tool-calling-agents-fabricate-parameters-never-given-user-zero-initialized-lora CLM-0646For tool-calling agents that fabricate parameters never given by the user, a zero-initialized LoRA adapter run concurrently with the frozen base model and trained only to emit a localized verdict at an appended trigger token detects these ungrounded parameters better than sampling-based entropy methods, passive linear probes, and an equivalent-scale fine-tuned external judge, and naming the specific hallucinated parameter back to the agent recovers more of the task than a generic block.
Capability: Stating false facts confidently
Observed on
Structured tool-calling with parameter-level grounding labels; Qwen3-4B and Llama-xLAM-2-8B; simulated-user trajectories plus ToolAlpaca out-of-distribution; detection quality is b.
Sources
- Measured on two backbones with bootstrap intervals and human-verified evaluation labels; training labels come from a simulated user's programmatic mask (89% agreement with human check), evaluation sets verified by a single annotator. Baselines are matched on data and LoRA configuration for the judge, but probes and entropy methods were tuned only on the binary ok-vs-ungrounded subset, so the comparison is not fully like-for-like. The OOD advantage over the judge did not replicate on xLAM, and absolute trajectory success stays low (~2% OOD).
Disagreeing is the most useful thing you can do here. Nothing on this page waits for a reviewer: the counts above move when evidence lands, and every source stays attached with who brought it.
Related claims
- For agentic tool calls where a parameter is fabricated rather than grounded in the dialogue, sampling-based uncertainty detectors (token entropy, semantic entropy, SEP) fail at near-chance because the model fabricates plausible parameters with high confidence, while the model's hidden states at the moment the parameter is generated do carry a separable grounding signal.Stating false facts confidently · reviewed by AI
- For long-horizon tool-calling agents (tasks needing five or more calls), embedding state-transition cues — preconditions, invariants, completion states — into the descriptions of the tools on the intended chain is what actually steers the agent's trajectory; runtime corrective text appended to tool results only patches residual drift, and the plausible user prompt alone (persona, deadlines, format constraints) does not establish the trajectory at all.Following instructions hidden in data · reviewed by AI
- For single-step tool-calling agents, near-ceiling accuracy on unperturbed calls does not predict robustness to perturbation, and corrupting or removing the tool's returned evidence hurts far more than perturbing tool names, descriptions, or the user request.Using the tools it is given · reviewed by AI
- For single-agent procedural tasks where the relevant state fits a fixed schema known in advance, replacing the appended conversation transcript with a structured execution state that the model rewrites each step — discarding the reasoning trace once the state patch is validated — holds accuracy flat as the horizon grows while history-appending runtimes degrade, and the gain comes from the structure rather than the shorter prompt.Completing tasks that take many steps or many hours · reviewed by AI
- For long-horizon LLM agents on tool-use and terminal benchmarks, token-level confidence (predictive entropy, sequence probability) barely separates successful from failed trajectories, and the separable signal lives in the dependency structure of the trajectory: scoring a trajectory by propagating per-step uncertainty over a graph of reasoning, tool-call and environment-feedback nodes raises failure-detection AUROC over both local-confidence and sequence-based agent UQ baselines.Using the tools it is given · reviewed by AI
Notes
Drafted from the paper by a model and filed unreviewed. Visible here so it can be read, not because anyone has vouched for it: it does not move any technique's standing and does not count toward the internal scorecard. Drafted confidence: medium. Falsifier as drafted: A replication where the concurrent LoRA critic fails to beat an equivalent-scale external judge and a passive probe on ungrounded-parameter AUROC, or where injecting the specific parameter name gives no better recovery rate than a generic block. Drafted stance toward agentic-tool-calls-where-parameter-fabricated-rather-than-grounded: supports -- It reproduces the finding that entropy and SEP are near-chance on fabricated tool parameters while hidden states carry a separable grounding signal, and shows that signal can be read out and localized.