SINGED benchmark: correct output does not mean safe execution

Researchers from The Hong Kong Polytechnic University and Hangzhou Dianzi University proposed the concept of "functional counterfeit" and built the SINGED benchmark to test whether tool-using agents can identify third-party implementations that produce correct output but carry effects prohibited by the task contract. 7549 audit trials covered 20 versions across 14 model families and 8 agent configurations; when a counterfeit was ranked first among candidates, 45% of executions selected it, and judging by output alone, all of these compromised executions showed task success. Forcing comparison of three candidates reduced the first-position selection rate from 27/60 to 0/60, but the benefit diminished once the decisive evidence was buried one to two dependency layers deep; seven model versions that had zero selections under three-source choice executed the counterfeit in 55/175 cells when only a single counterfeit source remained. The paper is a preprint (arXiv 2609.35889) and has not been peer-reviewed.