When History Lies: Evaluating and Improving Tool Us...

When History Lies: Evaluating and Improving Tool Us... | AI Research

Key Takeaways

When History Lies: Evaluating and Improving Tool Use under Misleading Multi-Turn Histories investigates why tool-calling language models often fail when pres...
Tool-calling agents infer task state from accumulated dialogue and tool traces.
In persistent interactions, however, historical traces may remain structurally valid and semantically plausible after they cease to be authoritative for the current request.
We introduce bench, a paired benchmark with synchronized Original, Polluted, and Oracle State views that preserve the system policy, current tools, latest request, and gold next action.
Eleven gold-preserving interventions isolate failures in decision state, entity binding, and interface execution across complete calls and non-call decisions.

Paper AbstractExpand

Tool-calling agents infer task state from accumulated dialogue and tool traces. In persistent interactions, however, historical traces may remain structurally valid and semantically plausible after they cease to be authoritative for the current request. We show that such history can hijack a policy the model already possesses: on Qwen3-1.7B, pollution flips 32.1% of decisions that are correct under the original trajectory and frequently induces reuse of corrupted entities or interface conventions. We introduce bench, a paired benchmark with synchronized Original, Polluted, and Oracle State views that preserve the system policy, current tools, latest request, and gold next action. Eleven gold-preserving interventions isolate failures in decision state, entity binding, and interface execution across complete calls and non-call decisions. We further propose ours, which transfers an Oracle-conditioned teacher policy to a student observing only polluted history through soft supervision on student-generated prefixes. On Qwen3-1.7B, ours achieves 87.0% Balanced Tool-Use Accuracy, outperforming Gold-SFT (66.3%), Oracle sequence distillation (82.3%), and off-policy token distillation (85.0%). The method scales consistently: an 8B teacher raises the same compact 1.7B student to 91.9%, while an 8B student reaches 93.0%. The resulting policies further transfer to clean histories, unseen functions, independently regenerated evaluation contexts, external tool-use benchmarks, and noisy multi-hop question answering. These results establish history reliability as a distinct tool-use bottleneck and demonstrate reliable-state policy transfer as an effective and scalable solution.

When History Lies: Evaluating and Improving Tool Use under Misleading Multi-Turn Histories investigates why tool-calling language models often fail when presented with interaction histories that contain outdated or irrelevant information. The authors identify a phenomenon called "history-induced policy hijacking," where models are distracted by structurally valid but non-authoritative traces in the conversation history, leading them to make incorrect tool-use decisions even when they possess the correct policy.

The Problem: History-Induced Policy Hijacking

In many real-world deployments, language models operate on long, accumulating interaction records. The researchers found that these histories can contain failed tool calls, obsolete entities, or incorrect interface conventions that remain syntactically plausible. When a model encounters these, it may prioritize the misleading historical precedent over the current, valid request. On the Qwen3-1.7B model, the authors observed that this pollution flips 32.1% of decisions that the model would have otherwise handled correctly.

ContextPollute-Bench

To measure this, the authors introduced ContextPollute-Bench, a benchmark that uses synchronized views of the same task:

Original: The standard, untouched interaction history.
Polluted: A version containing inserted, misleading, but structurally valid traces.
Oracle State: A view containing only the reliable, decision-relevant information, excluding misleading data.
By keeping the system policy, available tools, and the latest user request identical across these three views, the benchmark isolates whether a model is being actively misled by history or if it simply lacks the necessary capability to perform the task.

Oracle-Guided On-Policy Distillation

To mitigate this, the authors proposed Oracle-Guided On-Policy Distillation (Oracle-OPD). This method trains a student model to ignore misleading history by using a frozen "teacher" model that is conditioned on the clean Oracle State.
During training, the student generates responses based on polluted history, and the teacher provides soft, token-level supervision based on the Oracle State. This allows the student to learn a policy that prioritizes reliable evidence over historical noise. At deployment, the student no longer requires the teacher or the Oracle State, relying only on the standard interaction history.

Performance and Scalability

The researchers reported that Oracle-OPD significantly improves tool-use accuracy. On the Qwen3-1.7B model, Oracle-OPD achieved an 87.0% Balanced Tool-Use Accuracy, outperforming standard supervised fine-tuning (66.3%) and other distillation methods.
The approach also scales effectively: when using an 8B parameter teacher, the 1.7B student’s performance rose to 91.9%. Furthermore, the authors found that the policies learned through this method transferred successfully to clean histories, unseen functions, and external tool-use benchmarks, suggesting that the model learns a robust, reliable-state policy rather than a specific rule for correcting individual errors.