描述与行为不一致对工具调用安全的影响

doi:10.12379/j.issn.2096-1057.2026.11.11

摘要/Abstract

摘要： 大语言模型（Large Language Model，LLM）智能体（Agent）主要依据开发者提供的自然语言描述选择调用工具，但现有智能体框架缺乏保证工具描述与实际行为一致的机制。为研究描述失真对工具调用安全的影响，本文构建了覆盖20个危险类别的受控评测基准，并设置不同失真等级及通道消融条件。在3个不同模型家族的实验中，描述失真程度与不安全调用率均呈显著正相关，虚假保证条件下的不安全调用率达到如实描述基线的2.4到5.4倍，且超过80%的不安全调用理由未显式提及风险。进一步分析表明，工具名称和参数模式中的危险信息有助于降低不安全调用率，两种基于描述的轻量级对策可使GPT在虚假保证条件下的不安全调用率相对降低37%至47%。上述结果表明，工具安全设计应在名称、描述和参数模式等多个通道中显式表达危险信息。

关键词: 大语言模型智能体；工具调用；描述—行为不一致；不安全调用率；安全基准

Abstract: LLM agents primarily rely on developer-provided natural-language descriptions when selecting tools, yet current agent frameworks lack a mechanism that guarantees consistency between tool descriptions and actual behavior. To study the safety impact of description distortion, we construct a controlled benchmark covering 20 danger categories with multiple distortion levels and channel-ablation conditions. Across three model families, greater description distortion is significantly associated with a higher Unsafe Invocation Rate (UIR). Under false reassurance, UIR reaches 2.4 to 5.4 times the honest-description baseline, and over 80% of unsafe calls contain no explicit risk-related wording in their rationales. Further analysis shows that danger signals in tool names and parameter schemas help reduce UIR, while two lightweight description-based mitigations reduce GPT's UIR under false reassurance by 37% to 47%. These results indicate that danger information should be expressed explicitly across the name, description and parameter-schema channels in tool design.

Key words: large language model agent; tool calling; description-behavior inconsistency; unsafe invocation rate; safety benchmark

中图分类号:

TP309

. 描述与行为不一致对工具调用安全的影响[J]. 信息安全研究, 2026, 12(11): 1069-1077.

Qian Hanwei, Ma Zhuo, Xia Lingling, Guan Junqi, Wang Qun. The Impact of Description-Behavior Inconsistency on Tool-Calling Safety in LLM Agents[J]. Journal of Information Security Reserach, 2026, 12(11): 1069-1077.

参考文献

[1] OWASP Foundation. MCP03:2025 tool poisoning[EB/OL]. [2026-07-12]. https://owasp.org/www-project-mcp-top-10/2025/MCP03-2025-Tool-Poisoning. [2] Sneh J, Yan R, Yu J, et al. ToolTweak: an attack on tool selection in LLM-based agents[PP/OL]. arXiv（2025-10-02）[2026-10-13]. https://arxiv.org/abs/2510.02554. [3] Blankenstein T, Yu J, Li Z, et al. BiasBusters: uncovering and mitigating tool selection bias in large language models[PP/OL]. arXiv（2025-10-01）[2026-10-13]. https://arxiv.org/abs/2510.00307. [4] Faghih K, Wang W, Cheng Y, et al. Tool preferences in agentic LLMs are unreliable[PP/OL]. arXiv（2025-05-23）[2026-10-13]. https://arxiv.org/abs/2505.18135. [5] Yeon J, Chaudhary I, Singh G. Quantitative certification of agentic tool selection[PP/OL]. arXiv（2025-10-05）[2026-10-13]. https://arxiv.org/abs/2510.03992. [6] Greshake K, Abdelnabi S, Mishra S, et al. Not what you‘ve signed up for: compromising real-world LLM-integrated applications with indirect prompt injection[C]//Proceedings of the 16th ACM Workshop on Artificial Intelligence and Security. New York: ACM, 2023: 79-90. [7] Zhang H, Huang J, Mei K, et al. Agent security bench (ASB): formalizing and benchmarking attacks and defenses in LLM-based agents[PP/OL]. arXiv（2024-10-03）[2026-10-13]. https://arxiv.org/abs/2410.02644. [8] Zharmagambetov A, Guo C, Evtimov I, et al. AgentDAM: privacy leakage evaluation for autonomous web agents[PP/OL]. arXiv（2025-03-13）[2026-10-13]. https://arxiv.org/abs/2503.09780. [9] El Yagoubi F, Al Mallah R, Badu-Marfo G. AgentLeak: a full-stack benchmark for privacy leakage in multi-agent LLM systems[PP/OL]. arXiv（2026-02-15）[2026-10-13]. https://arxiv.org/abs/2602.11510. [10] Baek H, Noh J, Seo S, et al. An evaluation of data leakage risks in tool-using LLM agents in realistic scenarios[PP/OL]. arXiv（2026-06-17）[2026-10-13]. https://arxiv.org/abs/2606.17114. [11] Wang H, Poskitt C M, Sun J. AgentSpec: customizable runtime enforcement for safe and reliable LLM agents[PP/OL]. arXiv（2025-03-24）[2026-10-13]. https://arxiv.org/abs/2503.18666. [12] Wang H, Poskitt C M, Wei J, et al. ProbGuard: proactive runtime monitoring for LLM agent safety via probabilistic prediction[PP/OL]. arXiv（2025-08-01）[2026-10-13]. https://arxiv.org/abs/2508.00500. [13] Yao S, Zhao J, Yu D, et al. ReAct: synergizing reasoning and acting in language models[C]//Proceedings of the 11th International Conference on Learning Representations. Kigali: OpenReview.net, 2023: 1-33. [14] Schick T, Dwivedi-Yu J, Dessi R, et al. Toolformer: language models can teach themselves to use tools[C]//Advances in Neural Information Processing Systems 36: Annual Conference on Neural Information Processing Systems 2023. Red Hook, NY: Curran Associates, Inc., 2023: 1-26. [15] Software Theorem. DBI-Bench: description-behavior inconsistency benchmark[EB/OL]. [2026-09-06]. https://github.com/software-theorem/DBI-Bench. [16] Model Context Protocol. Reference servers[EB/OL]. [2026-07-12]. https://github.com/modelcontextprotocol/servers. [17] ExecuteAutomation. MCP database server[EB/OL]. [2026-07-12]. https://github.com/executeautomation/mcp-database-server.