工具調用在鏈路上被悄悄改寫

Computer Science > Artificial Intelligence arXiv:2610.04375 (cs) [Submitted on 3 Oct 2026] Title:Do Tool Calls Execute as Intended?

Measuring and Repairing Intent-Execution Correspondence in LLM Agents Authors:Boyang Yang, Zhenhao Li, Ziyao Yang, Kanghui Jia, Xin Yin, Mingmou Liu, Haoye Tian View a PDF of the paper titled Do Tool Calls Execute as Intended?

Measuring and Repairing Intent-Execution Correspondence in LLM Agents, by Boyang Yang and 6 other authors View PDF HTML (experimental) Abstract:Agents built on large language models (LLMs) build and run software through tool calls.

A call reaches its program through several hops, and any hop can change the call without notice.When the changed call fails, the agent retries a correct call, which costs users time and money.

Benchmarks and failure analyses do not see the change, because they read the call and its result but not what a hop received.We define intent-execution correspondence (IEC) as the property that the executed action matches the action the emitted call denotes under the tool contract.

Our protocol observes what each hop received without executing the call, and names the first hop that changed it by the receiver's own parser.IntAct then delivers the call in a form that this hop cannot alter, or refuses the call.

We build IEC-Bench from the changes observed in real-world use, with chains of dependent calls under the execution paths of 4 widely-used harnesses.In 47,828 shell calls within production sessions, Claude Code's Bash tool changes 12.0% of the calls that carry code, escape sequences, or long text.

For 80.7% of the calls whose backslashes are changed, the wrong action runs without any reported error.All 10 measured harnesses change a call.Trajectory-based judgment attributes 95.1% of the production failures to the LLM, although the path caused more than half of them.

On IEC-Bench, the path raises the token cost per passed task 2.4 times (up to 12.3 times).A hop that changes a call also hides the changes after it, so 55.1% of the failures on one path appear only after its first hop is repaired.IntAct, deployed in a commercial product, recovers 79.

2% of the failures with a changed call.Harnesses should therefore be designed and tested hop-by-hop to ensure a correct call executes as intended or is refused.Subjects: Artificial Intelligence (cs.AI); Software Engineering (cs.SE) Cite as: arXiv:2610.04375 [cs.AI] (or arXiv:2610.04375v1 [cs.

AI] for this version) https://doi.org/10.48550/arXiv.2610.

04375 Focus to learn more arXiv-issued DOI via DataCite (pending registration) Submission history From: Boyang Yang [view email] [v1] Sat, 3 Oct 2026 08:38:35 UTC (790 KB) Full-text links: Access Paper: View a PDF of the paper titled Do Tool Calls Execute as Intended?

Measuring and Repairing Intent-Execution Correspondence in LLM Agents, by Boyang Yang and 6 other authorsView PDFHTML (experimental)TeX Source view license Current browse context: cs.AI < prev | next > new | recent | 2026-10 Change to browse by: cs cs.

SE References & Citations NASA ADSGoogle Scholar Semantic Scholar export BibTeX citation Loading...BibTeX formatted citation × loading...Data provided by: Bookmark Bibliographic Tools Bibliographic and Citation Tools Bibliographic Explorer Toggle Bibliographic Explorer (What is the Explorer?

) Connected Papers Toggle Connected Papers (What is Connected Papers?) Litmaps Toggle Litmaps (What is Litmaps?) scite.ai Toggle scite Smart Citations (What are Smart Citations?) Code, Data, Media Code, Data and Media Associated with this Article alphaXiv Toggle alphaXiv (What is alphaXiv?

) Links to Code Toggle CatalyzeX Code Finder for Papers (What is CatalyzeX?) DagsHub Toggle DagsHub (What is DagsHub?) GotitPub Toggle Gotit.pub (What is GotitPub?) Huggingface Toggle Hugging Face (What is Huggingface?) ScienceCast Toggle ScienceCast (What is ScienceCast?

) Demos Demos Replicate Toggle Replicate (What is Replicate?) Spaces Toggle Hugging Face Spaces (What is Spaces?) Spaces Toggle TXYZ.AI (What is TXYZ.AI?) Related Papers Recommenders and Search Tools Link to Influence Flower Influence Flower (What are Influence Flowers?

) Core recommender toggle CORE Recommender (What is CORE?) Author Venue Institution Topic About arXivLabs arXivLabs: experimental projects with community collaborators arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.

Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy.arXiv is committed to these values and only works with partners that adhere to them.

Have an idea for a project that will add value for arXiv's community?Learn more about arXivLabs.Which authors of this paper are endorsers?| Disable MathJax (What is MathJax?)