When Not to Imitate: Boundary-Aware Skill Memory for Reliable Tool-Use LLM Agents
Authors: Zihan Lin, Zhenyu Chen, Jiawen Wei, Xiaohan Wang, Jie Cao, Jiajun Chai, Wei Lin, Guojun Yin, Ran He
Organizations: Meituan · School of Advanced Interdisciplinary Sciences, University of Chinese Academy of Sciences · MAIS&NLPR, Institute of Automation, Chinese Academy of Sciences · Zhongguancun Academy
Extracting skills from past successes is critical for the efficient evolution of Large Language Model (LLM) agents. Prevailing agent self-evolution paradigms typically rely on a core assumption: equipping LLMs with skill memories derived from successful trajectories will monotonically improve their problem-solving capabilities. However, probe analyses reveal that extracting skills solely from successful trajectories traps the model in a Skill Imitation Trap. For tasks that resemble past successes but require different tools, retrieving more skills paradoxically increases the model's confidence in wrong tool calls---procedure skills raise the wrong-tool margin by 47% over a memory-free baseline. To overcome this limitation, we propose Boundary-Aware Skill Memory (BASM), which augments each skill with explicit boundary fields---applicability conditions, risk cues, avoidance rules, and recovery notes. These fields transform each retrieved skill from an unconditional action template into state-conditioned guidance: the agent applies the skill when its conditions hold, suppresses inapplicable tool calls when they do not, and issues targeted repairs when execution fails. Across three agent benchmarks and four model scales, BASM consistently outperforms success-distilled skill-memory baselines: it improves task success rate by up to 23.8% on AppWorld, accuracy by up to 5.0% on BFCL, and reduces attack success rate by 4.6% on AgentDojo, while simultaneously reducing average AppWorld steps by up to 6.6% relative to the memory-free baseline.
Figures & tables
Figure 1: Overview of BASM . BASM builds a boundary-aware skill library from logged trajectories, storing each skill as a procedural core—goal, procedure, and tools—with boundary fields covering applicability, risk, avoidance, and recovery. At inference, BASM retrieves candidate skills, selectively exposes boundary evidence under a fixed token budget, and checks proposed tool calls to decide whether to apply, suppress, or repair. This transforms skill reuse from blind imitation into validity-scoped transfer, suppressing wrong-tool preference while preserving efficient reuse and local recovery.
Figure 2: Success-distilled skill memory ( Proc. Skill ) amplifies wrong-tool preference with retrieval depth; BASM reverses this trend.
Figure 3: Boundary fields suppress wrong-tool preference through a state-conditioned attention mechanism. BASM reduces the wrong-tool margin from 10.71 to 2.26 , a suppression that padding controls cannot explain. Knocking out boundary-span attention restores the imitation-trap direction. Tok : applicable state; Twrong : inapplicable state; Trepair : post-failure state
Qwen3-32B
Method
Base
Long Context
Miss Func
Miss Param
Overall
Base
52.0
41.5
45.5
35.0
43.50
Proc. Skill
60.5
41.5
49.0
36.0
46.75
App. Skill
60.0
41.5
47.0
37.0
46.38
BASM
57.5
42.5
51.0
36.5
46.88
Qwen3.5-397B-A17B
Table 1: BFCL results on Qwen3-32B and Qwen3.5-397B-A17B. We report accuracy across four multi-turn subsets. Best in bolded and second are underlined .
Model
Method
Success
Avg. Steps
Qwen3-32B
Base
62.50
12.46
Proc. Skill
66.07
11.61
App. Skill
60.12
12.03
BASM
76.19
11.71
Qwen3.5-397B-A17B
Base
35.12
13.50
Proc. Skill
52.98
12.64
Table 2: AppWorld results on Qwen3-32B and Qwen3.5-397B-A17B. BASM achieves the highest AppWorld task success rate among the tested methods.
Benchmark
Base
Proc. Skill
App. Skill
BASM
Qwen3-8B
BFCL Acc. ( ↑ )
34.13
33.88
35.25
38.88
AppWorld SR ( ↑ )
29.76
33.33
33.33
36.31
AgentDojo Utility ( ↑ )
40.99
31.51
31.61
35.93
AgentDojo ASR ( ↓ )
8.01
10.01
10.54
5.90
Qwen3-14B
Table 3: Results on Qwen3 variants. BASM turns skill memory from procedural reuse into controlled transfer.
Mode
BFCL ( ↑ )
AppWorld ( ↑ )
Utility ( ↑ )
ASR ( ↓ )
Base
34.13
29.76
40.99
8.01
Proc. Skill
33.88
33.33
31.51
10.01
App. Skill
35.25
33.33
31.61
10.54
Prompt-BASM
38.38
29.17
31.93
10.54
Repair-Only
34.13
25.60
30.87
7.17
BASM
38.88
36.31
35.93
5.90
Table 4: Component ablation on Qwen3-8B. Base , Proc. Skill , App. Skill , and BASM follow Table 3 . Prompt-BASM uses BASM-style boundary prompting without the runtime repair loop; Repair-Only uses the runtime repair loop without boundary-enriched prompts; BASM − Avoid removes avoidance rules; BASM − Recovery removes recovery notes.
Appendix figures & tables9 assets
Supplementary material from the paper’s appendix.
Appendix
Figure 4: Boundary attention replication. Length-normalized boundary/procedure attention across task-state buckets for Qwen3-8B and Qwen3-14B. Under BASM, decision-token attention shifts from the procedure toward boundary fields precisely in risky and repair states, while equal-length controls fail to reproduce this state-conditioned pattern.
Figure 5: Detailed Twrong logit margins. BASM reduces both the specific wrong-tool margin and the broader tool-vs-control margin more than equal-length controls, showing that boundary semantics suppresses the risky action attractor rather than merely changing prompt length or formatting.
Figure 6: Boundary knockout controls. Same-prompt attention knockout identifies the boundary span as the causal anti-imitation channel. Masking boundary attention pushes BASM back toward the Proc. Skill imitation pattern, recovering 69.4% of the wrong-tool gap, while random same-length and procedure-span masks fail to restore the imitation pattern.
Figure 7: Qwen3-14B lightweight knockout. Boundary knockout again moves the Twrong wrong-tool margin upward while suppressing the boundary-attention path. The smaller magnitude is consistent with a more distributed implementation in the larger model, but the causal direction matches the 8B intervention.
Figure 8: Head-level boundary attention. Per-layer/per-head log2 (boundary/procedure) attention for BASM in Twrong at k=2 . Boundary reading is concentrated in identifiable heads rather than uniformly spread across the prompt, consistent with a state-conditioned attention modulator.
Figure 9: Candidate boundary heads. Heads ranked by the increase in boundary/procedure log-ratio from Tok to Twrong . The largest shifts identify attention heads that become boundary-seeking exactly when procedural imitation becomes risky.
Figure 10: Residual-stream probe control. Task-disjoint linear probes do not isolate a stable applicability vector. This supports the view that BASM works through dynamic decision-token attention to boundary text rather than through a static hidden-state label artifact.
Figure 11: Recall-depth call rates. The Skill Imitation Trap appears in realized candidate choices, not only in logits. Proc. Skill keeps wrong calls high near risky retrieval depths, whereas BASM suppresses those wrong calls by conditioning skill reuse on boundary evidence.
Figure 12: Equal-token control paired status. Pairing against procedure padding isolates the value of boundary semantics under an equal context budget. BASM and padding trade wins on BFCL, while BASM is slightly ahead on AppWorld, consistent with the claim that boundary fields matter most when procedural memory must be state-conditioned.
Skills have emerged as a practical and effective approach for enhancing LLM agents at inference time through structured packages of knowledge. However, existing evaluations largely measure whether skills improve aggregated task success, leaving a more fundamental question underexplored: When do skills help, why do they work, and where do they fail? Through controlled experiments across various benchmarks, agent harnesses and LLMs, we isolate the effects of representation, outcome annotation, retrieval difficulty, and cross-framework robustness of skills. To further answer this question, we design a contrastive study that combines controlled quantitative experiments with paired trajectory analysis. We normalize 8,135 trial records from controlled experiments and retain 238 valid unique labels from 240 open-coded records. We consolidate these observations into a taxonomy of three high-level categories and twelve skill-use modes: skills work when noisy trajectories become procedural anchors that stabilize execution. Skills improve over Workflow Memory by 6.06 points in matched comparisons. Procedural anchoring accounts for 65.7% of skill cases, versus 4.5% for explicit knowledge injection, showing that skills stabilize action rather than inject missing facts. Retrieval is a separate bottleneck: as pools grow from 5 to 100, actual-use precision falls from 29.6% to 3.3%. Confusable distractors impair offline identification, yet downstream success remains stable; exact ground-truth invocation is neither sufficient nor necessary. Skills fail under brittle assumptions, incompatible contexts, or insufficient adaptation. These findings move evaluation beyond aggregate success rates and guide reliable self-evolving agents.
Zhiyuan Jiang, Fangrui Huang, Hanwen Xing +6
Princeton University · Stanford University · University of Southern California +2
Large Language Model (LLM) agents increasingly rely on domain-specific skills, yet manually authoring such skills does not scale, and skills generated purely from parametric knowledge often miss critical operational pitfalls. We introduce Trace2Skill, a framework that consolidates broad execution trajectories in parallel into a unified skill directory through inductive reasoning over agent experience. Trace2Skill supports both deepening existing human-written skills and creating useful skills from weak LLM-generated drafts. Experiments demonstrate the effectiveness of Trace2Skill across diverse domains, including office workflows, math reasoning, and vision QA. Importantly, the evolved skills are not merely memorized artifacts of the trajectories used to create them: they often transfer across model scales, across model families, and to out-of-distribution settings. For example, skills evolved from Qwen3.5-35B trajectories improve a Qwen3.5-122B agent by up to 57.65 percentage points on WikiTableQuestions. Further analyses show that Trace2Skill outperforms sequential skill editing and ReasoningBank-style retrieval memories, compresses recurring failures and workarounds into standard operating procedures (SoPs), and yields portable skills that can be reused without parameter updates or test-time retrieval.
Jingwei Ni, Yihao Liu, Xinpeng Liu +7
ETH Zürich · University of Zurich · Peking University +2
Skill-based prompting has become a practical mechanism for improving LLM agents, yet existing methods often treat skills as summaries of the agent's own experience or of successful demonstrations. This creates a mismatch for weaker student agents. A failed trajectory may not reveal the missing knowledge or strategy, while a teacher trajectory may be too implicit to internalize. We propose SKILL-KD, a contrastive skill distillation framework that treats skills as an explicit distillation medium between agents of different capabilities. Given a student failure and the teacher trajectory on the same task, SKILL-KD distills their actionable discrepancy into a textual skill patch, evaluates it by re-running the student, and iteratively refines it when the student still fails. To prevent skill drift from repeated local updates, SKILL-KD maintains trace-linked edit histories and performs Drift-Aware Skill Consolidation to decide whether each patch is added, merged, or skipped. Across five agent benchmarks and two student settings, SKILL-KD consistently improves frozen student agents over fixed-model adaptation baselines.
Qiming Shi, Yibo Dou, Jiawen Zhu +5
State Key Lab of CAD&CG, Zhejiang University · School of Software and Microelectronics, Peking University · School of Software Technology, Zhejiang University +1