mlsanityData to 7 Oct 2026

Binding Drift in Multi-Step Tool-Augmented Agents

arXiv 2607.18316 ↗First posted 17 Jul 2026cs.SE cs.AI cs.CLcited by 0

On the map: LLM agents and tool use → Tool learning and function calling

Abstract (arXiv)

Tool-augmented language-model agents execute multi-step workflows over external systems, resolving an entity once and then acting on it across subsequent steps. Prior work shows that in single-step actions, agents select the correct tool but bind it to the wrong entity 24-26% of the time. We study what happens to entity bindings over time: do they stay correct, silently drift to a different entity, or, if wrong from the start, propagate and compound? We formalize binding drift (correct at step 1, wrong later) as distinct from error propagation (wrong at step 1, carried forward), and score them on disjoint workflow sets so the two cannot be conflated. In a controlled multi-step testbed (200 workflows, 580 entity-binding-scored steps, four enterprise domains, eight model backends spanning small to frontier), we find: (1) under controlled error injection, an entity lock (the intuitive "persist the first binding" fix) amplifies wrong actions from 907 to 2,746 (3.0x; bootstrap 95% CI [2.8, 3.3]), because it faithfully carries the seeded wrong entity into every later step; (2) the amplification reaches 8.5x on the most affected model (Claude Opus 4.5); (3) a practical LLM-based re-verifier (a single cheap second model call re-reading the original instruction) reduces wrong actions by 79% (0.21x; CI [0.18, 0.25]), closing the gap to within 1 percentage point of an oracle upper-bound (0.20x); and (4) in the natural (non-injected) setting, baseline agents drift on 18% of eligible workflows, with the per-step error rate rising across steps. Persistence and re-verification are not interchangeable: a defense that eliminates drift can worsen propagation, and a practical re-verifier nearly matches oracle recovery.

Key facts. No citing papers in the map yet (data through 7 Oct 2026). Placed in Tool learning and function calling, one of 16 directions in LLM agents and tool use. Builds on 27 of its 32 references that are in the map. First posted on arXiv 17 Jul 2026.

Builds on

27 of 32 references.

Closest ancestors · 7

Same direction, newest first

  1. 2026Entity Binding Failures in Tool-Augmented Agents29 Jun
  2. 2026ToolChoiceConfusion: Causal Minimal Tool Filtering for Reliable LLM Agents4 Jun
  3. 2025TRAJECT-Bench:A Trajectory-Aware Benchmark for Evaluating Agentic Tool Use6 Oct
  4. 2023MINT: Evaluating LLMs in Multi-turn Interaction with Tools and Language Feedback19 Sep
  5. 2023ToolLLM: Facilitating Large Language Models to Master 16000+ Real-world APIs31 Jul
  6. 2023Gorilla: Large Language Model Connected with Massive APIs24 May
  7. 2023Toolformer: Language Models Can Teach Themselves to Use Tools9 Feb

Other references · 20

  1. 2023Reflexion: Language Agents with Verbal Reinforcement Learningcited by 4,064
  2. 2023Generative Agents: Interactive Simulacra of Human Behaviorcited by 3,500
  3. 2023Lost in the Middle: How Language Models Use Long Contextscited by 3,383
  4. 2023Self-Refine: Iterative Refinement with Self-Feedbackcited by 3,317
  5. 2023Voyager: An Open-Ended Embodied Agent with Large Language Modelscited by 2,081
  6. 2023WebArena: A Realistic Web Environment for Building Autonomous Agentscited by 1,908
  7. 2023AutoGen: Enabling Next-Gen LLM Applications via Multi-Agent Conversationcited by 1,906
  8. 2024τ-bench: A Benchmark for Tool-Agent-User Interaction in Real-World Domainscited by 1,280
  9. 2023AgentBench: Evaluating LLMs as Agentscited by 1,211
  10. 2018MultiWOZ -- A Large-Scale Multi-Domain Wizard-of-Oz Dataset for Task-Oriented Dialogue Modellingcited by 760
  11. 2023CRITIC: Large Language Models Can Self-Correct with Tool-Interactive Critiquingcited by 751
  12. 2023Identifying the Risks of LM Agents with an LM-Emulated Sandboxcited by 514
8 more
  1. 2019Towards Scalable Multi-domain Conversational Agents: The Schema-Guided Dialogue Datasetcited by 426
  2. 2023Cognitive Architectures for Language Agentscited by 422
  3. 2020Autoregressive Entity Retrievalcited by 333
  4. 2017End-to-end Neural Coreference Resolutioncited by 240
  5. 2019Transferable Multi-Domain State Generator for Task-Oriented Dialogue Systemscited by 215
  6. 2020TripPy: A Triple Copy Strategy for Value Independent Neural Dialog State Trackingcited by 130
  7. 2020Neural Entity Linking: A Survey of Models Based on Deep Learningcited by 46
  8. 2017Chaos Engineeringcited by 18

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2026When Tool Calls Succeed but Workflows Fail: Anomalies at the Agent-Tool Boundary
  2. 2026Persistent Semantic Entities in Tool-Augmented LLM Systems
  3. 2026AgentProcessBench: Diagnosing Step-Level Process Quality in Tool-Using Agents
  4. 2026Action-Space Shaping for LLM Agents: Measuring and Mitigating Tool-Schema Bias
  5. 2026E-Bench: Benchmarking Multi-Step Tool-Use Agents in Real-World Product Scenarios
  6. 2026Designing for Doubt: The Case for Informed Abstention in Autonomous Agents
  7. 2026How Consistent Are LLM Agents? Measuring Behavioral Reproducibility in Multi-Step Tool-Calling Pipelines
  8. 2025Tool Preferences in Agentic LLMs are Unreliable