智能体何时应当停止？面向工具使用型大语言模型的证据携带式终止机制

文章背景与核心概要

工具使用型大语言模型（LLM）智能体在执行任务时，经常面临一个关键决策点：何时停止执行。现有的系统虽然实现了用于控制终止成功率、认证执行轨迹或强制执行运行时策略的机制，但在面对受控终止故障时，往往无法对接收、范围和闭环重放设计进行彻底的测试。

本文提出并评估了“证据携带式终止”（Evidence-Carrying Termination, ECT）框架。在该框架下，智能体仅在满足以下两个条件时才被允许返回 COMPLETE（完成）状态：第一，存在一个类型化的证书，将每一个必要的答案声明绑定到有效的、范围内的轨迹证据上；第二，确定性重放能够成功重构出所声明的值。研究表明，ECT 能够显著降低不安全终止的风险，并在保持任务完成率的同时，提供更强的执行可靠性。

摘要概要

Tool-using Large Language Model (LLM) agents frequently struggle with a critical decision point: determining when to stop execution. While existing systems implement mechanisms to gate terminal success, certify execution traces, or enforce runtime policies, they often fail to thoroughly test receipt-, scope-, and closed-replay designs across controlled termination faults.

This paper introduces and evaluates Evidence-Carrying Termination (ECT). Under this framework, an agent is only permitted to return a COMPLETE status when: 1. A typed certificate binds every required answer claim to valid, in-scope trace evidence. 2. A deterministic replay successfully reconstructs the claimed value.

关键发现与评估结果

Static Study (48 Synthetic Tasks across 6 Tool-Use Families with 8 Faults):

ECT: Produced 0/288 unsafe completions.

Inspected Termination-Critic Core: Produced 252/288 unsafe completions.

Statistical Difference: -87.50 percentage points (95% task-cluster interval: [-87.50, -87.50] pp).

Frozen 576-Trajectory Study (22 Primary Held-Out Task Clusters):

Premature Unsupported Terminations: ECT achieved 0/66, compared to 40/66 for the base controller (difference: -60.61 pp, 95% interval [-78.79, -40.91] pp).

Supported Completion: ECT achieved 97/132 versus 92/132 for the controller (difference: 3.79 pp, interval [0.00, 9.09] pp), comfortably satisfying a -10-point noninferiority margin.

Recovery & Gates: ECT executed successful recovery in 18/66 trajectories (with 17 subsequently completing successfully with support), passing all three closed-loop gates.

Scope Limitation: ECT strictly certifies support within a recorded trace under declared assumptions; it does not independently verify external truth, real-world safety, or model alignment.

关键发现与评估结果

静态研究（涵盖 6 个工具使用家族、8 种故障类型的 48 个合成任务）：
- ECT： 产生 0/288 次不安全完成。
- 受检的终止评估核心（Termination-Critic Core）： 产生 252/288 次不安全完成。
- 统计差异： -87.50 个百分点（95% 任务簇区间：[-87.50, -87.50] pp）。
冻结 576 条轨迹研究（22 个主要留存任务簇）：
- 过早的无支持终止： ECT 达到 0/66，而基础控制器为 40/66（差异：-60.61 pp，95% 区间 [-78.79, -40.91] pp）。
- 有支持的完成： ECT 达到 97/132，而控制器为 92/132（差异：3.79 pp，区间 [0.00, 9.09] pp），舒适地满足了 -10 点的非劣效性边界。
- 恢复与门控： ECT 在 18/66 条轨迹中执行了成功的恢复（其中 17 条随后在支持下成功完成），通过了所有三个闭环门控。
范围限制： ECT 仅在声明的假设下严格认证记录轨迹内的支持情况；它不会独立验证外部真值、现实世界安全性或模型对齐情况。