Large language models increasingly act as agents that call external tools, yet most tool-safety research examines only what follows a tool call. The prior decision of whether to call the tool remains largely unexamined and can influence downstream safety. Across the seven open-weight models, the unweighted model-average harm rate after admitted harmful requests is 74.5%. To identify what governs this decision, we apply a factorial intervention to the input request. Within our generated construction, neutralizing the requested-operation component produces the largest admission contrast (19 pp). A linear direction estimated from this contrast influences held-out admission in four of seven models; effects on operation-neutralized requests in some models show that it is not an operation-specific mechanism. We then test whether written refusal is behaviorally and representationally coupled to the same decision. Written refusal accompanies 33.6% of admitted harmful calls. Plain-text refusal training reduces unsafe admission in models that retain benign tool use, showing that response-level safety training can transfer to the call decision. Together, these results establish a partial, model-dependent relation between written refusal and tool admission. They motivate direct evaluation and supervision of tool admission rather than treating text refusal as its proxy.
Figures & tables
Figure 1: System workflow and threat model of tool admission. Stage 1 (Input): the harmful request asks the model to use a fixed URL for a harmful task, and the benign request asks it to summarize the same URL. Stage 2 (Tool admission): the agent calls the web-retrieval tool or does not call it. Stage 3 (Execution): an admitted call returns the cached page and the model answers from it, while a no-call response can still be answered from parametric knowledge.
Figure 2: Instruction-component ablation on 147 behaviors. (a) Seven-open-model mean admission across the eight factorial conditions. A = domain phrase, B = requested-operation phrase, and C = specificity; 1 retains the original component and 0 neutralizes or removes it. (b) Main effects (mean admission with the component absent minus present) for the open-model mean and three closed models. The requested operation has the largest effect in all four summaries.
Figure 3: Signed alignment between the requested-operation direction dB and admission-outcome direction dc across normalized depth. Diamonds mark operation-probe-selected layers; faint lines show each model’s maximum absolute cosine over 10 random controls.
Figure 4: Signed alignment between the text-refusal direction dtext and the admission-outcome direction dc across normalized depth. Diamonds mark operation-probe-selected layers; faint lines show each model’s maximum absolute cosine over 10 random controls.
Figure 5: Single-seed plain-text refusal fine-tuning pilot: harmful request admission rate (%) before and after fine-tuning on disjoint behaviors. Three model–recipe combinations preserve 95–99% benign calling; Llama-3.2-3B falls to 80.7%.
Appendix figures & tables7 assets
Supplementary material from the paper’s appendix.
Appendix
Table 6Table 7Table 8Table 9Table 10Table 11
Table 19: Full-data direction removal at selected dB layer, full behavior pool (percentage points). Selection and evaluation use same pool; Table 2 reports held-out analysis.
Large language models (LLMs) are increasingly deployed with access to external tools, yet harmful tool-mediated interactions are less likely to be refused when compared to regular conversational ones. As this change in refusal behavior remains underexplored, we investigate its underlying mechanisms across a diverse set of open-weight language models. We find that information about the harmfulness of a request remains strongly encoded in the model's representations and transfers across conversational and tool-mediated inputs. Evidence from representation geometry and neuron-level analysis further indicates that the two interaction modes systematically distribute harm-related computation differently. Crucially, while conversational inputs can be refused at relatively low levels of perceived harmfulness, tool-mediated inputs remain permissive until harmfulness crosses a substantially higher effective refusal threshold. Moreover, tool-mediated refusal is also more brittle: progressively weakening the refusal computation disrupts tool-mediated refusal at lower intervention strengths than conversational refusal, even when benign capabilities remain intact. Together, our findings indicate that tool mediation does not simply reduce the internal perception of harm, but instead impacts its conversion into refusal. Overall, this suggests tool-mediated environments may intrinsically reduce robustness of models to harmful requests, and that conventional safety evaluations may not fully transfer to LLM agents.
Abel Rodríguez, Giuseppe Garofalo, Lieven Desmet +1
Agentic multimodal large language models (MLLMs) have recently pushed the frontier of visual reasoning by calling tools such as zooming and tagging. Despite the recent strong success of agentic MLLMs, this work uncovers a critical safety failure in the tool-use paradigm: agentic tool-using MLLMs become less capable of refusing harmful requests. Our experiments confirm that, across three popular safety benchmarks, all the top open- and closed-weight MLLMs we test exhibit significantly lower safety in tool-using settings than in non-tool settings, with a relative refusal failure rate increase of up to 68.7%. Based on analysis of 100,000+ responses, including extended experiments, we also propose two possible reasons for this safety degradation.
Large language models deployed as agents increasingly interact with external systems through tool calls--actions with real-world consequences that text outputs alone do not carry. Safety evaluations, however, overwhelmingly measure text-level refusal behavior, leaving a critical question unanswered: does alignment that suppresses harmful text also suppress harmful actions? We introduce the GAP benchmark, a systematic evaluation framework that measures divergence between text-level safety and tool-call-level safety in LLM agents. We test six frontier models across six regulated domains (pharmaceutical, financial, educational, employment, legal, and infrastructure), seven jailbreak scenarios per domain, three system prompt conditions (neutral, safety-reinforced, and tool-encouraging), and two prompt variants, producing 17,420 analysis-ready datapoints. Our central finding is that text safety does not transfer to tool-call safety. Across all six models, we observe instances where the model's text output refuses a harmful request while its tool calls simultaneously execute the forbidden action--a divergence we formalize as the GAP metric. Even under safety-reinforced system prompts, 219 such cases persist across all six models. System prompt wording exerts substantial influence on tool-call behavior: TC-safe rates span 21 percentage points for the most robust model and 57 for the most prompt-sensitive, with 16 of 18 pairwise ablation comparisons remaining significant after Bonferroni correction. Runtime governance contracts reduce information leakage in all six models but produce no detectable deterrent effect on forbidden tool-call attempts themselves. These results demonstrate that text-only safety evaluations are insufficient for assessing agent behavior and that tool-call safety requires dedicated measurement and mitigation.