linear-probe-tool-calling-model-s-hidden-state-last-generated CLM-0238A linear probe on a tool-calling model's hidden state at the last generated token detects incorrect tool-calls — including wrong-but-well-typed argument values that parsers and logs do not catch — and works better on larger models and at middle-to-late layers than at the final layer.
Capability: Using the tools it is given
Observed on
18 open tool-calling LLMs from 1B to 70B parameters, on BFCL simple_python/java/javascript and multiple splits (750 examples per model), models with above 80% tool-calling accuracy.
Sources
- Validated by: Not stated. Measured AUROC and AUPR per layer per model; most models above 0.80 AUROC, ~0.06 AUROC gain for 70B over ~8B. Transfer across disjoint error-type splits above 0.75 AUROC suggests a general correctness feature rather than error-specific cues. Confound with capability partly addressed: R^2 within the ~8B group is 0.005 and two large but lower-accuracy models still probe well. Single benchmark, short simple-call splits, in-distribution test split — no deployment or distribution-shift test.
Disagreeing is the most useful thing you can do here. Nothing on this page waits for a reviewer: the counts above move when evidence lands, and every source stays attached with who brought it.
Related claims
- A linear probe on a tool-calling model's hidden state at the last generated token detects incorrect tool-calls — including wrong-but-well-typed argument values that parsers and logs do not catch — and works better on larger models and at middle-to-late layers than at the final layer.Using the tools it is given · reviewed by AI
- For open models (8B-14B) filling structured tool-call parameters, a linear probe on the hidden state at the position just before a parameter value is written predicts whether that value will be correct better than token log-probability (in-domain AUC about 0.986 vs 0.914), and using that score to filter self-generated calls for fine-tuning beats self-training filtered by log-probability or majority vote.Using the tools it is given · reviewed by AI
- For single-step tool-calling agents, near-ceiling accuracy on unperturbed calls does not predict robustness to perturbation, and corrupting or removing the tool's returned evidence hurts far more than perturbing tool names, descriptions, or the user request.Using the tools it is given · reviewed by AI
- For agentic tool calls where a parameter is fabricated rather than grounded in the dialogue, sampling-based uncertainty detectors (token entropy, semantic entropy, SEP) fail at near-chance because the model fabricates plausible parameters with high confidence, while the model's hidden states at the moment the parameter is generated do carry a separable grounding signal.Stating false facts confidently · reviewed by AI
- On multi-turn tool-calling benchmarks that score whether the final environment state matches a gold trajectory, aggregate accuracy hides wrong action-class choices: a model can call a withheld or under-specified tool with fabricated arguments, be handed the missing piece on a later turn, and still be graded PASS — so heavily tool-trained model families rank high while almost never asking for a missing parameter or refusing an unavailable function.Whether the measurement made the finding · reviewed by AI
Notes
Drafted from the paper by a model and filed unreviewed. Visible here so it can be read, not because anyone has vouched for it: it does not move any technique's standing and does not count toward the internal scorecard. Drafted confidence: medium. Falsifier as drafted: Probes trained this way scoring near chance AUROC on held-out tool-calls, or final-layer probes matching or beating middle-layer probes, or no size advantage once tool-calling accuracy is controlled.