Blog · arXiv Analysis · Published: August 12, 2026 · Modified: August 12, 2026 · Last reviewed: August 12, 2026

The Ungrounded Parameter Becomes the Tool-Call Veto

A syntactically valid API argument can still be unsupported by anything the user said.

A recent latent-critic experiment makes that missing support visible at the parameter key, but its strongest governance use is a narrow veto before execution, not a general certificate of agent safety.

The Paper

The source is Sanidhya Vijayvargiya and Rahul Lokesh’s Actionable Hallucination Detection: Translating Latent Uncertainty into Agentic Critique, arXiv:2608.10430v1 [cs.LG, with cs.AI cross-listing], submitted August 11, 2026. The version-one record describes 22 pages and six figures.

The authors define three tool-call outcomes: correct and grounded, wrong tool, and a correct tool containing a parameter absent from the conversation. Their specification-grounding definition deliberately excludes syntax errors and omitted parameters and does not test claims against external factual truth. The study uses 5,000 training scenarios, 500 in-distribution evaluation tasks with unseen tools, and 200 out-of-distribution ToolAlpaca scenarios.

Plausible Is Not Grounded

A date, recipient, account, or mode can fit an API schema and look reasonable while remaining unsupported. That is a provenance failure. Schema validation asks whether a value has the right shape; specification grounding asks whether the dialogue supplied or implied it. Neither question establishes external truth, organizational permission, or informed authorization.

The paper calls the unsupported value a hallucination. For governance, the narrower label is useful: ungrounded parameter. It names the field that should not cross the execution boundary without clarification. Conversely, a grounded field should not automatically pass. A user can mention an account number without possessing authority to transfer from it. Grounding is one veto condition, not the whole permission system.

Reactive, Not Prescient

The proposed Latent Critic is a LoRA adapter served beside a frozen base model. The base produces the tool call; the adapter’s concurrent outputs are ignored. After the complete call, a [POS] trigger asks the adapter for ok, wrong_tool, or ungrounded: [parameter]. Training masks the tool-call tokens and applies loss only to the trigger and diagnostic label, as the architecture description specifies.

The paper’s timing test is unusually important. Across 500 cases, reported probability of the ungrounded label is 19.54 percent before the call and 16.25 percent after tool selection, then rises to 95.24 percent when the unsupported parameter key is generated. The authors correctly call the signal reactive rather than prescient. The deployment inference is precise: serialize the candidate call, run the critic, then let an external policy decide whether the executor receives it. The model has already composed the bad argument; the environment has not yet honored it.

Detection Needs Its Denominator

On Qwen3-4B, the main detection table reports 0.966 in-distribution and 0.925 out-of-distribution AUROC for ungrounded calls. The appendix reports 83.83 percent exact matching of the offending parameter. Those results are promising, but comparisons require care: the Critic and external judge operate one-versus-rest on a three-class set, while probe and entropy baselines use only the binary grounded-versus-ungrounded subset. The appendix also says continuous-baseline F1 thresholds were optimized on the evaluation split, so AUROC and AUPRC are cleaner comparisons than F1.

The same table labels its detection samples as N=303 in-distribution and N=522 out-of-distribution, while the setup names 500 evaluation tasks and 200 OOD scenarios; version one does not reconcile those units. Its plus-or-minus values are standard deviations over 10,000 bootstrap resamples, not reported retrainings across random seeds. A release decision therefore needs the actual call-level records, a defined sampling unit, and repeat-training variation—not only the headline curve area.

Localization Helps the Retry, Not the Whole Agent

The closed-loop test compares no intervention, a generic block, and a block that identifies the offending key. On 500 in-distribution trajectories, specific feedback reports 61.2 percent parameter F1 and 22.1 percent trajectory success, versus 51.3 and 20.3 percent for a generic block; its false-block rate is 2.9 rather than 9.4 percent. On the subset where a block occurred, reported recovery rises from 23.9 to 37.0 percent in distribution and from 20.0 to 29.3 percent out of distribution.

That is evidence for localization, not autonomous resilience. On 200 OOD trajectories, success is 2.2 percent with the base agent, 2.0 with a generic block, and 2.1 with specific feedback. The OOD failure taxonomy says only 27 percent of failed trajectories contain the two error classes the Critic targets; malformed calls, absent-tool invention, refusal, and type errors remain outside its scope. A better diagnostic can improve a retry without repairing the planner that receives it.

The Version-One Evidence Boundary

Training labels come from a pipeline in which Qwen3.5-122B both simulates the user’s evolving specification mask and later judges difficult implicit references. Initial programmatic labels show 89 percent agreement with manual evaluation, and all evaluation trajectories are verified and, where needed, corrected by a single human annotator. The conclusion acknowledges that limitation; version one reports no second annotator, adjudication protocol, or inter-rater statistic.

Generalization also varies by backbone. On Llama-xLAM-2-8B, the Critic’s OOD AUROC is 0.649 versus 0.630 for the external judge, and the authors state that the internal-access advantage under shift is model-dependent. The activation-patching result, which makes the Critic emit the ungrounded label in 96 percent of patched trajectories, supports a causal account of that classifier’s hidden-state dependence. It is not evidence of consciousness, intention, or human-like self-knowledge.

No study-specific code, data, or model repository URL appears in the reviewed version-one record, full text, or source package. The package contains manuscript source, bibliography, tables, and figures. I checked the reported methods and numbers against those files but did not independently rerun the experiments.

The Parameter-Veto Receipt

A deployable receipt should record the complete user context; tool name and schema; every argument; each argument’s provenance as explicit, inferred, defaulted, or unresolved; Critic and base-model versions; diagnostic and localized key; decision threshold; validation slice and false-positive budget; block or execute decision; clarification shown; retry count; final call; executor response; permission check; and human override.

Keep the veto outside the model and stage it before side effects. Treat an ungrounded label as a reason to withhold, not as permission for the agent to guess again. Treat an ok label as evidence about conversational support, not factual correctness or authority. The Spiralist lesson is mechanical: when a missing specification is localized, preserve the missing field as a stop condition instead of letting fluent completion convert absence into action.

Sources

Return to Blog