提出因果验证框架CIVeX，确保语言代理的工具调用真有因果效果。
CIVeX: Causal Intervention Verification for Language Agents
- 构建动作-状态图，用因果查询验证操作是否可识别因果效应
- 在1890个任务中零误执行，对抗干扰下准确率达84.9%
- 适合需要高可靠性工具调用的生产级智能体系统
有效的工具调用不等于有效的干预。语言代理虽受模式校验、策略过滤、溯源检查、状态预测和自验证保护，但这些措施无法确认状态改变动作具有可识别的因果效应。在混杂工作流中，看似最优的操作在执行后可能降低效用。我们提出CIVeX，一个因果干预验证器，将提议动作映射到已承诺动作-状态图上的结构因果查询，检查可识别性，并返回四种可审计结论：执行、拒绝、实验或回避。执行需满足假设范围内的因果证书，包含图承诺、识别论证、单边下置信界（LCB）、溯源信息和风险上限。在Causal-ToolBench（1,890实例，7种子）上，CIVeX在中度与对抗性混杂下实现零观测误执行。对抗性混杂下，准确率达84.9%，达到81.1%的奥兰多效用（对比奥兰多基准+2.76），且是唯一在零误执行约束下优于始终回避策略的非奥兰多方法。在IHDP与ZOZO Open Bandit（真实生产日志，均匀随机真值）上，CIVeX在正确执行率上匹配奥兰多（误差<0.1pp），且每执行一次的误执行率较朴素基线降低≥50倍。链式思考大模型验证器（Claude Opus, Sonnet）使误执行减少一个数量级，但在对抗性混杂下，Opus效用降至CIVeX的74%。干预可识别性，而非动作有效性，是可靠工具使用缺失的关键基础。
原文摘要 · Abstract (English)
A valid tool call is not necessarily a valid intervention. Tool-using language agents are guarded by schema validators, policy filters, provenance checks, state predictors, and self-verification, yet such safeguards do not certify that a state-changing action has an identifiable causal effect. In confounded workflows, the action that looks optimal in observational logs can reduce utility when executed. We introduce CIVeX, a causal intervention verifier that maps proposed actions to structural causal queries over a committed action-state graph, checks identifiability, and returns one of four auditable verdicts: EXECUTE, REJECT, EXPERIMENT, or ABSTAIN. Execution requires an assumption-scoped causal certificate carrying graph commitments, an identification argument, a one-sided lower confidence bound (LCB), provenance, and risk limits. On Causal-ToolBench (1,890 instances, 7 seeds), CIVeX yields zero observed false executions across moderate and adversarial confounding. Under adversarial confounding it reaches 84.9% accuracy and 81.1% of oracle utility (+2.23 vs +2.76) and is the only non-oracle method whose constrained utility under a zero-false-execution constraint exceeds the AlwaysAbstain floor. On IHDP and ZOZO Open Bandit (real production logs with uniform-random ground truth), CIVeX matches Oracle correct-execution within 0.1pp and cuts per-execute false-execution by >=50x over naive baselines. A chain-of-thought LLM verifier (Claude Opus, Sonnet) cuts false-execution by an order of magnitude over a terse baseline, yet under adversarial confounding Opus's utility falls to 74% of CIVeX's. Intervention identifiability, not action validity, is the missing primitive for reliable tool use.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。