LEASH: Uncertainty-Aware Weak-to-Strong Escalation and Oversight for Computer-Use Agents

LEASH. Uncertainty-Aware Weak-to-Strong Escalation and Oversight for Computer-Use Agents. By Qingni Wang and six others, from Simular and the University of Wisconsin–Madison. Published on the fifteenth of October. No code repository is linked to it.

Computer-use agents increasingly take on long-horizon tasks, and that puts two bad options on the table. Running a frontier model at every step is expensive. A small open-weight model on its own often fails. Weak-to-strong escalation sits between them: a weak agent acts by default, and hands control to a strong one only when it is needed.

That middle ground raises two difficulties. The first is deciding when to escalate, which needs an uncertainty signal cheap enough to check at every step. The second arrives after the handoff. The strong agent can still get lost, and because it is usually served through a black-box API, it exposes no internals that could be monitored. Escalation solves the cost problem only if both of those are handled.

LEASH is a training-free framework built around that pair of difficulties. It unleashes the strong agent only when the weak agent's latent uncertainty signals that it is needed, and it keeps the strong agent on a leash afterwards. There are three layers. Initial task uncertainty supports early routing, before the task gets going. Step-level uncertainty drives escalation at runtime. And after a handoff, a shadow observer provides continued oversight of the strong black-box agent.

A single kind of signal fuels all three layers: latent uncertainty. The weak model's hidden states are compared with the hidden states from its own past trajectories, both the successful ones and the failed ones. A state that looks more like the failures signals higher uncertainty. While the weak agent is executing, the estimator reuses activations that were already produced during action generation. It therefore needs no extra forward pass, and no monitor has to be trained for the purpose.

Experiments run on OSWorld across four contemporary model backbones. LEASH consistently improves over standalone weak agents. At matched escalation rates, it outperforms random escalation by between six point five five and eleven point nine four points, which separates the value of knowing when to escalate from the value of escalating at all.

The headline configuration uses Qwen3.5-35B-A3B as the weak model. It reaches seventy-three point six six percent task success at zero point four one one seven dollars per task. That matches Claude Opus 5 running always-on, at seventy-two point nine percent, while reducing inference cost by nineteen point two percent.

The design turns on where the signal comes from. The strong agent is opaque, so oversight cannot look inside it. The weak model is not opaque, and its hidden states, already computed while it acts, end up serving three jobs: routing the task at the start, deciding when to escalate, and watching the strong agent once it has taken over. Paying for the frontier model only when the cheap one signals trouble is how the combination reaches the frontier model's success rate at a lower cost.