每天早上一封邮件，把昨天的 AI 梳理好订阅邮件

METAL LAB

Outcome Monitors: Recovery Affordances for Silent Tool Failures

arXiv:2608.193032026-08-21

给AI智能体加一张不带强制力的提醒条,让它在悄悄出错时也能找到出路,任务完成率翻了一倍多

AI智能体能发现工具调用超时这类明显故障,但对格式正常、内容却是错的结果,比如缓存的错误页面或负数价格,往往会当作事实直接采信。研究者提出了Outcome Monitors,它依据从无故障历史记录或公开API规范中提炼出的规则来检查工具返回结果,一旦违规,就保留原始结果并附上一张不具强制力的提醒,说明哪个属性出了问题、以及有哪些可用的替代工具,最终选择权仍留给智能体。在多个模型和基准测试中,任务完成率明显提升,而效果的关键并非诊断细节的多少,而是有没有告诉智能体具体能换用哪些工具。

他们做了什么

  1. 问题背景:智能体能察觉超时之类的明显失败,但对格式正常、内容错误的'悄悄失败'(如缓存错误页、负数价格)容易信以为真
  2. 方法:从与任务无关的历史正常执行记录或公开API规范中自动提炼出结果应满足的规则(outcome contract);一旦违规,保留原始结果不变,只附加一张不具强制力的提醒,标明违反的属性名和可用的公开替代工具,不阻止行动也不代为修复
  3. 结果:在ToolMaze基准上,来自两个不同厂商的四个模型平均任务完成率从10.9%提升到28.1%,并在第三个厂商的模型(MiniMax M3)上得到复现;在模拟零售场景的tau-bench测试中,两档难度下完成率分别提升14.0和12.0个百分点
  4. 验证:如果从提醒中去掉'可用替代工具列表',效果就消失,恢复列表后效果又回来;而增加诊断细节或改变提醒出现的时机都没有带来可检测到的差异,说明真正起作用的是告诉智能体能换哪些工具
  5. 局限:在依据真实生产事故案例改编的测试集中,对于提炼规则词汇之外的新型错误,检测率降到46%,不过结果依然会正常传递,整体任务完成率没有受到影响
Figure 1: A raw interface leaves detection, localization, and recovery with the agent. Detect and advise instead flags a contract violation and appends an advisory receipt carrying a diagnostic witness and a list of available recovery tools. It neither removes actions nor selects a repair. Controls (Section 5) identify the recovery-tool list, not the property-specific witness, as the active content in our tested sample.
Figure 1: A raw interface leaves detection, localization, and recovery with the agent. Detect and advise instead flags a contract violation and appends an advisory receipt carrying a diagnostic witness and a list of available recovery tools. It neither removes actions nor selects a repair. Controls (Section 5) identify the recovery-tool list, not the property-specific witness, as the active content in our tested sample.
Table 1: Conceptual comparison of recovery interfaces. Shaded cells mark where a strategy differs from the Outcome Monitor row, which serves as the reference; the shading locates design differences and does not rank them. The table characterizes mechanisms, not measured superiority.
StrategyTriggerGroundingLocalized witnessRestricts actionsExtra tool reads
Generic cautionlearned detector eventexternal invariantnonono
Self-critiquemodel’s own judgmentinternaluncertainnooptional
Always verifyevery advertised readnone (fixed policy)only after comparisonnoyes
Hard guardmonitor-detected eventexternal ruleyesyesno
Outcome Monitorlearned detector eventexternal invariantyesnono
Table 2: Frozen paired ToolMaze completion. The four-model primary aggregate clusters shared tasks; MiniMax M3 is a separately frozen third-family replication and is not pooled. Δ is in percentage points; W/L counts discordant pairs. All models run with extended reasoning disabled. Primary task-cluster sign-flip p<.00001; 95% bootstrap interval [11.25,23.44].
FamilyModelBaseMonitorΔW/L
DeepSeekV4 Flash14/8027/80+16.2515/2
DeepSeekV4 Pro13/8023/80+12.5014/4
Qwen3.7 Plus3/8015/80+15.0012/0
Qwen3.7 Max5/8025/80+25.0021/1
Primary aggregate35/32090/320+17.1962/7
MiniMaxM3 replication5/8020/80+18.7517/2

为什么重要

随着AI智能体越来越多地自动调用外部工具完成实际工作,已有案例显示它们会把损坏或过期的数据误当作事实,得出看似自信实则错误的结论。这项研究展示了一种无需额外训练、无需多调用模型、成本很低且效果可验证的方法,能大幅减少这类问题。

本文术语

  • Outcome Contract · 正常工具返回结果应当满足的规则,自动从无故障的历史执行记录或公开API文档中提炼得到
  • Outcome Monitors · 本论文提出的系统,用于检查工具返回结果是否违反outcome contract,并在违反时附加不具强制力的提醒
  • 悄悄失败(Silent Tool Failure) · 不像超时那样明显,而是结果格式正常但内容错误的失败类型
  • ToolMaze / tau-bench / AppWorld · 用于测试AI智能体调用外部工具完成任务能力的基准测试环境
  • 复原可用项(recovery affordance) · 出现问题时智能体实际可以选用的替代工具或操作

论文原文摘要（英文）

When a tool call times out, the agent sees the failure and can route around it. A cached error page or negative price can instead arrive in the expected format and be consumed as fact. We introduce Outcome Monitors, which detect violations of outcome contracts mined from task-disjoint traces or derived from public schemas. On a violation, the monitor preserves the result and issues a nonbinding receipt naming the violated property and public recovery tools. In frozen, prespecified evaluations with injected failures, Outcome Monitors raise ToolMaze completion from 10.9% to 28.1% across four models in two provider families and replicate in a third. In tau-bench retail, completion improves by 14.0 and 12.0 points on two tiers. In separate ToolMaze controls, removing the recovery-tool list eliminates the measured gain and restoring it recovers the effect; diagnostic detail and timing produce no detectable differences. Gains concentrate where the fault blocks completion. On a suite transcribed from a published incident taxonomy, detection outside the mined vocabulary falls to 46%, though delivery continues and completion is unchanged. Recovery tools are the active receipt content in these controls; extending detection beyond the contract vocabulary remains open.

作者 · Sugam Panthi, Rabab Abdelfattah

在 arXiv 阅读

最新论文

全部论文 →

METAL LAB 最新报道

图片来源： Sugam Panthi et al., arXiv:2608.19303, CC BY 4.0