FCD 方法解决 LLM 智能体工具调用的 schema-epoch 漂移问题
When Valid Tool Calls Change Meaning: Formation-Consistent Dispatch for LLM Agents
研究团队发现工具调用在审批延迟期间可能悄悄变更安全效果，提出 FCD 方案，32 个版本实验里拦截了效果外泄的调用，做智能体安全的可以看看。
一篇 arXiv 论文指出，智能体生成的工具调用即使 schema 有效且未改动，在 rollout、重连或延迟审批期间仍可能因描述符与处理函数关系脱节而获得不同安全效果，作者称之为 schema-epoch drift。论文提出 formation-consistent dispatch（FCD），将实现分析绑定到执行权限：由审核过的 profile 从官方来源生成来源绑定的效果上近似。实验覆盖 32 个官方发布版本，其中 29 个无需针对版本做改动、3 个触发升级。在预注册对比中，FCD 完成全部 3 个效果保持私有的待处理调用，并拦截全部 3 个效果变为公开的调用；而版本级放行会放行 6 个调用并产生 3 个公开效果。
When Valid Tool Calls Change Meaning: Formation-Consistent Dispatch for LLM Agents
Tool-enabled agents form calls from model-visible interfaces, while hosts later select their implementation. Standard dispatch omits the descriptor-handler relation. An unchanged and schema-valid call can therefore acquire a different security effect during rollout, reconnect, or delayed approval. We call this failure schema-epoch drift. We present formation-consistent dispatch (FCD), which connects implementation analysis to execution authority. Reviewed profiles produce provenance-bound over-approximations of declared in-scope effects from official source. Under a closed-target approval policy, a verifier applies each formed call to a summary and captures a successor only when its effects fit the call's security contract. Atomic admission and a final-hop fence preserve this decision to the effect. The exact source retains priority, and the captured successor becomes eligible only after source retirement. Stock releases and deployment changes reproduced the failure. Four profiles covered 32 official releases: 29 required no release-specific change and three escalated. A frozen 16-release expansion matched a separate source oracle. In a preregistered stock comparison, FCD completed all three pending calls whose effect remained private and blocked all three whose omission became public. Exact pinning and release-wide denial stopped all six calls, while release-wide approval completed all six but produced three public effects. A separate lifecycle experiment carried a formation-captured certificate across source retirement. The same safe certificate installed later governed new formations without expanding the pending call's authority.
