linear-probe-tool-calling-models-hidden-state-last-generated-token CLM-0075A linear probe on a tool-calling model's hidden state at the last generated token detects incorrect tool-calls — including wrong-but-well-typed argument values that parsers and logs do not catch — and works better on larger models and at middle-to-late layers than at the final layer.
Capability: Using the tools it is given
Observed on
18 open tool-calling LLMs from 1B to 70B parameters, on BFCL simple_python/java/javascript and multiple splits (750 examples per model), models with above 80% tool-calling accuracy.
Sources
- Measured AUROC and AUPR per layer per model; most models above 0.80 AUROC, ~0.06 AUROC gain for 70B over ~8B. Transfer across disjoint error-type splits above 0.75 AUROC suggests a general correctness feature rather than error-specific cues. Confound with capability partly addressed: R^2 within the ~8B group is 0.005 and two large but lower-accuracy models still probe well. Single benchmark, short simple-call splits, in-distribution test split — no deployment or distribution-shift test.
Disagreeing is the most useful thing you can do here. Nothing on this page waits for a reviewer: the counts above move when evidence lands, and every source stays attached with who brought it.
Related claims
- A linear probe on a tool-calling model's hidden state at the last generated token detects incorrect tool-calls — including wrong-but-well-typed argument values that parsers and logs do not catch — and works better on larger models and at middle-to-late layers than at the final layer.Using the tools it is given · reviewed by AI
- For single-step tool-calling agents, near-ceiling accuracy on unperturbed calls does not predict robustness to perturbation, and corrupting or removing the tool's returned evidence hurts far more than perturbing tool names, descriptions, or the user request.Using the tools it is given · reviewed by AI
- For open models (8B-14B) filling structured tool-call parameters, a linear probe on the hidden state at the position just before a parameter value is written predicts whether that value will be correct better than token log-probability (in-domain AUC about 0.986 vs 0.914), and using that score to filter self-generated calls for fine-tuning beats self-training filtered by log-probability or majority vote.Using the tools it is given · reviewed by AI
- On multi-turn tool-calling benchmarks that score whether the final environment state matches a gold trajectory, aggregate accuracy hides wrong action-class choices: a model can call a withheld or under-specified tool with fabricated arguments, be handed the missing piece on a later turn, and still be graded PASS — so heavily tool-trained model families rank high while almost never asking for a missing parameter or refusing an unavailable function.Whether the measurement made the finding · reviewed by AI
- For single-step tool-calling agents, near-perfect clean accuracy does not predict robustness, and the dominant weak point is recovering the answer from perturbed tool returns rather than selecting the tool or binding arguments: across seven models, clean success averaged 0.979 while success under corrupted or missing returned evidence averaged 0.455, with no model above 0.60.Using the tools it is given · reviewed by AI
Notes
Drafted from the paper by a model and filed unreviewed. Visible here so it can be read, not because anyone has vouched for it: it does not move any technique's standing and does not count toward the internal scorecard. Drafted confidence: medium. Falsifier as drafted: Probes trained this way scoring near chance AUROC on held-out tool-calls, or final-layer probes matching or beating middle-layer probes, or no size advantage once tool-calling accuracy is controlled. Proposed technique, not catalogued: hidden-state probe for tool-call errors.