Misleading Histories Hijack Tool-Calling Agents: New Benchmark and Intervention
A recent paper on arXiv (2608.06057) discusses how tool-calling agents in ongoing multi-turn interactions can be misled by historical data that, while structurally sound and semantically reasonable, lacks authority for the current request. The authors illustrate that this 'polluted' history can distort an existing policy, with Qwen3-1.7B showing a 32.1% shift in correct decisions based on the original trajectory, often leading to the reuse of tainted entities or interface norms. To combat this issue, they present a paired benchmark featuring synchronized Original, Polluted, and Oracle State views, which maintain the system's policy, current tools, latest request, and ideal next action. Additionally, they suggest eleven interventions to identify failures in decision-making, entity binding, and interface execution. Lastly, they introduce a technique for transferring an Oracle-conditioned teacher policy to a student that only sees the polluted history, aimed at enhancing robustness. The paper can be accessed via arXiv with the identifier 2608.06057.
Key facts
- Tool-calling agents infer task state from accumulated dialogue and tool traces.
- Historical traces may remain structurally valid and semantically plausible after ceasing to be authoritative.
- Pollution flips 32.1% of decisions correct under the original trajectory on Qwen3-1.7B.
- Pollution induces reuse of corrupted entities or interface conventions.
- A paired benchmark with Original, Polluted, and Oracle State views is introduced.
- Eleven gold-preserving interventions isolate failures in decision state, entity binding, and interface execution.
- A method transfers an Oracle-conditioned teacher policy to a student observing only polluted history.
- Paper is available on arXiv under identifier 2608.06057.
Entities
Institutions
- arXiv