When Not to Imitate: Boundary-Aware Skill Memory for Reliable Tool-Use LLM Agents

Zihan Lin; Zhenyu Chen; Jiawen Wei; Xiaohan Wang; Jie Cao; Jiajun Chai; Wei Lin; Guojun Yin

cs.CLAug 23, 2026

When Not to Imitate: Boundary-Aware Skill Memory for Reliable Tool-Use LLM Agents

Authors: Zihan Lin, Zhenyu Chen, Jiawen Wei, Xiaohan Wang, Jie Cao, Jiajun Chai, Wei Lin, Guojun Yin,

Organizations: Meituan · School of Advanced Interdisciplinary Sciences, University of Chinese Academy of Sciences · MAIS&NLPR, Institute of Automation, Chinese Academy of Sciences · Zhongguancun Academy

Abstract

Extracting skills from past successes is critical for the efficient evolution of Large Language Model (LLM) agents. Prevailing agent self-evolution paradigms typically rely on a core assumption: equipping LLMs with skill memories derived from successful trajectories will monotonically improve their problem-solving capabilities. However, probe analyses reveal that extracting skills solely from successful trajectories traps the model in a Skill Imitation Trap. For tasks that resemble past successes but require different tools, retrieving more skills paradoxically increases the model's confidence in wrong tool calls---procedure skills raise the wrong-tool margin by $47\%$ over a memory-free baseline. To overcome this limitation, we propose Boundary-Aware Skill Memory (BASM), which augments each skill with explicit boundary fields---applicability conditions, risk cues, avoidance rules, and recovery notes. These fields transform each retrieved skill from an unconditional action template into state-conditioned guidance: the agent applies the skill when its conditions hold, suppresses inapplicable tool calls when they do not, and issues targeted repairs when execution fails. Across three agent benchmarks and four model scales, BASM consistently outperforms success-distilled skill-memory baselines: it improves task success rate by up to $23.8\%$ on AppWorld, accuracy by up to $5.0\%$ on BFCL, and reduces attack success rate by $4.6\%$ on AgentDojo, while simultaneously reducing average AppWorld steps by up to $6.6\%$ relative to the memory-free baseline.

Figures & tables

Figure 1: Overview of BASM . BASM builds a boundary-aware skill library from logged trajectories, storing each skill as a procedural core—goal, procedure, and tools—with boundary fields covering applicability, risk, avoidance, and recovery. At inference, BASM retrieves candidate skills, selectively exposes boundary evidence under a fixed token budget, and checks proposed tool calls to decide whether to apply, suppress, or repair. This transforms skill reuse from blind imitation into validity-scoped transfer, suppressing wrong-tool preference while preserving efficient reuse and local recovery.

Figure 2: Success-distilled skill memory ( Proc. Skill ) amplifies wrong-tool preference with retrieval depth; BASM reverses this trend.

Figure 3: Boundary fields suppress wrong-tool preference through a state-conditioned attention mechanism. BASM reduces the wrong-tool margin from

10.71

2.26

, a suppression that padding controls cannot explain. Knocking out boundary-span attention restores the imitation-trap direction.

T_{\mathrm{ok}}

: applicable state;

T_{\mathrm{wrong}}

: inapplicable state;

T_{\mathrm{repair}}

: post-failure state

Qwen3-32B
Method	Base	Long Context	Miss Func	Miss Param	Overall
Base	52.0	41.5	45.5	35.0	43.50
Proc. Skill	60.5	41.5	49.0	36.0	46.75
App. Skill	60.0	41.5	47.0	37.0	46.38
BASM	57.5	42.5	51.0	36.5	46.88
Qwen3.5-397B-A17B

Table 1: BFCL results on Qwen3-32B and Qwen3.5-397B-A17B. We report accuracy across four multi-turn subsets. Best in bolded and second are underlined .

Model	Method	Success	Avg. Steps
Qwen3-32B	Base	62.50	12.46
	Proc. Skill	66.07	11.61
	App. Skill	60.12	12.03
	BASM	76.19	11.71
Qwen3.5-397B-A17B	Base	35.12	13.50
	Proc. Skill	52.98	12.64

Table 2: AppWorld results on Qwen3-32B and Qwen3.5-397B-A17B. BASM achieves the highest AppWorld task success rate among the tested methods.

Benchmark	Base	Proc. Skill	App. Skill	BASM
Qwen3-8B
BFCL Acc. ( $\uparrow$ )	34.13	33.88	35.25	38.88
AppWorld SR ( $\uparrow$ )	29.76	33.33	33.33	36.31
AgentDojo Utility ( $\uparrow$ )	40.99	31.51	31.61	35.93
AgentDojo ASR ( $\downarrow$ )	8.01	10.01	10.54	5.90
Qwen3-14B

Table 3: Results on Qwen3 variants. BASM turns skill memory from procedural reuse into controlled transfer.

Mode	BFCL ( $\uparrow$ )	AppWorld ( $\uparrow$ )	Utility ( $\uparrow$ )	ASR ( $\downarrow$ )
Base	34.13	29.76	40.99	8.01
Proc. Skill	33.88	33.33	31.51	10.01
App. Skill	35.25	33.33	31.61	10.54
Prompt-BASM	38.38	29.17	31.93	10.54
Repair-Only	34.13	25.60	30.87	7.17
BASM	38.88	36.31	35.93	5.90

Table 4: Component ablation on Qwen3-8B. Base , Proc. Skill , App. Skill , and BASM follow Table 3 . Prompt-BASM uses BASM-style boundary prompting without the runtime repair loop; Repair-Only uses the runtime repair loop without boundary-enriched prompts; BASM

-

Avoid removes avoidance rules; BASM

-

Recovery removes recovery notes.

Appendix figures & tables9 assets

Supplementary material from the paper’s appendix.

Appendix

Figure 4: Boundary attention replication. Length-normalized boundary/procedure attention across task-state buckets for Qwen3-8B and Qwen3-14B. Under BASM, decision-token attention shifts from the procedure toward boundary fields precisely in risky and repair states, while equal-length controls fail to reproduce this state-conditioned pattern.

Figure 5: Detailed

T_{\mathrm{wrong}}

logit margins. BASM reduces both the specific wrong-tool margin and the broader tool-vs-control margin more than equal-length controls, showing that boundary semantics suppresses the risky action attractor rather than merely changing prompt length or formatting.

Figure 6: Boundary knockout controls. Same-prompt attention knockout identifies the boundary span as the causal anti-imitation channel. Masking boundary attention pushes BASM back toward the Proc. Skill imitation pattern, recovering

69.4\%

of the wrong-tool gap, while random same-length and procedure-span masks fail to restore the imitation pattern.

Figure 7: Qwen3-14B lightweight knockout. Boundary knockout again moves the

T_{\mathrm{wrong}}

wrong-tool margin upward while suppressing the boundary-attention path. The smaller magnitude is consistent with a more distributed implementation in the larger model, but the causal direction matches the 8B intervention.

Figure 8: Head-level boundary attention. Per-layer/per-head $\log_{2}$ (boundary/procedure) attention for BASM in $T_{\mathrm{wrong}}$ at $k=2$ . Boundary reading is concentrated in identifiable heads rather than uniformly spread across the prompt, consistent with a state-conditioned attention modulator.

Figure 9: Candidate boundary heads. Heads ranked by the increase in boundary/procedure log-ratio from

T_{\mathrm{ok}}

T_{\mathrm{wrong}}

. The largest shifts identify attention heads that become boundary-seeking exactly when procedural imitation becomes risky.

Figure 10: Residual-stream probe control. Task-disjoint linear probes do not isolate a stable applicability vector. This supports the view that BASM works through dynamic decision-token attention to boundary text rather than through a static hidden-state label artifact.

Figure 11: Recall-depth call rates. The Skill Imitation Trap appears in realized candidate choices, not only in logits. Proc. Skill keeps wrong calls high near risky retrieval depths, whereas BASM suppresses those wrong calls by conditioning skill reuse on boundary evidence.

Figure 12: Equal-token control paired status. Pairing against procedure padding isolates the value of boundary semantics under an equal context budget. BASM and padding trade wins on BFCL, while BASM is slightly ahead on AppWorld, consistent with the claim that boundary fields matter most when procedural memory must be state-conditioned.

LLM Agent Memory

Large language model agent memory lets agents retain, organize, retrieve, and update information across interactions and long-running tasks.

See all 368 papers

Demystifying Agent Skills: Why They Work-Until They Don't
Aug 14, 2026Zhiyuan Jiang, Fangrui Huang, Hanwen Xing +6LLM Agent Skill Evaluation LLM Agents
Princeton University · Stanford University · University of Southern California +2
Trace2Skill: Distill Trajectory-Local Lessons into Transferable Agent Skills
Mar 26, 2026Jingwei Ni, Yihao Liu, Xinpeng Liu +7LLM Agent Skill Learning LLM Agent Self-Improvement
ETH Zürich · University of Zurich · Peking University +2
SKILL-KD: Contrastive Skill Distillation for LLM Agents
Jul 30, 2026Qiming Shi, Yibo Dou, Jiawen Zhu +5Skill Distillation LLM Agent Skill Learning
State Key Lab of CAD&CG, Zhejiang University · School of Software and Microelectronics, Peking University · School of Software Technology, Zhejiang University +1

Aug 14, 2026J/K move · Enter open · S save

Demystifying Agent Skills: Why They Work-Until They Don't

Zhiyuan Jiang, Fangrui Huang, Hanwen Xing, Xander Wu+5

Princeton University · Stanford University · University of Southern California+2

LLM Agent Skill Evaluation LLM Agents LLM Agent Skill Retrieval LLM Agent Evaluation LLM Agent Reliability

Open paper AskPDF arXiv

Skills have emerged as a practical and effective approach for enhancing LLM agents at inference time through structured packages of knowledge. However, existing evaluations largely measure whether skills improve aggregated task success, leaving a more fundamental question underexplored: When do skills help, why do they work, and where do they fail? Through controlled experiments across various benchmarks, agent harnesses and LLMs, we isolate the effects of representation, outcome annotation, retrieval difficulty, and cross-framework robustness of skills. To further answer this question, we design a contrastive study that combines controlled quantitative experiments with paired trajectory analysis. We normalize 8,135 trial records from controlled experiments and retain 238 valid unique labels from 240 open-coded records. We consolidate these observations into a taxonomy of three high-level categories and twelve skill-use modes: skills work when noisy trajectories become procedural anchors that stabilize execution. Skills improve over Workflow Memory by 6.06 points in matched comparisons. Procedural anchoring accounts for 65.7% of skill cases, versus 4.5% for explicit knowledge injection, showing that skills stabilize action rather than inject missing facts. Retrieval is a separate bottleneck: as pools grow from 5 to 100, actual-use precision falls from 29.6% to 3.3%. Confusable distractors impair offline identification, yet downstream success remains stable; exact ground-truth invocation is neither sufficient nor necessary. Skills fail under brittle assumptions, incompatible contexts, or insufficient adaptation. These findings move evaluation beyond aggregate success rates and guide reliable self-evolving agents.

Abstract

LLM Agent Memory

Explore similar work

Demystifying Agent Skills: Why They Work-Until They Don't

Trace2Skill: Distill Trajectory-Local Lessons into Transferable Agent Skills

SKILL-KD: Contrastive Skill Distillation for LLM Agents