Causal Verification for Reliable Tool Use

Existing safeguards for tool-using language agents, schema validators, policy filters, provenance checks, fail to guarantee that a chosen action will have a predictable, identifiable causal effect. In confounded environments, an action appearing optimal in observational data can paradoxically decrease utility when executed. This fundamental gap hinders the reliability of AI agents performing state-changing tasks.

Beyond Action Validity: The Primacy of Causal Effect Identifiability

The core insight presented in this arXiv paper is that current tool-use verification focuses on whether an action can be performed, not whether it should be performed from a causal impact perspective. Even with sophisticated LLMs, the ability to generate a syntactically correct tool call does not equate to a causally sound intervention. This distinction is critical in workflows where confounding variables can lead to deceptive observational signals.

Introducing CIVeX: A Causal Intervention Verifier

To address this, the authors introduce CIVeX causal intervention verifier, a novel framework that maps proposed actions to structural causal queries. By constructing and analyzing a committed action-state graph, CIVeX rigorously checks for intervention identifiability. It then issues one of four auditable verdicts: EXECUTE, REJECT, EXPERIMENT, or ABSTAIN. The EXECUTE verdict requires a comprehensive causal certificate, including graph commitments, identification arguments, confidence bounds, provenance, and risk limits, ensuring a high bar for deployment.

Empirical Validation: Robustness and Superiority

Evaluations on challenging benchmarks like Causal-ToolBench, IHDP, and ZOZO Open Bandit demonstrate CIVeX's effectiveness. On Causal-ToolBench, under adversarial confounding, CIVeX achieved 84.9% accuracy and 81.1% of oracle utility, critically maintaining zero observed false executions. Notably, it is the only non-oracle method to surpass the AlwaysAbstain floor under a zero-false-execution constraint. Comparisons against chain-of-thought LLM verifiers reveal that while LLMs can reduce false executions significantly, their utility drops under adversarial conditions, falling short of CIVeX's performance. The CIVeX causal intervention verifier also achieved parity with Oracle correct-execution on real-world production logs (IHDP, ZOZO Open Bandit) and drastically reduced per-execute false-executions compared to naive baselines.