When Not to Imitate: Boundary-Aware Skill Memory for Reliable Tool-Use LLM Agents

1 Introduction

• As retrieval depth increases, success-distilled skills increase preference for semantically similar but inapplicable tools, shifting attention toward procedures without checking whether their assumptions hold.This Skill Imitation Trap can make skill memory underperform a memory-free baseline in inapplicable states.Source: §1 · pp. 1–2
• BASM improves AppWorld success rate by up to 23.8%, BFCL accuracy by up to 5.0%, and reduces AgentDojo attack success rate by 4.6%.It also reduces average AppWorld steps by up to 6.6% relative to the memory-free baseline, and Qwen3-14B achieves Pareto improvements in utility and safety.Source: §1 · p. 2
• BASM combines a seven-slot skill schema—goal, procedure, tools, applicability conditions, risk cues, avoidance rules, and recovery notes—with budgeted retrieval, boundary checking, and runtime repair.It guides agents to apply skills when assumptions hold, suppress risky tool calls when they do not, and repair local execution failures.Source: §1 · p. 2
• In risky states, success-distilled memory raises wrong-tool margin by 47% relative to memory-free, and ablating boundary-span attention recovers 69.4% of the imitation effect.Boundary fields act as a causal anti-imitation channel; the model consults them more in risky and repair states than in safe ones.Source: §1 · p. 2

Self-Evolution Agents

• Tool-use research progressed from task-independent approaches to reusable skill libraries storing successful behaviors as executable code or text.Early examples include the Reason-Act-Observe loop (Yao et al., 2022), Toolformer (Schick et al., 2023), and ToolLLM (Qin et al., 2024); skill libraries were pioneered by Wang et al. (2023) and Zhu et al. (2023).Source: §2 · p. 2
• Later approaches distilled insights and workflows or pursued reflection, online induction, hierarchical knowledge bases, RL internalization, and cross-framework sharing.These lines of work include Zhao et al. (2024), Wang et al. (2024), Shinn et al. (2023), Wang et al. (2025), Wang et al. (2026a), Lu et al. (2026b), and Tang et al. (2025). They share the premise that retrieving skills from successful experience benefits current decisions, although retrieved skills can prompt over-imitation (Wang et al., 2026a).Source: §2 · pp. 2–3

Skill Retrieval and Applicability

• Standard retrieval measures relevance rather than applicability, so similar retrieved skills lack an explicit signal for when their procedures should be suppressed.BASM adds boundary fields and a boundary relevance score to reranking and prompt formatting, making skills validity-scoped rather than unconditional action templates. It adapts initiation-set preconditions from the options framework into natural-language fields extracted from trajectories and enforced at retrieval, formatting, and execution time.Source: §2 · p. 3

3.2 Retrieval Trap

• At k = 2, success-distilled skill memory raises wrong-tool margin to 10.71, while BASM lowers it to 2.26; both configurations start at 7.31 at k = 0.The retrieval-depth reversal shows that additional procedural evidence can strengthen preference for a semantically similar but invalid tool.Source: Figure 2 · p. 4, §3.2 · p. 4

3.1 Diagnostic Setup

• The diagnostic classifies decisions as Tok, where a retrieved skill should be applied; Twrong, where a similar but inapplicable skill should be suppressed; or Trepair, where the agent should repair after failure.Wrong-tool margin measures preference for incorrect tools over correct or abstention alternatives at the first action token, before environment feedback can intervene.Source: §3.1 · p. 4

3.3 Mechanism Analysis

• BASM’s boundary-to-procedure attention ratio rises from 0.15 in Tok to 1.23 in Twrong and 1.81 in Trepair, while its wrong-tool preference on Twrong falls from 10.71 to 2.26.Same-length controls do not reproduce the state-dependent attention pattern, and their wrong-tool preferences of 6.60 and 5.14 remain above BASM’s.Source: §3.3 · pp. 4–5, Figure 3 · p. 5

3.4 Attention Knockout

• On Qwen3-8B Twrong examples, boundary-attention knockout raises wrong-tool preference by +3.45 logits and broader tool preference by +3.65 logits; control knockouts do not produce the same shift.On Qwen3-14B, knockout shifts Twrong–wrong by +0.27, Twrong–correct by +0.04, and Tok–correct by −0.11, indicating selective suppression of invalid imitation rather than a general penalty on tool use.Source: §3.4 · p. 5, Figure 3 · p. 5

4.1 Skill Schema

• Each BASM skill has seven slots: goal, procedure, tools, applicability conditions, risk cues, avoidance rules, and recovery notes.The first three slots provide procedural guidance; the remaining four define the skill’s boundary and validity scope, including when it is safe to invoke, what makes it unsafe, what to suppress, and how to correct local failures.Source: §4.1 · p. 6

4.2 Method Design

• The library is built offline from successful and failed trajectories using both plan-step and tool-invocation anchors; successful context supplies procedures, while failures supply boundary evidence.A deterministic validator checks JSON, required fields, list-valued boundary slots, non-empty risk cues and avoidance rules, and tool-schema validity; candidates still invalid after retry are discarded.Source: §4.2 · p. 6
• BASM retrieves skills using semantic relevance, tool overlap, and step/goal overlap, then exposes procedures within a fixed token budget and boundaries only when relevant to the current state.The formatter always exposes each skill’s goal, procedure, and tools; it includes boundary fields only when their relevance score exceeds a threshold.Source: §4.2 · pp. 6–7
• At execution, a boundary checker blocks or revises proposed tool calls that violate applicability conditions, match avoidance rules, or repeat known failures.It checks deterministic string and schema rules first, reserving LLM-assisted judgment for ambiguous natural-language conditions.Source: §4.2 · p. 7
• In stateful multi-turn settings, recovery notes trigger targeted repair hints after a local failure instead of retrieving the full skill set again.In single-turn settings, recovery notes can guide tool selection, but there is no execution loop for issuing a repair action.Source: §4.2 · p. 7

5.1 Setup

• The evaluation covers BFCL v3’s 800 multi-turn function-calling instances, AppWorld’s 168 stateful tasks, and AgentDojo’s tool-knowledge prompt-injection attacks.BFCL’s miss_func and miss_param subsets test rejection of semantically similar but inapplicable calls; AgentDojo reports Utility and Attack Success Rate (ASR).Source: §5.1 · p. 7

5.2 Main Results

• For Qwen3-8B and Qwen3-14B, BASM beats the strongest skill-memory baselines on BFCL and AppWorld; on AgentDojo, it reduces ASR most at 8B and yields Pareto improvements at 14B.At 8B, the ASR reduction comes with a minor utility cost; at 14B, BASM has both the highest utility and lowest ASR among memory configurations.Source: Table 3 · p. 7, §5.2 · p. 8

5.1 Setup

• Experiments use four Qwen backbones with thinking mode disabled and compare Base, Proc. Skill, App. Skill, and full BASM under a shared retrieval substrate and evaluation pipeline.BASM adds applicability conditions, risk cues, avoidance rules, and recovery notes; temperature is 0.001.Source: §5.1 · pp. 7–8

5.2 Main Results

• On Qwen3-32B, BASM reaches 76.19% AppWorld success versus Proc. Skill’s 66.07%, while reducing average steps by 6.0% relative to Base (12.46 to 11.71).BASM also achieves the best aggregate BFCL accuracy on this model, with its largest margin on Miss Func.Source: §5.2 · p. 8
• On Qwen3.5-397B-A17B, BASM scores 53.75 on BFCL versus Proc. Skill’s 53.38 and reaches 54.76% AppWorld success versus 52.98%.Average AppWorld steps fall by 6.6% relative to Base (13.50 to 12.61).Source: §5.2 · p. 8

5.3 Ablation Study

• Boundary prompting and runtime repair are complementary: Prompt-BASM nearly matches BASM on BFCL, but BASM reaches 36.31% AppWorld success versus Prompt-BASM’s 29.17%.Repair-Only remains at Base on BFCL (34.13%) and falls below Base on AppWorld (25.60% vs. 29.76%); without boundary guidance, repair can disrupt multi-step execution.Source: §5.3 · p. 8
• Removing avoidance rules or recovery notes worsens results, while applicability conditions alone improve BFCL over Proc. Skill but raise AgentDojo ASR.Removing avoidance lowers BFCL by 0.88 points, leaves AppWorld unchanged, lowers AgentDojo utility from 35.93 to 30.87, and raises ASR from 5.90 to 6.95. Removing recovery lowers BFCL by 1.88 points and AppWorld by 2.38 points, lowers utility to 31.82, and raises ASR to 6.85. App. Skill improves BFCL over Proc. Skill by 1.37 points but raises ASR by 0.53 points.Source: §5.3 · p. 8

6 Conclusion

• BASM improves task success by up to 23.8% on AppWorld, function-calling accuracy by up to 5.0% on BFCL, and reduces attack success rate by 4.6% on AgentDojo; average AppWorld steps decrease by up to 6.6% versus the memory-free baseline.The benchmark evaluations span model scales from 8B to 397B.Source: §6 · pp. 8–9
• Without explicit validity boundaries, retrieved skills can amplify wrong-tool preference; BASM adds applicability, risk, avoidance, and recovery fields enforced at retrieval, prompt formatting, and execution.These fields make skill reuse state-conditioned rather than unconditional imitation.Source: §6 · p. 8
• Knockout probes attribute wrong-tool suppression to boundary-span attention, while ablations show complementary benefits from boundary-conditioned prompting and runtime repair.The probes rule out prompt length and added context as the cause of wrong-tool suppression.Source: §6 · p. 9

Limitations

• The evaluation focuses on text-based tool-use agents in benchmarked environments, leaving multimodal agents, changing tool APIs, and long-running workflows with delayed feedback for future study.The current setting covers tasks whose goals, observations, and tool feedback can be expressed in natural language.Source: Limitations · p. 11
• BASM represents boundary conditions as explicit natural-language fields; future work could explore compact or adaptive representations for tighter context budgets.The explicit fields make the current mechanism interpretable and easy to inspect.Source: Limitations · p. 11
• The evaluation emphasizes autonomous tool use, adversarial-instruction safety, and interaction efficiency; human-agent collaboration and personalized tool preferences remain to be studied.Such analysis could clarify adapting boundary-aware memories across users and deployment settings.Source: Limitations · p. 11
• Broader deployment with high-impact tools may raise risks without appropriate permissioning, audit logging, or human approval.BASM is designed to make tool use more state-aware and easier to inspect.Source: Limitations · p. 11
• The work uses public benchmarks and environments under their licenses and terms, and associated released materials will include license information without redistributing third-party artifacts beyond their permissions.Source: Limitations · p. 11

Artifact Use

• Benchmark-derived artifacts are intended for research and should not be redistributed or deployed beyond the original artifacts’ licenses and access terms.The authors also screen derived artifacts for identifying information, credentials, API keys, unique user identifiers, and offensive content, removing, anonymizing, or excluding detected sensitive fields.Source: Artifact Use · pp. 11–12
• The experiments use no real user data, relying instead on public benchmark environments and model-generated trajectories.The work does not collect human-subject data, recruit participants, conduct paid annotation or user studies, or intervene with human participants.Source: Artifact Use · pp. 11–12
• Evaluation uses official benchmark partitions and scripts, with default evaluator settings unless otherwise stated, and introduces no new data splits or human-collected dataset.The stated scripts are for BFCL v3, AppWorld, and AgentDojo v1.2.2.Source: Artifact Use · p. 12
• AI assistants supported language editing and drafting of some non-technical text, while authors reviewed and approved the research, results, analysis, and final manuscript.AI assistants did not generate experimental results or replace author judgment.Source: Artifact Use · p. 12

• BASM pairs each stored procedure with its boundary of validity, addressing imitation of retrieved procedures in semantically similar but inapplicable states.Source: A Additional Experiments · p. 12
• The probes examine decision-token attention, next-action logits, same-prompt intervention, and realized call behavior.Source: A Additional Experiments · p. 12
• Boundary fields act as a state-conditioned attention modulator, preserving procedural recall in Tok while suppressing overconfident imitation in Twrong and guiding recovery in Trepair.Source: A Additional Experiments · p. 12

A.1 Mechanism Replication and Logit Evidence

• Equal-length padding controls preserve prompt length and schema position but fail to reproduce BASM’s risk-sensitive boundary/procedure profile, ruling out token-count, slowdown, and formatting explanations.The qualitative attention pattern also holds across the 8B and 14B backbones, though its magnitude may differ.Source: §A.1 · p. 12, Figure 4 · p. 13
• Under BASM, decision-token attention shifts from procedure to boundary fields in risky and repair states; safe states read less boundary information.The same qualitative state pattern appears for Qwen3-8B and Qwen3-14B.Source: §A.1 · p. 12, Figure 4 · p. 13
• On Twrong, wrong-tool margin falls from 10.71 with Proc. Skill to 2.26 with BASM, versus 6.60 with irrelevant padding and 5.14 with procedure padding.The reduction beyond the equal-length controls supports explicit boundary semantics as a stronger suppression signal than added context or schema regularity alone.Source: §A.1 · p. 13
• BASM reduces the tool-vs-control margin from 14.24 with Proc. Skill to 5.20, lowering commitment to inappropriate tool actions when a retrieved skill should be rejected.This supports lack of a boundary around skill reuse, rather than lack of skill knowledge, as the failure mode.Source: §A.1 · p. 13

A.2 Same-Prompt Knockout Evidence

• Random same-length and procedure-span masks do not restore imitation, showing that decision-token access to the boundary span—not generic context deletion—is the anti-imitation channel.BASM also reduces both the specific wrong-tool margin and broader tool-vs-control margin more than equal-length controls.Source: §A.2 · p. 13, Figure 5 · p. 13, Figure 6 · p. 13
• Under same-prompt boundary-attention knockout, the wrong-tool margin rises +3.45 logits, recovering 69.4% of the Proc. Skill gap for wrong-tool margin and 41.0% for broader tool margin.The broader tool margin rises in the same direction under the intervention.Source: Figure 6 · p. 13, §A.2 · p. 13
• On Qwen3-14B, boundary knockout again raises the Twrong wrong-tool margin, while changing the Twrong correct-tool margin only slightly and moving Tok correct-tool margin oppositely.The effect is smaller than on Qwen3-8B, consistent with a more distributed boundary-evidence route in the larger model.Source: Figure 7 · p. 14, §A.2 · p. 14

A.3 Where the Boundary Signal Appears

• In Twrong at k = 2, BASM’s boundary/procedure attention is concentrated in identifiable heads, especially in middle and later layers, rather than spread uniformly across the prompt.This pattern is consistent with a state-conditioned modulator that changes how much the decision token trusts the procedure without erasing it.Source: Figure 8 · p. 14, §A.3 · p. 14
• Candidate heads increase their boundary/procedure log-ratio from Tok to Twrong, identifying state-sensitive pathways while span-level knockout remains the direct causal test.The head ranking is a mechanistic signature; it does not replace the span-level evidence for the information channel used by the decision token.Source: §A.3 · p. 14, Figure 9 · p. 15

A.4 Boundary Mechanism, Behavior, and Control Comparisons

• Task-disjoint linear probes do not isolate a stable, uniquely stronger BASM applicability feature, supporting dynamic decision-token attention to boundary text over a static hidden-state label.BASM keeps boundaries available as contextual evidence for the moment of action selection, when the current state may not satisfy a retrieved procedure’s preconditions.Source: Figure 10 · p. 15, §A.4 · p. 15
• Proc. Skill keeps wrong-call rates high as retrieval depth rises, while BASM lowers them at risky depths without relying on a generic no-tool bias.In these states, the desired action may be to avoid the retrieved tool, choose a control action, or wait for a repair path.Source: Figure 11 · p. 15, §A.4 · p. 15
• On BFCL, BASM and procedure padding have balanced paired wins, while BASM wins more examples on stateful, multi-step AppWorld.The contrast is consistent with boundary fields helping when interaction requires checking applicability, recognizing risk cues, or repairing local failures; extra procedure text can still help with ordinary function selection.Source: Figure 12 · p. 16, §A.4 · p. 16

Appendix takeaway.

• Across appendix analyses, risky- and repair-state boundary reading suppresses wrong-tool preference, while removing boundary attention pushes the model back toward imitation.Together with the head, probe, call-rate, and paired-outcome analyses, the results support the conclusion that reliable memory must tell an agent when not to imitate.Source: Appendix takeaway · p. 16