为工具选择错误提供高置信度安全上限，保障智能体在真实场景下的可靠性。
Quantitative Certification of Agentic Tool Selection
- 将工具选择建模为伯努利估计问题，基于真实工具分布生成序列进行评估。
- 在常见工具库中测试发现，当前智能体正确率上限仅约20%，远低于理想情况。
- 输出带统计保证的认证证书，适合评估不同模型、检索器与策略的安全性。
大型语言模型（LLMs）越来越多地被部署于智能体系统中，其中核心任务是将用户意图映射到相关外部工具。工具选择错误可能导致严重后果，如未经授权的数据访问，且无需修改代理底层模型。现有评估依赖精心设计的良性基准，但实际部署中的行为取决于代理所遇到的工具池，而开放注册表中的工具池由第三方决定。本文提出 LLMCert-T，首个可返回高置信度上界的安全认证框架，用于评估工具选择流水线在真实工具分布下满足声明安全规范的概率。LLMCert-T 将工具选择评估建模为伯努利估计问题，从安全规范固定的分布中抽取插入式工具序列。为模拟真实部署条件，该分布被实例化为逐轮生成插入工具序列的随机过程，并依赖前一轮代理的选择进行条件化。通过汇总每轮结果，获得满足规范概率的一侧 Clopper-Pearson 上界。以证书形式返回此上界，使安全声明直观、可操作，并支持跨模型、检索器、缓解措施和注册表策略的比较。在主流 BFCL 与 OpenAPI 工具池上，LLMCert-T 显示当前 LLM 代理在干扰选择与前 N 饱和规范下仍脆弱：其认证正确率上限降至约 20%，远低于干净池下的下界。
原文摘要 · Abstract (English)
Large language models (LLMs) are increasingly deployed in agentic systems, where a fundamental task is mapping user intents to relevant external tools. Errors in tool selection can have severe outcomes, such as unauthorized data access, even without modifying the agent's underlying model. Existing evaluations measure performance on curated, benign benchmarks. However, a pipeline's behavior in deployment depends on the tool pool the agent actually encounters, which in open registries is shaped by third parties. We introduce LLMCert-T, the first statistical framework that returns \textbf{high-confidence upper bounds on the probability that a tool-selection pipeline satisfies a declared safety specification under a realistic tool distribution}. LLMCert-T models tool-selection evaluation as a Bernoulli estimation problem, drawing inserted-tool sequences from a distribution that the safety specification fixes. To evaluate robustness against realistic deployment conditions, we instantiate this distribution as a stochastic process that generates inserted-tool sequences round by round, conditioning each round on the agent's selection in the previous round. LLMCert-T aggregates the per-trial outcomes into a one-sided Clopper-Pearson upper bound on the probability that the specification is satisfied. By returning this bound as a certificate with statistical guarantees over the inserted-tool sequence distribution, LLMCert-T makes safety claims intuitive, actionable, and comparable across models, retrievers, mitigations, and registry policies. Across popular BFCL and OpenAPI tool pools, LLMCert-T shows that current LLM agents remain fragile under Distractor Selection and Top-N Saturation specifications: their certified correctness upper bounds drop to approximately 20\%, far below their clean-pool lower bounds.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。