long-horizon-tool-calling-agents-tasks-needing-five-or-more-calls CLM-0083For long-horizon tool-calling agents (tasks needing five or more calls), embedding state-transition cues — preconditions, invariants, completion states — into the descriptions of the tools on the intended chain is what actually steers the agent's trajectory; runtime corrective text appended to tool results only patches residual drift, and the plausible user prompt alone (persona, deadlines, format constraints) does not establish the trajectory at all.
Capability: Following instructions hidden in data
Observed on
Attacker can modify natural-language tool metadata (malicious MCP tool publication or post-registration description change) and also supplies the user prompt; measured on a 120-tas.
Sources
- supportsECLIPSE: Self-Evolving Stealthy Prompt Injection Attack against Long-Horizon Agentic SystemsAblation on the authors' own benchmark under a defended DeepSeek victim: prompt-only 19-27% success, runtime correction alone 37.5%, tool-description encoding 66.7%, both 69.2%. Same-lab benchmark and success metric; the ablation isolates the channels but only for one victim model and one filter, and the mechanism claim generalizes beyond what was tested.
Disagreeing is the most useful thing you can do here. Nothing on this page waits for a reviewer: the counts above move when evidence lands, and every source stays attached with who brought it.
Related claims
- For single-agent procedural tasks where the relevant state fits a fixed schema known in advance, replacing the appended conversation transcript with a structured execution state that the model rewrites each step — discarding the reasoning trace once the state patch is validated — holds accuracy flat as the horizon grows while history-appending runtimes degrade, and the gain comes from the structure rather than the shorter prompt.Completing tasks that take many steps or many hours · reviewed by AI
- For tool-using agents on long-trajectory benchmarks, an injection defense that audits each candidate action against a one-step-ahead predicted tool set holds attack success low while keeping task utility near the attack-free level, whereas defenses that fix a global plan or filter whole tool outputs lose utility because the predicted full trajectory almost never matches the executed one once environmental feedback arrives.Following instructions hidden in data · reviewed by AI
- For single-step tool-calling agents, near-ceiling accuracy on unperturbed calls does not predict robustness to perturbation, and corrupting or removing the tool's returned evidence hurts far more than perturbing tool names, descriptions, or the user request.Using the tools it is given · reviewed by AI
- For tool-calling agents that fabricate parameters never given by the user, a zero-initialized LoRA adapter run concurrently with the frozen base model and trained only to emit a localized verdict at an appended trigger token detects these ungrounded parameters better than sampling-based entropy methods, passive linear probes, and an equivalent-scale fine-tuned external judge, and naming the specific hallucinated parameter back to the agent recovers more of the task than a generic block.Stating false facts confidently · reviewed by AI
- For long-horizon LLM agents on tool-use and terminal benchmarks, token-level confidence (predictive entropy, sequence probability) barely separates successful from failed trajectories, and the separable signal lives in the dependency structure of the trajectory: scoring a trajectory by propagating per-step uncertainty over a graph of reasoning, tool-call and environment-feedback nodes raises failure-detection AUROC over both local-confidence and sequence-based agent UQ baselines.Using the tools it is given · reviewed by AI
Notes
Drafted from the paper by a model and filed unreviewed. Visible here so it can be read, not because anyone has vouched for it: it does not move any technique's standing and does not count toward the internal scorecard. Drafted confidence: medium. Falsifier as drafted: An ablation on comparable long-horizon agent tasks where rewriting tool descriptions with workflow cues adds little over the prompt alone, or where runtime correction signals alone reach similar attack success and trajectory similarity. Proposed technique, not catalogued: Static workflow encoding in tool descriptions.