Beyond Plausible Prediction: Safety Sufficiency in Web World Models

Introduction

Web world models are increasingly used to forecast the outcomes of potential actions before an agent executes them. While a predicted future may appear semantically plausible, this does not automatically ensure that the model provides the information needed for safe decision‑making. Hu, Cristea, Bibi, and Yu (2026) highlight this gap by evaluating ten frozen open models on 3,000 predictions, finding that 86.1% of the outputs are judged plausible yet many models display asymmetric authorization behavior—low false‑safe execution but poor recall of cases requiring clarification (ASK) and a bias toward blocking actions. This motivates the concept of safety sufficiency, which asks whether a predictive interface retains and exposes the policy‑decisive evidence required to distinguish between EXECUTE, ASK, and BLOCK outcomes.

SafeWebWorld: A Benchmark for Safety Sufficiency

To operationalize safety sufficiency, the authors introduce SafeWebWorld, a benchmark spanning five web‑safety domains. The benchmark evaluates models on three axes:

1. Action‑conditioned futures – generated predictions conditioned on a candidate action.
2. Policy‑decisive evidence – the extent to which the prediction contains information that a downstream policy can use to make a correct authorization decision.
3. Policy‑conditioned decisions – the final EXECUTE/ASK/BLOCK label derived from the evidence.

SafeWebWorld provides a structured way to measure not just the plausibility of predictions but their utility for safety‑critical reasoning.

Findings from Security‑Aligned Supervised Fine‑Tuning

The authors apply a controlled Security‑Aligned Supervised Fine‑Tuning (SASFT) protocol to improve evidence preservation. Results show a substantial increase in the amount of policy‑decisive evidence retained after fine‑tuning. However, this improvement comes at a cost: the models’ authorization‑sensitive decisions deteriorate, indicating a trade‑off between preserving evidence and making accurate decisions.

To probe the cause of this deterioration, the paper introduces Latent Authorisation Recovery (LAR), a two‑step analysis:

• Frozen‑score recalibration attempts to recover decision quality by adjusting the final readout without altering model weights. This yields notable recovery, though the magnitude varies across model backbones.
• Paired recovery adds a second, complementary readout step, offering only modest additional gains.

Crucially, even when aggregate recovery metrics look promising, within‑family and matched‑authorization evaluations remain poor. This suggests that overall recoverability does not guarantee robust fine‑grained authorization behavior.

Implications for Future Research

The study underscores three key takeaways for the AI safety community:

1. Plausibility ≠ Safety – A model can generate believable futures while omitting or distorting the evidence needed for safe policy decisions.
2. Evidence Preservation Is Necessary but Not Sufficient – Enhancing the amount of retained policy‑decisive information does not automatically translate to better authorization outcomes.
3. Recovery Techniques Must Be Evaluated Granularly – Aggregate metrics can mask persistent weaknesses in specific authorization scenarios; fine‑grained benchmarks like SafeWebWorld are essential.

Researchers developing web‑enabled agents should therefore incorporate safety‑sufficiency testing early in the pipeline, using benchmarks that explicitly measure evidence quality and decision fidelity.

Practical Takeaway

When deploying web world models, practitioners should:

• Run SafeWebWorld‑style evaluations to verify that predictions contain actionable safety evidence.
• Monitor both aggregate recovery scores and detailed authorization metrics after any fine‑tuning.
• Prioritize model architectures and readout strategies that maintain a stable relationship between evidence preservation and decision accuracy.

By focusing on safety sufficiency rather than mere plausibility, developers can build more trustworthy agents capable of navigating complex web environments without compromising security.