Risk-Sensitive Agent Compositions
Authors: Guruprerana Shabadi
Rajeev Alur
Venue: ICLR 2026 Poster (2026)
Keywords: Agentic systems
agent composition
safety
risk-sensitive planning
planning
Primary area: probabilistic methods (Bayesian methods, variational inference, sampling, UQ, etc.)
TL;DR: We propose a framework and an efficient algorithm to find compositions of AI agents that minimize risk.

Abstract: From software development to robot control, modern agentic systems decompose complex objectives into a sequence of subtasks and choose a set of specialized AI agents to complete them.
We formalize agentic workflows as directed acyclic graphs, called agent graphs, where edges represent AI agents and paths correspond to feasible compositions of agents.
Real-world deployment requires selecting agent compositions that not only maximize task success but also minimize violations of safety, fairness, and privacy requirements which demands a careful analysis of the low-probability (tail) behaviors of compositions of agents.
In this work, we consider risk minimization over the set of feasible agent compositions and seek to minimize the value-at-risk and the conditional value-at-risk of the loss distribution of the agent composition where the loss quantifies violations of these requirements.
We introduce an efficient algorithm which traverses the agent graph and finds a near-optimal composition of agents.
It uses a dynamic programming approach to approximate the value-at-risk of agent compositions by exploiting a union bound.
Furthermore, we prove that the approximation is near-optimal asymptotically for a broad class of practical loss functions.
We also show how our algorithm can be used to approximate the conditional value-at-risk as a byproduct.
To evaluate our framework, we consider a suite of video game-like control benchmarks that require composing several agents trained with reinforcement learning and demonstrate our algorithm's effectiveness in approximating the value-at-risk and identifying the optimal agent composition.

Published as a conference paper at ICLR 2026
RISK-SENSITIVE AGENT COMPOSITIONS
Guruprerana Shabadi, Rajeev Alur University of Pennsylvania {shabadi, alur] wwwnn. edu
ABSTRACT
From software development to robot control, modern agentic systems decompose complex objectives into a sequence of subtasks and choose set of specialized AI agents to complete them. We formalize agentic workflows as directed acyclic graphs, called agent graphs, where edges represent Al agents and paths corre- spond to feasible compositions of agents. Real-world deployment requires select- ing agent compositions that not only maximize task success but also minimize violations of safety, fairness, and privacy requirements which demands careful analysis of the low-probability (tail) behaviors compositions of agents. In this work, consider risk minimization over the set of feasible agent compositions and seek to minimize the value-at-risk and the conditional aalue-at-risk of the loss distribution of the agent composition where the loss quantifies violations of these requirements. We introduce an efficient algorithm which traverses the agent graph and finds near-optimal composition of agents. uses dynamic programming approach to approximate the value-at-risk of agent compositions by exploiting a union bound. Furthermore, we prove that the approximation is near-optimal asymptotically for a broad class of practical loss functions. We also show how our algorithm can be used to approximate the conditional value-at-risk as byproduct. To evaluate our framework, we consider a suite of video game-like control bench- marks that require composing several agents trained with reinforcement learning and demonstrate our algorithm's 's effectiveness in approximating the value-at-risk. and identifying the optimal agent composition.
INTRODUCTION
Modern agentic workflows orchestrate specialized AI agents to tackle complex tasks demanding diverse range of skills. Typically, a high-level planning agent decomposes the main task into a se- quence of subtasks and selects appropriate worker agents to execute them. These worker agents can be powerful generalist models, such as large language models (LLMs) and vision-language models (VLMs), control policies trained with reinforcement learning imitation learning. Such sys- tems have demonstrated considerable success in automating tasks across various domains, including software development (Zhang et al.. [025a Niu al. 20255 Hu al. (025), complex information retrieval (Zhang et al. (025b). scientific discovery (Gridach et al. 2025). and robot control (Ichter
al. 2022 Feng et al. 2025 Yang al. 2024 Zhao al. 2025).
In addition to maximizing task success, deploying agentic systems in the real world requires mini- mizing various forms of risk. The stochastic nature of both environment and agents means that we have to rigorously analyze low low-probayility but high-consequence tail behaviors that emerge when multiple agents interact. Our work follows rich body of literature in risk-sensitive planning and control that dates back to the 1970s (Howard and Matheson 1972 Whittle 1981) where the objec- tive is to optimize risk measure of the loss (or reward) distribution as opposed to the expectation. A risk measure is function that maps a loss distribution to real number and takes into account attributes like the variance and the tail of the distribution. Some examples include the value-at-rist (VaR) which corresponds the tail quantile and conditional value-at at-risk (CVaR) which is the pected tail loss. In this work, we consider loss functions that quantify violations of requirements such safety, faimesss and privacy.
In our formalization, we represent an agentic workflow by an agent graph (example in Figure I which is directed acyclic graph in which edges correspond agents (denoted #1,-..g T4) and

---

Published as a conference paper at ICLR 2026
paths correspond to feasible agent compositions that achieve the overall objective. In Figure have two compositions of agents to pick from: PA == R1 - T3 and pa = T2 - πạ. Finally, the risk associated with agent's 's behavior is quantified with a real-valued loss function L, T; R that takes as input a trace of execution of the corresponding agent ni.
Example 1: DroneNav. Consider four control agents TI...., T that have been trained to navigate a drone between the rooms S " A, S 32, B, A _ F, and B _h F. We define loss functions I, T: -> R for each agent that capture safety requirements. They take as input the trajectory from a rollout of policy and return the negative minimum distance between the obstacles in the rooms and the trajectory. Now, consider the task of navigating a drone from room S to the tar- get room F which can be achieved by two paths: one passing through room A and another through room B. This can be rep- resented by the agent graph in Figure 1] where compositions of agents to choose from. The loss functions of the compositions of agents PA and pn correspond to the negative minimum distance between the obstacles and the sequence of trajectories of the agents in each composition. In particular, for the composition PA. the loss function is denoted I.pa : T T3 -> and is given by Lpa (11, tx) == max(L L1 (f1), (fa)) where l and 13 are trajectories from rollouts of Ti and T3 respectively. Lpn is symmetrically defined.
A
F
ma
L1
La
Lu
LA
B
Figure 1: An agent graph
have the two
Example 2: Information retrieval. Suppose we have access an LLM agent that we are using in an information retrieval and processing task. In this setting, a natural requirement is to minimize the amount of hallucinated information, i.e., data that not taken from data sources or the I.LM context. We define the loss function to be metric that quantifies the amount of hallucinated information in the outputs which can be a score produced by an LLM-as-a-Judee. Next, consider the task of constructing an agentic system that takes input the name of a country and produces graph of the evolution of literacy rates in the country over a period of five decades. Also, suppose we have two data sources UNESCO and the World Bank- from which the system needs to fetch relevant pages and then write a Python script to generate the plot. This can be represented by the agent graph in Figure 1 where क and 2 represent LLM agents tasked with retrieving relevant text data from the two sources, and π3 and Ty represent agents that write the script to produce the plot from the data. Yet again, the loss of the composition of agents is given by Lp (f))t)) == max (ax(Li(t)) Lt(t)) which now corresponds to the maximum amount of information hallucinated by either of the two agents I or æ3 in their corresponding outputs & and f3-
As noted in these examples, when the loss of each agent quantifies violations of safety, fairness, and privacy requirements, the loss of a composition of agents- the quantity we want minimize is the maximum of the losses incurred by each agent. In contrast, existing literature in risk-sensitive planning usually considers the cumulative loss (Ahmadi et al. [022]] Kretínský and Meggendorfer, 2018) which is the natural choice when the losses represent costs.
Given an agent graph, our objective is to find the path representing an agent composition that min- imizes the value-at-risk, denoted VaR., which is the (1 au--uantile of the loss distribution of the agent composition for a user-defined risk budget a > O. In other words, minimizing VaR, minimizes constant t > 0 such that with probability least 1 a, each agent in the chosen com- position of agents incurs a loss of at most L* We also consider another risk measure known as the conditional value-at-risk (also known as expected shortfall), denoted CVaR,,, which is defined as the expected loss in the worst a fraction of the loss distribution. In the rest of this work, we assume only black-box access to the agents and focus on estimating these risk measures through sampling.
A straightforward approach to minimizing the value-at-risk is to consider each feasible agent com- position, estimate its tail quantile, and pick the optimal composition. However, this method is ineffi- cient since the graph can have an exponential number of compositions as function of the number of agents. We overcome this hurdle with an efficient algorithm that scales polynomially in the number of agents and incrementally builds a near-optimal path while traversing the agent graph. At its heart quantile estimation method that approximates the value-at-risk dividing the risk budget amongst the agents and applying union bound. It then finds the optimal allocation of the risk budget over a discretized set of budgets using a dynamic programming algo- rithm. We prove that this approximation is near-optimal asymptotically when the losses of agents
composition of agents by
2

---

Published as a conference paper at ICLR 2026
given by independent random variables. This independence assumption holds when the losses are functions of the agent behavior and do not directly impact task accuracy or performance. Indeed, safety, fairness, and privacy are often properties of the behavior and are orthogonal to task success. Further, since the conditional value-at-risk can he approximated as the average of tail quantiles, we show how it can be recovered byproduct of our algorithm.
We implement our algorithm and test its performance on a series of reinforcement learning (RL) en- vironments. Here, we look at long-horizon tasks that require composing several agents trained with RL to complete them. We consider two tasks-safety in navigation and fair resource consumption- and design suitable loss functions that capture these requirements. We confirm empirically that our algorithm produces tight approximations of the alue-at-risk and the conditional value-at-riss, thereby finding optimal agent compositions. Further experiments show that our algorithm robust to reasonable amount of correlation between agent losses.
In summary, our contributions consist of the following:
1. We formalize the risk minimization objective for agentic workflows as the problem of find- ing an agent composition that minimizes the value-at-risk of the loss quantifying violations of safety, fairness, and privacy requirements (Section 2).
2. Then, we introduce an efficient algorithm that approximates this optimization problem with a quantile estimation method using the union bound and dynamic programming. Further- more, we prove that this approximation is near-optimal asymptotically under independence assumptions. (Section 3)
3. Finally, we evaluate our algorithm on compositional reinforcement learning benchmarks using two tasks: safety-critical navigation and fair resource consumption. We design ap- propriate loss functions for these tasks and demonstrate that our algorithm successfully identifies optimal agent compositions while providing tight approximations of their risk measures (Section 4).
1.1 RELATED WORK
Our work builds upon a large body of literature on automated planning and control under uncer- tainty (Ghallab et al., 2016). Traditionally, the planning problem modeled as a Markov decision process (MDP) over which the expected (un)discounted cumulative loss is minimized using algo- rithms like value iteration or reinforcement learning. Towards designing risk-aware agents, recent works have instead considered the optimization of risk measures that look at the tail of the loss distri- bution instead of the expected loss. [Ahmadi et al. (202T): ): Kretínský and Meggendorfery (2018) study risk minimization for reachability and mean-payof objectives in MDPs, while Bastani et al. (2022); Wang et al. (2023); Greenberg et al. (2022); Choi et al. (202T) develop risk-sensitive reinforcement learning algorithms. These works consider risk measures that fall into the class of coherent risk mea- sures (Artzner et al.] 1999) that include the conditional value-at-risk and the entropic value-at-risk. Risk-sensirive objectives have also been considered in the stochastic control literature. Methods for risk-sensitive linear, quadratic, and Gaussian control (Whittle) 1981) have been developed along with more recent methods for non-linear model predictive control (Nishimura et al. 2020).. We also refer to Wang and Chapman (202)) for a comprehensive survey of this topic. However, all of these works stand contrast with our framework where we want minimize risk measure of the maximum incurred loss instead of the cumulative loss.
Related lines of research in robotics include hierarchical reinforcement learning (Jothimurugan et al., 2021 Dalal et al., 2024]] Zhou et al. 2024 Huang et al.) 2023 Lin et al.) 2024) and task and mo- tion planning (TAMP) (Kaelbling and Lozano-Pérez, PéTe in which long-horizen control objectives are decomposed into subtasks that are carried out by motion planners or other low-level controllers trained with RL or imitation learning. Similar frameworks have been proposed for automatic gener- ation of agentic workflows to automate software development tasks (Niu et al., 2025 Zhang et al.) 2025a Hu et al. 2025) that sequence LLM-agents to complete smaller subtasks. Agentic systems have also been proposed for the tasks of complex information retrieval (Zhang et al. (025b) and sci-
entific discovery (Gridach et al.) 2025). These methods typically optimize the overall task success probability and do not consider risk minimization.
3

---

Published as a conference paper at ICLR 2026
2 RISK MINIMIZATION OVER AGENT GRAPHS
In this work, an agent is any machine learning model f X D(T x Y) where X is the input domain, T is the set of computational traces capturing the set of agent behaviors, Y is the output domain, and (T x Y) is the set of probability distributions over T x Y. For example, for an agent controlling robot, X is the set of initial states, 7 is the set of trajectories of the robot in its environment, and Y is the set of final states. In the case of a language model, X is the set of prompts. Y is the set of final responses, and T is the set of intermediate tokens used to produce the final response. This can be the Thain-of-Thought reasoning traces, or interactions with tool like retrieval from the web or running code. We consider distribution over traces and outputs, as opposed to single output, to enable modeling stochastic agent behaviors along with interactions with a stochastic environment. We only assume sampling access to the distribution over outputs and denote (t, v) ~ fz) for sampling a trace-output pair (t. y) from the agent f for the input
We quantify the risk associated with an agent's 's trace by a loss function L T allows decouple risk, which depends the agent's overall behavior, from task accuracy, which only depends on the final output. Thus, the loss function can encode desiderata the agent's s behavior like safety, privacy, and fairness. For example, in the DroneNav environment from Example 1 the loss function quantifies how safe a control policy is on a trajectory of the drone.
- R. This formulation
Observe that given distribution over the inputs D(X), the agent f induces distributions Dy (T) and D2(Y) over the set of traces and outputs respectively. We can sample t ~ (T) or y (Y by first sampling x D(X), then sampling (4, f(x), and dropping one of the two components. Evaluating the loss on the distribution of traces gives us a distribution over the losses the agent incurs. Since we are concerned with risk minimization, we focus on analyzing tail behaviors of the loss distribution. In particular, we are interested in optimizing the following risk measures: the value-at-risk at level a E (0, 1), denoted VaR,, and the conditional value-at-risk. denoted CVaR.- VaR,, corresponds to the (1 - a:) -quantile of the distribution. In other words, a (1 a) fraction of the traces will have a loss smaller than the VaR,- To formally define it, let Z DT(() be random variable over the traces of the agent f. Then we can express
(L == (ouatile(L(Zz))) 1 a) inf {g E R. Pr[[(Z]) S 9) 1 a}. (1)
On the other hand, CVaR a coherent risk measure Artzner et al. 1999). is more sensitive to the tail loss distribution and is defined as the expected tail loss:
CVaRa|L(Zg)] 1 ( VaR, [a = =EIL())))))EE) (((g) > VaR.|4(Z,]II
(2)
We now shift our attention to compositions of agents. Agents can be composed sequentially to complete long-horizon objectives. composition of agents sequentially transforms inputs in which the output of one agent becomes the input for the next agent. Given long-horizon objective, model all feasible agent compositions that achieve the objective as a directed acyclic graph called an agent graph.
Definition (Agent graph). An agent graph G is a tuple components:
with the following
1. A set of vertices V and edges E SV x V that form directed acyclic graph.
2. X associates domain X,, to each vertex V.
3. To each edge = =(,,v) E E, T associates a trace set Te, F associates an agent fe X, + DTe x X.), and associates a loss function Le Te - R.
4. 8 E V denotes the source vertex and 'D is the initial imput distribution over the domain X,,
5. t V denotes the terminal vertex and X, represents the output domain of the long-horizon objective.
Consider an agent graph G. Let P C V be the set of directed paths from to Consider p vi رt em, Un+11 with v) and Um+1 I,, and 61, .1,--., Cm the directed edges along the path.
4

---

Published as a conference paper at ICLR 2026
Algorithm Bucketed Efficient algorithm for the the|RMAG VaR objective
Require: G EX, s, Dz): agent graph; d E Nyo: number of buckets; sample
size; risk budget a E (0,1)
...... 20....7..... 2: VaR (V B - IR) <- init empty map
1: B {0,
7 2
Set risk level buckets b Map to store VaR estimates D Map store best partial paths
best-paths (V x B - V*) init empty map
4: best.samples: (V x B (X,)*) + init empty map
5:
D Map store samples along best partial path
6:
[0
Base case: no risk at source
7: best.samplesjss + [.,,...,, In,
,,,, where I , Ds
b -Draw input samples
8: O + topological ordering on V excluding
9: for vertex v in the order O and
B do
10: pred predecessor vertices of
11:
> All predecessors have been processed due to topological order
12:
VaRlu,a)
13:
for v' Eped and E Bea do { (-lo,, + ((vv')
Bsa = {g B 5
15:
(z1,..., best besttsssspppl saeesssammlesss".c'
16:
+ ((1,,)) ~ ((t)......
(In, ~ [(xa))
17:
Sample trace-ouipul pairs along edge
18:
losses + (L(tt) (Ltt)).... L(t,)
edgeVaR quantil(Losses,
Empirical (1 (ā a') -quantil
20:
pathVaR + max(VaR[u', a'], edgeVaR)
> VaR along the path
if pathVaR < VaR(e, then
22:
VaR[u, + pathVaR
bo Update best estimate
23:
paths(c', best_samplespp < (.,,...,,,
best.
+-
24:
25: end
26: end for
27:
end for
28:
return VaRjt, a), best pathsst.
Path with minimum VaR estimate
Equipped with the initial input distribution D., the sequence of agents (Sey: .... Sem induces a joint distribution ((To, x...X. xT...) which we denote D,- We can sample (41, (m) DD by sampling Ij X., followed by (t1, x2) ~ fer (x1), (t2,zz) fez (Z2). until (tm, xm+11 fe. (Im). We
refer to a sample from Dp as a sequence of traces and define the random variable Zp ~ Dp.
We also define composed loss function along the path Lp Tep ... X Tem - IR as I.p(tI....,hm)) hm) = max (Te, (44)
(3)
which is the maximum of losses incurred by the sequence of trajectories (4,,...,bm)) bm).
We now have all the ingredients to state our risk minimization objective over agent graph RMAG).
Objective (RMAG). Let G = (V,E,X,T,F,L, 8,,, D.) be an agent graph and let P C V* be the of directed paths from L. For given risk level (0,1) and risk measure p [VaR,, CVaR,) we define the risk minimization objective as the following optimization problem
arg min (Z,)) pEP
Rephrasing in words, the optimization objective corresponds to finding path from to t in the agent graph that minimizes the risk measure of the maximum the losses incurred by the agents along the path.
3 FINDING THE PATH MINIMIZING RISK
We first consider the RMAG objective with the VaR risk measure and then show we can recover the CVaR through procedure. simple procedure find the optimal path is to estimate the
5

---

Published as a conference paper at ICLR 2026
VaR,, along each path and pick the path that minimizes it. We can estimate the VaR., by computing the empirical (1 - aaaa)-gpp qquantile on samples drawn from the loss along a path Lp(Z)). While this is asymptotically optimal, it can be inefficient when the graph has an exponential number of paths as function of the number of vertices.
To circumvent this, we present an efficient algorithm that only scales polynomially in the number of vertices in the agent graph and is also asymptotically near-optimal under certain assumptions. Bucketed Vakk is dynamic programming algorithm that processes the vertices in the agent graph in the topological order and incrementally builds a near-optimal path.
To understand how it works, we first present how we can estimate the value-at-risk of the loss distribution of a single path incrementally. To this end, consider a path an agent graph p = 01 St
Cm, Um++1 with U1 being the source vertex and Um++1 the target vertex. Let (Zi..... Zm) ~ D(T., x... Tem) be sequence of random variables representing the sequences of traces of the agents along the path. Then define RI,..., Rm to be real-valued random variables representing the losses incurred by the agents along each edge. Formally, Lem. (Zm). If Lp is the composed loss function along the path as defined in Equation (3) we can rewrite Lp( (Z) as max(RI,..... Rm). A key observation that enables the incremental estimation of VaR,I<p(2 (Z)] (or equivalently, the (1 - a )--quantile of Lp(Z)) is that we can estimate VaR., [R of each loss variable individually with a; chosen such that Σ a = a. Following this, we can apply
write R₁ Lee (Z,) )........ Rm =
the union bound to obtain
VaR.:Lp(Z2)) VaR. [ma,. Rm)) s max Vaaa,, [R.]].
This bound is justified in the proof of Theorem This method allows us to estimate the value-at-risk of each edge loss variable independently and then combine the estimates at the end by computing their maximum. However, we need to optimize the allocation of the risk budgets a; along each edge. Intuitively, allocating higher risk budget to higher edge losses would result in lower value-at-risk for that edge since it would correspond to a lower quantile.
Bucketed Vak optimizes this by searching for risk budget allocations in discretized set of buckets B {0, 9, 2g..... a} for a given discretization factor d E N At each vertex v and corre- sponding each bucket E B, the algorithm inductively builds an optimal path that minimizes the upper bound on the valuc-at-risk along the partial path at risk budget of a. It achieves this by considering each predecessor v' of u and each allocation of budget a' S ā until v', for which we have inductively constructed the optimal path, and then estimates the value-at-rishe by allocating budget of a' the loss along the edge v' -> u. The optimal path for (v, â)) is then obtained by extending the optimal path to (v', aa) that minimizes the value-at-risk estimate. A detailed proof of soundness and run-time analysis of the algorithm can be found in the proof of Theorem I
Theorem 1. Consider G (V, T, F, s,t,t, an agent graph, d N>o the number of buckets, n E Nso the sample size, and a E (0, 1) the risk budget. Then, let q E IR and p E V be the value-at- at-r estimate and path returned by BucketedVaR G, d, n, a). Then, for all 5 (0, 1), with probability at least 1 5,
1 2n
2(d 1)
q (u,ntile(L,
7), with 7 = -V]
In
(6)
Furthermore, the time complexity of BucketedVaR G, d, n, a)) is O(n(d + 1)?(v(?) assuming that sampling from agents' output distributions and the initial distribution D, incur constant costs.
Proof sketch. Observe that since y + 0 as n + co, the theorem tells us that the estimated value- at-risk q is at least as large as the true value-at-risk of the loss distribution of the path p, which corresponds to quantile (p (Zp). 1 1---a a). We can show this using union bound argument for the budget allocations found by the algorithm along with the fact that the empirical CDF converges
uniformly to the true CDF by the DKW inequality (Dvoretzky et al. 1956 Massart 1990). The
time complexity easily deduced by looking at the pseudocode of Bucketed VaR See Appendix B for the complete proof.
Theorem I only justifies the validity of the union bounding method for estimating the value-at-risk but we have not discussed the optimality of BucketedVaR) Here, we can only hope to achieve tight

---

Published as a conference paper at ICLR 2026
estimates of the value-at-risk when the loss variables along every path are independent are only loosely correlated. Under these independence assumptions, Theorem tells us that asymptotically, the quantile estimated by the BBucketedVaR. algorithm alggaorrhh is at most the [1 + a² + /2)-mnultelle of the losses along the optimal path. other words, the path found by our algorithm is suboptimal by an additive factor of a² /2 with respect the quantiles of the optimal path loss.
Theorem 2. Let G,d, f,d,n, n, and a be defined as in Theorem 1, Further, assume that the losses along given by independent real-valued random variables Re for each e E E' such that for all directed paths p, we can write Zp = (Reys..., Re,. Now, let (q. p) = Bucketed VackkttedaRR(C G, d, n. oi) and let p¹ be the path optimizing the RMAG objective. Then, for all
each edge of the agent graph
0 E (0, 1), with probability at least 1
222 2
a²
S quantile n,
Lo. ( -
Proof sketch. This again a consequence of the uniform convergence of the empirical CDF along with the fact that the independence of the loss variables allows us to deduce an upper bound. See Ap pendix B for the complete proof.
Equipped with Bueckttee algorithm to approximate VaR., over the agent graph, we show how we can also approximate the conditional value-at-risk CVaR,,, using the quantities computed by the
algorithm. From the expression for CVaR, in Eqqation (2), the integral as
it is easy see that approximate
CVaR,14,(2)] = Σ VaR yaRxy1Lp(2)] [Z]] k=1
(8)
But notice that the VaR algorithm has already optimized values of VaR [L,(Z) over the agent graph for 1 - t &. d and so suffices to take the average of these values. Finally, we observe that increasing the sample size and the number of buckets also improves the approximation of CVaR..
EXPERIMENTAL EVALUATION
4.1 BENCHMARKS
We implement the BBckketd algorithm for risk minimization and evaluate its performance on a suite of discrete and continuous control benchmarks that require composing agents trained with reinforcement learning (RL) to complete long-horizon objectives. In all the benchmarks that we consider, the agent graphs G = (V, E, X, F, L, s, t, D.) share the following structure: the do- main associated with each vertex X, is the state space of the control environment Σ and the agents along each edge are control policies Te : Σ + D(E* x Σ) that take an initial state and produce a distribution over trajectories and final states. These final states then become the initial states for the next policy. Lastly, D, represents the distribution over the initial states of the environment.
In the first set of benchmarks, the objective is to maximize safety during navigation and manipula- tion. We adapt the 16-Rooms and Fetch environments from Jothimurugan et al. (202T) in which the long-horizon objective is specified avoid subtask: reaching a target region while avoiding a set of dangerous states. To adapt this into an agent graph, we define loss functions for each edge subtask as the negative of the cumulative reward function which captures the reach-avoid specification. Additionally, we adapt the 16-Rooms environment to implement a version of the drone navigation task from |Example I] Secondly, we implement the BoxRelay benchmark using the Miniworld (Chevalier-Boisse
task graph. In task graph, each edge represents reach-
et al.) 2023) frame- work in which we seek to minimize resource consumption. The objective is move the player around while picking up boxes and dropping them at different locations. We add the constraint that the player has limited battery power but gets recharged each time a box is dropped off at a target. Importantly, since the initial positions of the player, the boxes, and the final target are all stochastic, this is a non-trivial optimization problem. To model the BoxRelay task as an agent graph, we define loss functions that evaluate to the number of time steps that box is carried before being put back down and thus quantifies resource consumption. Complete benchmark descriptions are included in Appendix C
7

---

Published as a conference paper at ICLR 2026
214
Dronehavv 16Rooms
Cloi coverege www.ee---fffeereee (%9
2.0
16-Rooms BoxRelay
Quaratte difference (15)
Fetch
BoxReley
Mouselav
1.-
2.0
106
0.0 0.2
0.1
c.55
0.0
0.2
0.2
0.03
Levels
Levels
Figure 2: (a) Absolute quantile difference in percentage between the quantile computed by the Buck- cted VaR algorithm and the desired quantile. (b) Absolute quantile difference in percentage between the approximate CVaR, and that estimated by the baseline. The empirical quantiles are computed on fresh set of 10* samples.
0.39
BoxRtaay
Tetch
16 Rooms
Empiiiaal quantle ceveraye
6:07
Daseline
Bucketadiaa
Desired Coverage
Des red coverage
Emprnce quartle
2:00
Empetica
0.92
0.00
16
Beaftely ey
0.90
red coverage
330
1390
5009
1503
10000
6D
60
100
Number of agents
(c) Varying number of agents in
(a) Varying sample size
(b) Varying number buckets
path
Figure 3: Empirical quantiles of the VaRg.1 estimates computed by Bucketed with varying parameters. 95% Clopper-Pearson CIs for the empirical quantiles computed on 10 samples also plotted.
4.2 EXPERIMENTAL RESULTS
Equipped with these benchmark environments, we conduct three sets of experiments to evaluate the effectiveness of the approximation obtained from the Bucketed algorithm. We measure the accuracy of the approximation by estimating the empirical quantile on 10 fresh samples of losses along the optimal path. Specifically, if c E IR is the approximate VaR,, returned by the [Buckttdd]] draw samples of losses along the optimal path and compute the fraction of these which are below e giving us the empirical quantile of e. We say that the approximation is tight if the We also use empirical quantiles compare
VaR algorrih,
empirical quantile close to the desired quantile approximations of CVaR..
Comparison with optimal baseline algorithm. We define baseline algorithm that explicitly esimates VaR, and CVaR, at the desired risk level a along each path of the agent graph. While this algorithm is asymptotically optimal, is inefficient section. The number of samples for both algorithms is set to 10 and the number of buckets is chosen based on the number of agents allow sufficient granularity in the allocation of the risk budget. For example, in the 16-Rooms benchmark since there are 8 agents along each path, we choose higher number of buckets.
Experiment 1:
discussed in the previous
We find that Bucketed Vak succeeds in finding the same optimal path the baseline algorithm across all the benchmarks along with tight estimates of both VaR,, and CVaR,, Figure 2 shows the absolute difference in percentage points of the quantile estimates obtained by the Bucketed algorithm and the baseline quantiles. We remark that the difference never more than a couple percentage points across all benchmarks and risk levels. It also finds non-trivial allocations of the risk budget for the agents: in the 16-Rooms benchmark, the budget allocations for the 8 agents along the path to estimate VaR.,1 16 0o, 10G, 23x. 19ā, 11 7ū, and 14 for 0.1/100.
8

---

Published as a conference paper at ICLR 2026
4.-
edges
cdges
0.08
14 edges
14 edges
29 adges
coverage
2.5
Empliicll
0.50
3.6
0.00
0.0
0.0
Correlation
Correistion lovel
Figure 4: (a) Empirical VaRg.1 coverage produced by Bucketed algorithm with respect in- creasing correlation and path length. (b) Absolute coverage error (in percent) between CVaRo.1 estimate produced by [BucketedVaR] and the baseline estimate. This is also plotted against increas- ing correlation and path length.
Experiment 2: Increasing sample size and number buckets. Increasing the sample size im- proves the approximation because we have more accurate quantile estimates and similarly higher number of buckets results more granular risk budget allocations. This is confirmed by the two experiments we in the first one, plotted in Figure 3al maintain the number of buckets at 100 and vary the number of samples from 500 to 10 with a = 0.1. The empirical quantile quickly stabilizes around 0.91 across benchmarks. The second experiment maintains the sample size 10a and varies the number of buckets from 5 to 100 with a = 0.1. Figure 3blagain shows a similar trend. We note that for the 16-Rooms benehmark, low number of buckets gives bad VaR estimates since the number of agents along each path is higher.
Experiment 3: Scaling number of agents. From our theoretical result, expect Bucketed to continue producing tight estimations of the VaR when we increase the number of agents along the path, provided that the condition on the independence of losses holds and the sample size is large enough. We test this hypothesis by simulating long path of agents using the 16-Rooms benchmark. We consider the optimal path in this benchmark which has a sequence of agents and construct new agent graph with 8k agents for k {1, 2, 5). We can sample a sequence of trajectories from this path by taking & trajectories of the original 8 agents. The losses are then computed us- ing the original loss functions. Since these are independently drawn trajectories, the assumption of independence holds. We estimate the VaR,, of this path agents using [BukkttddaR for 104 samples, 0.1, and 100 buckets. The results plotted in |Figure 3c in which we observe that the approximation continues to remain tight with an increasing number of agents.
Experiment 4: Robustness to correlated losses. To test the quality of the union bound approxima- tions made by the Bucketed algorithm when losses are not independent, we setup an artificial agent graph which consists of a path of varying length along with loss functions that sample from correlated Gaussian distributions (complete description in Appendix C.3). This allows us to study the tightness of the approximation with increasing correlation (p) and path length. The results plotted in FFigure 4 While the approximation breaks down when we have complete correlation
(p 1), it is interesting note that the algorithm continues produce reasonable approximations upto correlation level of 0.5.
LIMITATIONS
A limitation of our algorithm is that we require the losses of agents to be independent to obtain the theoretical guarantee regarding the tightness of the value-at-risk estimates. Empirically, however, we observe that it continues to produce tight estimates even without any formal independence guar- antees which indicates that we may be able to relax this assumption. Regardless, we emphasize that this independence assumption holds when the losses are metrics of the agent behavior rather than task performance which the case in all our benchmarks and examples. Another limitation that may not always have well defined loss functions like in the of LLM agent and we may have to rely on L.MM-as-a-judge methods or human annotations which may expensive and noisy. Lastly, the sample complexity of method can be high to obtain accurate risk measure estimates.

---

Published as a conference paper at ICLR 2026
However, if our only objective is to find the optimal path without computing risk measures, then online optimization using a multi-armed bandits style approach could be explored.
CONCLUSION AND FUTURE DIRECTIONS
In summary, we introduced framework for choosing optimal agent compositions to minimize the value-at-risk of losses that encode violations of safety, faimesss and privacy requirements. Our dynamic programming approach efficiently allocates the risk budget across agents, supporting tight approximations. Empirical results compositional RL benchmarks confirm its effectiveness in identifying optimal paths and quantifying tail behaviors, paving the way for more reliable agentic workflows.
A direction for the future is to incorporate the Vac algorithm in existing agentic frame- works. It is also possible to speed up the algorithm through GPU implementation since the com- putation of the intermediate VaR estimates highly parallelizable While we present an efficient algorithm minimize the value-at-risk in agent graphs, it is also an interesting future direction to extend our work to the estimation of other popular risk measures that are included in the class of coherent risk measures (Artzner al.. 1999). Yet another interesting direction to explore whether we can develop online multi- aamiid bandit style algorithms to minimize risk. Such an algorithm would have to pick a composition of agents at each turn and minimize long-term regret with respect to the optimal composition. This can reduce sample complexity by directly converging towards the optimal composition circumventing the risk measure computation. Recent works risk-aware ban- dits (Tan et al. 20222 and combinatorial bandits (Ayyagari and Dukkipati 2021 seem to indicate that this is feasible.
7 REPRODUCIBILITY STATEMENT
The source code along with detailed instructions to reproduce results and plots have been included in the supplementary materials. Further benchmark and experimental details are also included in AAp pendix C
ACKNOWLEDGEMENTS
This research was partially supported by the NSF Award SLES 2331783.
REFERENCES
Mohamadreza Ahmadi, Anushri Dixit, Joel W. Burdick, and Aaron D. Ames. Risk-averse stochastic shortest path planning. In 202/ 60th IEEE Conference on Decision and Control (CDC). Austin, TX, USA, December 14-17, 2021, pages 5199-5204. IEEE, 2021. doi: (0.100//DC4444420021. 9683527. URL wttphttt:/// wtw.doooo.ooo....oooo.oooooo.o..
2021. 9683527
Philippe Artzner, Freddy Delbaen, Jean-Mare Eber, and David Heath. Coherent measures of risk.
Mathematical Finance, 93))203--228 1999. doi: http:://0oo.ooo///..111111677000
URL
httpp::/cnnimellibrrre
wwwey. http:///..........111////96906.3
Shaarad Ayyagari and Ambedkar Dukkipati. Risk-aware algorithms for combinatorial semi-bandits.
arXiv preprini arXiv:21 2021.
Osbert Bastani, Yecheng Jason Ma, Estelle Shen, and Wanqiao Xu. Regret bounds for risk-sensitive reinforcement learning. In Sanmi Koyejo, S. Mohamed, A. Agar- Cho, and A. Oh, editors, Advances in Neural Informa- tion Processing Systems 35: Annual Conference
wal, Danielle Belgrave,
Neural Information Processing Sys- tems 2022, NeurIPS 2022, New Orleans, LA, USA. November 28 December 9, 2022, 2022. URL http:// http::/papers.eee.// www.::iinssssccc....e wtw.ffffffff--bstraccaa wwwaacctttoooofooeeeeeeee ort.aa/ee......aaaaa.aa.aa.aaaoe html]
8b489936222944885575 2
Maxime Boisveic Bolun Dai, Mark Towers, Rodrigo de Lazcano, Lucas Willems, Salem Lahlou, Suman Pal, Pablo Samuel Castro, and Jordan Terry. Minigrid & miniworld:
10

---

Published as a conference paper at ICLR 2026
Modular & customizable reinforcement learning environments for goal-oriented tasks. CoRR, 10W/2306611831,, 2023.
Jinyoung Choi, Christopher Dance, Jung-Eun Eun Kim, Seulbin Hwang, and Kyung- Park. Risk- conditioned distributional soft actor-critic for risk-sensitive navigation. In 2021 IEEE Interna- lional Conference on Robotics and Automation (ICRA), pages 8337-8344. IEEE, 2021.
Murtaza Dalal, Tarun Chiruvolu, Devendra Singh Chaplot, and Ruslan Salakhutdinov. Plan-seq- learn: Language model guided RL for solving long horizon robotics tasks. In The Twelfth Inter- national Conference Learning Representations, ICLR 2024, Vienna, Austria, May 7-11, 2024. OpenReview.net, 2024.
A. Dvoretzky, J. Kiefer, and J. Wolfowitz. Asymptotic Minimax Character of the Sample Distri- bution Function and of the Classical Multinomial Estimator. The Annals of Mathematicall Statis- fics, 27(3):642 669, 1956. doi: 10.121 4/020///1//777777774
htllhttts: /ww.////////// org/10.
1217/amm/117772111
Yunhai Feng, Jiaming Han, Zhuoran Yang. Xiangyu Yue, Sergey Levine, and Jianlan Luo. Reflective planning: Vision-language models for multi-stage long-horizon robotic manipulation, 2025. URL
https: wwtpxxv.oog//aee htwpg//bs//55000 16700.60.77777
Scott Fujimoto, Herke van Hoof, and David Meger. Addressing function approximation error in actor-critic methods. In Jennifer G. Dy and Andreas Krause, editors, Proceedings of the 35th In- ternational Conference on Machine Learning, ICML 2018, Stockholmsmüssann Stockholm, Swe- den, July 10-15, 2018, volume 80 of Proceedings of Machine Learning Research, pages 1582- ngs mlr wwwpppessssss.ee fuj imotol Ba.
1591. PMLR, 2018. URL
html
Malik Ghallab, Dana Nau, and Paolo Traverso.
Automated Planning and Act- ing. Cambridge University Press, 2016. ISBN 978-1-107-03727-4, URL http:
artific htt.///wwwwa.n........///./aaaaa
7/www.
aut out.amtteeplaamnniggnnneccccaacd
Ido Greenberg, Yinlam Chow, Mohammad Ghavamzadeh, and Shie Mannor. Effi cient risk-averse reinforcement learning. In Sanmi Koyejo, Mohamed, A. Agar- wal, Danielle Belgrave, K. Cho, and A. Oh, editors, Advances in Neural Informa- tion Processing Systems 35: Annual Conference on Neural Information Processing Sys- tems 2022, NeurlPS 2022, New Orleans, LA, USA. November 28 December 9, 2022, 2022. URL http:://appeeeeeeeeeeeeeepp ccpppp/ppppppppppppppppppp.p waceeer__ileeeeee www.s/fewteeeeeeeeeeeeeeaaaaeeet htte:///...le///ppp//////////
2211 http::/aaaecaaaaaaaaaaaat---reee htmml
Mourad Gridach, Jay Nanavati, Christina Mack, Khaldoun Zine El Abidine, and Lenon Mendes. Agentic AI for scientific discovery: A survey of progress, challenges, and future directions. In Towards Agentic AI for Science: Hypothesis Generation, Comprehension, Quantification, and Validation, 2025. URL http::::/pppeeeviieeeeee
net htte:/oorunidddyyycice
Ronald A Howard and James E Matheson. Risk-sensitive markov decision processes. Management science, 18(7):356-366 1972.
Yaojie Hu, Qiang Zhou, Qihong Chen, Xiaopeng Li, Linbo Liu, Dejiao Zhang, Amit Kachroo, Talha Oz, and Omer Tripp. Qualityflow: An agentic workflow for program synthesis controlled by LLM quality checks. CoRR, abs/2501. 17167, 2025. doi: 10:4550/ARXV.25001.11
URI.
https://ddp .ww.oo.orrg//oo .org/10...... 48550/ arxiv. 2501 17167
Tao Huang, Kai Chen, Wang Wei, Jianan Li, Yonghao Long, and Qi Dou. Value-informed skill chaining for policy learning of long-horizon tasks with surgical robot. In 2023 JEEE/RSJ In- ternational Conference on Intelligent Robots and Systems (IROS), pages 8495-8501, 2023. doi: 10. N0.11099/RROS55552.22222 10342180.
Brian Ichter, Anthony Brohan, Yevgen Chebotar, Chelsea Finn, Karol Hausman, Alexander Her- 7og, Daniel Ho, Julian Ibarz, Alex Irpan, Eric Jang, Ryan Julian, Dmitry Kalashnikov, Sergey
11

---

Published as a conference paper at ICLR 2026
Levine, Yao Lu, Carolina Parada, Kanishka Rao, Pierre Sermanet, Alexander Toshev, Vincent Vanhoucke, Fei Xia, Ted Xiao, Peng Xu, Mengyuan Yan, Noah Brown, Michael Ahn, Omar Cortes, Nicolas Sievers, Clayton Tan, Sichun Xu, Diego Reyes, Jarek Rettinghouse, Jomell Quiambao, Peter Pastor, Linda Luu, Kuang-Huei Lee, Yuheng Kuang, Sally Jesmonth, Nikhil J. Joshi, Kyle Jeffrey, Rosario Jauregui Ruano, Jasmine Hsu, Keerthana Gopalakrishnan, Byron David, Andy Zeng, and Chuyuan Kelly Fu. Do as can, not as I say: Grounding language in robotic affordances. In Karen Liu, Dana Kulic, and Jeffrey Ichnowski, editors, Confer- ence on Robot Learning. CoRL 2022, 14-18 December 2022, Auckland, New Zealand, vol- ume 205 of Proceedings of Machine Learning Research, pages 287-318. PMLR, 2022. URL ml www..press/vv0333 wwtp///////ittteaaaaa html
Kishor Jothimurugan, Suguman Bansal, Osbert Bastani, and Rajeev Alur. Compositional re- inforcement learning from logical specifications. In Mare' Aurelio Ranzato, Alina Beygelz- imer, Yann N. Dauphin, Percy Liang, and Jennifer Wortman Vaughan, editors, Advances in Neural Information Processing Systems 34: Annual Conference on Neural Information Processing Systems 2021, NeurlPS 2021, December 6-14, 2021, virtual, pages 10026 10039, 2021. URL htttps://proceedinng hewp:eeeeeeddnngneeeee.......... http://eeerrrrreoc.p//e/////0000 cc/papper/222/hash.
html
Leslie Pack Kaelbling and Tomás Lozano-Pérez. Hierarchical task and motion planning in the now. In IEEE International Conference on Robotics and Automation, ICRA 2011, Shanghai, China, 9-13 May 2011, pages 1470-1477. IEEE, 2011. doi: 10.1109/CCR..201..05 5,980391. URL wwwp:/o.rrro1..0
2014:...1111 5980391
Jan Kretínský and Tobias Meggendorfer. Conditional value-at-risk for reachability and mean payoff in markov decision processes. In Anuj Dawar and Erich Grädel, editors, Proceedings of the 33rd Annual ACM/IEEE Symposium Logic in Computer Science, LJCS 2018, Oxford, UK, July 09-12, 2018, pages 609-618, ACM, 2018. doi: 10.1145/3209108.32099 URL https: 7/doi org/ 10, 1wt..1111533210000 3209176
Zhenyang Lin, Yurou Chen, and Zhiyong Liu. Sketch rl: Interactive sketch generation for long- horizon tasks via vision-based based skill predictor. IEEE Robotics and Automation Letters, 9(1):867- 874, 2024. doi: 1O9/LLA..202...33333
Horia Mania, Aurelia Guy, and Benjamin Recht. Simple random search of static linear poli- cies is competitive for reinforcement learning. Samy Bengio, Hanna M. Wallach, Hugo Larochelle, Kristen Grauman, Nicolò Cesa-Bianchi, and Roman Garnett, editors, Advances in Neural Information Processing Systems 31: Anmual Conference on Neural Information Processing Systems 2018, NeurIPS 2018, December 3-8, 2018, Montréal, Canada, pages 1814, 2018 URL UtL.https::/pprceedd.... pnw../ http://ss....a..pspccpaaaee///// cccpaaper/2118//aa.. 763 155ee555eeed0004ccc4777a...11333
html
P. Massart. The Tight Constant in the ability, 18(3): 1283, 1990. doi: 10. 10.12144/00//1176997446 URL httpthttp//// //doti.:://d..... /ttg//ooioggoo 10.
Inequality. The Annals of Prob-
Haruki Nishimura, Boris Ivanovic, Adrien Gaidon, Marco Pavone, and Mac Schwager. Risk- sensitive sequential action control with multi-modal human trajectory forecasting for safe crowd- robot interaction. In 2020 JEEE/RSJ International Conference on Intelligent Robots and Systems (IROS), pages 1/205-11222 IEEE, 2020.
Boye Niu, Yiliao Song, Kai Lian, Yifan Shen, Yu Yao, Kun Zhang, and Tongliang Liu. Flow: Mod- ularized agentic workflow automation. In The Thirteenth International Conference on Learn- ing Representationss ICLR 2025, Singapore, April 24-28, 2025, OpenReview.net, 2025. URL net wwweeeettetiioeeeeeeeeeeeeeeeeee fot.ummmddsslxbburrsooo
Matthias Plappert, Marcin Andrychowicz, Alex Ray, Bob McGrew, Bowen Baker, Glenn Powell, Jonas Schneider, Josh Tobin, Maciek Chociej. Peter Welinder, Vikash Kumar, and Wojeiech Zaremba. Multi-goal reinforcement learning: Challenging robotics environments and request for research, 2018.
12

---

Published as a conference paper at ICLR 2026
John Schulman, Filip Wolski, Prafulla Dhariwal, Alec Radford, and Oleg Klimov. Proximal policy optimization algorithms. CoRR, N/V1707700644, 2017. URL http:// /ttp://aaxvv.... org./ abs/
7107.06347
Vincent YF Tan, Krishna Jagannathan, al. A survey of risk-aware multi-armed bandits. arXiv preprint wrXiv:2205.05844 2022.
Kaiwen Wang. Nathan Kallus, and Wen Sun. Near-minimax-opimall risk-sensitive reinforcement learning with evar. In Andreas Krause, Emma Brunskill, Kyunghyun Cho, Barbara Engelhardt, Sivan Sabato, and Jonathan Scarlett, editors, International Conference Machine Learning, ICML 2023, 23-29 July 2023, Honolulu, Hawaii, USA, volume 202 Proceedings of Machine Learming Research, pages press/v202 wang23m.mmm.............mmm.mm html
PMLR, 2023. URL htlll:tp////ppt httpapsss/ppcceeennnoeooooooo/ee mmlr.
Yuheng Wang and Margaret P Chapman. Risk-averse autonomous systems: A brief history and recent developments from the perspective of optimal control. Artificial Intelligence, 311:103743, 2022.
Peter Whittle. Risk-sensitive Iiner/quadratic/gaussian control. Advances in Applied Probability, 13 (4):764-777, 1981.
Zhutian Yang, Caclan Garrett, Dieter Fox, Tomás Lozano-Pééie Pérez, and Leslie Pack Kaelbling, Guiding long-horizon task and motion planning with vision language models, 2024. URL https://
02193
Jiyy Zhang, Jinyu Xiang, Zhaoyang Yu, Fengwei Teng, Xionghui Chen, Jiaqi Chen, Mingehen Zhuge, Xin Cheng. Sirui Hong, Jinlin Wang, Bingnan Zheng, Bang Liu, Yuyu Luo, and Chenglin Wu. Aflow: Automating agentic workflow generation. In The Thirteenth International Confer- ence on Learning Representations, ICLR 2025, Singapore, April 24-28, 2025. OpenReview.net, net fttt/forummnd=-5SVvkee.
2025a. BtLhhtts::
Weizhi Zhang, Yangning Li, Yuanchen Bei, Junyu Luo, Guancheng Wan, Liangwei Yang, Chenxuan Xie, Yuyao Yang. Wei-Chieh Huang, Chunyu Miao, Henry Peng Zou, Xiao Luo, Yusheng Zhao, Yankai Chen, Chunkit Chan, Peilin Zhou, Xinyang Zhang. Chenwei Zhang, Jingbo Shang. Ming Zhang, Yangqiu Song, Irwin King. and Philip S. Yu. From web search towards agentic deep research: Incentivizing search with reasoning agents, 2025b. URL httph:://sat /ttpss///arxvvvoo org/
abs/ 2os/2506.. 18959
Qingqing Zhao, Yao Lu, Moo Jin Kim, Zipeng Fu, Zhuoyang Zhang, Yecheng Wu, Zhaoshuo Li, Qianli Ma. Song Han, Chelsea Finn, Ankur Handa, Ming- Yu Liu, Donglai Xiang, Gordon Wet- zstein, and Tsung- Lin. Cot-vla: Visual chain-of-thought reasoning for vision-language-action models. 2025 IEEE/CVF Conference on Computer Vixion and Puttern Recognition (CVPR), pages 1702-1713, 2025.
URL https://aapp wew.atiescooaa..rrggooooooo
277435005
Zihan Zhou, Animesh Garg, Dieter Fox, Caelan Reed Garrett, and Ajay Mandlekar. SPIRE: Syn- ergistic planning, imitation, and reinforcement learning for long-horizon manipulation. In 8th Annual Conference on Robot Learning, 2024. URL https: /ot net wwt/ forum?
id cd=cvUXoou8iz)
13

---

Published as a conference paper at ICLR 2026
A USE OF LARGE LANGUAGE MODELS (LLMS)
LLMs were used code assistants in writing and debugging parts of the codebase. They were also used to polish the writing.
B PROOFS OF CORRECTNESS, EFFICIENCY, AND OPTIMALITY OF THE BUCKETEDVAR ALGORITHM
Proof of Theorem / We first establish the correctness of the algorithm by showing that, with high probability, the value-at-risk estimate y returned by the BucketedVaR algorithm is least as large as the (1
-qquntilee of the loss distribution along the returned path p.
Let p = 1 + 02 For E (1, allocated edge e, such that Σ a These allocations correspond the buckets selected by the algorithm.
+ Ug the path returned by the algorithm, where 1 = and Us = I.. let e; (vi, 1141) be the edges along this path, and let a; be the risk budget
For each edge c₁. let Rú The loss along the entire path is given by Lp(Zp) = max RR...... Rx-1).
Le. (Z.) be the random variable representing the loss along that edge.
By the union bound property of probabilities, have
Pr Pr|max(B11 RE 1) > of S
Pr[R: > >1]
(9)
k-1
ai
(10)
(11)
where we set g such that Pr(R; > 4) = dg.
This implies that 2 VaR, [T.. (Zp)) However, in the algorithm, we estimate the (1 quanttle for each edge empirically using n samples. By the Dvoretzky-Kieee Kieee-iieeeeeeoneeeeeeeee Wolfowitz (DKW) inequal-
ity (Dvoretzky al. 1956
Massart 1990). with probability at least - 8', the empirical CDF F
for each edge satisfies:
2 ln
sup [x))) F((x)) S
(12)
zEk
2n
8'
where F; is the true CDF of R.,
For our algorithm, we need this hold for all the empirical CDFs that estimate. By looking at the pseudocode, we remark that we make at most [V|3(d + 1)2 quantile estimations. So setting 5' (d+1)=/v12 and applying the union bound, with probability at least - 6, all empirical CDFs
within In 2dd+1**VEE of their true CDFs.
Therefore, the error in quantile estimation for the path p is most
2(d + 1(= V < IV
2(d 1)
7 (A: 1)
2n In
In
(13)
2n
8
This implies that, with probability at least - 8, the estimated value-at-risk q is at least large as the (1 -a - ()) quaatile of (2p))
For the time complexity analysis, observe that the algorithm processes each vertex-bucket pair (v, a) at most once and there are at most [V] + 1) such pairs. For each pair, it considers its prede- cessors vertices of and bucket allocation a' Bea. There again most [V] + 1) pairs. For each combination, it processes n samples. Thus, the overall time complexity O(n(d + 1)?) assuming constant-time sampling operations.
14

---

Published as a conference paper at ICLR 2026
Proof of ['heormm 2 Under the independence assumption of losses along edges, can provide tighter analysis of the optimality of the Bucketed algorithm.
Let p- vi 22
- be the optimal path minimizing the value-at-risk, where vi and v.. = For {l...., K-' 1}. let ef (ef, of41) be the edges along this path.
Let Ri...., - be the independent random variables representing the losses along the edges of the optimal path. The loss along the entire optimal path is given by Lyp (Zp-) max(Hi R)
For independent random variables, the CDF of the maximum is the product of the individual CDFs
h- Pr(R
k -1
Finax (x) = Pr[max(RR
R S x]
II
II P(())
(14)
Now, suppose we optimally allocate the risk budget a among the edges of the optimal path, assigning af to edge ef such that Dm= aç-
The optimal allocation would ensure that the (1 - a -uuantile is the same for all edges, which we denote q² This means (g)) 1 os for all i. Since Bucketed VaR searches over discretized buckets, as d + oc, it approaches this optimal allocation.
Under this optimal allocation, the CDF of the maximum at q" is
k-
Fma (4") =
II R((e')
(15)
1=1
II of)) i=1
(16)
To upper bound this product, we use the inequality (1 - x)) S e
which holds for all x E [0, 1]
---
Il (1 - at) < az
(17)
of
(18)
(19)
For all > 0, we can use the Taylor expansion of e around zero
a²
a
a = a
(20)
2!
3
41
To establish strict upper bound on a we consider the function h(a)) = - a + 2 e and show that h(a)) > 0 for all
0.
Note that 1(0) = 0 and h((a)) = =1 a e At a = 0. we have h'(0) = 0. Computing the second derivative, h" (a(a) - we see that (a( > for all 0 since e when
0.
Since (²(a) 0 for all 0, the function h((o:) is strictly increasing for a Given that 1((0) = 0, this means 1'(())) > 0 for all a > 0.
As (a( for all > the function h(aa) is strictly increasing for > Since h(0) conclude that h(aa= > 0 for all a > 0.
Therefore, have established the strict inequality
a
1 - a
for all & > 0
(21)
2
15

---

Published as a conference paper at ICLR 2026
Figure 5: 16-Rooms environment with obstacles avoid red. The light blue square the bottom left corner is the initial room of the point mass. The first subgoal is the dark blue square, followed by green, pink, and brown. Image taken from Jothimurugan et (2021).
This gives
S a²
Fmax (max(
(22)
which implies that
a
quantile(Lpr ), a 2
(23)
As n + Co, the empirical quantile estimates converge to the true quantiles, and as d - oo, the discretization error in budget allocation vanishes. Therefore, asymptotically, the value-at-risk esti- mate returned by Bucketed VaR satisfies I quantile(Lp- (Zpz ), 1 a + e²), which completes the proof.
C BENCHMARK ENVIRONMENTS AND EXPERIMENTAL EVALUATION SETUPS
C.I MAXIMIZING SAFETY DURING NAVIGATION AND MANIPULATION
We test our algorithm on the 16-Rooms and Fetch environments from Jothimurugan et al. (202 who present a compositional RL framework complete long-horizon objectives in continuous en- viromments. An objective is specified task graph, every edge represents a reach-avoid subtask: reaching a target region while avoiding a set of dangerous states. They design algorithm that finds the path that maximizes the probabil- ity of completing all the reach-avoid subtasks along the path where the control policies along the edges are trained using RL. Each reach-avoid subtask specifies real-valued reward function that takes in a trajectory of execution of the policy and evaluates to at least zero if the trajectory success- fully completes the subtask. Intuitively, the reward captures a distance metrie between trajectories and reach-avoid sets. The loss function in the agent graph is defined as the negative of the reward function.
task graph which is the same
agent graph. In the
The 16-Roomi enviromment consists of 16 rooms arranged in a 4 x 4 grid with doors between adjacent rooms. RL policies are trained to control point mass to complete reach-avoid tasks. The agent graph has 13 vertices and 16 paths of length 8 each. The second Fetch environment (Plappert ctt al. 2018) is taken from Gymnasium- -obstiss and involves controlling a 7-DoF robotic arm with gripper attached at the end pick up and move objects. We consider the task graph for the PickAndPlaceChoiss objective that directs the gripper to move near the object, grip it, pick it up and move along of two trajectories. The graph has 7 vertices and 2 paths of length 5. Additionally, we adapt the Rooms environment to implement a version of the drone navigation task from Example
16

---

Published as a conference paper at ICLR 2026
C.1.1 16-RooMS
Environment and agent graph. This benchmark environment borrowed from Jothimurugan et al. (2021). The state and action spaces are continuous and involves controlling a point mass to navigate between rooms while avoiding obstacles. map of the environment shown is shown in Figure 5| Jothimurugan et al. (202T) specify objectives in the form of task graphs where each vertex corresponds to a set of subgoal states and each edge represents a reach-avoid subtask of reaching the target vertex's 's subgoal states. The task graph that consider corresponds to the specification Øs from Jothimurugan et al. (2021) and is also visualized in Figure 5] It consists of 13 vertices arranged in sequence of diamonds with 4 vertices in each diamond like in Figure 1| The first diamond specifies starting from the light blue square and reaching the room marked with the dark blue square in Figure 5) jusing either the top path while avoiding the red obstacle or using the bottom path. Similarly, the next diamond specifies the two paths to reach the green square, followed by the pink, and brown squares. Each edge in the task graph also associated with a real-valued reward function that evaluates to at least zero when a trajectory of the controller satisfies the reach- avoid subtask. This is function of the distance between a trajectory and the obstacles and between the trajectory and the subgoal region. So if the reward is positive then it means that the trajectory stays at least a certain distance away from the obstacles and reaches at most a certain distance to the goal.
Mapping a task graph to an agent graph is simple: to define the loss functions along each edge, we simply consider the negative of the reward function that upper bound on the loss corresponds to a lower bound on the reward. The agents along each edge are RL policies trained to complete the reach avoid subtasks. The policies trained using the ARS algorithm (Mania al. 2018) using the same recipe as described in Jothimurugan et al. 2021). Since the training of policies are dependent the initial state distribution, we train the policies lazily when required by the [Buck-] Vat algorithm by approximating the initial state distribution from samples from the previous policy.
Additional experimental observations. In Table I since the estimated VaR at all levels for the 16-Rooms benchmark is negative, it implies that with probability at least 1 1 a, the reward along all the edges of the path are at least the positive estimated VaR, where a is the risk level.
C.1.2 FETCH
The Fetch robotic arm environment (Plappert et al., 2018) from Gymnasium Robotics is a simulated robot environment with gripper attached. The reach-avoid task graph is again taken from Joth- imurugan et al. (2021) and has 8 vertices with two paths. It corresponds to the PickAndPlaceChoitn specification and involves moving the gripper close an object, gripping it, picking it up, and mov- ing it along one of two trajectories. The policies are trained using TD3 (Fujimoto et al. 2018) with the hyperparameters specified by Jothimurugan al. (202I).
C.1.3 DRONENAV
As described previously, we adapt the 16-Rooms environment to implement the DroneNav environ- ment from Example I] Additionally, we adjust the sizes of the obstacles so that one of the paths has bigger obstacles than the other path.
Additional experimental observations. This environment was designed as a counterexample- the algorithm from Jothimurugan et al.] (2021) would be unable to pick path in the graph since only maximizes the success probability and in this case both are feasible to complete the reach-avoid tasks with probability On the other hand, optimizing the RMAG objeoceectiv would give us that the path with the smaller obstacles is safer.
C.2 MINIMIZING RESOURCE CONSUMPTION
We use the Miniworld (Chevalier-Boisseee vironment of which the top-view map is shown in Figure 6a Observations in this environment are
al. 2023) framework to implement the BoxRelay
given first-person view RGB images (see Appendix C.2.T). The objective is to move the player
17

---

Published as a conference paper at ICLR 2026
0
(a) Top-view map with agent (b) First-person person view when carrying
graph
box
Figure 6: BoxRelay environment
(red triangle) the first box (marked 1) and pick it up. The player can then choose go to either of the two boxes in the two middle rooms (3 or 7), place the initial box, pick up the next box, and finally drop it at the location marked in the right room with a star. Furthermore, after picking up the box at 7, the player can choose to exit through one of the two exits or 9. We add the constraint that the player has limited battery power but gets recharged after dropping the first box and before picking up the second box. So we would like to minimize the amount of time that either box is held by the player. Importantly, since the initial positions the player, the boxes, and the final target are all chosen uniformly at random within each room, this is non-trivial optimization problem.
We can model the BoxRelay task as an agent graph as follows: the graph is as shown in Figure 6a with the numbers being the vertices. The edges represent the agents which are RL policies trained to navigate the player to pick up and place objects at the desired locations. The loss functions evaluate the number of time steps that box is carried before being put back down and thus quantifies the resource consumption. Here, the RMAG objective corresponds to minimizing the maximum time that any box is carried by the player.
C.2.1 BOXRELAY
The environment and the agent graph details are presented in Section 4 The policies are trained using the PPO (Schulman et al. 2017) CNN-Policy algorithm from StableBaselines3 package with the default hyperparameters for 500,000 iterations for each edge policy. The initial state distribution was again estimated by taking rollouts of the previous edge policy. The loss functions in the agent graph are defined as follows where the vertices are numbered as shown in Figure 6a
(e(t) = oo for edges e {(0, 1), (1, (1, (3, 4), (7, 8), (7,9)) and for all trajecto- ries
The other edge loss functions for E {(2, 3). (6, 7). (4, 5), (8, 9). (9, 5)) return the number of time steps that the box was carried by the player by cumulating it with the number of time steps from the previous agent which also carried the box.
C.3 CORRELATED GAUSSIAN NOISE EXPERIMENT
For experiment 4, to measure the robustness of our algorithm to correlations in the loss distributions, we create a synthetic agent graph which simply a path with a varying number of edges >>> O. Let C, Xi,..., X, ~ N(0, be i.i.d. Gaussian variables with mean and unit variance. Then for given correlation level E [0, 1]. we define the correlated edge loss variables L!...., Lp as
1 pC /1 Px,
(24)
Thus, under complete correlation = 1, all the edge loss random variables represent the same variable C' and under zero correlation 0. they are independent.
18

---

Published as a conference paper at ICLR 2026
Table Comparison of the approximated VaR with the optimal bascline algorithm to compute VaR on 10 samples. We prefer empirical quantiles that are close to a where a is the risk level. 95% Clopper-Pearson CIs are specified for the empirical quantiles computed on fresh of 10
samples.
Risk level
VaR estimate
Baseline estimate
VaR quantile (%)
Baseline quantile (%)
Benchmark
Buckets
DroneNav
0.2
-0,339
-0.339
79.56 778.75, 80.34]
79.56 788.55 80.34]
0.1
-0.330
-0.330
89.77 19.15, 90.35]
89.77 19.15, 90.35]
0.05
-0.328
-0,328
95.01 194.56, 95.42]
95.01 [94.56, 95.42]
16-Rooms
0.2
100
-0.0253
-0.0277
82.74 18,9, 83.47]
81,26 (8048,, 82.02)
0.1
100
-0.0135
-0.0135
91.24 190.66, 91.78]
91.24 190666, 91.78]
0.05
100
-0.0084
-0.0084
95.45 195.02, 95.85)
95.45 (95.02, 95.85)
Fetch
0.2
0.0314
0.0250
80.45 17965,, 81.22)
79.58 (78.77, (8877,88..0 80.36]
0.1
30
0.3483
0.3393
90.92 190.33, 91.47]
90.53 (9993,, 91.09]
0.05
30
0.3914
0.3881
95,40 19.997, 95.80]
95.28 (94.84, 95.68]
BoxRelay
0.2
148
81.79 81.01, 82.54)
80.56 79.77, 81.33]
0.1
50
176
175
90.90 190.31, 91.45]
90,70 190.11, 91.26]
0.05
50
210
208
95,46 (95.03, 95.85]
95.34 (94.90, 95.74]
Table Comparison of the approximated CVaR with the optimal baseline algorithm on 10 samples. Empirical coverages computed fresh set of 10 samples.
Risk level
CVaR estimate
Baseline estimate
CVaR quantile (%)
Baseline quantile (%
Benchmark
Buckets
DroneNav
0.2
17.648
17.649
87.08
88,30
0.1
30
17.652
17.652
94.72
94.72
0.05
30
17.654
17.654
96.99
96.99
16-Rooms
0.2
100
-0.0134
-0.0139
90.82
89.75
0.1
100
-0.0077
-0.0073
95.26
94.34
0.05
100
-0.0051
-0.0045
96.55
98.70
Fetch
0.2
30
0.359
0.317
88.96
88.15
0.1
30
0,411
0,409
96.74
96.74
0.05
30
0.451
0.453
98.19
98.25
BoxRelay
0.2
50
180.54
179.86
93.57
93,49
0.1
50
210.96
210.61
96.47
96,47
0.05
246.30
246.27
98.24
98.24
C.4 EXPERIMENT COMPUTATIONAL REQUIREMENTS
All experiments were completed on one computer with an Intel Xeon 6248 CPU and one NVIDIA GeForce RTX 2080 GPU.
D EXPERIMENTAL RESULTS
Complete evaluation results of the Bucketed algorithm along with comparison with the baseline optimal algorithms to compute VaR and CVaR are given in Table I
19


Reviews:
[{"review_id": "bYZSLHTrrm", "reviewer": "Reviewer_B2Qs", "summary": "The paper formalises risk-sensitive composition of agentic workflows represented as DAGs, where path loss is the max over edge-level losses. It proposes BucketedVaR, a dynamic-programming algorithm that allocates a risk budget across edges via a union bound to upper-bound the path value at risk and select a path in polynomial time. Theoretical results include a finite-sample guarantee based on DKW and an asymptotic near-optimality bound under independence of edge losses. Experiments on compositional rl tasks show tight empirical coverage and agreement with an exhaustive baseline on small graphs.", "questions": "Q1 Dependence-robust, conservative guarantees. How can BucketedVaR be modified to deliver non-anti-conservative VaR ${ }_\\alpha$ guarantees under unknown edge-loss dependence without path enumeration? \n\nQ2 What is the empirical sensitivity to tail dependence? Please inject controlled correlation between edge losses (e.g., shared disturbance processes, comonotonic sampling) and report coverage error and path changes versus your baseline.\n\nQ3. Some suggestions for baselines: (i) chance-constrained shortest path surrogates; (ii) CVaR of max; (iii) an independence-aware exact path solver (using order statistics / product CDFs) where feasible.", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. Clear formulation & motivation: Risk of max loss is appropriate for safety/privacy violations in composed systems.\n\n2. Simple, scalable idea: Union-bound budgeting with DP avoids path enumeration; complexity $O\\left(n(d+1)^2|V|^2\\right)$.\n\n3. Theory with interpretable slack: Asymptotically, the selected path is within an $\\alpha^2 / 2$ quantile-level slack under independence (Thm. 2)\n\n4. Empirical evidence: Tight coverage across benchmarks; agreement with exhaustive baseline; clear sensitivity to buckets/sample.", "weaknesses": "1. Choice of VaR over CVaR: VaR ignores tail severity; CVaR is often preferred for safety. The paper mentions CVaR as future work but gives no partial result or empirical check.\n\n2. Missing baselines and ablations. No comparison to chance-constrained shortest path or to dependence-aware relaxations. No experiments that explicitly vary tail dependence (e.g., shared noise seeds, correlated disturbances) to show robustness/failure modes.\n\n3. Finite-sample conservativeness is unclear. Thm. 1 shows the returned threshold q satisfies coverage $\\geq 1-(\\alpha+\\gamma)$ (Eq. 5), i.e., it provides an upper bound on $\\text{VaR} _{\\alpha+\\gamma}$, not necessarily on $\\operatorname{VaR} _\\alpha$. Hence $q$ can underestimate the true $\\operatorname{VaR} _\\alpha$ when $\\gamma>0$-problematic for safety guarantees. The text claims the estimate is \"at least as large as the true VaR\" asymptotically, but the finite-sample statement doesn't ensure one-sided conservativeness at level $\\alpha$.\n\n4. Graphs are small (e.g., 16 paths), and a is relatively large ( $\\geq 0.05$ ). Safety practice often targets $\\alpha \\leq 10^{-3}$. Sample sizes of $10^4$ per comparison are heavy and may be infeasible for LLM/robotic agents. There is no runtime/scaling analysis on denser DAGs or rarer tails.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "mcqh4Z4FAz", "reviewer": "Reviewer_pFjP", "summary": "The paper presents a risk-aware framework for optimally selecting agent compositions that are represented as directed acyclic graphs, called agent graphs. The algorithm BucketedVaR utilizes dynamic programming to traverse the agent graph and find the optimal path that minimizes the value-at-risk of losses by dividing the risk budget $\\alpha$ among the agents and applying a union bound. Theoretical analysis shows that asymptotically, the quantile estimated by the algorithm is near-optimal when the loss variables along every path are independent or are only loosely correlated, scaling polynomially with the number of agents. The algorithm is tested on a series of reinforcement learning benchmarks to evaluate its effectiveness in identifying optimal paths and quantifying tail behaviors.", "questions": "1. How sensitive are the algorithm’s guarantees/empirical performance to deviation from independence and to noise in loss measurements?\n2. Why was VaR chosen over CVaR?\n3. How would the method adapt when only a few samples per agent are feasible, such as LLM-based agents?", "limitations": "", "rating": 4, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "- This work connects risk-sensitive optimization and compositional agent systems using directed acyclic graphs. The presented BucketedVaR algorithm is polynomial in the number of agents, thereby avoiding exponential enumeration (as seen in baselines).\n\n- The topic presented is relevant and has significance for measuring risk sensitivity in safety-critical AI agent composition. The experiments in various RL benchmarks demonstrate that BucketedVaR successfully identifies the same optimal path as the baseline algorithm across all benchmarks, while providing tight estimates of VaRα.\n\n- The paper is clearly written and well-organized; the agent graph formalism and examples presented help illustrate the ideas effectively.", "weaknesses": "- In real AI agent chains, losses are often correlated via shared context or sequential dependence; the paper should analyze or empirically test how violation of independence could affect performance.\n\n\n- Since the work only tested on RL benchmarks but described LLM examples as potential use cases, missing validation on LLM agentic pipelines where sampling cost and judge noise matter is concerning. For LLMs, losses (e.g., amount of hallucinated information) may be subjective, noisy, or non-numeric. Additionally, black-box sampleability may be significantly more expensive than in RL, where thousands of samples per edge can be easily obtained.\n\n\n- VaR ignores tail severity and is not a coherent risk measure; the authors should justify this choice of using VaR versus CVaR or provide comparative results.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "7W3c4Wy5KY", "reviewer": "Reviewer_ZHyK", "summary": "The paper studies risk-sensitive agent composition in multi-agent workflows. It models the system as a directed acyclic graph (DAG), where each edge represents an agent and each path corresponds to a feasible composition. The goal is to minimize the Value-at-Risk (VaR) of losses that capture safety, fairness, or privacy violations, focusing on tail risks. To do this, the authors propose a dynamic programming (DP)–style algorithm, BucketedVaR, that uses a union bound and a discretized risk budget to estimate an upper bound on the VaR. They prove asymptotic near-optimality under independence assumptions, and experiments on compositional RL benchmarks show the method can recover the optimal paths with accurate VaR estimates.", "questions": "1. The framework assumes that the overall task can be represented as a DAG of agents. In many real-world scenarios, agent interactions may not follow a strict directional or decomposable structure. How restrictive is this assumption, and could the proposed approach be extended beyond DAG workflows? \n\n2. The theoretical analysis seems to rely on several independence and directionality assumptions, as well as implicitly fixed outputs between connected agents. Could the authors clarify which of these are essential for the algorithm’s validity and which could be relaxed? \n\n3. The loss function is defined only over the trace T, while the output Y appears not to influence the risk. In realistic settings, the output could affect downstream traces. How would the framework handle such dependencies? \n\n4. In Figure 4b, the 16-Rooms benchmark exhibits a noticeable spike when using 5–20 buckets. Could the authors explain this behavior? \n\n5. While the theoretical and algorithmic contributions are clear, the practical applicability of the framework remains uncertain. The paper would benefit from a discussion of potential real-world scenarios where the proposed method could be directly used or integrated into existing agentic systems.\n\nI am not primarily working on the formal side of risk-sensitive optimization, but these questions reflect my current understanding of the framework and its assumptions.", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. The paper presents a technically sound and mathematically coherent formulation of risk minimization for agent compositions. \n\n2. The theoretical development is detailed and carefully reasoned, with clear proofs supporting the approximation guarantees. \n\n3. Overall, the work provides both a mathematical framework and an algorithmic contribution that meaningfully advance the study of risk-aware agent systems.", "weaknesses": "1. The paper’s presentation is quite dense, and the abstract and introduction do not clearly communicate the main ideas, which makes it difficult to identify the core contribution without considerable effort. \n\n2. The approach also depends on several strong assumptions, such as the DAG workflow structure and the independence of agent losses, which limit its generality and practical relevance. \n\n3. Finally, the work remains mostly theoretical, and it is not clear how the proposed framework could be applied or integrated into real-world multi-agent systems.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)