PaperlayerView exact revision on arXiv

Source-linked AI summary

ToolRobustBench: Stage-Wise Perturbation Evaluation and Failure Diagnosis for Tool-Calling Agents

YiShan Zheng, Yuan Wu, Yi Chang

arXiv:2608.23635v1cs.SEcs.AI

TL;DR

Clean end-to-end success cannot reveal where tool-use failures originate or how they propagate across the call process. ToolRobustBench evaluates stage-aligned perturbations with cascade-aware attribution, finding sharp robustness degradation under observation perturbations and non-additive mixed-family failures.

  • Problem

    Clean final accuracy cannot identify where tool-use failures begin or distinguish upstream causes from downstream symptoms.

  • Method

    ToolRobustBench uses controlled, stage-aligned perturbations and cascade-aware attribution to measure failure locations and propagation.

  • Results

    Across 15,456 single-family instances and mixed-family perturbations, robustness drops sharply, with tool-output/observation handling the main bottleneck and mixed-family robustness not captured by isolated results.

  • Takeaways & Limitations

    Tool-use evaluation should combine clean success, stage-localized perturbations, and cascade-aware attribution, including targeted cross-stage interactions.

  • Takeaways & Limitations

    The controlled benchmark uses deterministic local tools, does not test long-horizon planning or persistent state, and samples only representative mixed-family combinations.

Abstract

from arXiv · show

Large language models (LLMs) rely on tool calling as a fundamental agent capability, enabling them to invoke external systems and complete tasks beyond text generation. However, clean end-to-end (E2E) success cannot identify where a tool-use failure originates or how it propagates through a call. We introduce ToolRobustBench, a stage-wise diagnostic benchmark for tool-calling agents, where a tool-calling agent is an LLM system that selects a tool, supplies structured arguments, and interprets its returned feedback. ToolRobustBench aligns four perturbation families with the tool-use pipeline: tool-interface, user-intent, tool-output/observation, and runtime-environment perturbations. It attributes failures to tool selection, schema grounding, argument binding, tool-output/runtime-feedback handling, and E2E task success. Experiments on 15,456 single-family instances across 7 models, 16 sampled local tools, 4 perturbation families, and 14 subtypes show high but non-uniform clean performance and substantial robustness degradation, with tool-output/observation perturbation the dominant bottleneck. Mixed-family experiments reveal non-additive failure patterns that are not explained by isolated single-family results. Thus, ToolRobustBench provides a deterministic and cascade-aware benchmark for diagnosing robustness beyond clean tool-calling accuracy;

1 Introduction

ToolRobustBench evaluates tool-calling robustness with stage-aligned perturbations and cascade-aware attribution, identifying where failures first arise and how they propagate. Across isolated and mixed perturbations, it finds observation handling to be the main bottleneck and mixed-family robustness to exceed what single-family results predict.

  • Problem setting: Tool calling requires inferring user intent, selecting a tool, binding structured arguments, and interpreting returned results or execution feedback, each of which can be disrupted in deployment.Perturbations include opaque tool identifiers, overlapping descriptions, indirect or inconsistent requests, schema drift, missing evidence, misleading candidates, and runtime faults.
  • Stage-aligned perturbation taxonomy: ToolRobustBench introduces four stage-aligned perturbation families: tool-interface, user-intent, tool-output/observation, and runtime-environment.Each family enters at a distinct point in the tool-calling pipeline.
  • Cascade-aware error attribution: The benchmark distinguishes observed symptoms from primary errors, earliest failed stages, source stages, and boundary violations to avoid misattributing downstream failures.For example, incorrect arguments may originate in argument binding or earlier tool-selection confusion, while runtime failures may result from corrupted arguments.
  • Deterministic and reproducible evaluation: The evaluation uses sampled local tools with stable gold arguments, expected results, and attribution signals, providing reproducible stage-localized explanations beyond clean final accuracy.This controlled design avoids volatility from live APIs and complements existing tool-use benchmarks.
  • Evidence on isolated and combined robustness: Across 15,456 single-family instances and mixed-family perturbations, observation handling is the main bottleneck, while mixed-family robustness is not captured by the weaker constituent family alone.The benchmark provides evidence on both isolated and combined robustness.

2 Related Work

Prior work evaluates general capabilities, tool calling, interactive agents, robustness, and failure attribution. ToolRobustBench complements these directions with deterministic, stage-localized, cascade-aware diagnosis under controlled perturbations inside single tool-calling episodes.

  • Tool-calling evaluation: API-Bank (Li et al., 2023), ToolBench (Qin et al., 2024), Gorilla’s APIBench (Patil et al., 2024), ToolAlpaca, StableToolBench (Guo et al., 2024), and BFCL broaden tool-calling evaluation across selection, invocation, generalization, stability, and agentic settings.These benchmarks extend evaluation beyond question answering toward API retrieval, tool selection, argument binding, changing API collections, unseen tools, simulated APIs, and serial, parallel, or agentic function calling.
  • Tool-calling evaluation: ToolRobustBench targets controlled tool-interface, user-intent, tool-output/observation, and runtime-environment perturbations rather than unperturbed tool-calling performance alone.This adopts the reproducibility motivation of StableToolBench (Guo et al., 2024) while shifting evaluation toward perturbation-based diagnosis.
  • Agent-process evaluation: AgentBench (Liu et al., 2024), WebArena (Zhou et al., 2024), ToolSandbox (Lu et al., 2025), and τ-bench evaluate interactive or stateful agent behavior.Their evaluations depend on state updates, action sequences, and trajectory quality, whereas ToolRobustBench uses deterministic single-step tasks to isolate observation recovery and runtime-state judgment.
  • Noise-robustness evaluation: AgentNoiseBench (Wang et al., 2026) and RoTBench (Ye et al., 2024) study realistic or multi-level robustness, while ToolRobustBench provides stage-localized, cascade-aware diagnosis under controlled perturbations.The broader evaluation literature includes MMLU (Hendrycks et al., 2021), BIG-bench (BIG-bench authors, 2023), HELM (Liang et al., 2023), and survey synthesis by Chang et al. (2024).
  • Failure attribution and agent safety: Who&When (?) attributes trajectory-level failures to agents and steps, whereas ToolRobustBench attributes failures within a single tool-calling episode to pipeline stages under controlled perturbations and deterministic scoring.AgentHarm (?) instead evaluates whether agents comply with harmful multi-step tasks, marking a distinct safety focus.

3 Design of ToolRobustBench

ToolRobustBench models each deterministic tool-calling instance with explicit gold targets, perturbation metadata, and stage-wise success criteria. Its four perturbation families and five capability axes support deterministic, cascade-aware attribution within a single tool-calling episode.

  • Instance representation: Each instance specifies a user request, candidate tool registry, gold tool, structured arguments, deterministic output, expected result, and perturbation family, subtype, and severity.Tools expose names, descriptions, JSON schemas, deterministic executors, and output formats.
  • Evaluation protocol: The benchmark evaluates pre-execution calls and post-execution recovery from perturbed returned evidence or runtime feedback within one tool-calling episode.It does not model persistent state repair across multiple user turns or chains of dependent tool calls.
  • Cascade-aware attribution: Deterministic backtracking records observed and primary errors, earliest failed and source stages, cascade indicators, and boundary violations to separate downstream symptoms from upstream causes.Boundary violations are flagged only when the attributed source lies outside the expected primary and allowed spillover sets, without using an LLM judge.
  • Diagnostic axes: Five axes—S1 tool selection, S2 schema grounding, S3 argument binding, S4 output or runtime-feedback handling, and S5 E2E success—locate the earliest source of failure.Success is binary and requires agreement with gold tool, arguments, applicable execution output, and final result; runtime cases additionally check predicted runtime fields.
  • Perturbation families: Four perturbation families target interface cues, user-intent expression, returned observations, and runtime execution feedback, with 14 subtypes and clean, light, medium, and heavy conditions.Runtime diagnostics include status, failure type, retryability, and the final result retained after interpreting feedback.

4 Experimental Setup

ToolRobustBench is constructed as a reproducible, stage-aligned benchmark over deterministic local tools, paired clean anchors, and controlled perturbations. Its main evaluation spans 7 models and 15,456 single-family records, with stratified severity conditions and human validation of automatic scoring.

  • Deterministic local-tool environment: The benchmark uses 40 original deterministic tools across 12 functional groups, sampling 16 with fixed seed 20260511 to ensure reproducible execution and scoring.Fixed outputs, hand-written JSON schemas, deterministic executors, and expected formats avoid live-API volatility.
  • Perturbation family construction: Four stage-aligned perturbation families instantiate 14 subtypes, with paired records differing from shared clean anchors only by controlled family, subtype, severity, and operator changes.The families enter at the tool registry/schema, user request, returned evidence, and runtime feedback stages.
  • Severity-controlled expansion: Severity forms a reproducible stress axis: light uses one weak operator, medium strengthens or amplifies it, and heavy stacks the strongest controlled operations while retaining a diagnostic target.Severity is assigned from intrinsic operator-strength scores and additive constituent scores for user-intent, observation, and runtime templates.
  • Dataset scale: The main single-family evaluation contains 15,456 records from 7 models, including 1,344 clean-baseline and 14,112 perturbed records across clean, light, medium, and heavy conditions.Mixed-family records are constructed separately and are excluded from this single-family count.
  • Scoring validation: Human judgments on 140 stratified single-family records substantially agree with automatic scoring for task success, observed error, primary error, and runtime-decision fields.A blind LLM annotation provides a secondary consistency check.

5 Single-Family Results

Single-family results show that high clean tool-calling accuracy does not predict robustness under perturbation, with tool-output/observation changes the dominant bottleneck. Stage-wise diagnostics further identify evidence recovery, cascading runtime failures, and intervention targets beyond aggregate success.

  • Perturbation families and subtypes: Average success declines from 0.979 in clean conditions to 0.869, 0.724, and 0.491 under light, medium, and heavy perturbations, respectively.C2 Return Evidence Loss is hardest at 0.142, followed by C1 Return Structure Noise at 0.460 and D2 Runtime Variability at 0.469; severity is not uniformly monotonic.
  • Evidence recoverability: Among 144 C2 instances, 49 are solved by at least one model, while human YES+PARTIAL recoverability is 100% for light, 70% for medium, and 35% for heavy cases.The overall human recoverability rate is 68.3%, showing a gap between recoverable evidence and current model behavior rather than systematically unrecoverable tasks.
  • Overall robustness: Average clean success is 0.979, yet perturbation robustness ranges from 0.766 to 0.664, with tool-output/observation perturbation producing the largest drop for every model.Three models reach 1.000 clean success, but clean performance remains non-uniform across tasks.
  • Failure attribution: Incorrect arguments dominate tool-output/observation failures at 91.7%, while runtime failures comprise 97.6% of runtime-environment failures and tool misselection dominates interface and intent failures.Runtime perturbations have the highest cascade rate at 0.638, whereas tool-output/observation perturbations have a cascade rate of 0.003, indicating mostly direct evidence-recovery failures.
  • Diagnostic validation and interventions: Correcting the attributed primary error recovers 100% of Tier-1, 82.1% of Tier-2, and 0% of Tier-3 failures, supporting cascade-aware causal diagnostics.Targeted interventions likewise reject mismatched fixes and prescribe effective ones: aliases raise gpt-5.4-mini success from 70.0% to 100.0%, while parameter-binding instructions leave it at 70.0%.
  • Runtime feedback: Runtime-feedback matching is highest for retryability at 0.949 and lowest for final result at 0.738, indicating weaker recovery of outcomes from mixed feedback.Matching for failure type is 0.917 and status is 0.783.

6 Mixed-Family Results

Mixed-family perturbations generally reduce success beyond weaker isolated baselines, with observation-related combinations producing especially damaging, non-additive failures. Some positive deltas reflect floor effects or more salient feedback rather than genuine robustness improvements.

  • Evaluation design: The study evaluates five interpretable subtype pairs at medium and heavy severity while excluding degenerate mixtures and incompatible C–D combinations that prevent clean attribution.The selected pairs retain non-degenerate accuracy ranges and cover distinct stage interactions, including observation-related combinations.
  • Mixed-family performance: 0.448 mean success for mixed pairs at medium severity versus 0.621 for the weaker constituent baseline across five pairs and seven models.Figure 4 compares mixed success with the weaker isolated constituent baseline across 70 model–combination–severity cells.
  • Failure mechanisms: A3+C4 and B4+C4 produce the strongest negative interactions, pushing failures toward incorrect arguments through competing or unreliable returned evidence.These combinations amplify earlier tool-selection or user-intent uncertainty through observation noise.
  • Mixed-family performance: A2+B3 at heavy severity and B2+D2 at medium severity yield positive deltas of +0.114 and +0.077, respectively, but these apparent reversals reflect floor effects or more salient feedback.
  • Failure mechanisms: Mixed-family difficulty cannot be reduced to the weaker single-family component because observation perturbations make earlier interface or intent uncertainty harder to resolve.The broader gpt-5.4-mini composition matrix and pair-level diagnostics are reported in Appendix Figures 15, 16, 21, and 22.

7 Discussion

ToolRobustBench argues that evaluation should combine clean success with stage-localized perturbations and cascade-aware attribution, because clean accuracy can hide upstream failures and mixed-stage interactions. Validation shows that the benchmark supports recoverability assessment, counterfactual diagnosis, and targeted repair triage.

  • Implications: Evaluation should combine clean success, stage-localized perturbations, and cascade-aware attribution rather than rely on clean accuracy or observed failure labels alone.High clean accuracy can hide observation-recovery and runtime-state failures, while downstream labels may misidentify upstream causes; mixed-family testing exposes cross-stage interactions.
  • Validation: Humans recover partial answers in 68.3% of sampled C2 cases, versus 27.8% success for the best model, showing evidence-loss failures are not inherently unrecoverable.The C2 recoverability validation supports interpreting these failures as model limitations rather than solely unrecoverable targets.
  • Validation: Repairing the attributed stage recovers 72.4% of failed instances, while targeted interventions distinguish useful S1 repairs from ineffective S3 prompting.These findings indicate that the benchmark provides actionable triage signals beyond ranking agents.

8 Conclusion

ToolRobustBench is a deterministic, stage-aligned, cascade-aware benchmark diagnosing tool-calling robustness across 15,456 single-family instances and representative mixed-family perturbations. It reveals sharp robustness declines despite high clean success, particularly under tool-output/observation perturbations, while validation studies support its diagnostic labels and utility.

  • ToolRobustBench provides a stage-aligned, deterministic, and cascade-aware benchmark for tool-calling agents.
  • Across 15,456 single-family instances and representative mixed-family perturbations, robustness drops sharply despite high clean success, especially under tool-output/observation perturbation.
  • Recoverability, counterfactual attribution, targeted intervention, and human-audit studies support the validity and utility of the diagnostic labels.

9 Limitations · A Tool Environment

ToolRobustBench is intentionally controlled: it uses representative mixed-family combinations and deterministic local tools, while omitting long-horizon, persistent-state, and cross-tool dependencies. Provider differences and a deliberately stratified validation sample remain sources of variation and limit prevalence estimates.

  • 9 Limitations: The main text reports five representative mixed-family combinations rather than exhaustively ranking pairwise templates.Degenerate all-zero mixtures do not compare models, and some C–D mixtures lack a well-defined observation target after execution state changes.
  • A Tool Environment: Deterministic local tools improve reproducibility but cannot represent all behaviors of live API ecosystems.
  • 9 Limitations: Single-step tasks do not test long-horizon planning, persistent state, or dependencies across tools.
  • A Tool Environment: Models accessed through different providers or OpenAI-compatible backends leave protocol compatibility as a residual source of variation.
  • 9 Limitations: The human-validation sample is stratified for subtype coverage and deliberately includes many heavy and failed cases.
  • 9 Limitations: The validation sample supports checking label and scorer behavior but should not be interpreted as an unbiased estimate of ambiguous-case prevalence.

B Data Construction Details … B.5 Deterministic Generation Artifacts

The data construction uses deterministic clean anchors, subtype-specific template operations, and code-generated perturbations, outputs, and diagnostic labels. Expected results are established before perturbation, while observation or runtime templates may define distinct post-execution targets.

  • B.1 Clean Seed Anchor: Clean anchors execute stored arguments before perturbation to establish expected results, preserving those targets unless observation or runtime templates specify post-execution judgments.The anchor distinguishes route computation from its neighboring travel-time function.
  • B.1 Clean Seed Anchor: The construction pipeline separates pre-perturbation execution targets from post-execution judgments supplied by observation or runtime templates.This separation allows perturbed variants to retain anchor targets unless feedback or runtime conditions redefine the judgment target.
  • B.2 Subtype Template Operations: Subtype templates alter specified input fields and instantiate representative deterministic operations from the template catalog.Table 11 expands the main-text specification with subtype-level input changes and operations.
  • B.2 Subtype Template Operations: Expected failure modes serve as diagnostic attribution hypotheses rather than requirements that every failed model output match them.The hypotheses support diagnosis without prescribing the exact form of each failure.
  • B.5 Deterministic Generation Artifacts: Construction relies on deterministic templates instead of evaluation instances generated by an external language model.GPT-assisted drafting is limited to diversifying natural-language templates before inclusion.
  • B.5 Deterministic Generation Artifacts: After template acceptance, deterministic code generates clean anchors, perturbations, executor outputs, and diagnostic labels.Dataset builders create clean anchors and executor results, while tool definitions specify the tools.

C Evaluation Validity Details · D Evidence Table

The evaluation validity audit combines stratified human annotation with scorer and protocol sensitivity checks. Raw records remain the basis for primary results, while normalization preserves differentiated runtime-environment findings across models.

  • C Evaluation Validity Details: The integrated validation audit covers 140 stratified single-family records, with ten records sampled from each subtype A1–D3.Agreement is label-specific, and unclear judgments are excluded from each label-level agreement computation.
  • C Evaluation Validity Details: Valid comparison counts differ across labels because unclear judgments are excluded and the prespecified not_applicable convention is applied to non-runtime decision fields.A blind LLM annotator, GPT-4, is also part of the annotation procedure described in the audit.
  • C Evaluation Validity Details: Human annotation covers data-construction validity, task success, error attribution, boundary judgments, and runtime-decision labels.The annotators are professionally trained and have more than two years of experience in data annotation and evaluation tasks.
  • C Evaluation Validity Details: After normalization, family-D results remain differentiated: deepseek-v4-pro reaches 0.748, claude-sonnet-4-6 reaches 0.745, qwen-plus reaches 0.713, and gpt-5.4-mini reaches 0.708.Failure-type alias normalization prevents semantically equivalent runtime-environment labels from being scored incorrectly solely because their surface forms differ.
  • D Evidence Table: The principal findings persist after scorer normalization and protocol-compatibility adjustments.Appendix Figures 12, 13, and 14 provide perturbation-calibration and scorer-ablation diagnostics.
  • C Evaluation Validity Details: Raw records remain the traceable basis of the primary results, while compatibility-adjusted estimates are reported separately as sensitivity analyses.Compatibility checks examine whether empty or invalid structured outputs arise from backend tokenbudget or protocol failures in post-execution decisions.

E Complete Model Result Tables · F Additional Diagnostic Figures

The appendix provides complete, raw-record-grounded model and family results for ToolRobustBench, alongside diagnostic figures spanning coverage, severity, subtype behavior, post-execution decisions, attribution, and mixed-family interactions. These materials substantiate recoverability of many evidence-loss cases, causal primary-error labeling, and diagnosis-guided repair selection.

  • E Complete Model Result Tables: The complete evaluation environment contains 40 deterministic local tools, while the main single-family experiments sample 16 tools using fixed seed 20260511.Each listed function has a structured schema, deterministic executor, and expected output format.
  • E Complete Model Result Tables: Validation tables preserve subtype construction, severity criteria, diagnostic labels, and human-audited records, with severity defined as input-side stress rather than an enforced accuracy ordering.The generation pipeline validates monotonic static strength before evaluation, but empirical model accuracy may remain non-monotonic.
  • E Complete Model Result Tables: Evidence-loss perturbations remain recoverable for many instances, primary-error labels identify causal sources in most cases, and diagnostic labels reject mismatched fixes while prescribing useful repairs.These conclusions are supported by the appendix’s result summaries and attribution-oriented diagnostic records.
  • F Additional Diagnostic Figures: Additional figures compare clean accuracy with perturbed robustness and diagnose severity, subtype difficulty, post-execution decisions, alias normalization, cascades, and boundary violations.The diagnostics include family-C evidence loss and competition, runtime decision fields, and model-specific post-execution profiles.
  • F Additional Diagnostic Figures: Mixed-family figures report selected medium- and heavy-severity success matrices, interaction-level attribution shifts, and cascade behavior across representative subtype pairs.The appendix also retains the full checked composition space for gpt-5.4-mini beyond the five representative pairs.
  • F Additional Diagnostic Figures: Diagnostic sheets cover tool-interface, user-intent, tool-output/observation, and runtime-environment perturbations, including their constituent subtype pressures.The sheets respectively examine interface shifts and similarity, intent ambiguity and conflict, observation corruption and competition, and runtime availability, variability, and feedback quality.
Loading 2608.23635v1…