用特殊探针工具诊断大模型选工具时的思维漏洞，发现越强模型越少犯错。
Diagnosing Tool-Selection Reasoning in LLM Agents with Canary Tools
- 设计六类探针工具，精准检测模型选工具时的六大认知缺陷
- 模型越强越少犯错，顶级模型犯错率是最低模型的36倍
- 探针能真实反映推理能力，不依赖关键词识别，适合安全评估
代理评估只能告诉我们模型选错了工具，却很少说明原因。本文引入‘探针工具’：植入模型上下文协议（MCP）工具集中的诊断工具，每类针对一种特定的工具选择弱点。提出六类分类体系（语义诱饵、参数陷阱、能力幻觉、前置条件盲区、时间诱饵、粒度陷阱），将单一‘选错工具’结果转化为多维推理缺陷画像。在120个任务上，对八种模型（六种托管、两种8B开源）进行三类探针密度与三组随机种子测试（共8,640次运行），另加2,880次细微性消融实验。任务成功由独立裁判评估，一致性系数Cohen's kappa=0.75。主要发现：第一，模型越强，越不易被攻破，任务级探针敏感率（CSR）跨模型差约36倍，最低为Claude Opus 4.8，最高为Llama 3.1 8B；第二，能力层级无法预测安全性，中等水平托管模型最脆弱，同一厂商中便宜模型反而更安全；第三，该分类体系具备能力分层特性：能力幻觉专攻前沿模型，其余类型对强模型基本无效，仅在小型开源模型上触发，因此可有效区分模型能力。削弱探针提示词后，前沿模型的敏感率几乎不变，证明其测量的是深层推理而非关键词匹配。敏感度还与任务失败显著相关（Spearman rho = -0.34），而最强模型在探针压力下性能无明显下降。论文公开框架、探针模板、任务和日志。
原文摘要 · Abstract (English)
Agent evaluations tell us that a model picked the wrong tool, but rarely why. We introduce canary tools: diagnostic probe tools planted in an agent's Model Context Protocol (MCP) tool set, each engineered to probe one specific tool-selection weakness. A six-type taxonomy (semantic decoys, parameter traps, capability mirages, prerequisite blindness, temporal decoys, and granularity traps) turns a single "wrong tool" outcome into a multi-dimensional profile of how a model reasons about tools. We evaluate eight models -- six hosted and two 8B open-weight -- spanning three capability tiers, on 120 tasks across three canary-density conditions and three seeds (8,640 runs), plus a 2,880-run subtlety ablation. Task success is graded by a provider-independent judge, corroborated by a second independent judge (Cohen's kappa = 0.75). We report three findings. First, susceptibility drops sharply as models get more capable: the per-task canary susceptibility rate (CSR) ranges about 36x across models, lowest for Claude Opus 4.8 and highest for Llama 3.1 8B. Second, capability tier alone does not predict safety: the most susceptible hosted model is mid-tier, and within a provider the cheaper model can be the safer one. Third, the taxonomy is capability-stratified: capability mirages most reliably trap frontier models, while the other types are largely inert on strong models but fire on small open models, so they discriminate by capability rather than being weak. Softening each canary's give-away phrase leaves frontier CSR essentially unchanged, evidence that the probes measure reasoning, not phrase-spotting. Susceptibility also predicts task failure (Spearman rho = -0.34), while the most robust models are not significantly degraded by canary pressure. We release the framework, canary schemas, tasks, and logs.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。