Tool Specifications Matter: Uncovering and Mitigating Safety Risks in AI Agents

1. Citation and canonical version

Minghui Pan, Jiayuxuan Yang, Yuanyuan Yuan, Yu Jiang, Zhenpeng Chen. arXiv:2607.29254v1, submitted 2026-07-31. Canonical arXiv metadata and full HTML accessed 2026-08-03 UTC.

2. Selection reason

New-delta paper with a specific, testable mechanism for a consequential agent-safety regression and a lightweight mitigation.

3. Paper in one paragraph

AUTHOR CLAIM: schema-formatted tool specifications weaken refusal-related representations and cause safety degradation; SafeKeep instead presents flattened tool descriptions to a separate safety judgment and retains schema tools for execution. The paper reports four-model results on AgentHarm and InjecAgent, including average harmful-request refusal rising from 23.8% to 70.6% and prompt-injection attack success falling from 25.6% to 2.5% (full text, §§3–6).

4. Claim-to-evidence table

Claim	Type/system/input/comparator	Outcome and magnitude	Boundary/supporting location	Audit status
Agent context suppresses refusal signals	descriptive/mechanistic; Llama-3.1-8B paired requests	harmful refusal 58% chatbot vs 3% agent; chatbot-direction AUROC 0.927 within chatbot vs 0.740 applied to agent	400 ToolSafety harmful requests, Claude-generated benign matches, 7:3 split; §3.1	Same-origin signal; paired construction is useful but generated controls can encode artifacts
Schema representation, not tool semantics, drives much of the shift	mechanistic; Llama/Qwen/Mistral	flattening raises AUROC 0.740→0.885, 0.786→0.845, 0.815→0.898; semantic randomization does not consistently help	component/length controls and representation/semantic ablations; Tables 1–2	Reasonable ablation evidence; probe/format dependence remains
Counter-steering schema direction causally reduces unsafe execution	causal intervention; Llama-3.1-8B	at alpha=4 refusal 5.0→47.5%, harmful execution 95.0→45.0%, invalid output 7.5%; stronger steering causes 77.5% invalid output	held-out harmful paired data; Table 3	Bounded intervention evidence; hyperparameter/invalid-output sensitivity limits generality
SafeKeep improves safety while preserving capability	predictive; four models; Base/SafeJudge/SafePrompt/SafeHarbor	refusal 23.8→70.6%; mean injection ASR 25.6→2.5%; AgentHarm accuracy 60.9→79.6%	AgentHarm 176 harmful + 176 benign; InjecAgent 1,054 attacks; Table 4	Strong same-paper benchmark result; SINGLE-SOURCE, no uncertainty or independent replication

5. Methods and validity audit

• Component addition and length-matched controls improve causal localization; preserving semantics while changing representation and vice versa is the key ablation.
• The paired 400-example diagnostic dataset is partly synthetic: Claude Sonnet 4.6 rewrote benign counterparts and authors manually inspected them. No independent annotator agreement or artifact analysis is reported in the visible methods.
• Mechanistic claims rely on a linear refusal direction and one main white-box model for causal steering. Activation steering's high invalid-output rate at larger alpha warns against equating lower harmful execution with valid refusal.
• SafeKeep evaluation spans four model families, but all metrics are point estimates. The paper reports no confidence intervals, repeated sampling, seed variance, or significance tests.
• AgentHarm accuracy jointly rewards harmful refusal and benign handling; InjecAgent “valid” measures parseability, not whether the benign user task is semantically completed. “Preserves task-handling capability” is therefore bounded to these benchmark metrics.
• Baselines are relevant, especially SafeJudge, but the same model judges and executes; correlated failure modes and adaptive attacks against the two-stage design are not evaluated.
• The models/templates are fast-moving 2026 versions. Reproducibility requires exact model revisions, prompts, and APIs; proprietary endpoints may drift.

6. Checks performed

The reported averages were checked against Table 4 values in the full text. No executable validation was run: reproducing the decisive claim requires multiple model weights/APIs and benchmark dependencies, and the sandbox policy prohibits network/secrets. A toy parser test would not change the evidence verdict.

7. Code/data/reproducibility

The repository tree contains paired data, ablation scripts, direction extraction, causal intervention, a SafeKeep demo, README, and requirements. Repository metadata showed one star, no declared license, and creation on the paper date when fetched. Code availability helps inspection; absent licensing, pinning/environment manifests, and independent execution keep reproducibility unverified.

8. Correction/integrity/conflicts

The arXiv record is v1 only. Crossref title search did not resolve a canonical publisher record. No correction, withdrawal, or formal notice surfaced in these bounded checks. No integrity verdict beyond that is warranted. Funding/conflict disclosures were not found in the accessible full-text rendering: UNKNOWN.

9. Independent support/contradiction map

• AgentHarm independently established that agent misuse benchmarks expose substantial harmful compliance; it supports the problem, not SafeKeep's mechanism.
• InjecAgent independently established 1,054 indirect prompt-injection cases across tool-integrated agents; it validates the threat surface, not this defense.
• OpenAlex/arXiv exact-mechanism searches and a GitHub exact repository search found no independent reproduction of the schema-format mechanism as of access. NOT FOUND IN SEARCH — LIMITED COVERAGE.
• No contradiction was located; publication is three days old, so absence of follow-up has almost no evidentiary weight.

10. Evidence score and verdict

3/5 — PROMISING — UNREPLICATED, scoped to the two evaluated benchmarks, named model/template versions, and the authors' implementation. The controls plausibly isolate a representation effect and SafeJudge is a useful comparator. Missing uncertainty, generated paired controls, narrow benchmarks, same-origin evaluation, model drift, and zero independent reproduction cap the verdict. The broader claim that schema formatting is a primary source across agent systems remains 2/5.

11. Harvestable mechanism and constraints

Mechanism: separate safety judgment from execution and render the same tool semantics in a non-schema format for judgment. Constraints: extra inference cost/latency, shared-model correlated failures, false refusals, schema-to-text fidelity, adaptive attacks, and changing native tool templates.

12. Unknowns and decisive next check

Independent preregistered reproduction using exact commits and frozen benchmarks, with three realistic tool suites, current model families, repeated decoding, confidence intervals, semantic benign-task completion, latency/cost, and adaptive injection. Kill the mechanism-specific opportunity if gains disappear against a schema-aware two-stage control or benign completion drops materially.

13. Fetched sources

1. arXiv metadata — primary metadata, accessed 2026-08-03.
2. arXiv full text — primary paper, accessed 2026-08-03.
3. SafeKeep repository metadata — implementation metadata, accessed 2026-08-03.
4. SafeKeep repository tree — artifact inventory, accessed 2026-08-03.
5. AgentHarm metadata — independent benchmark source, accessed 2026-08-03.
6. InjecAgent metadata — independent benchmark source, accessed 2026-08-03.