AgentFlareScholar · tool use and function calling in language models
Tool calling is moving from basic API use to robust, safe, self-extending agents
Foundational work set up self-taught tool use, large-scale tool datasets and function-calling benchmarks. Recent preprints focus on distilling agents, adversarial safety training and agents that build their own tools.
AISA Scholar API · arXiv
You're reading the full report — free for humans and search engines.
The same content ships as a structured JSON dataset (normalized facts, sources and
citation arrays, no HTML parsing) so AI agents can consume it directly — metered per fetch via the open
HTTP 402 payment protocol.
crawlerAutoPrice=true · verify at https://esa.aisa.one/api/v1/access/verify
Teaching models to call tools
Early work asked how language models acquire tool skills. Toolformer showed that a model can learn in a self-supervised way which APIs to call, when, with what arguments, and how to use the results, starting from a handful of demonstrations per API. ToolLLM then argued that open-source models lag because instruction tuning ignores tool use. It built ToolBench from 16,464 real-world RESTful APIs across 49 categories, with data constructed using ChatGPT. A survey of tool learning organizes the field around why tools help and a four-stage workflow: task planning, tool selection, tool calling and response generation.
Evaluating function calling and its robustness
As function calling became a standard model feature, evaluation broadened. The Berkeley Function Calling Leaderboard traces the shift from tool use to agentic evaluation and examines abilities such as generating parallel function calls. NexusRaven presents a commercially permissive model that turns user queries into executable function-calling code. An industrial-practice survey covers challenges and future directions. A 2026 study on multilingual tool calling introduces the MLCL benchmark for Chinese, Hindi and Igbo and finds that many failures occur despite correct intent understanding and tool selection. Parameter values in the user's language are a dominant failure mode.
Agents that make and revise their own tools
A second line of work lets models create tools rather than only call them. LATM is a closed-loop framework in which one LLM acts as tool maker, writing reusable Python utility functions, and another acts as tool user. Tools are cached so later requests can reuse them. A recent preprint extends this idea to text-rich knowledge graphs. Its DKGI harness has agents write Python over complete node and edge files, and execution feedback guides tool creation and revision, so the evolving tools determine what evidence is gathered next.
Training, distilling and securing tool-using agents
Recent preprints treat tool-using agents as objects to be trained and hardened. ActionOPD distills agents into smaller models by supervising at the level of semantic actions with a black-box teacher, instead of at the token level. AgentSafeEvo uses co-evolutionary reinforcement learning, pairing an attacker that builds adversarial tasks with a defender that must use tools safely. ActICL trains a multimodal agent to retrieve in-context demonstrations through tool-augmented reasoning. These build on earlier work on reward-driven and on-device function calling, such as ToolRM and Hammer.
What’s new on arXiv
Monthly arXiv submissions in this area were 52 in Oct 2025 and 74 in Jan 2026, reached 103 in May 2026, and stood at 103 in Aug 2026 and 102 in Sep 2026.
ActionOPD distills capable agents into smaller students by treating semantic actions as the unit of supervision. At states the student encounters, it samples actions from both student and a black-box teacher and rewards the student by semantic agreement. This avoids needing teacher token probabilities or compatible tokenization.
AgentSafeEvo frames agent safety as an attacker-defender game trained with reinforcement learning. Malicious content can sit in user queries, tool descriptions or environment observations. The attacker builds adversarial tasks that expose weaknesses in tool use, and the defender learns to finish tasks safely. Learnability-guided task weighting is also introduced.
The DKGI harness lets language model agents write Python tools directly over complete knowledge-graph node and edge files, combining shell search and file inspection. Execution feedback drives tool creation and revision. The training-free approach is evaluated on benchmark datasets spanning three domains.
ActICL trains a multimodal LLM agent to acquire its in-context learning context via tool-augmented reasoning. The agent identifies its own information gaps during iterative reasoning and performs targeted, progressive retrieval of demonstrations, rather than retrieving everything at once with a fixed scoring method.
ActionOPD: Distilling Decisions, Not Tokens
Huining Yuan, Xiangmin Yi, Zelai Xu, Zixu Wang, Xinlei Chen, Xiao-Ping Zhang, Yu Wang, Chao Yu
Distilling capable language-model agents into smaller models requires aligning the student's behavior with the teacher's. This raises a fundamental question: at which states and at what granularity should this alignment be performed? Offline imitation provides dense but token-specific supervision and can suffer from state-distribution mismatch. Token-level on-policy distillation (OPD) addresses this mismatch but typically requires teacher token probabilities and compatible tokenization. We argue that semantic actions provide a natural unit of supervision for agent distillation. We introduce ActionOPD, an action-level on-policy distillation method motivated by maximizing expected teacher-action likelihood at student-encountered states. At each such state, ActionOPD samples actions from both the student and a black-box teacher, rewarding student actions according to their semantic agreement with the sampled teacher actions. Through policy optimization, ActionOPD aligns the student's action-level behavior with the teacher's decisions without requiring reproduction of teacher-written reasoning or access to teacher token probabilities. Training Qwen3-4B and Qwen3-8B with two teachers on diverse, curated tool-use tasks yields average gains of 3.3-6.9 percentage points across four out-of-distribution benchmarks. ActionOPD scales favorably with student size and teacher capability, without requiring the teacher and student to share a model family or tokenizer. On τ^2-bench, ActionOPD achieves competitive performance against offline distillation and token-level OPD. We further explore Self-ActionOPD with a same-model teacher and privileged context. These results establish ActionOPD as a promising approach to agent distillation.
Function-Space Temporal Self-Distillation for Policy Optimization
Aryan Das, Arnab Bhattacharya, Vinay Kumar Verma
Reinforcement Learning with Verifiable Rewards (RLVR) improves reasoning in language models, but scalar outcomes provide coarse supervision over response trajectories. Self-distillation offers denser token-level guidance by comparing an unassisted policy with a feedback-informed self-teacher, yet the teacher evolves with the student, creating unstable targets and motivating additional regularization. We introduce Function-Space Policy Optimization (FSPO), a single-policy framework that combines current privileged adaptation with function-space temporal consolidation. FSPO stores sparse historical next-token distributions as fixed temporal targets, providing temporal separation without maintaining a persistent teacher model. It further introduces privileged disagreement correction to explicitly suppress locally overvalued actions, reliability-adaptive grounding that strengthens reference supervision when self-generated evidence repeatedly fails, and quality and coverage-aware temporal memory that retains verified behaviors and improves privileged demonstrations. Across reasoning and tool-use benchmarks, FSPO achieves the highest average accuracy under a 5-hour training budget, improving over the strongest baseline by approximately 4% points on average while reducing peak memory from about 70 GB to 56 GB on Olmo3-7B-Instruct.
ActICL: Post-Training for Agentic Multimodal In-Context Learning
Yanshu Li, Ruixiang Tang, Junyi Jessy Li, Elias Stengel-Eskin
Multimodal in-context learning (ICL) is an important capability of multimodal large language models (MLLMs). Its performance is closely tied to the demonstrations it uses, making demonstration retrieval a core problem for ICL. Common methods use fixed scoring methods to retrieve all the demonstrations at once, which may introduce redundancy and noise. Context-aware retrieval methods have emerged to address this problem by allowing incremental retrieval from a growing context. However, none of them lets the MLLM learn how to judge what new demonstrations it needs and then carry out progressive retrieval on its own. To this end, we introduce ActICL, which trains an MLLM agent to acquire and use an ICL context via tool-augmented reasoning. An ActICL agent analyzes its own information gaps during iterative reasoning and tool-use actions. Based on these gaps, it performs targeted retrieval to acquire a set of initial candidates. It can then use the existing context to further filter the candidates and refine the context, or it can iteratively perform a new retrieval. When the agent judges that the context is sufficient for the task, or when the resource limit is reached with the user request met, it sends the acquired context to an answering model, either the agent itself or another MLLM. We use a two-stage post-training procedure that jointly optimizes the agent's acquisition and answering. With an adaptive number of demonstrations, ActICL improves average performance by 11.6 percentage points over standard similarity-based retrieval across seven benchmarks and three MLLMs, and by 4.4 points compared to the strongest prior baseline. The contexts acquired by ActICL agents can also be used effectively by frontier models. When GPT-5.6-Sol performs 4-shot ICL, ActICL's contexts improve its performance by 3.5 points over standard retrieval, averaged over three benchmarks.
VideoHarness-SRSI: Structured Recursive Self-Improvement for Video Understanding Harness
Zihao Lin, Haoyu Dong, Haobo Xu, Chi-Chih Chang, Xuying Ning, Yinglong Xia, Shuang Yang, Zhuokai Zhao, Xinying Song, Dongfang Liu, Lifu Hua…
LLM system capabilities depend not only on model parameters but also on the executable harnesses that organize information acquisition, tool use, reasoning, and memory. Recursive harness evolution can automate their design, but how it can reliably discover generalizable systems from limited, noisy, and repeatedly reused feedback remains unclear. We study this question in agentic video understanding, where rich multimodal evidence and coupled mechanisms make harness optimization challenging. We first introduce VideoHarness-BRSI, a recursive self-improvement framework that evolves video harnesses around a frozen vision-language model. Analyzing over 4,000 evolved candidates, we find it competitive with hand-engineered systems but identify three interconnected failure modes: validation overfitting, search-budget dilution, and the early-experience trap. We trace all three to a common root: the same imperfect validation evidence drives both harness revisions and the proposer's search strategy. We therefore propose VideoHarness-SRSI, an evidence-governed framework in which every search decision rests on evidence that is transferable, sufficient, and gathered before the search commits. It restricts the proposer to content-free feedback, informs exploration with instrumented warm-up experiments, and develops mechanisms in isolated probe-race branches before factorial composition and joint refinement. Across four video understanding benchmarks, VideoHarness-SRSI improves the equally weighted mean held-out score by 6.2% relative to VideoHarness-BRSI and reduces the mean validation-test gap by 37.9%. Reliable harness evolution thus depends on how search is organized and informed, not only on how well it optimizes validation performance.
AgentSafeEvo: Adversarial Co-Evolution for LLM Agent Safety
Chenxu Wang, Xiaoyu Wen, Han Qi, Ziyuan Zhou, Cheng Jin, Chaochao Lu, Qiaosheng Zhang
Large language model (LLM) agents accomplish complex tasks through multi-turn interactions with external tools. However, malicious content embedded in user queries, tool descriptions, or environment observations can manipulate their decisions and induce unsafe actions. Adversarial co-evolution has emerged as an effective approach to strengthening LLM safety, but existing work primarily focuses on language-level safety or indirect prompt injection in web tasks. In this paper, we introduce AgentSafeEvo, a co-evolutionary reinforcement learning framework for agent safety built on an attacker-defender game spanning diverse tasks and attack types. The attacker learns to construct adversarial agent tasks that expose weaknesses in the defender's tool use, while the defender learns to complete tasks safely under these attacks. We further introduce learnability-guided task weighting, which uses within-task defender-reward variability to adjust each task's contribution to attacker and defender updates. Extensive experiments on agent safety and general capability benchmarks demonstrate that our method improves adversarial robustness while maintaining general agent capabilities.
SEAR: Self-Evolving Agentic Robotics
Xinyi Wang, Bangzheng Li, Hanyu Wang, Lin Zhang, Andrea Yaoyun Cui, Zhenggang Tang, Shyamal Buch, Dejia Xu
Frontier language-model agents can now improve robots on their own: they write control code, test it, and keep what works as skills and memories for the next task. We introduce SEAR (Self-Evolving Agentic Robotics), a framework and benchmark built around two questions. Is the agent really learning, or just trying more often? And does what it learns still help on new tasks, in a new simulator, and on a real robot? The framework runs an agent in three modes: it writes code that becomes the policy (code-as-policy), acts live in the control loop (agent-as-policy), or works as a researcher that fine-tunes a vision-language-action model (auto-research). The benchmark adds controls that separate retained experience from repeated attempts, familiar tasks, privileged simulator state, larger budgets, and luck. Across seven frontier language models, 330 simulated and five physical tasks, and over four years of agent runtime, we highlight three findings. First, the learning curve of a robotic agent depends both on the overall time budget and the task difficulty relative to model capability. Harder tasks make longer sessions worthwhile; on easier tasks, re-rolling short attempts does just as well. Second, control code and shared routines transfer across tasks and simulators, while task-specific solutions do not. On a real robot, we observe a performance gap between agent-designed practice and novel human-designed scenes. Third, different models evolve more effectively in different ways. Some do best acting live, others writing code first. And a text-only model keeps pace with a comparable multimodal one: perception helps with error assessment, but agentic reasoning and tool use can matter more. We release the benchmark and codebase to support future research.
SolBehave: Evaluating the Behavioural Correctness of LLM-Generated Smart Contracts
Giovanni Pio Delvecchio, Stefano Fantazzini, Giacomo Frisoni, Gianluca Moro, Lorenzo Bacchiani, Mario Bravetti, Thomas Troels Hildebrandt
Large language models increasingly generate Solidity smart contracts that, once deployed, can never be patched, making a single latent fault permanent and exploitable. Yet current evaluations mostly ask only whether generated code compiles. We introduce SolBehave, a benchmark for evaluating the correctness of model-generated contracts at scale, moving beyond ad hoc unit tests. Across 250 real, reproducible Ethereum contracts, we apply three complementary tests of behavioural fidelity: differential fuzzing, historical-transaction replay, and, as our core contribution, synthetic-transaction replay guided by a Dynamic Condition Response (DCR) graph that enumerates the space of legitimate function-call sequences. Differential fuzzing compares each generated function with the original on automatically generated inputs; historical replay compares the whole contract on the transactions it actually received on-chain; DCR-guided replay compares it on sequences of calls that follow its intended usage, including orderings that never occurred on-chain. We evaluate seven state-of-the-art open-weight models after one round of automated repair. Compilation success ranges from 26.4% to 92.7%, but under differential fuzzing only 31.4% of all generated function bodies that compile, pooled over models and samples, are equivalent to the original. Divergence at the contract level is the norm rather than the exception: for six of the seven models, between 13% and 31% of the generated contracts that compile diverge from the original under historical replay, and between 13% and 44% under DCR-guided replay; only Gemma-4-31B stays below 3% on both. Compilation is therefore a necessary condition for correctness and far from a sufficient one.
Knowledge Graphs as Files: An Agent Harness Where Tool Creation and Tool Use Co-Evolve
Yuyang Bai, Yu Wang, Yu Zhang
Searching text-rich knowledge graphs requires following relations while examining textual evidence. Predefined graph interfaces constrain what evidence agents can access, even when they write code to combine tool calls or process retrieved subgraphs. We propose direct knowledge graph interaction (DKGI), a harness in which language model agents create graph access tools directly over complete node and edge files. The agent writes Python code to follow relations, combine node sets, and select textual evidence, interleaving execution with shell search and file inspection. This lets agents process large node sets in bulk while returning selected text for the model to assess. Execution feedback guides tool creation and revision, while the evolving tools determine what evidence the agent gathers next. On benchmark datasets spanning three domains, training-free DKGI exceeds the strongest published baseline by at least 6.7 Hit@1 points on every graph, even with a minimal harness. Controlled ablations show the benefits of multi-turn programming over shell-only access and predefined graph tools, while trajectories show agents revising code to extend searches or address errors. These findings highlight the value of allowing tool creation and tool use to co-evolve during graph search. Our code and data are available at https://github.com/leopoldwhite/DKGI.
Foundational papers
- 2023
- 2024
- 2024Large language models as tool makers406 citations
- 2024
- 2025
- 2026
- 2026-10
The berkeley function calling leaderboard (bfcl): From tool use to agentic evaluation of large language models
SG Patil, H Mao, F Yan, CCJ Ji, V Suresh et al.
Contribution. Presents the Berkeley Function Calling Leaderboard, moving evaluation from basic tool use toward agentic settings and probing abilities such as generating parallel function calls.
Tool learning with large language models: A survey
C Qu, S Dai, X Wei, H Cai, S Wang, D Yin, J Xu et al.
Contribution. Surveys tool learning with LLMs, covering why tools help and a four-stage workflow: task planning, tool selection, tool calling and response generation.
Toolllm: Facilitating large language models to master 16000+ real-world apis
Y Qin, S Liang, Y Ye, K Zhu, L Yan, Y Lu et al.
Contribution. Introduces ToolLLM, a framework with the ToolBench instruction-tuning dataset built from 16,464 real-world RESTful APIs across 49 categories, aimed at closing the tool-use gap in open-source LLMs.
Toolformer: Language models can teach themselves to use tools
T Schick, J Dwivedi-Yu, R Dessì et al.
Contribution. Shows that language models can teach themselves to use tools such as a calculator, search engine and calendar, deciding which APIs to call, when, and with what arguments, in a self-supervised way.
Large language models as tool makers
T Cai, X Wang, T Ma, X Chen et al.
Contribution. Proposes LATM, where one LLM makes reusable Python tools and another uses them, with tool caching to make serving of later requests more efficient.
Function calling in large language models: Industrial practices, challenges, and future directions
M Wang, Y Zhang, B Yu, B Hao, C Peng et al.
Contribution. Reviews industrial practices, challenges and future directions for function calling in large language models, including reinforcement-learning approaches that bootstrap tool-use examples.
Nexusraven: a commercially-permissive language model for function calling
VK Srinivasan, Z Dong, B Zhu, B Yu et al.
Contribution. Presents NexusRaven-13B, a commercially permissive open-source model that translates user queries into executable function-calling code for operating software tools.
Toolrm: Outcome reward models for tool-calling large language models
M Agarwal, I Abdelaziz, K Basu, M Unuvar et al.
… Benchmarks: In addition to FC-RewardBench, we evaluate models on the following commonly used function-calling benchmarks: Berkeley Function Calling Leaderboard (BFCL) v3 (…
Hammer: Robust function-calling for on-device language models via function masking
Q Lin, M Wen, Q Peng, G Nie, J Liao, J Wang et al.
… Recent research has shown significant interest in leveraging LLMs as autonomous agents to perform complex tasks through function calling and tool usage [18, 19]. IBM Granite-20B-…
Lost in execution: On the multilingual robustness of tool calling in large language models
Z Luo, TP Kutralingam, ON Okoani, W Xu et al.
Contribution. Introduces the MLCL diagnostic benchmark and finds that multilingual tool calling often fails despite correct intent and tool selection, with parameter value language mismatch a dominant failure mode.
Open problems
- Multilingual tool calling still fails on parameter values written in the user's language, violating language-invariant execution conventions.
- Malicious content in queries, tool descriptions or observations can steer agents toward unsafe actions, so defences must cover diverse tasks and attack types.
- Distilling agent behavior into smaller students without state-distribution mismatch or reliance on teacher token probabilities remains difficult.
- Reliably discovering generalizable tool-using systems from limited, noisy, repeatedly reused feedback is unresolved, given overfitting and search-budget dilution.
FAQ
What is tool learning in LLMs?
It is a paradigm that augments LLMs with external tools to tackle complex problems. A survey organizes it into task planning, tool selection, tool calling and response generation.
Can models learn tool use without heavy supervision?
Toolformer shows a model can learn in a self-supervised way which APIs to call, when, and with what arguments, using only a handful of demonstrations per API.
Can LLMs build their own tools?
Yes. LATM has one LLM write reusable Python utility functions and another apply them. A recent preprint has agents write and revise tools over knowledge-graph files.
How this page is made. Foundational papers and citation counts come from academic search via the AISA Scholar API, with abstracts read from each paper’s page; recent preprints and monthly volumes come from the public arXiv API (metadata CC0). The digest is written by a language model from those abstracts only — every theme links the papers it draws on, and figures not in the inputs are removed.
Sources & citations
- The berkeley function calling leaderboard (bfcl): From tool use to agentic evaluation of large language models 833 citations
- Tool learning with large language models: A survey 519 citations
- Toolllm: Facilitating large language models to master 16000+ real-world apis 2,608 citations
- Toolformer: Language models can teach themselves to use tools 7,859 citations
- Large language models as tool makers 406 citations
- Function calling in large language models: Industrial practices, challenges, and future directions 33 citations
- Nexusraven: a commercially-permissive language model for function calling 63 citations
- Toolrm: Outcome reward models for tool-calling large language models 17 citations
- Hammer: Robust function-calling for on-device language models via function masking 59 citations
- Lost in execution: On the multilingual robustness of tool calling in large language models 14 citations
- ActionOPD: Distilling Decisions, Not Tokens arXiv · 2026-10-14
- Function-Space Temporal Self-Distillation for Policy Optimization arXiv · 2026-10-14
- ActICL: Post-Training for Agentic Multimodal In-Context Learning arXiv · 2026-10-14
- VideoHarness-SRSI: Structured Recursive Self-Improvement for Video Understanding Harness arXiv · 2026-10-14
- AgentSafeEvo: Adversarial Co-Evolution for LLM Agent Safety arXiv · 2026-10-14
- SEAR: Self-Evolving Agentic Robotics arXiv · 2026-10-13
- SolBehave: Evaluating the Behavioural Correctness of LLM-Generated Smart Contracts arXiv · 2026-10-13
- Knowledge Graphs as Files: An Agent Harness Where Tool Creation and Tool Use Co-Evolve arXiv · 2026-10-13