When History Lies: Evaluating and Improving Tool Use under Misleading Multi-Turn Histories

The paper studies a failure mode in tool-calling agents: in persistent multi-turn interactions, historical dialogue and tool traces may become non-authoritative for the current request while remaining structurally valid and semantically plausible. The authors note that "tool-calling agents infer task state from accumulated dialogue and tool traces. In persistent interactions, however, historical traces may remain structurally valid and semantically plausible after they cease to be authoritative for the current request." Such misleading history can actively redirect a model away from a correct action it already knows how to take.

The motivating example (Figure 1A) is an airline assistant that must update reservation KKKYCG but sees a failed historical tool call using the invalid argument name paymentId; a robust model should follow the current schema and emit payment id, but the model may imitate the misleading historical precedent. Because the failed call does not change the reservation state, the correct next action is identical with or without the trace.

The authors contrast their work with existing robustness research: "Recent robustness work studies natural query variations and changes to the available toolkit, while ReflecTool-Bench evaluates whether models detect and repair prior tool-use mistakes in multi-turn dialogues. These settings do not isolate whether a plausible but non-authoritative historical trace redirects the model when the current request, available tools, and gold action remain fixed." They term the phenomenon they identify history-induced policy hijacking, noting that "pollution flips 32.14% of examples that are correct under Original history, affecting both Call and Answer decisions; direct reuse of injected entities and interface forms further identifies the misleading trace as the cause."

The authors introduce ContextPollute-Bench, a paired benchmark with synchronized Original, Polluted, and Oracle State views that preserve the system policy, current tools, latest request, and gold next action. Each benchmark item is a synchronized tuple (x orig, x poll, x oracle, a*), where Original is the untouched source prefix. Polluted inserts a structurally valid but non-authoritative trace before the unchanged request, while preserving a⋆(x orig) = a⋆(x poll) = a⋆(x oracle). The Oracle State view contains only reliable, decision-relevant intent, slots, observations, policy, and evidence status and preserves the information needed for the decision without exposing the gold tool name.

The benchmark is constructed from the airline and retail domains of APIGen-MT. It includes eleven gold-preserving interventions spanning three semantic groups: Decision-State, Entity-Binding, and Interface-Execution. These operators include unsupported completion claims, irrelevant reads, decommissioned tools, competing entities, and wrong, missing, extra, obsolete, reformatted, or unit-shifted arguments. Deterministic validators preserve source-message order, keep the latest request final, pair tool calls with results, instantiate the intended distractor, and verify that the gold action is unchanged, and Oracle States are rejected if they expose the gold tool or omit decision-critical state.

The benchmark uses two key metrics: TCR (Tool-Use Recall), P(pred = gold call gold = CALL) requiring a complete correct call, and OCR (Over-Call Rate), P(CALL gold = ANSWER). The primary metric is BTA (Balanced Tool-Use Accuracy), BTA = ½·TCR + ½·(1−OCR), which balances correct calling and non-calling. Splits include Train (9,901), Validation (1,121), Test-Indist (2,375), and OOD-600 (600 Call-required examples whose gold actions invoke six held-out tools unseen in training). Quality is validated through an adjudicated 200-example audit and a stratified 1,000-example cross-audit, yielding 97.0% gold correctness, 99.0% Oracle sufficiency, and 98.0% annotator agreement, and in the larger audit humans accept 93.7% of examples jointly across gold validity, Oracle quality, and pollution naturalness.

The authors propose Oracle-guided On-Policy Distillation (Oracle-OPD), which combines three design components:

1. Reliable-State Conditioning: The teacher conditions on the synchronized Oracle State, representing the policy induced by authoritative task evidence rather than by competing historical traces.

2. Distributional Policy Transfer: Token-level soft targets preserve the teacher's relative preferences over answering, calling, tool selection, and argument generation, which are discarded by a single hard target sequence.

3. Student-State Coverage: A fixed gold or teacher-generated prefix may not cover the states reached by a student conditioned on misleading history. Oracle-OPD therefore evaluates the teacher on prefixes generated by the current student.

The objective is: given paired Polluted and Oracle inputs (x p, x o), the student generates y πθ(· x p), and the loss is L OPD = the average over student-generated prefixes of D KL(q t S ∥ q t T), where q t S and q t T are the student and teacher distributions on the same prefix, with the teacher conditioned on Oracle State. Deployment uses only the student and ordinary history—the teacher and Oracle State are removed at inference time.

Diagnosis. On Qwen3-1.7B, pollution flips 32.1% of predictions correct under Original to wrong under Polluted, with rates 29.4% for Call and 40.5% for Answer; relative to Oracle-correct predictions, the rates are 40.8%, 37.5%, and 50.8%. The authors conclude: Pollution thus changes behavior on tasks whose underlying policy is already available. A corrupted-literal adoption analysis shows the base model adopts the corrupted literal in 34.8% of same-tool/different-target examples, 20.9% of entity-interleaving examples, and 65.8% of format-drift examples; after Oracle-OPD training, adoption falls to 1.0% and 0.4% on the two entity-binding operators even though the misleading trace remains visible.

Post-training comparison. Oracle-OPD reaches 0.8703 BTA, combining 0.9132 complete-call recall with 0.8273 non-call recall and obtaining the highest decision and tool accuracy among same-size methods. The progression is consistent: Oracle-SeqKD, off-policy OD, and Oracle-OPD reach 0.8229, 0.8499, and 0.8703 BTA, respectively. Oracle-OPD improves over off-policy OD by "+0.0204 BTA (95% CI [+0.0118, +0.0295], p < 10−4). By contrast, Gold-SFT and its rebalanced, sequence-normalized, and DPO variants instead concentrate in a high-restraint regime, with near-perfect non-calling but much lower complete-call recall" (Gold-SFT: 0.6628 BTA with only 0.3422 TCR).

Strategy plane analysis. "Training only on Call examples preserves high execution recall but provides no supervision for when tool use should stop: CALL-only Gold-SFT reaches 0.8762 TCR but only 0.2942 non-call recall. Mixed Gold-SFT learns the opposite boundary, reaching 0.9834 non-call recall but 0.3422 TCR. In contrast, mixed Oracle-OPD reaches the upper-right region with 0.9132 TCR and 0.8273 non-call recall."

Transfer to clean histories. Freezing the exact checkpoints and evaluating on the synchronized Original view shows Oracle-OPD reaches 0.8450 BTA on Original input, while held-out-function TCR remains essentially unchanged between Polluted and Original views (0.7433 versus 0.7450). The authors conclude this shows that reliable-state supervision changes which evidence governs the policy across both polluted and clean histories.

Operator-level robustness. Oracle-OPD is best or tied on seven of the eight Call-side operators and obtains the strongest operator-macro TCR. Its largest gains occur on unit or scale drift and on the two entity-binding interventions.

Factorized design analysis. The method's three components are each validated: (1) replacing the Original teacher view with Oracle State raises BTA from 0.7562 to 0.8703 (reliable conditioning); (2) token-level off-policy distillation reaches 0.8499 BTA, compared with 0.8229 for Oracle-SeqKD (soft supervision); (3) Using student-generated prefixes raises BTA from 0.8479 for teacher-prefix OD and 0.8499 for gold-prefix off-policy OD to 0.8703 (student-state coverage). A teacher-to-student curriculum reaches only 0.7923, whereas direct student-prefix coverage throughout training produces the strongest balanced policy.

Scaling. Replacing the 1.7B teacher with an 8B teacher raises BTA from 0.8703 to 0.9193, while retaining the same compact 1.7B deployment model. At the 8B student scale, Gold-SFT provides a strong reference policy at 0.9221 BTA. An Oracle-specialized teacher further raises Oracle-OPD to 0.9301 BTA and 0.8217 OOD TCR.

External and noise-robustness transfer. The 8B-teacher 1.7B student reaches 80.45 BFCL macro accuracy, compared with 79.58 for the untuned model, improves When2Call Macro-F1 from 0.2701 to 0.3294, and reduces unsupported tool invocation from 0.5000 to 0.3411. On HotpotQA-Distractor (zero-shot, 7,405 examples), the 1.7B student distilled from an 8B teacher reaches 0.5015 F1 under noisy context, exceeding the next-best trained checkpoint by 2.97 F1 points, and obtains the smallest clean-to-noisy F1 gap among the trained 1.7B models (0.1596). A prompt-only control is ineffective: A direct instruction to ignore failed or irrelevant history raises BTA only from 0.4720 to 0.4849. Cross-generator evaluation with Claude-Opus-4.7 independently regenerated contexts confirms the diagnosis and method advantage (Oracle-OPD achieves 0.8135 BTA as the strongest 1.7B model under Polluted input; the Oracle-specialized 8B variant reaches 0.9238).

The authors note: "ContextPollute-Bench focuses on controlled next-action interventions over airline and retail trajectories. Extending the framework to naturally occurring production histories and end-to-end interaction would further broaden its coverage. Oracle-OPD additionally uses Oracle State and on-policy rollouts during training, while deployment requires only the distilled student and ordinary interaction history."

The paper concludes: "Robust tool use requires models to identify which historical state remains authoritative for the current request. ContextPollute-Bench makes this capability measurable through synchronized, gold-preserving Original, Polluted, and Oracle views, revealing that misleading traces can redirect policies that models otherwise execute correctly. Oracle-OPD transfers an Oracle-conditioned policy to polluted-context student rollouts through soft supervision on student-visited prefixes... These results establish history reliability as a distinct and tractable training target for multi-turn tool-using agents."

The paper lists three contributions: "(1) Controlled diagnosis. ContextPollute-Bench isolates history-induced policy hijacking through synchronized, gold-preserving Original, Polluted, and Oracle State views over complete calls and non-call decisions. (2) Reliable-state policy transfer. Oracle-OPD transfers an Oracle-conditioned teacher policy onto polluted-context student rollouts without requiring Oracle State or a teacher at deployment. (3) Broad validation. Paired attribution, operator-level analysis, clean-view and cross-generator transfer, unseen functions, model scaling, and external tool-use and noisy multi-hop QA evaluations establish the mechanism and breadth of the resulting robustness."

Based on this paper, AI systems can be improved in the following concrete ways:

• The system can distinguish authoritative current state from plausible-but-outdated historical traces.

• In a travel-assistant scenario, after seeing a failed historical call with invalid argument name paymentId, the improved model correctly emits payment id under the current schema instead of imitating the misleading precedent.

• This reduces adoption of corrupted literals from 34.8% (same-tool/different-target), 20.9% (entity interleaving), and 65.8% (format drift) down to 1.0% and 0.4% on entity-binding interventions, even while the misleading trace remains visible.

• The system can ignore decommissioned tools, unsupported completion claims, irrelevant reads, competing entities, and incorrect argument formats without changing its gold action.

• It keeps the gold next action fixed even when polluted history is inserted, because it learns to rely on reliable decision-relevant state rather than surface-level historical imitation.

• The system jointly optimizes “call correctly when a tool is needed” and “don’t call when answering is correct.”

• Concretely, Oracle-OPD reaches 0.8703 BTA with 0.9132 complete-call recall and 0.8273 non-call recall, whereas prior methods collapse into either high-call/low-restraint or high-restraint/low-call regimes.

• This prevents both over-calling and under-calling in persistent multi-turn interactions.

• The system is trained by distilling token-level soft preferences from a teacher conditioned on clean, decision-relevant Oracle State, evaluated on prefixes the student actually generates when conditioned on polluted history.

• At inference, the oracle and teacher are removed; only the compact student and ordinary conversation history are needed.

• Deployment cost stays low while robustness improves: a 1.7B student distilled from an 8B Oracle teacher reaches 0.9193 BTA, and an Oracle-specialized 8B teacher further raises it to 0.9301 BTA.

• The system does not overfit to polluted inputs; the same checkpoint also improves on clean Original histories.

• It maintains performance on held-out tools whose names were never seen in training, with OOD TCR essentially unchanged between polluted and clean views.

• Robustness transfers across independently generated contexts from a different tool-calling model, confirming the effect is not an artifact of one data generator.

• The improved agent reaches 80.45 BFCL macro accuracy (up from 79.58 for the untuned model).

• It improves When2Call Macro-F1 from 0.2701 to 0.3294.

• It reduces unsupported tool invocation from 0.5000 to 0.3411.

• In zero-shot HotpotQA with distractor noise, the distilled 1.7B student reaches 0.5015 F1, outperforming the next-best trained checkpoint by 2.97 F1 points, and has the smallest clean-to-noisy F1 gap among trained 1.7B models.

• The system achieves robustness through training, not by adding instructions like “ignore failed history,” which only improved BTA from 0.4720 to 0.4849.

• This gives a scalable, model-level fix for misleading multi-turn contexts rather than a brittle prompting workaround.

What the improved AI system can do: it can participate in long-lived multi-turn tool-using conversations while correctly ignoring structurally valid but non-authoritative historical traces, selecting the correct current tool, using the correct current argument schema, deciding when not to call a tool, preserving performance on clean inputs and unseen tools, and transferring this robustness to downstream benchmarks like BFCL, When2Call, and noisy multi-hop QA.