teams whose benchmark decays as the entities it describes move on (a menu reprices, a payout settles).

Industry relevance: The setting is a production agent with a fixed product spec and tool contracts — required wording, forbidden wording, which tool answers which question — which is exactly where deployed teams start. The paper's framing that published GEPA use cases grow a minimal seed prompt while production agents start spec-complete, so optimization must compress rather than add, is a practical correction to how prompt optimization is usually pitched.

Future Directions

• Measuring decay. The authors state they have not yet measured how a compressed candidate's advantage decays as production drifts, despite the harness being designed to regenerate on demand. This is the most directly acknowledged open question.
• Explaining the model dependence. The gain ranges from 3.5% to 7.6% across families, and the authors conclude the benefit depends on the model optimized — what property of a subject model predicts a larger compression headroom is unresolved.
• Hardening the gates. The Appendix B near-miss shows batch-dependent no-harm checks and duplicate-blind text-coverage judges can both miss a deletion; the deterministic critical-rule gate is the proposed fix, and whether it fully closes the gap is a natural follow-up.
• Covering unstaged scope. A tool call routed outside a datapoint's staged scope reads live state and goes unflagged rather than failing loudly — a known hole in the reproducibility mechanism that a stricter sandbox could close.
• Statistics on the borderline families. Gemini's and OpenAI's intervals include zero; larger held-out sets or more rollouts would be needed to tell a genuine null from an underpowered measurement.

Target Audience

Engineers and applied researchers running conversational agents in production, particularly those whose agents read and write mutable enterprise data and who need evaluation results that hold still between runs. It is also relevant to teams using or evaluating prompt optimizers, who will find the spec-complete-start framing and the reward-hacking gate directly actionable, and to evaluation-infrastructure builders interested in benchmark staleness as distinct from contamination or saturation. Readers wanting a self-contained introduction to GEPA's mechanics should look elsewhere; this paper assumes that background and focuses on what makes the fitness signal trustworthy.

Authors’ abstract

Evaluating conversational agents that act on live, mutable enterprise data is hard: replayed sessions drift as backend state changes, and a benchmark built today can silently go stale as the data it describes moves on. We present an offline evaluation harness for a production conversational agent that stays reproducible despite the live data it operates on changing, and that can be regenerated on demand once it goes stale. We then use this harness as the fitness function for GEPA-based prompt optimization under a correctness gate that guards against reward hacking. Applied to a production merchant-facing agent, correctness-gated compression shrinks the agent's full prompt surface by 3.5-7.6% without regressing held-out task correctness, consistently across three independent subject-model families, and for one, correctness measurably improves.