Abstract

Tool-using AI agents are evaluated on benchmarks measuring task completion rates, but high scores may reflect memorization rather than genuine reasoning. We introduce the Causal Intervention Benchmark (CIB), which systematically modifies tool interfaces to separate capability from pattern matching. Agent accuracy drops by 41.3% under perturbations, with argument reordering causing the largest degradation (52.1%). Agents with documented pretraining exposure to benchmark data show 2.3x greater degradation.

1. Introduction

The ability to use external tools—APIs, databases, code interpreters—has emerged as a defining capability of modern AI agents [1, 2]. Benchmark suites such as ToolBench [3], API-Bank [4], and ToolAlpaca [5] evaluate agents on hundreds of API-calling tasks, and state-of-the-art systems now achieve 70-90% success rates on these benchmarks.

However, a growing concern in the evaluation literature is whether these scores reflect genuine understanding of tool semantics or memorization of tool-calling patterns. Recent work has shown that LLMs can memorize specific API signatures and calling conventions from their pretraining data [6], and that benchmark contamination is widespread [7].

We draw inspiration from causal inference methodology [8] to design interventions that break surface-level correlations while preserving the underlying task structure. If an agent truly understands what a tool does (rather than how it was called in training data), its performance should be robust to interface modifications that do not alter the tool's functional behavior.

2. The Causal Intervention Framework

2.1 Intervention Types

We define four classes of interventions, ordered by expected difficulty:

Type I — Renaming ($\mathcal{I}_R$): Replace function names with semantically neutral alternatives.

• Example: get_weather(city, date) → fetch_atmospheric_data(city, date)
• Preserves: signature structure, argument names, documentation
• Tests: reliance on function name recognition

Type II — Argument Reordering ($\mathcal{I}_A$): Permute the order of function arguments.

• Example: search(query, max_results, sort_by) → search(sort_by, query, max_results)
• Preserves: function name, argument names, documentation
• Tests: reliance on positional heuristics

Type III — Parameter Augmentation ($\mathcal{I}_P$): Add new required parameters with documented defaults.

• Example: translate(text, target_lang) → translate(text, target_lang, formality="neutral")
• Preserves: original functionality with correct default
• Tests: ability to read and follow updated documentation

Type IV — Semantic Replacement ($\mathcal{I}_S$): Replace a tool with a semantically equivalent alternative that has a completely different interface.

• Example: send_email(to, subject, body) → dispatch_message(recipient_info={"email": to}, content={"title": subject, "text": body})
• Preserves: functional capability
• Tests: compositional understanding of tool semantics

2.2 Formal Definition

Let $\mathcal{T} = {t_1, \ldots, t_n}$ be the set of available tools, each defined by a signature $\sigma(t_i)$ and documentation $d(t_i)$. An intervention $\mathcal{I}: (\sigma, d) \rightarrow (\sigma', d')$ modifies the interface while preserving the input-output mapping:

$$\forall \mathbf{x} \in \text{dom}(t_i): t_i(\mathbf{x}) = t_i'(\phi_\mathcal{I}(\mathbf{x}))$$

where $\phi_\mathcal{I}$ is the argument transformation induced by the intervention.

The Intervention Robustness Score (IRS) for agent $A$ under intervention class $\mathcal{I}$ is:

$$\text{IRS}(A, \mathcal{I}) = \frac{\text{Acc}(A | \mathcal{I})}{\text{Acc}(A | \emptyset)}$$

where $\text{Acc}(A | \mathcal{I})$ is the task completion accuracy under intervention and $\text{Acc}(A | \emptyset)$ is the baseline accuracy.

3. Experimental Setup

3.1 Benchmark Construction

We sample 340 tasks from three benchmarks:

Each task is evaluated under all four intervention types plus the null intervention, yielding $340 \times 5 = 1700$ evaluation instances.

3.2 Agents Evaluated

3.3 Evaluation Protocol

Each agent receives the modified tool documentation and must complete the task through function calling. We use exact match on the final function call (name + arguments) for single-step tasks and a relaxed sequence match (allowing reordering of independent calls) for multi-step tasks. All agents receive three attempts per task; we report best-of-three accuracy.

4. Results

4.1 Overall Intervention Robustness

4.2 Contamination Effect

Grouping agents by contamination status:

The contaminated group shows a mean IRS of 0.36 vs. 0.63 for the uncertain group—a degradation ratio of $0.63 / 0.36 = 1.75$x. When restricting to ToolBench-derived tasks (where contamination is most direct), this ratio increases to 2.31x.

4.3 Intervention Type Analysis

The asymmetric impact of different interventions reveals the nature of agent heuristics:

The fact that argument reordering ($\mathcal{I}_A$) causes nearly twice the degradation of renaming ($\mathcal{I}_R$) is striking. It suggests that agents encode a strong prior over argument positions that overrides the information provided in the documentation.

4.4 Multi-Step Task Analysis

Degradation is amplified in multi-step tasks:

The error compounding factor grows super-linearly with task length, suggesting that intervention-induced errors propagate and interact across steps.

5. Discussion

5.1 Implications for Benchmark Design

Our results demonstrate that current tool-use benchmarks substantially overestimate agent capability due to two confounded signals: (1) genuine compositional reasoning and (2) memorization of tool-calling patterns. We recommend that benchmark designers include at least $\mathcal{I}_A$ (argument reordering) interventions as a standard robustness check.

5.2 Positional Bias in Function Calling

The dominance of positional heuristics over semantic understanding echoes findings in the NLP literature on positional bias in reading comprehension [9] and multiple-choice QA [10]. Our work extends this finding to the structured output domain of function calling, where the consequences of positional bias are more severe because incorrect argument ordering leads to silent failures rather than obviously wrong answers.

5.3 Limitations

1. Intervention naturalness: Our automated interventions may produce unnatural API designs that would not occur in practice. However, the goal is diagnostic, not ecological validity.

2. Best-of-three evaluation: This generous evaluation protocol may understate degradation for agents that can partially self-correct through retry.

3. Contamination measurement: We use documented training data exposure as a proxy for contamination. Actual contamination through pretraining data is impossible to verify for closed-source models.

4. Limited model diversity: Our evaluation covers seven agents. The findings may not generalize to agents using fundamentally different tool-use architectures (e.g., code-generation-based approaches).

5. English-only: All tasks and tool documentation are in English. Cross-lingual tool-use robustness is unexplored.

6. Conclusion

We introduced the Causal Intervention Benchmark (CIB), demonstrating that current tool-using agents rely heavily on surface-level heuristics—particularly argument positioning—rather than semantic understanding of tool capabilities. The 41.3% average accuracy drop under interface perturbations, and the 2.3x greater degradation for contaminated models, provide concrete evidence that tool-use benchmarks need intervention-based robustness checks. We release CIB as an open diagnostic toolkit.

References

[1] T. Schick et al., "Toolformer: Language models can teach themselves to use tools," NeurIPS, 2023.

[2] S. Yao et al., "ReAct: Synergizing reasoning and acting in language models," ICLR, 2023.

[3] Y. Qin et al., "ToolLLM: Facilitating large language models to master 16000+ real-world APIs," ICLR, 2024.

[4] M. Li et al., "API-Bank: A comprehensive benchmark for tool-augmented LLMs," EMNLP, 2023.

[5] X. Tang et al., "ToolAlpaca: Generalized tool learning for language models," arXiv:2306.05301, 2023.

[6] O. Magar and R. Schwartz, "Data contamination: From memorization to exploitation," ACL, 2022.

[7] C. Dodge et al., "Documenting the English Colossal Clean Crawled Corpus," arXiv:2104.08758, 2021.

[8] J. Pearl, Causality: Models, Reasoning, and Inference, 2nd ed., Cambridge University Press, 2009.

[9] Y. Ko et al., "Look at the first sentence: Position bias in question answering," EMNLP, 2020.

[10] M. Zheng et al., "Large language models are not robust multiple choice selectors," ICLR, 2024.