Robust Tool Selection Beyond Description Matching

Source abstract

Large language model (LLM) agents choose which external tool to call from the tools' documentation, and this description matching fails in three measurable ways: similar tools create ambiguity, truncated or anonymized documentation creates degradation, and untrusted catalogs admit adversarial injection. We present Three-Axis Tool Selection (TATS), which answers each condition with a different signal: a contextual bandit that learns online to separate similar tools, schema features that survive the loss of descriptions, and a success-filtered anomaly penalty (ADAB) that downweights candidates unlike anything that has succeeded before. All three run inside one compact eight-feature selector with no LLM call at inference, evaluated axis by axis on BFCL and MetaTool. Under ambiguity, TATS's advantage over description matching widens from 12.6 to 21.4 points as similar candidates grow from 5 to 50; under name-only documentation, schema features keep 62.1% accuracy where description matching falls to 30.2%; under injection, ADAB cuts the selection rate of a malicious tool from 6.9% to 1.7% at a 3.4-point clean-catalog cost. We state when any feature-only defense cannot stop an attacker who knows the scoring rule, confirm it with a relaxed oracle, and show that an unforgeable registry of trusted tools reduces the same attack to about 1% of queries.