改几句工具描述，就能让大模型选错工具，暴露了智能体系统的严重漏洞。
Tool Preferences in Agentic LLMs are Unreliable
- 通过修改工具文本描述，操纵大模型的工具选择偏好。
- 优化后描述使工具使用率在GPT-4.1上提升超10倍。
- 该现象在17个模型中普遍存在，提醒开发者警惕误用风险。
大语言模型（LLMs）如今可通过模型上下文协议（MCP）访问多种外部工具，极大扩展了其作为智能体的能力。然而，LLMs完全依赖工具的文本描述来决定使用哪个工具——这一过程出人意料地脆弱。本文通过一系列工具描述的修改实验，揭示了主流工具调用协议中的漏洞：某些描述修改可显著提高工具在竞争中的使用率。在受控实验中，经优化描述的工具在GPT-4.1和Qwen2.5-7B上的使用量比原描述高出10倍以上。我们进一步评估了不同描述修改在直接竞争中的表现，并检验其在17种不同模型间的泛化性。这些发现虽为工具推广提供了强大手段，但也凸显了构建更可靠智能体工具选择机制的紧迫性。代码已公开于 https://github.com/kazemf78/llm-unreliable-tool-preferences。
原文摘要 · Abstract (English)
Large language models (LLMs) can now access a wide range of external tools, thanks to the Model Context Protocol (MCP). This greatly expands their abilities as various agents. However, LLMs rely entirely on the text descriptions of tools to decide which ones to use--a process that is surprisingly fragile. In this work, we expose a vulnerability in prevalent tool/function-calling protocols by investigating a series of edits to tool descriptions, some of which can drastically increase a tool's usage from LLMs when competing with alternatives. Through controlled experiments, we show that tools with properly edited descriptions receive over 10 times more usage from GPT-4.1 and Qwen2.5-7B than tools with original descriptions. We further evaluate how various edits to tool descriptions perform when competing directly with one another and how these trends generalize or differ across a broader set of 17 different models. These phenomena, while giving developers a powerful way to promote their tools, underscore the need for a more reliable foundation for agentic LLMs to select and utilize tools and resources. Our code is publicly available at https://github.com/kazemf78/llm-unreliable-tool-preferences.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。