Can Agents Generalize to the Open World? Unveiling the Fragility of Static Training in Tool Use

Can Agents Generalize to the Open World? Unveiling the Fragility of Static Training in Tool Use

Song-Lin Lv * 1 2 Weiming Wu * 1 Rui Zhu 1 Zi-Jian Cheng 1 2 Lan-Zhe Guo 1 2

Abstract

them to navigate external environments to solve complex, multi-step tasks (Guo et al., 2024; Wang et al., 2024b; Qu et al., 2025). Optimized via Supervised Fine-Tuning (SFT) and Reinforcement Learning (RL), recent open-source models (Hsieh et al., 2023; Qu et al., 2024; Qwen et al., 2024; Bai et al., 2025) have achieved tool invocation proficiency that rivals proprietary frontiers like GPT-4 (Achiam et al., 2023) and Gemini (Team et al., 2023). As illustrated in Figure 1, under the prevailing static world assumption, where the distribution of tools, schemas, and interaction logic remains consistent between training and inference (Shen et al., 2023; Yin et al., 2025; He et al., 2025), both SFT and RL paradigms demonstrate stable and continuous performance gains, eventually converging on near-perfect success rates.

arXiv:2607.01084v1 [cs.AI] 1 Jul 2026

While Large Language Model (LLM) agents demonstrate proficiency in static benchmarks, their deployment in real-world scenarios is hindered by the dynamic nature of user queries, tool sets, and interaction dynamics. To address this generalization gap, we formalize OpenAgent (Tool-Use Agent in Open-World), a problem setting characterized by distributional shifts across query, action, observation, and domain dimensions. To systematically diagnose its impact, we construct a controlled sandbox environment where we define fine-grained environmental shifts across a four-tier hierarchy, Perception, Interaction, Reasoning, and Internalization, and conduct a comprehensive series of experiments. Our analysis yields a series of key insights, demonstrating that agents trained via both Supervised Fine-Tuning(SFT) and Reinforcement Learning suffer from varying degrees of performance degradation when confronting open environmental shifts. Building on these insights, we propose Perturbation-Augmented Fine-Tuning, a disturbance-based intervention strategy for SFT that lays the foundation for enhancing agent robustness and utility in realistic environments. Our code will be released at: https://github. com/LAMDA-NeSy/OpenAgent.

However, this stability is often an artifact of the closed-set nature of current benchmarks. Real-world deployment is fundamentally non-stationary: APIs are deprecated, tool schemas evolve, and user instructions are frequently ambiguous. When these environmental dynamics diverge from training priors, the apparent mastery observed in static benchmarks often proves fragile. This discrepancy raises a fundamental research question: Do current training paradigms enable agents to generalize to the open world? To rigorously address this, we formally define OpenAgent (Tool-Use Agent in Open-World), a problem setting characterizing shifts across four dimensions: User Queries (∆Q), Tool Sets (∆A), Interaction Dynamics (∆O) and Task Domain (∆D). To isolate the impact of these shifts from the inherent instability and transient noise of real-world APIs, we establish a controlled sandbox environment. This setup allows for controlled probing, enabling us to maintain a pure closed-set baseline while systematically injecting openworld perturbations across a four-tier diagnostic framework: Perception, Interaction, Reasoning, and Internalization.

1. Introduction The integration of Tool Learning and the Model Context Protocol (MCP) (Anthropic, 2024) has catalyzed a paradigm shift in Large Language Model (LLM) agents, enabling

Our comprehensive evaluations reveal varying degrees of generalization and adaptability in SFT and RL models under open-world settings, while further identifying their respective structural weaknesses. We find that both paradigms suffer from performance degradation in open environments, albeit through distinct failure modes. While SFT agents are prone to trajectory overfitting and brittle symbolic anchoring, RL agents, despite demonstrating better semantic

*

Equal contribution 1 School of Intelligence Science and Technology, Nanjing University, Nanjing, China 2 National Key Laboratory for Novel Software Technology, Nanjing University, Nanjing, China. Correspondence to: Lan-Zhe Guo <guolz@lamda.nju.edu.cn>. Proceedings of the 43 rd International Conference on Machine Learning, Seoul, South Korea. PMLR 306, 2026. Copyright 2026 by the author(s).

1

Can Agents Generalize to the Open World? Unveiling the Fragility of Static Training in Tool Use &ORVH(QYLURQPHQW 





6)77UDLQLQJ6WHS 







 

$FFXUDF\



h"

a"



(q)

Tool 1



…



7RRO(UURU5DWH

















Action Shift (∆𝒜)

  



6)7$FFXUDF\





5/7UDLQLQJ6WHS

6)77RRO(UURU5DWH



5/$FFXUDF\

…

env

Value …

(q, a! ,..,o"#! )

Tool N

Success!

Query Shift (∆𝓠)

Open World

Observation Shift (∆𝓞)

h"

a"

o"



(q')



…



𝜋$

o"

𝜋$

(q', a! ,..,o"#! )

Tool 1' … Tool N+1

env

Domain Shift

None … Error!

5/7RRO(UURU5DWH

Figure 2. Challenges in OpenAgent setting, including query, action, observation and domain shifts.

Figure 1. Performance evolution of SFT and RL agents in the closed setting. Both approaches show stable and continuous improvement throughout the training process.

Lin et al., 2025; Mo et al., 2026) standardize tool invocation via token prediction. Conversely, RL frameworks such as ToolRL (Qian et al., 2025), DeepEyes (Zheng et al., 2026), and others (Feng et al., 2025; Yu et al., 2025; Qian et al., 2025) utilize reward mechanisms to drive robust decisionmaking. Hybrid paradigms including ReTool (Feng et al., 2026), DeepEyesV2 (Hong et al., 2026), and others (Su et al., 2025; Li et al., 2026) combine SFT initialization with RL exploration. Following recent closed-source advances models like Deepseek-V3.2, GLM-4.5 (Zeng et al., 2025), and Kimi K2 (Team et al., 2025), we select full-parameter SFT and RL as baselines.

grounding, remain vulnerable to boundary blindness due to a teleological bias in their reward structures. Building on these insights, we introduce PerturbationAugmented Fine-Tuning (PAFT), a data-centric intervention strategy for SFT. By injecting controlled observation anomalies and symbolic noise into training trajectories, PAFT decouples models from shallow pattern memorization and restores robust generalization in open worlds. In summary, the primary threefold contributions of this work are as follows:

Evaluation Paradigms for Agents Agent capabilities are evaluated via local tools (Wang et al., 2024a; Guo et al., 2024; Huang et al., 2024; Ye et al., 2025) and remote protocols (Li et al., 2023; Wang et al., 2024c; Gao et al., 2025; Wang et al., 2026). Existing benchmarks mainly prioritize task success (Mialon et al., 2024; Liu et al., 2025; Patil et al., 2025; Shao et al., 2026), while robustness studies focus on inference-time perturbations (Ye et al., 2024; Xiong et al., 2025). Recently, agent benchmarks further move toward realistic environments (Liu et al., 2024; Zhou et al., 2024; Drouin et al., 2024; Jimenez et al., 2024; Koh et al., 2024; Trivedi et al., 2024; Ma et al., 2024; Xie et al., 2024; Xu et al., 2025a). Unlike open-environment learning for passive models (Guo et al., 2020; Li et al., 2021; Zhou, 2022; Guo & Li, 2022; Jia et al., 2024; Guo et al., 2025; Cheng et al., 2025), OpenAgent studies shifts in multi-step. While prior work (Chu et al., 2025) shows RL’s advantage over SFT, it lacks tool-use contexts; we address this gap by analyzing training-to-testing transfer under open-environment shifts.

• Formalization of Open Environment in Tool Use: We formally define the OpenAgent setting, characterizing the shifts in queries, tool sets, interaction dynamics and task domain inherent to real-world deployments. • Systematic Evaluation in Open Environments: We establish a controlled sandbox environment and conduct a comprehensive series of experiments to evaluate the robustness of SFT and RL agents across varying levels of environmental shifts. • Key Insights and Methods: We identify critical failure modes in current paradigms, specifically symbolic anchoring in SFT and boundary blindness in RL, and propose PAFT to effectively mitigate performance degradation. Conflict of Interest Disclosure. The authors declare no conflicts of interest.

2. Related Works

3. Preliminaries

Post-training Paradigms for Agents Current methodologies are categorized into three methods. SFT-based works like GenTool (He et al., 2025), TOUCAN (Xu et al., 2025b), and others (Shi et al., 2024; He et al., 2025; Yuan et al., 2025;

3.1. Problem Formulation We model the agent as a sequential decision-making process M = ⟨Q, A, O, π⟩, comprising user queries Q, tool space 2

Can Agents Generalize to the Open World? Unveiling the Fragility of Static Training in Tool Use

Query

Requirements

Call Return Messages

What

Instruction Blurring

Information Redundancy

Schema Adaptability

Tool

∅

The value is xxx

{value: xxx}

Normal Message Format Shift

Error Message Null Message

Para change

Symbolic Drift

Semantic Trap

Identity Erasure

Value Redirection

Before

+

I can’t ……

Tool A

Missing Condition

Fatal Error

Tool Error + Tool Redirection

Tool B

After

Merged Tool

Trace Simplification

Active Refusal There is a shortcut/ Inversion!

Name

Tel.

Tel.

Name

Logic Inversion

Domain Transfer

Plan Planning

Rule Reasoning

Figure 3. Architecture Diagram of the Evaluation Task. We partition this evaluation task architecture diagram into four levels from shallow to deep: Perception, Interaction, Reasoning, and Internalization.

A, and observation space O. Given a query q ∈ Q, at each step t, the agent uses policy πθ (at | ht ) to select action at ∈ A based on history ht = (q, a1 , o1 , . . . , at−1 , ot−1 ). The environment returns observation ot ∈ O, which updates the history to ht+1 = (ht , at , ot ) until task completion. Our core challenge is the generalization of the model when testtime distributions diverge from training priors.

trajectory: an initial misparse may seed a misaligned tool chain whose errors compound across subsequent steps. Structural Shift in Action Space (∆A). The tool space becomes non-stationary (Atest ̸= Atrain ), spanning multiple levels of change: surface drift, which renames identifiers while preserving functionality; semantic conflict, which retains familiar names but alters documented behavior; and structural reconfiguration, which merges, splits, or inverts tool dependencies. The agent must distinguish cosmetic changes from fundamental reconfigurations and ground actions in the current tool semantics.

3.2. The OpenAgent Setting: Distributional Shifts Unlike distributional shifts in passive models, where each input is perturbed independently, tool-use agents face cascading shifts along the agent-environment loop. A perturbation at step t may alter observation ot , which enters the history ht′ and conditions all subsequent decisions πθ (at′ | ht′ ) for t′ > t, causing errors to compound along the trajectory. As illustrated in Figure 2, OpenAgent covers query shifts (q → q ′ ), action-space shifts including perturbed existing tools and newly introduced tools, observation shifts such as None or Error, and joint domain shifts where all interaction elements change together. We decompose this interactive shift space into four dimensions.

Dynamics Shift in Observation Space (∆O). The feedback channel becomes non-stationary: test-time observations may include return formats, error states, null values, or corrective instructions that are absent or rare in training. Unlike static outputs, these observations directly update the agent’s belief state and reshape the subsequent action space. Crucially, the agent must discriminate informative anomalies that require policy adjustment from terminal failures that require task refusal, a distinction absent in passive settings where each input simply calls for a prediction.

Intent Shift in Query Space (∆Q). The intent distribution P (q) shifts across both semantic directives and linguistic surface forms. Unlike passive input perturbations, query misinterpretation in tool-use agents propagates through the

Compositional Domain Shift (∆D). This shift jointly changes Q, A, and O into a new domain while preserving a latent problem-solving structure G. Despite distinct

3

Can Agents Generalize to the Open World? Unveiling the Fragility of Static Training in Tool Use

surface semantics and interfaces, the agent must transfer the underlying reasoning topology by re-grounding its nodes and dependencies in the target domain, rather than relying on domain-specific lexical or procedural patterns.

• Refusal Rate (RR): Evaluates boundary awareness in unsolvable scenarios by measuring the ratio of correctly identified unsolvable cases (RR = Nref usal /Nunsolvable ). A higher RR indicates superior active boundary detection.

4. Evaluation Tasks

4.2. Tier 1: Perception Generalization

4.1. Experimental Setup

In the context of agentic interaction, perception acts as the cognitive gateway grounding raw observations into actionable representations. To successfully initiate a task, an agent must traverse three representational alignments: deciphering unstructured user intents, aligning with rigid interface protocols, and comprehending functional tool definitions. We systematically evaluate the generalization boundaries of these capabilities through the following three dimensions.

Controlled Sandbox Environment. We utilize a synthetic sandbox environment to enable controlled probing of agent capabilities. Unlike real-world APIs which introduce uncontrollable transient noise, a sandbox allows us to precisely isolate environmental variables and establish a pure closed environment baseline to measure open environment shifts. We synthesized a diverse set of tool-use tasks focused on simple geographical POI queries and calculation problems to test reasoning boundaries, the full specifications of which are detailed in the Appendix A. Datasets and Protocols. The dataset comprises 6,050 training samples and 880 evaluation samples. To ensure rigorous evaluation, we enforced a strict separation between the datasets where no variation patterns from the test set appear during the training phase. This guarantees that the reported performance reflects genuine robustness rather than information leakage or pattern memorization. Training Implementation. We employ Qwen2.5-7BInstruct (Qwen et al., 2024) as the backbone model. The SFT stage uses full-parameter fine-tuning, while the RL stage adopts the GRPO framework with sparse answers and format rewards. To further ensure a fair comparison with SFT, the RL environment provides only basic error codes upon failure without detailed guidance. We trained both models under comparable computational budgets until they achieved convergence in the closed environment as illustrated in Figure 1. The Training details are provided in Appendix B.

Instruction Robustness (∆Q). Real-world user instructions are rarely canonical. We evaluate whether the agent can extract invariant intents from non-standard inputs by introducing two distinct types of variations. • Instruction Blurring: We simulate scenarios where user intent is obfuscated by syntactic variance (e.g., colloquialisms, rhetorical questions) or semantic ambiguity (e.g., implicit references, omitted entities). This tests the model’s ability to reconstruct exact intents without relying on explicit keyword matching. • Information Redundancy: We test the robustness of the model’s attention mechanism against information overload. By embedding the core instruction within irrelevant context or verbose background details, we evaluate the agent’s capability to filter out red herrings and lock onto functional constraints. Schema Adaptability (∆A). Agents often overfit to specific API formats seen during training. In this experiment, we introduce protocol shifts by modifying the reserved keywords in the tool invocation schema. For instance, we alter the parameter dictionary key from the standard arguments to variants like args or parameters. This verifies whether the model comprehends the abstract concept of parameter passing or merely performs rigid template completion based on memorized structural tokens.

Metrics. We employ four metrics to assess performance across correctness, efficiency, robustness, and adaptability: • Tool Error Rate (TER): Measures robustness via the ratio of invalid invocations to total calls (T ER = Nerror /Ntotal ). A lower TER indicates precise adherence.

Semantic Grounding (∆A). Current agents often rely on Symbolic Anchoring with rigid dependence on memorized identifiers rather than true understanding of functional definitions. To decouple these factors, we investigate whether models can adapt to dynamic documentation shifts through a Drift-Trap-Erasure trilogy:

• Active Exploration Score (AES): Quantifies adaptability by penalizing “cognitive inertia” when tools fail. AES = e−(nold −1)

(1)

• Symbolic Drift: We test tolerance to perturbations via two sub-variants: Noise Injection (appending nonsemantic suffixes) and Synonymous Rewriting (using LLMs to paraphrase). This verifies generalization across semantically equivalent but symbolically distinct labels. • Semantic Trap: We engineer a conflict between sym-

where nold is the count of repeated invalid attempts. A score of 1.0 signifies immediate adaptation. • Average Tool Chain Length (ATCL): Gauges efficiency by averaging tool invocations on solvable tasks. Lower values reflect concise reasoning topologies. 4

Can Agents Generalize to the Open World? Unveiling the Fragility of Static Training in Tool Use

bol and semantics with adversarial attack.by retaining a familiar tool name but modify its description to explicitly forbid usage. If the agent invokes it, it proves that symbolic overrides semantic understanding. • Identity Erasure: We perform the ultimate test of grounding by replacing meaningful tool names with random identifiers (e.g., Tool 2A3D). This removes symbolic shortcuts, forcing the agent to rely exclusively on reading comprehension of the documentation to solve the task.

that the valid parameter logic has shifted (e.g., “ID 1024 is deprecated, use ID 2048”). We verify if the agent can grasp this dynamic constraint and reissue the tool call with corrected values. • Tool Redirection: The environment signals that a specific tool schema is obsolete and explicitly suggests an alternative one. This tests whether the agent can abandon its pre-planned trajectory and strictly adhere to the new operational manual provided in the feedback.

4.3. Tier 2: Interaction Generalization

4.4. Tier 3: Reasoning Generalization

Interaction generalization evaluates whether an agent can use environmental feedback to refine subsequent actions. In open environments, observations may indicate format changes, execution failures, or new operational constraints rather than merely confirming previous tool calls. We examine three capabilities: Format Adaptability for parsing diverse observation structures, Error Correction for recovering from explicit or silent failures, and Dynamic Alignment for adjusting actions according to feedback-provided rules.

Beyond perception and interaction, Reasoning determines whether an agent can compose individual tool calls into a valid execution plan. Instead of triggering APIs sequentially according to memorized trajectories, a robust agent should infer the current rules governing tool behavior and construct an execution graph that satisfies the task dependencies. We evaluate this ability through two complementary dimensions: Rule Reasoning, which tests whether the agent can adapt to changed functional definitions, and Path Planning, which tests whether it can reorganize tool dependencies under altered execution structures.

Format Adaptability (∆O). Agents typically overfit to standard JSON formats for parsing observations. This experiment tests the fundamental capability of the agent to parse non-standard feedback. We introduce Format Shift by altering the structure of tool return values from structured JSON to unstructured formats such as Markdown tables or raw text logs. This evaluates whether the agent extracts key information based on semantic content rather than relying on rigid syntactic parsing templates.

Rule Reasoning (∆A). Models may memorize trainingtime rules instead of performing deduction from the current tool description. We introduce a Calculation Shift by modifying the functional semantics of selected tools while keeping their interfaces unchanged. For example, a tool originally defined to return a value multiplied by 0.5 is redefined in the test setting to use a factor of 0.1. This experiment verifies whether the agent can derive the correct result from the updated rule description, or instead reverts to the memorized rule from the training distribution.

Error Correction (∆O). Open environments may expose agents to execution failures that interrupt the planned trajectory. We evaluate whether the agent can diagnose such failures and recover by revising its invocation plan or selecting alternative tools. We consider two types of failure:

Path Planning (∆A). This dimension evaluates whether the agent can construct valid execution graphs under changed tool dependencies. We test whether it genuinely reasons over the current causal structure among tools, rather than overfitting to fixed tool chains observed during training, through two complementary sub-experiments:

• Error Return: The primary tool explicitly returns an error code or traceback message after invocation. This tests whether the agent can interpret explicit failure signals and switch to a redundant tool to resolve the blockage. • Null Return: The primary tool returns a null value or an empty string without any warning. This tests whether the agent can detect an implicit anomaly where the return is syntactically valid but semantically uninformative, and infer that corrective action is required.

• Trace Simplification: We test whether the agent can improve execution efficiency when a shortcut becomes available. Specifically, we introduce a composite tool that functionally replaces a multi-step tool chain used during training. The agent should recognize the new affordance and select the efficient composite tool, rather than rigidly following the previously memorized multi-step trajectory. • Logic Inversion: We test robustness to causal reversal in the tool dependency graph. At test time, we invert the documented information-acquisition order, for example by making the output of tool B a prerequisite for invoking tool A. This verifies whether the agent can resolve preconditions from the current dependency graph, or in-

Dynamic Alignment (∆O). Real-world environments are non-stationary and may provide corrective instructions within feedback to steer the agent away from obsolete assumptions. We evaluate whether the agent can perform feedback-conditioned policy adjustment through two active guidance mechanisms: • Value Redirection: The environment notifies the agent 5

Can Agents Generalize to the Open World? Unveiling the Fragility of Static Training in Tool Use

stead adheres to the fixed topological order learned from training trajectories.

Tier 1: Tool Perception

RL achieves semantic grounding through interaction while SFT relies on brittle symbolic anchoring that degrades as fitting increases.

4.5. Tier 4: Internalization Generalization Internalization generalization evaluates whether an agent has learned task-level principles that go beyond local tool invocation patterns. At this level, a robust agent should not only execute valid tool-use trajectories, but also recognize when a task is infeasible under the current constraints and transfer abstract problem-solving structures across domains. We examine this through two capabilities: Active Refusal, which tests solvability boundary recognition, and Domain Transfer, which tests whether learned reasoning topologies can be reused in semantically different environments.

As illustrated in Figure 4, we observe a consistent degradation pattern where robustness declines as training steps increase. Specifically, in the Semantic Trap and Identity Erasure experiments, the SFT model displays a sharp increase in TER accompanied by a significant drop in accuracy. The dashed blue line indicates that SFT frequently invokes the wrong tools when surface-level names are perturbed. Conversely, while RL also experiences some performance decay due to overfitting, it maintains a consistently lower error rate and higher accuracy retention compared to SFT. The RL agent demonstrates superior resistance to adversarial descriptions and effectively ignores misleading name cues.

Active Refusal (∆Q ∪ ∆O). A robust agent should determine whether a task is solvable given the available information and executable tools, rather than forcing a plausible but unsupported answer. We evaluate this boundary-awareness ability through two insufficient-condition scenarios:

This disparity stems from SFT’s reliance on symbolic anchoring, where the model acts as a superficial pattern matcher that collapses once surface tokens are decoupled from their semantics. In contrast, the penalty-driven nature of RL necessitates semantic grounding, compelling the agent to scrutinize functional descriptions rather than memorizing rigid name-context associations.

• Missing Condition: We remove necessary conditions from the user query through a human-verified process, making the task theoretically unsolvable due to information deficiency. This tests whether the agent can detect the logical incompleteness of the request and refuse to answer, instead of fabricating missing information to force completion. • Fatal Error: We simulate an unrecoverable failure where a necessary tool returns a fatal error and no alternative tool is available. This tests whether the agent can recognize the resulting operational deadlock and conclude that the task is currently unexecutable, rather than repeatedly retrying or hallucinating a successful result.

Tier 2: Interaction with Guidance

RL leverages explicit guidance for dynamic policy adaptation, while SFT exhibits trajectory inertia and often hallucinates outcomes under corrective feedback. As illustrated in Figure 5, we observe a distinct behavioral divergence dependent on feedback clarity. Under ambiguous signals like null returns, both models exhibit performance degradation. Crucially, this failure mode follows a clear trend where the inability to adapt intensifies as training progresses. As the models become more fitted to the training distribution, their capacity to actively explore under uncertainty progressively declines. A significant disparity emerges under explicit tool redirection. Qualitative case studies reveal that SFT tends to interpret observations as successful confirmations, even when the feedback explicitly redirects the agent. Consequently, it ignores the guidance and hallucinates successful observations to force the continuation of its pre-planned trajectory. In contrast, RL maintains high adaptability by parsing the instruction and migrating to the new tool immediately, and then continues reasoning.

Domain Transfer (∆D). This dimension evaluates whether the agent can transfer internalized problem-solving structure across domains. We introduce a Holistic Domain Shift, where user queries, tool definitions, and environmental observations change jointly. For example, we migrate the testing environment from an address-query scenario to a medical-registration scenario. Although the surface semantics and interfaces change substantially, the underlying causal structure is preserved as a latent structural invariance. This experiment tests whether the agent can re-ground the same abstract reasoning topology, such as a search-selectconfirm chain, in a novel target domain rather than overfitting to domain-specific lexical or procedural cues.

We hypothesize that this behavioral divergence stems from differences in training paradigms. SFT is optimized on clean demonstrations where observations consistently validate actions. This likely conditions the model to disregard the causal link between feedback content and the subsequent policy, thereby making its behavior resemble an open-loop

5. Key Observations Synthesizing the results across the four tiers of generalization, we distill observations regarding the behavioral divergence between SFT and RL in open-world agentic tasks. 6

Can Agents Generalize to the Open World? Unveiling the Fragility of Static Training in Tool Use 7LHU1RLVH,QMHFWLRQ 





7LHU6\QRQ\PRXV5HZULWLQJ 







0HWULF'HOWD





7LHU6HPDQWLF7UDS























7LHU,GHQWLW\(UDVXUH 































 





  





















6)7$FFXUDF\'HOWD





6)77(5'HOWD





5/$FFXUDF\'HOWD



















5/7(5'HOWD

Figure 4. Accuracy Delta and TER in Tier-1 Perception. SFT exhibits brittle symbolic anchoring and underperforms compared to RL when tool semantics shift. For detailed case analyses, refer to Appendix E. Delta represents the performance gap relative to the closed-set baseline. Setup and absolute values are provided in Appendix C and D. 



7LHU1XOO5HWXUQ 









7LHU9DOXH5HGLUHFWLRQ 







$FFXUDF\'HOWD



 

























6)7$FFXUDF\'HOWD





  

   



















 





 











7LHU7RRO5HGLUHFWLRQ





 



















6)7$(66FRUH

5/$FFXUDF\'HOWD



















$(66FRUH

7LHU(UURU5HWXUQ  



 













5/$(66FRUH

Figure 5. Accuracy Delta and AES Score in Tier-2 Interaction. Both RL and SFT degrade under ambiguous feedback, but RL maintains superior resilience under explicit guidance while SFT fails to adapt. Delta represents the performance gap relative to the closed-set baseline. Setup and absolute values are provided in Appendix C and D.

execution policy. Conversely, RL encourages a more closedloop behavior because ignoring error signals is penalized during interaction. This interaction mechanism potentially forces the agent to treat environmental observations as critical state updates, ensuring that explicit environmental instructions are prioritized to maximize reward.

ysis in Appendix E reveals that despite the documentation explicitly stating the new prerequisite order, both models frequently hallucinate the existence of the training-set topology. This suggests that while RL generalizes well to local rule shifts, both paradigms overfit to the temporal order of action sequences, treating the dependency graph as a fixed action order rather than a dynamically specified logical structure.

Tier 3: Reasoning Generalization

Tier 4: Boundary Awareness

RL demonstrates generalization in local adaptation, yet both paradigms suffer substantial degradation under global dependency inversion.

Both paradigms struggle with boundary awareness in unsolvable states, but exhibit distinct failure patterns: SFT often fails to perceive fatal feedback, whereas RL perceives the failure but still favors forced completion.

As illustrated in Figure 6, RL exhibits superior generalization in local optimization tasks. In Trace Simplification, the RL model achieves the lowest ATCL, indicating it successfully abandons the memorized training-time sequence to utilize efficient composite tools. Similarly, in Rule Reasoning, RL outperforms SFT by dynamically adhering to updated calculation logic, whereas SFT shows a stronger tendency to regress to memorized training constants.

As illustrated in Figure 7, both models struggle to identify unsolvable queries, leading to low refusal success rates when tools are unavailable. However, a fine-grained analysis of non-refusal cases under Fatal Error scenarios reveals that SFT and RL fail through qualitatively distinct mechanisms. Case studies in Appendix E.4.1 show that upon receiving an error, SFT directly outputs an unsupported answer without acknowledging the error at all, effectively treating the error observation as if it were a normal return value. In contrast, RL explicitly recognizes the failure (e.g., “It seems the

However, a critical shared failure emerges in Logic Inversion. When the causal dependency between tools is reversed (e.g., shifting from A → B to B → A), both SFT and RL suffer precipitous performance drops. Qualitative anal7

Can Agents Generalize to the Open World? Unveiling the Fragility of Static Training in Tool Use

Close Environment

Open Environment

Figure 6. Accuracy comparison on Tier 1-Instruction Robustness (left) and Tier 3-Rule Reasoning & Path Planning (right), evaluated at the stable training phase. While SFT models exhibit degradation across all perturbations, RL models show drops primarily under logic inversion and query variations. Detailed setups and full training dynamics are provided in Appendices C and D.

Accuracy (%) Close Environment

Rejection Rate (%) Open Environment

Figure 7. Accuracy in Tier 1-Schema Adaptability, Tier 2-Format Adaptability, and Tier 4-Domain Transfer (left) and Refusal Rate in Tier 4-Active Refusal (right), evaluated at the stable training phase. Both SFT and RL models are robust to simple format changes, whereas SFT shows significant degradation under domain transfer. Both methods demonstrate limited active refusal for unsolvable queries. Detailed setups and full training dynamics are provided in Appendices C and D.

tool is not available”), demonstrating a notably high error awareness rate, yet it still proceeds to fabricate an answer rather than issuing a refusal.

Perturbation-Augmented Fine-Tuning (PAFT), a data intervention strategy that augments Dclean with controlled trajectory-level perturbations:

This divergence is consistent with the open-loop versus closed-loop dichotomy observed in earlier tiers. SFT’s failure is perceptual: its open-loop policy does not parse environmental feedback, so the error signal is simply ignored. RL’s failure, however, is more decisional: it perceives the error but still favors completion, which is consistent with a teleological bias induced by outcome-oriented rewards. Because training rewards presuppose that every problem is solvable, the policy learns to provide an answer at all costs, prioritizing completion over honest refusal. This is distinct from mere overconfidence; it reflects a structural limitation of outcome-based reward design that lacks an explicit incentive to abstain when the task is infeasible. Such persistent forced-completion behavior raises critical agent safety concerns, as models may sacrifice truthfulness for helpfulness in unpredictable open-world deployments.

DPAFT = (1 − α) Dclean ∪ α · G(Dclean )

(2)

where G applies perturbation operators that expand the support of h into regions containing anomalous observations, unsolvable states, and symbolic variants. Unlike standard augmentation that perturbs inputs in isolation, PAFT operates at the trajectory level, injecting perturbations midtrajectory and supervising the corrective continuations. 6.1. Method Environmental Feedback Perturbation (EFP). To combat the open-loop trajectory inertia, we extend successful sub-trajectories by injecting stochastic observation anomalies that simulate unexpected environmental feedback. A standard chain is transformed via a generator Genv as: G

τorig = {ai , oi } −−env −→ τ ′ = {ai , ochange , a′i , oi }

6. Perturbation-Augmented Fine-Tuning

(3)

Here, ochange represents a feedback anomaly (e.g., tool redirection or value deprecation). The model is supervised to generate a corrective action a′i that recovers from the disturbance, rather than blindly assuming success. This converts the open-loop pattern into a closed-loop recovery behavior.

Our analysis reveals that SFT’s generalization decay stems from a distributional mismatch: standard SFT optimizes L = −E(h,a)∼Dclean [log πθ (a|h)], where all training histories h are drawn exclusively from successful executions. This confines the learned policy to a narrow manifold Hclean that excludes error states, ambiguous feedback, and symbolic variations. To bridge this gap, we propose

Solvability Boundary Perturbation (SBP). To address the boundary blindness identified in Tier 4, we construct negative samples that enforce explicit refusal behavior. A refusal 8

Can Agents Generalize to the Open World? Unveiling the Fragility of Static Training in Tool Use Table 1. PAFT results across open environment tiers. Model

Tier-1 Tier-2 Tier-3 Acc ∆↑ Acc ∆↑ Acc ∆↑

PAFT yields consistent improvements across all training stages and tiers. For early-stage models, PAFT transforms severe degradation into positive deltas across Tiers 1–3, indicating that perturbation-augmented training can preemptively prevent overfitting to clean trajectories.

Tier-4 RR↑

Performance across training stages Base

-29.8

-8.5

-8.5

12.2

SFT-200 + PAFT SFT-400 + PAFT SFT-600 + PAFT SFT-800 + PAFT

-67.7 +28.6 -53.9 +5.6 -51.3 -2.5 -50.4 -4.1

-48.2 +26.5 -45.4 +4.9 -46.4 -2.9 -45.3 -5.3

-39.9 +22.7 -32.5 -2.8 -33.0 -10.7 -28.0 -9.8

0.3 99.3 0.0 97.8 0.1 99.6 0.2 99.6

Ablation Study. The lower portion of Table 1 reveals two key findings. (1) Perturbation ratio. Increasing α from 0.2 to 0.3 yields clear gains across all tiers, while further increasing to 0.4 provides marginal or no additional benefit. We attribute this diminishing-return pattern to a trade-off between distributional coverage and signal quality: at low α, the model is exposed to too few perturbed trajectories to learn robust recovery behaviors; as α grows, the augmented data progressively covers more failure regions, but beyond a saturation point, an excessive proportion of perturbed samples dilutes the clean supervision signal and introduces conflicting gradients between normal task completion and anomaly handling, leading to no further improvement or even slight regression. The result suggests that α=0.3 achieves a near-optimal balance between robustness and task performance.

Ablation: perturbation ratio α (at 800 steps) α = 0.2 α = 0.3 (default) α = 0.4

-6.9 -4.1 -5.3

-7.7 -5.3 -7.8

-15.8 -9.8 -11.1

90.4 99.6 96.4

Ablation: individual components (at 800 steps, α = 0.3) EFP only SBP only SRP only

-30.1 -38.9 -14.9

-3.2 -36.5 -34.2

-27.0 -31.7 -10.6

1.7 99.2 2.1

(2) Component contributions. EFP improves Tier-2 interaction adaptability, as the injected observation anomalies teach the model to parse and react to unexpected feedback rather than executing blindly along pre-planned trajectories. Notably, EFP contributes minimally to Tier-4 refusal, indicating that error adaptation and unsolvable-state recognition capture distinct capabilities. SBP almost exclusively restores Tier-4 refusal capability by introducing fatal error samples that break the implicit solvability assumption, while leaving other tiers largely unaffected, which suggests that, in our setting, boundary blindness is strongly tied to data coverage problem where the model never learns to refuse simply because Dclean contains no refusal demonstrations. SRP primarily enhances Tier-1 perception robustness and Tier-3 reasoning generalization, as symbolic perturbations force the model to attend to functional descriptions rather than surface-level identifiers, mitigating both symbolic anchoring and the associated downstream reasoning errors. This targeted effectiveness, where each component is necessary yet individually insufficient, confirms that PAFT is a structured, diagnosis-driven intervention rather than generic data augmentation.

generator injects unrecoverable errors into the observation, modifying the trajectory to: G

refusal τorig = {ai , oi , ai+1 } −− −→ τ ′ = {ai , ofatal , aend }

(4)

where ofatal signifies a fatal error with no alternative tools available, and aend represents the explicit refusal action. This breaks the implicit “every problem is solvable” assumption in Dclean and teaches the model to halt execution rather than hallucinate. Symbolic Representation Perturbation (SRP). To decouple the symbolic anchoring identified in Tier 1, we apply surface-level augmentations to the tool definition space. An auxiliary agent performs synonymous rewriting and noise injection on tool names and documentation content. This forces the model to ground its decision-making in invariant functional semantics rather than memorized token sequences. To ensure evaluation fairness, all perturbation patterns are automatically generated without any prior knowledge of the specific variation types used in the test set, reducing the risk of information leakage. 6.2. Experimental Results

7. Conclusion

We evaluate PAFT on the most challenging tasks from each tier: Semantic Trap (Tier-1), Tool Redirection (Tier2), Logic Inversion (Tier-3), and Fatal Error (Tier-4). For Tiers 1–3, we report the Accuracy Delta (∆) relative to the closed-set baseline; for Tier-4, we report the absolute RR. We set α = 0.3 as the default perturbation ratio.

In this paper, we formalize the OpenAgent setting and leverage a controlled sandbox to diagnose the open-world adaptability of LLM agents. Our systemic analysis reveals that both SFT and RL paradigms exhibit vulnerabilities when facing non-stationary environmental shifts. Furthermore, we propose PAFT, a disturbance-based intervention strategy designed to mitigate trajectory overfitting in SFT.

Performance. As shown in the upper portion of Table 1, 9

Can Agents Generalize to the Open World? Unveiling the Fragility of Static Training in Tool Use

Acknowledgements

International Conference on Learning Representations, 2026.

This work was supported by the Key Program of Jiangsu Science Foundation (BK20243012), the NSFC (62306133), and the 111 Center (No. B26023).

Feng, W., Zhao, P., Jiang, G., Hao, C., Zhang, Y., Liu, G., and Wang, H. Pvpo: Pre-estimated value-based policy optimization for agentic reasoning. arXiv preprint arXiv:2508.21104, 2025.

Impact Statement This work studies robustness and failure modes of tool-use agents under open-world shifts. Its primary positive impact is to improve the reliability and safety of deployed agents by identifying conditions under which models ignore feedback, misuse tools, or hallucinate answers. Potential risks include misuse of stronger tool-use agents in automated decisionmaking systems. We mitigate this by emphasizing refusal behavior, boundary awareness, and controlled evaluation rather than unrestricted deployment.

Gao, X., Xie, S., Zhai, J., Ma, S., and Shen, C. Mcp-radar: A multi-dimensional benchmark for evaluating tool use capabilities in large language models. arXiv preprint arXiv:2505.16700, 2025. Guo, L.-Z. and Li, Y.-F. Class-imbalanced semi-supervised learning with adaptive thresholding. In Proceedings of the 39th International Conference on Machine Learning, 2022. Guo, L.-Z., Zhang, Z.-Y., Jiang, Y., Li, Y.-F., and Zhou, Z.H. Safe deep semi-supervised learning for unseen-class unlabeled data. In Proceedings of the 37th International Conference on Machine Learning, 2020.

References Achiam, J., Adler, S., Agarwal, S., Ahmad, L., Akkaya, I., Aleman, F. L., Almeida, D., Altenschmidt, J., Altman, S., Anadkat, S., et al. GPT-4 technical report. arXiv preprint arXiv:2303.08774, 2023.

Guo, L.-Z., Jia, L.-H., Shao, J.-J., and Li, Y.-F. Robust semisupervised learning in open environments. Frontiers of Computer Science, 19, 2025.

Anthropic. Introducing the model context protocol. https://www.anthropic.com/news/ model-context-protocol, 2024.

Guo, Z., Cheng, S., Wang, H., Liang, S., Qin, Y., Li, P., Liu, Z., Sun, M., and Liu, Y. Stabletoolbench: Towards stable large-scale benchmarking on tool learning of large language models. In Ku, L., Martins, A., and Srikumar, V. (eds.), Findings of the Association for Computational Linguistics, 2024.

Bai, S., Chen, K., Liu, X., Wang, J., Ge, W., Song, S., Dang, K., Wang, P., Wang, S., Tang, J., Zhong, H., Zhu, Y., Yang, M., Li, Z., Wan, J., Wang, P., Ding, W., Fu, Z., Xu, Y., Ye, J., Zhang, X., Xie, T., Cheng, Z., Zhang, H., Yang, Z., Xu, H., and Lin, J. Qwen2.5-VL technical report. arXiv preprint arXiv:2502.13923, 2025. Cheng, Z.-J., Jia, Z.-Y., Zhou, Z., Li, Y.-F., and Guo, L.Z. TabFSBench: Tabular benchmark for feature shifts in open environment. In Proceedings of the 42nd International Conference on Machine Learning, 2025.

He, J., Neville, J., Wan, M., Yang, L., Liu, H., Xu, X., Song, X., Pan, J. Z., and Zhou, P. Gentool: Enhancing tool generalization in language models through zero-to-one and weak-to-strong simulation. In Che, W., Nabende, J., Shutova, E., and Pilehvar, M. T. (eds.), Findings of the Association for Computational Linguistics, 2025.

Chu, T., Zhai, Y., Yang, J., Tong, S., Xie, S., Schuurmans, D., Le, Q. V., Levine, S., and Ma, Y. SFT memorizes, RL generalizes: A comparative study of foundation model post-training. In Proceedings of the 42nd International Conference on Machine Learning, 2025.

Hong, J., Zhao, C., Zhu, C., Lu, W., Xu, G., and Yu, X. DeepEyesV2: Toward agentic multimodal model. In The Fourteenth International Conference on Learning Representations, 2026. Hsieh, C.-Y., Chen, S.-A., Li, C.-L., Fujii, Y., Ratner, A., Lee, C.-Y., Krishna, R., and Pfister, T. Tool documentation enables zero-shot tool-usage with large language models. ArXiv:2308.00675, 2023.

Drouin, A., Gasse, M., Caccia, M., Laradji, I. H., Del Verme, M., Marty, T., Boisvert, L., Thakkar, M., Cappart, Q., Vazquez, D., Chapados, N., and Lacoste, A. WorkArena: How capable are web agents at solving common knowledge work tasks? In Proceedings of the 41st International Conference on Machine Learning, 2024.

Huang, Y., Shi, J., Li, Y., Fan, C., Wu, S., Zhang, Q., Liu, Y., Zhou, P., Wan, Y., Gong, N. Z., and Sun, L. Metatool benchmark for large language models: Deciding whether to use tools and which to use. In The Twelfth International Conference on Learning Representations, 2024.

Feng, J., Huang, S., Qu, X., Zhang, G., Qin, Y., Zhong, B., Jiang, C., Chi, J., and Zhong, W. ReTool: Reinforcement learning for strategic tool use in LLMs. In The Fourteenth 10

Can Agents Generalize to the Open World? Unveiling the Fragility of Static Training in Tool Use

Jia, L.-H., Guo, L.-Z., Zhou, Z., and Li, Y.-F. Realistic evaluation of semi-supervised learning algorithms in open environments. In The Twelfth International Conference on Learning Representations, 2024.

Ma, C., Zhang, J., Zhu, Z., Yang, C., Yang, Y., Jin, Y., Lan, Z., Kong, L., and He, J. AgentBoard: An analytical evaluation board of multi-turn LLM agents. In Advances in Neural Information Processing Systems, volume 37, 2024.

Jimenez, C. E., Yang, J., Wettig, A., Yao, S., Pei, K., Press, O., and Narasimhan, K. SWE-bench: Can language models resolve real-world GitHub issues? In The Twelfth International Conference on Learning Representations, 2024.

Mialon, G., Fourrier, C., Wolf, T., LeCun, Y., and Scialom, T. Gaia: a benchmark for general ai assistants. In The Twelfth International Conference on Learning Representations, 2024. Mo, Y., Zhou, C., Cheng, F., Yu, J., Pan, L., Liu, F., Zhou, S., Li, H., Lin, Z., and Torr, P. Open-World LLM logical reasoning. In Forty-third International Conference on Machine Learning, 2026.

Koh, J. Y., Lo, R., Jang, L., Duvvur, V., Lim, M. C., Huang, P.-Y., Neubig, G., Zhou, S., Salakhutdinov, R., and Fried, D. VisualWebArena: Evaluating multimodal agents on realistic visual web tasks. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics, 2024.

Patil, S. G., Mao, H., Yan, F., Ji, C. C.-J., Suresh, V., Stoica, I., and Gonzalez, J. E. The Berkeley function calling leaderboard (BFCL): From tool use to agentic evaluation of large language models. In Proceedings of the 42nd International Conference on Machine Learning, 2025.

Li, M., Zhao, Y., Yu, B., Song, F., Li, H., Yu, H., Li, Z., Huang, F., and Li, Y. Api-bank: A comprehensive benchmark for tool-augmented llms. In Bouamor, H., Pino, J., and Bali, K. (eds.), Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, 2023.

Qian, C., Acikgoz, E. C., He, Q., Wang, H., Chen, X., Hakkani-Tür, D., Tur, G., and Ji, H. ToolRL: Reward is all tool learning needs. In Advances in Neural Information Processing Systems, volume 38, 2025.

Li, Y.-F., Guo, L.-Z., and Zhou, Z.-H. Towards safe weakly supervised learning. IEEE Transactions on Pattern Analysis and Machine Intelligence, 43, 2021.

Qu, C., Dai, S., Wei, X., Cai, H., Wang, S., Yin, D., Xu, J., and Wen, J.-R. COLT: Towards completeness-oriented tool retrieval for large language models. In Proceedings of the 33rd ACM International Conference on Information and Knowledge Management, 2024.

Li, Z., Zhang, H., Han, S., Liu, S., Xie, J., Zhang, Y., Choi, Y., Zou, J., and Lu, P. In-the-flow agentic system optimization for effective planning and tool use. In The Fourteenth International Conference on Learning Representations, 2026.

Qu, C., Dai, S., Wei, X., Cai, H., Wang, S., Yin, D., Xu, J., and Wen, J. Tool learning with large language models: a survey. Frontiers Comput. Sci., 19, 2025.

Lin, Q., Wen, M., Peng, Q., Nie, G., Liao, J., Wang, J., Mo, X., Zhou, J., Cheng, C., Zhao, Y., Wang, J., and Zhang, W. Hammer: Robust function-calling for on-device language models via function masking. In The Thirteenth International Conference on Learning Representations, 2025.

Qwen, Yang, A., Yang, B., Zhang, B., Hui, B., Zheng, B., Yu, B., Li, C., Liu, D., Huang, F., Wei, H., Lin, H., Yang, J., Tu, J., Zhang, J., Yang, J., Yang, J., Zhou, J., Lin, J., Dang, K., Lu, K., Bao, K., Yang, K., Yu, L., Li, M., Xue, M., Zhang, P., Zhu, Q., Men, R., Lin, R., Li, T., Tang, T., Xia, T., Ren, X., Ren, X., Fan, Y., Su, Y., Zhang, Y., Wan, Y., Liu, Y., Cui, Z., Zhang, Z., and Qiu, Z. Qwen2.5 technical report. arXiv preprint arXiv:2412.15115, 2024.

Liu, X., Yu, H., Zhang, H., Xu, Y., Lei, X., Lai, H., Gu, Y., Ding, H., Men, K., Yang, K., Zhang, S., Deng, X., Zeng, A., Du, Z., Zhang, C., Shen, S., Zhang, T., Su, Y., Sun, H., Huang, M., Dong, Y., and Tang, J. AgentBench: Evaluating LLMs as agents. In The Twelfth International Conference on Learning Representations, 2024.

Shao, J.-J., Zhang, B.-W., Yang, X.-W., Chen, B., Han, S., Jinghao, P., Wei, W.-D., Cai, G., Dong, Z., Guo, L.-Z., and Li, Y.-F. Chinatravel: An open-ended travel planning benchmark with compositional constraint validation for language agents. In The Fourteenth International Conference on Learning Representations, 2026.

Liu, Z., Qiu, J., Wang, S., Zhang, J., Liu, Z., Ram, R., Chen, H., Yao, W., Heinecke, S., Savarese, S., Wang, H., and Xiong, C. MCPEval: Automatic MCP-based deep evaluation for AI agent models. In Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing: System Demonstrations, 2025.

Shen, Y., Song, K., Tan, X., Li, D., Lu, W., and Zhuang, Y. HuggingGPT: Solving AI tasks with ChatGPT and its friends in Hugging Face. In Advances in Neural Information Processing Systems, volume 36, 2023. 11

Can Agents Generalize to the Open World? Unveiling the Fragility of Static Training in Tool Use

Shi, Z., Gao, S., Chen, X., Feng, Y., Yan, L., Shi, H., Yin, D., Ren, P., Verberne, S., and Ren, Z. Learning to use tools via cooperative and interactive agents. In Al-Onaizan, Y., Bansal, M., and Chen, Y. (eds.), Findings of the Association for Computational Linguistics: EMNLP, volume EMNLP 2024 of Findings of ACL, 2024.

Xiong, Q., Huang, Y., Jiang, Z., Chang, Z., Zheng, Y., Li, T., and Li, M. Butterfly effects in toolchains: A comprehensive analysis of failed parameter filling in llm tool-agent systems. arXiv preprint arXiv:2507.15296, 2025. Xu, F. F., Song, Y., Li, B., Tang, Y., Jain, K., Bao, M., Wang, Z. Z., Zhou, X., Guo, Z., Cao, M., Yang, M., Lu, H. Y., Martin, A., Su, Z., Maben, L., Mehta, R., Chi, W., Jang, L., Xie, Y., Zhou, S., and Neubig, G. TheAgentCompany: Benchmarking LLM agents on consequential real-world tasks. In Advances in Neural Information Processing Systems, volume 38, 2025a.

Su, Z., Li, L., Song, M., Hao, Y., Yang, Z., Zhang, J., Chen, G., Gu, J., Li, J., Qu, X., et al. Openthinkimg: Learning to think with images via visual tool reinforcement learning. arXiv preprint arXiv:2505.08617, 2025. Team, G., Anil, R., Borgeaud, S., Alayrac, J.-B., Yu, J., Soricut, R., Schalkwyk, J., Dai, A. M., Hauth, A., Millican, K., et al. Gemini: a family of highly capable multimodal models. arXiv preprint arXiv:2312.11805, 2023.

Xu, Z., Soria, A. M., Tan, S., Roy, A., Agrawal, A. S., Poovendran, R., and Panda, R. Toucan: Synthesizing 1.5 m tool-agentic data from real-world mcp environments. arXiv preprint arXiv:2510.01179, 2025b.

Team, K., Bai, Y., Bao, Y., Chen, G., Chen, J., Chen, N., Chen, R., Chen, Y., Chen, Y., Chen, Y., et al. Kimi k2: Open agentic intelligence. arXiv preprint arXiv:2507.20534, 2025.

Ye, J., Wu, Y., Gao, S., Huang, C., Li, S., Li, G., Fan, X., Zhang, Q., Gui, T., and Huang, X.-J. Rotbench: A multi-level benchmark for evaluating the robustness of large language models in tool learning. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, 2024.

Trivedi, H., Khot, T., Hartmann, M., Manku, R., Dong, V., Li, E., Gupta, S., Sabharwal, A., and Balasubramanian, N. AppWorld: A controllable world of apps and people for benchmarking interactive coding agents. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics, 2024.

Ye, J., Li, G., Gao, S., Huang, C., Wu, Y., Li, S., Fan, X., Dou, S., Ji, T., Zhang, Q., Gui, T., and Huang, X. Tooleyes: Fine-grained evaluation for tool learning capabilities of large language models in real-world scenarios. In Proceedings of the 31st International Conference on Computational Linguistics, 2025.

Wang, J., Zerun, M., Li, Y., Zhang, S., Chen, C., Chen, K., and Le, X. GTA: A benchmark for general tool agents. In Advances in Neural Information Processing Systems, volume 37, 2024a. Wang, L., Ma, C., Feng, X., Zhang, Z., Yang, H., Zhang, J., Chen, Z., Tang, J., Chen, X., Lin, Y., Zhao, W. X., Wei, Z., and Wen, J. A survey on large language model based autonomous agents. Frontiers Comput. Sci., 18, 2024b.

Yin, S., Lei, T., and Liu, Y. Toolvqa: A dataset for multistep reasoning vqa with external tools. In Proceedings of the IEEE/CVF International Conference on Computer Vision, 2025.

Wang, X., Wang, Z., Liu, J., Chen, Y., Yuan, L., Peng, H., and Ji, H. MINT: evaluating llms in multi-turn interaction with tools and language feedback. In The Twelfth International Conference on Learning Representations, 2024c.

Yu, Q., Zhang, Z., Zhu, R., Yuan, Y., Zuo, X., Yue, Y., Dai, W., Fan, T., Liu, G., Liu, L., et al. DAPO: An open-source LLM reinforcement learning system at scale. In Advances in Neural Information Processing Systems, volume 38, 2025.

Wang, Z., Chang, Q., Patel, H., Biju, S., Wu, C.-E., Liu, Q., Ding, A., Rezazadeh, A., Shah, A., Bao, Y., and Siow, E. MCP-Bench: Benchmarking tool-using LLM agents with complex real-world tasks via MCP servers. In The Fourteenth International Conference on Learning Representations, 2026.

Yuan, S., Song, K., Chen, J., Tan, X., Shen, Y., Ren, K., Li, D., and Yang, D. Easytool: Enhancing llm-based agents with concise tool instruction. In Proceedings of the 2025 Conference of the Nations of the Americas Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers), 2025.

Xie, T., Zhang, D., Chen, J., Li, X., Zhao, S., Cao, R., Hua, T. J., Cheng, Z., Shin, D., Lei, F., Liu, Y., Xu, Y., Zhou, S., Savarese, S., Xiong, C., Zhong, V., and Yu, T. OSWorld: Benchmarking multimodal agents for open-ended tasks in real computer environments. In Advances in Neural Information Processing Systems, volume 37, 2024.

Zeng, A., Lv, X., Zheng, Q., Hou, Z., Chen, B., Xie, C., Wang, C., Yin, D., Zeng, H., Zhang, J., et al. Glm-4.5: Agentic, reasoning, and coding (arc) foundation models. arXiv preprint arXiv:2508.06471, 2025. 12

Can Agents Generalize to the Open World? Unveiling the Fragility of Static Training in Tool Use

Zheng, Z., Yang, M., Hong, J., Zhao, C., Xu, G., Yang, L., Shen, C., and Yu, X. DeepEyes: Incentivizing “thinking with images” via reinforcement learning. In The Fourteenth International Conference on Learning Representations, 2026. Zhou, S., Xu, F. F., Zhu, H., Zhou, X., Lo, R., Sridhar, A., Cheng, X., Ou, T., Bisk, Y., Fried, D., Alon, U., and Neubig, G. WebArena: A realistic web environment for building autonomous agents. In The Twelfth International Conference on Learning Representations, 2024. Zhou, Z.-H. Open-environment machine learning. National Science Review, 9, 2022.

13

Can Agents Generalize to the Open World? Unveiling the Fragility of Static Training in Tool Use

Appendix Contents A Sandbox Environment

15

A.1 Database . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

15

A.2 Logical Architecture and Function Classification of Tools . . . . . . . . . . . . . . . . . . . . . . . . . .

16

A.3 Tool Call Module . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

16

A.4 Training and Test Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

17

B Experimental Details

18

C Implementation Details of OpenAgent Evaluation Task

20

C.1 Tier 1: Perception Generalization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

20

C.1.1

Instruction Robustness. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

20

C.1.2

Schema Adaptability. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

20

C.1.3

Semantic Grounding. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

20

C.2 Tier 2: Interaction Generalization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

21

C.2.1

Format Adaptability. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

21

C.2.2

Error Correction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

21

C.2.3

Dynamic Alignment. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

21

C.3 Tier 3: Reasoning Generalization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

21

C.3.1

Rule Reasoning. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

21

C.3.2

Path Planning. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

22

C.4 Tier 4: Internalization Generalization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

22

C.4.1 Active Refusal . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

22

C.4.2

22

Domain Transfer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

D Detailed Experimental Results

23

D.1 Tier 1 Experiments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

23

D.2 Tier 2 Experiments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

29

D.3 Tier 3 Experiments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

34

D.4 Tier 4 Experiments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

37

E Case Study

37

E.1 Tier 1: Perception . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

37

E.1.1

Instruction Blurring & Information Redundancy . . . . . . . . . . . . . . . . . . . . . . . . . .

37

E.1.2

Schema Adaptability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

37

E.1.3

Semantic Grounding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

38

E.2 Tier 2: Interaction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

39

14

Can Agents Generalize to the Open World? Unveiling the Fragility of Static Training in Tool Use

E.2.1

Format Adaptability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

39

E.2.2

Value Redirection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

39

E.2.3

Tool Redirection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

40

E.3 Tier 3: Reasoning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

41

E.3.1

Rule Learning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

41

E.3.2

Path Planning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

41

E.4 Tier 4: Internalization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

41

E.4.1

Fatal Error . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

41

E.4.2

Information Missing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

42

E.4.3

Domain Shift . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

42

F Real-World API Validation

43

A. Sandbox Environment Since live APIs and MCP-based tool ecosystems are often unstable, version-dependent, and difficult to control during evaluation, we build a local code-running sandbox to simulate tool calls. Specifically, we create a Python sandbox environment class that includes database, tools implementation, and tool call module. Detailed information is as follows: A.1. Database We built our experimental database using public Point of Interest (POI) data from Beijing. Each POI entry has five key attributes: Phone Number, Address Name, Adname (Administrative Name), Coordinates (Latitude/Longitude), and Category. To strictly prevent data leakage and ensure the model relies entirely on tool usage rather than parameter memory to answer, we adopted an anonymization protocol. Specifically, all Address Names and Phone Numbers are replaced with unique, randomly generated alphanumeric strings and non-repeating number sequences, respectively. In addition, we strictly separate the training and test databases to avoid the model guessing the answers correctly by chance. Examples of the database data are shown in Table 2.

Table 2. Samples of the Anonymized POI Knowledge Base

Address Name

Phone Number

Adname

Coordinates

Category

exotlwnk cqhecbvi rjztnhhg

00000000 00000001 00000002

chaoyang haidian changping

116.413486, 39.992582 116.318014, 40.029475 116.303367, 40.160994

C1 C2 C2

15

Can Agents Generalize to the Open World? Unveiling the Fragility of Static Training in Tool Use

Figure 8. Logic Diagram of Tools. Each line represents one tool. The start of an arrow denotes the input, while the end of an arrow denotes the output.

A.2. Logical Architecture and Function Classification of Tools We designed the logical architecture of the tools in accordance with the logic diagram (Figure 8) and the following rules: 1. For key-value (coords, tel, name) query functions: we only support the counterclockwise query method by default, i.e., coords can only be used to query tel; 2. For the fare query function: we only allow queries by name; 3. For the distance calculation function: we only allow latitude and longitude as input parameters; 4. For non-key information queries: we allow any three key information to be used as input. The above rules also restrict the input type of each tool, and we finally obtained 12 tools, which are shown in Table 3. Table 3. Definitions of training set tools with categorized input and output types. Tool Name

Functional Description

Input

Output

search map coordinates administrativedivisionquery fetch poi category

Retrieve location coordinates by exact name. Retrieve the district name (adname) by exact name. Retrieve the category type by exact name.

Name Name Name

Coords District Category

find contact at coords reverse geocoding venue type identifier

Retrieve the telephone number using coordinates. Retrieve the district name using coordinates. Retrieve the category type using coordinates.

Coords Coords Coords

Tel District Category

caller id lookup regional mapping by tel service catalog search

Retrieve the name of a POI using its telephone number. Retrieve the district name using telephone number. Retrieve the category type using telephone number.

Tel Tel Tel

Name District Category

calculate distance by coords get adult cost by name get child cost by name

Calculate distance between two coordinates. Calculate discounted adult price (0.5x) by name. Calculate discounted child price (0.2x) by name.

Coords × 2 Name Name

Distance Price Price

A.3. Tool Call Module We set up the different tool call modules for RL training and evaluation testing in two different ways: • For RL training, we use the Verl Tool framework. The core idea is to run the code sandbox as a service on the server and open an external port. This port receives tool names and corresponding parameters, then sends back the tool call results. During each RL training run, we use the terminator <tool call >to detect tool call commands. Specifically, when the model outputs this keyword, it stops generating text and triggers the tool detector. After processing all data in the same batch, the tool detector accesses the port uniformly to get results. These operations ensure only one tool call 16

Can Agents Generalize to the Open World? Unveiling the Fragility of Static Training in Tool Use

command is formed per conversation turn. The rest of the reinforcement learning process is the same as normal RL training. • For evaluation testing, we simulate multi-turn conversations and also detect tool calls via the terminator, which ensures that only one tool call is triggered in a single turn. If the model outputs </answer >, it means the response is finished. In summary, the experimental environment of our study is composed of the query database, the sandbox code execution environment, the training and test sets, as well as the training and testing logic. The case of interaction is shown below. Interaction case { "role": "user", "content": "I have the phone number ’00001433’. Can you help me find the location of the place associated with this number?" }, { "role": "assistant", "content": "<tool call>{"tool": "caller id lookup", "args": {"tel": "00001433"}}</tool call>" }, { "role": "user", "content": "Observation: {"name": "sgtdfxvz" }" }, { "role": "assistant", "content": "There is no direct tool available to retrieve the location from a phone number. Therefore, I will first use the phone number to look up the name of the place. <tool call>{"tool": "search map coordinates", "args": {"name": "sgtdfxvz"}}</tool call>" }, { "role": "user", "content": "Observation: {"location": "116.445179,39.953269" }" }, { "role": "assistant", "content": "Now that I have the name of the place, I can proceed to find its location using the name-based lookup tool. <answer>116.445179,39.953269</answer>" }

A.4. Training and Test Data Following data preparation in the main paper and the database and tools mentioned above, we employ a reverse-synthesis approach to generate training instances. By randomly sampling initial query conditions and target answers based on our defined tool set, we derive a symbolic reasoning trajectory. Formally, a symbolic trajectory Tsym is defined as: Tsym = {c, t1 → t2 → · · · → tk , a}

(5)

where c represents the initial condition (e.g., a specific location coordinate), ti denotes the i-th tool invocation in the chain, and a is the final answer. To align these symbolic representations with human interaction patterns, we utilize an LLM 17

Can Agents Generalize to the Open World? Unveiling the Fragility of Static Training in Tool Use 30

28.4%

Others

Percentage (%)

25 20

adult_cost 20.5%

calc_distance

Others 17.0%

17.0%

15.0%

12.7%

2.8%

15

search_map_coords

11.4%

0

24.4% 12.7% 15.0%

find_contact 1

2

3

4

Step Number

(a) Step Distribution

5

5.7% 5.7%

10 5

5.7%

34.1%

17.4%

5.7%

6

basic_tel

13.6%

price

child_cost

(b) Tool Coverage

6.8%

caller_id_lookup

28.4%

basic_location basic_name single_adname

distance

(c) Source Distribution

Figure 9. Overall Statistics of the POI Multi-step Tool-calling Dataset: (a) Distribution of task complexity by step count; (b) Proportions of various tool invocations; (c) Composition of task scenarios and sources.

to transform and smooth Tsym into natural language question-answer pairs, resulting in a dataset of coherent multi-step tool-use queries. The final dataset comprises a total of 6,930 samples, divided into a training set (N = 6, 050) and a test set (N = 880). The dataset characteristics are designed to ensure rigorous evaluation: • Complexity Distribution: Both the training and test sets follow an identical distribution regarding the length of tool chains (e.g., 1-hop, 2-hop, ..., k-hop). This ensures that the test set accurately reflects the structural complexity of the training data. • Database Isolation: To eliminate the possibility of data leakage, the training and test sets are synthesized from disjoint subsets of the underlying POI database. Consequently, the model must generalize its reasoning capabilities to unseen entities rather than recalling specific POI attributes seen during training. Regarding task complexity distribution, the dataset employs a stepped logical chain design covering a range from one to six steps; two-step tasks serve as the core backbone (accounting for 28.4%), while nearly 40% of the samples consist of high-difficulty reasoning tasks involving three or more steps, ensuring depth in the model’s learning of long-range tool invocation paths. In terms of tool and scenario distribution, the dataset exhibits a high degree of domain focus and balance: the core tool caller id lookup represents 24.4% of invocations, while ticket price calculation (adult/child cost) and geographic measurement (coords/distance) tools work in close coordination to form the foundation of task execution. This distribution is further corroborated by the source scenarios, where price-related (34.1%) and distance-related (28.4%) contexts dominate, providing the model with abundant material for numerical reasoning and logical alignment. Overall, this dataset covers basic attribute queries (e.g., POI names, phone numbers, and administrative divisions) and utilizes complex step distributions to force the model into semantic grounding rather than simple symbolic matching during extreme testing, such as anonymization or logical inversion. With its scientific tool sampling proportions and diverse business scenarios, this dataset serves as an ideal benchmark for training agents equipped with efficient path planning and robust generalization capabilities. In addition, we also provide the tools that can be used in Table 3.

B. Experimental Details We adopt Qwen2.5-7B-Instruct as the backbone model and perform full-parameter fine-tuning based on the LLaMA-Factory framework. The AdamW optimizer is employed, with the learning rate and batch size set to 3e-5 and 2, respectively. The training process runs for a total of 800 steps, with a model checkpoint saved every 200 steps. For the RL paradigm, training leverages the GRPO tool calling algorithm implemented on the Verl-Tool platform. Notably, we use the normal GRPO to keep comparison fairly. The AdamW optimizer is also used here, with the learning rate set to 1e-6, the number of deployments configured to 8, and the total training steps set to 280. The PAFT algorithm differs from SFT only in the 18

Can Agents Generalize to the Open World? Unveiling the Fragility of Static Training in Tool Use

training dataset. The reward function was designed as follows:

Reward = 0.8 × Acc + 0.2 × scoref ormat

Note that we guarantee that both models are fully fitted and strictly control the amount of input data to ensure the fairness of the comparison. Testing Setup: During the inference phase, all models were uniformly constrained with identical sampling hyperparameters: the sampling temperature was fixed at 0.0, and the Top-p value was set to 1.0. For modifying the tool settings, we conducted three experiments and analyzed the results comprehensively. The system prompt template for training and testing is as follows:

System Prompt "You are a professional geographic information assistant. You can answer questions about places, phone numbers, distances, and ticket prices by calling POI database tools. ### Available Tools: [ {"name": "search map coordinates", "description": "Retrieve the location coordinates (longitude,latitude) of a POI by its exact name.", "parameters": {"type": "object", "properties": {"name": {"type": "string"}}, "required": ["name"]}}, {"name": "administrative division query", "description": "Retrieve the district name (adname) of a POI by its exact name.", "parameters": {"type": "object", "properties": {"name": {"type": "string"}}, "required": ["name"]}}, {"name": "fetch poi category", "description": "Retrieve the category type of a POI by its exact name.", "parameters": {"type": "object", "properties": {"name": {"type": "string"}}, "required": ["name"]}}, {"name": "find contact at coords", "description": "Retrieve the telephone number of a POI using its location coordinates.", "parameters": {"type": "object", "properties": {"location": {"type": "string", "description": "’lon,lat’ string"}}, "required": ["location"]}}, {"name": "reverse geocoding", "description": "Retrieve the district name of a POI using its location coordinates.", "parameters": {"type": "object", "properties": {"location": {"type": "string", "description": "’lon,lat’ string"}}, "required": ["location"]}}, {"name": "venue type identifier", "description": "Retrieve the category type of a POI using its location coordinates.", "parameters": {"type": "object", "properties": {"location": {"type": "string", "description": "’lon,lat’ string"}}, "required": ["location"]}}, {"name": "caller id lookup", "description": "Retrieve the name of a POI using its telephone number.", "parameters": {"type": "object", "properties": {"tel": {"type": "string"}}, "required": ["tel"]}}, {"name": "regional mapping by tel", "description": "Retrieve the district name of a POI using its telephone number.", "parameters": {"type": "object", "properties": {"tel": {"type": "string"}}, "required": ["tel"]}}, {"name": "service catalog search", "description": "Retrieve the category type of a POI using its telephone number.", "parameters": {"type": "object", "properties": {"tel": {"type": "string"}}, "required": ["tel"]}}, {"name": "calculate distance by coords", "description": "Calculate the distance in meters between two specific coordinates. Requires mode=2.", "parameters": {"type": "object", "properties": {"start lat": {"type": "number"}, "start lon": {"type": "number"}, "end lat": {"type": "number"}, "end lon": {"type": "number"}, "mode": {"type": "integer", "description": "Verification code."}}, "required": ["start lat", "start lon", "end lat", "end lon", "mode"]}}, {"name": "get adult cost by name", "description": "Calculate the discounted adult ticket price (0.5x) by POI name. Requires mode=1.", "parameters": {"type": "object", "properties": {"name": {"type": "string"}, "mode": {"type": "integer", "description": "Verification code."}}, "required": ["name", "mode"]}}, {"name": "get child cost by name", "description": "Calculate the discounted child ticket price (0.2x) by POI name. Requires mode=1.", "parameters": {"type": "object", "properties": {"name": {"type": "string"}, "mode": {"type": "integer", "description": "Verification code."}}, "required": ["name", "mode"]}} ] ### Protocol: 1. ONE TOOL PER TURN: You MUST output only ONE tool call at a time. Wait for the observation before doing anything else. 2. Tool Format: To use a tool, strictly output a JSON object with "name" and "arguments" keys. Example: {"name": "get tel by name", "arguments": {"name": "Beijing Hotel"}} 3. Final Answer: Wrap the result in <answer></answer>. Keep numerical answers to 1 decimal place."

19

Can Agents Generalize to the Open World? Unveiling the Fragility of Static Training in Tool Use

C. Implementation Details of OpenAgent Evaluation Task C.1. Tier 1: Perception Generalization C.1.1. I NSTRUCTION ROBUSTNESS . • Instruction Blurring: We employ API calls to rewrite user queries, introducing complexities through syntactic variations (e.g., colloquialisms, rhetorical questions) or semantic ambiguities (e.g., implicit references, entity omissions). • Information Redundancy: We employ API calls to rewrite user queries by embedding core instructions within irrelevant contexts or lengthy background details, thereby simulating real-world informational noise. Please refer to the Appendix E.1.1 for further details. C.1.2. S CHEMA A DAPTABILITY. We alter the parameter dictionary key from the standard args to arguments, as shown in Appendix E.1.2. C.1.3. S EMANTIC G ROUNDING . Synonymous Rewriting We assess the model’s capability to decouple functional intent from specific symbolic labels by replacing tool identifiers with semantically equivalent alternatives. This requires the model to move beyond simple string matching and demonstrate a deep understanding of the underlying natural language semantics. Table 4. Tool Mapping for Synonym Rewriting Original Tool Name

→

Synonymous Variant

calculate distance by coords search map coordinates get adult cost by name

→ → →

calculate separation via positions lookup location latlong fetch grownup price using name

Noise Injection While maintaining the integrity of the tool schema, we introduce subtle syntactic perturbations into the tool names by inserting articles or determiners. We utilize this setup to evaluate the model’s tolerance to minor fluctuations in API naming and its stability when encountering non-standardized inputs. Table 5. Tool Mapping for Surface Noise Original Tool Name

→

Noisy Variant

calculate distance by coords search map coordinates get adult cost by name

→ → →

calculate the distance by coords search for map coordinates get 1 adult cost by name

Semantic Adversarial We designed a “description trap” where the familiar tool names are retained, but their functional descriptions are modified to explicitly forbid their previous usage. We require the model to overcome “path dependency” on familiar names, recognize the obsolescence of the original tool based on the updated description, and accurately invoke a new tool with matching functionality. Table 6. Changes in Semantic Adversarial Status

Tool Name

Obsolete Target

get adult cost by name fetch grownup price using name

Functional Role Service fee calculation only (Forbidden) Actual ticket price calculation (Correct)

Identity Erasure To isolate the model’s reliance on pure functional logic, we replace all human-readable identifiers with randomly generated UUIDs. In this extreme setting, we force the agent to perform reasoning based exclusively on the provided natural language descriptions. 20

Can Agents Generalize to the Open World? Unveiling the Fragility of Static Training in Tool Use Table 7. Tool Mapping for Identity Erasure Semantic Tool Name

→

Anonymous Identifier

calculate distance by coords search map coordinates get adult cost by name

→ → →

Tool a2fb Tool c3d8 Tool r6t7

C.2. Tier 2: Interaction Generalization C.2.1. F ORMAT A DAPTABILITY. We diversify the structure of tool return values, transitioning from strictly structured JSON to less constrained formats such as Markdown tables or raw text logs. Table 8. Example of Format Shift in Tool Observations Type

Content Structure

Structured (Old) Unstructured (New)

"content": "Observation: {location: 116.35,40.22} " "content": "Observation: {location is 116.35,40.22} "

C.2.2. E RROR C ORRECTION . • Error Return: We simulate an explicit failure where the primary tool returns a specific error message (e.g., “This tool is unavailable now”) or a traceback. This scenario evaluates whether the agent can interpret explicit error signals and proactively switch to a redundant tool to resolve the blockage. • Null Return: We introduce an implicit failure where the primary tool returns a null value or an empty set (∅) without any diagnostic warning. This tests the agent’s capability to detect anomalies based on the absence of content, rather than the presence of an error signal, and infer the necessity of a fallback execution.

Table 9. Mapping of Tool Failure Modes and Expected Agent Responses Failure Type Error Return Null Return

Tool Observation (Return) {"error":

"This tool is unavailable now"} ""

C.2.3. DYNAMIC A LIGNMENT. • Value Redirection: We simulate a scenario where the provided parameter logic is deprecated, and the environment returns a message including new, valid parameters. • Tool Redirection: We simulate a scenario where the primary tool returns an error explicitly stating it is obsolete while simultaneously suggesting an alternative tool. Importantly, we feed the interaction history into the API model (DouBao) to enable it to judge whether the target model refuses to answer. C.3. Tier 3: Reasoning Generalization C.3.1. RULE R EASONING . We introduce rule conflicts in a special tool by modifying the mathematical constants in the tool description. Specifically, we kept the tool interface unchanged, but significantly adjusted the calculation ratio in the Prompt in the test set to examine whether the model relies on the memory from the training stage or can perform real-time reasoning based on immediate instructions. 21

Can Agents Generalize to the Open World? Unveiling the Fragility of Static Training in Tool Use Table 10. Experimental Setup for Calculation Shift: Transitioning from Training Logic to Dynamic Test Logic Tool Name

Training rule (Origin)

Test rule (Changed)

get adult cost

Discounted Price = 0.5x Original Price

Discounted Price = 0.1x Original Price

get child cost

Discounted Price = 0.2x Original Price

Discounted Price = 0.1x Original Price

C.3.2. PATH P LANNING . Trace Simplification We implement Tool shortcut to evaluate the agent’s ability to optimize its reasoning trajectory when more efficient paths become available. In this setup, we condense the functionality of two separate, sequential tools into a single, streamlined tool. This transformation reduces a multi-step dependency chain into a one-step execution. Table 11. Implementation of Tool Consolidation Original Multi-step Tools

→

Consolidated Tool (Single Step)

search map coords + find contact coords find contact coords + caller id lookup caller id lookup + search map coords

→ → →

get tel by name get name by location get location by tel

Logic Inversion We simulate causal inversions in the dependency figure 8. During the testing phase, we intentionally reverse the information acquisition order described in the documentation, effectively inverting the preconditions of the tools. For example, if a task originally required Tool A to precede Tool B, we redefine the logic such that Tool A now depends on the output of Tool B. Table 12. Implementation of Causal Reversal Original Tool Logic

→

Reversed Causal Logic (Test)

search map coords: Name → Coords find contact coords: Coords → Tel caller id lookup: Tel → Name

→ → →

lookup name by coords: Coords → Name get coords by tel: Tel → Coords search tel by name: Name → Tel

C.4. Tier 4: Internalization Generalization C.4.1. ACTIVE R EFUSAL We implement Active Refusal by constructing “Missing Condition” and “Fatal Error” scenarios, transitioning tasks from being “inevitably solvable” to “deterministically unsolvable.” We utilize this setup to assess the model’s capability to recognize task boundaries—specifically, whether it can choose to proactively refuse the request rather than generating hallucinations when faced with information deficiency or execution deadlocks. The error tools include calculate distance by coords, search map coordinates, and get adult cost by name. Table 13. Implementation of Active Refusal via Insufficient Conditions Scenarios

Original State (Solvable)

Perturbed State (Unsolvable)

Missing Condition Fatal Error

Complete information in User Query Successful Tool Execution

Randomly excised key entities/constraints Irrecoverable error with no alternative tools

C.4.2. D OMAIN T RANSFER We implement a Domain Shift by changing the distributions of all three interactive elements: the user query, tool definitions, and environmental observations. Specifically, we transfer the evaluation environment from a geographic address lookup task to a medical registration task. While the surface presentation of the tasks is entirely altered, we retain the latent causal logical structure (Figure 8) invariance. 22

Can Agents Generalize to the Open World? Unveiling the Fragility of Static Training in Tool Use Table 14. One-to-One Tool Mapping for Joint Domain Shift Geographic Domain (Source Ptrain )

Medical Domain (Target Ptest )

search map coordinates administrative division query fetch poi category

get medical facility coords query medical administration fetch medical service type

N ame → Coords N ame → Admin N ame → Category

find contact at coords reverse geocoding venue type identifier

find emergency hotline at coords reverse medical geocoding identify clinic category

Coords → T el Coords → Admin Coords → Category

caller id lookup regional mapping by tel service catalog search

lookup facility by hotline query medical region by tel classify service by tel

T el → N ame T el → Admin T el → Category

calculate distance by coords get adult cost by name get child cost by name

calculate ambulance route distance get checkup cost by name get vaccine cost by name

M ath(mode = 2) CostA(mode = 1) CostB(mode = 1)

Latent Logic

D. Detailed Experimental Results D.1. Tier 1 Experiments We report the full numerical results for all Tier-1 perception experiments. Tables 15–16 present accuracy and ATCL under instruction-level perturbations (Instruction Blurring and Information Redundancy). Table 17 reports performance under schema keyword changes. Tables 18–22 provide per-tool breakdowns across three semantic grounding experiments (Parameter Drift, Synonymous Rewriting, Noise Injection, Semantic Adversarial, and Identity Erasure), where each tool is evaluated independently to isolate tool-specific failure patterns. Across all settings, SFT exhibits increasing symbolic anchoring as training progresses, while RL maintains more stable accuracy retention.

Table 15. Detailed Results of Instruction Blurring

Model/Step

Acc (Abs)

ATCL Ratio

ATCL (Abs)

ATCL Ratio

ATCL Diff

base

20.91

71.32

3.76

101.35

+0.05

sft-200 sft-400 sft-600 sft-800

78.98 67.39 78.07 78.30

120.45 83.40 95.69 95.17

2.78 2.70 2.84 2.83

128.70 96.09 99.30 98.26

+0.62 -0.11 -0.02 -0.05

rl-40 rl-80 rl-160 rl-240 rl-280

34.43 58.64 67.27 74.89 74.77

63.78 79.63 82.22 81.86 81.84

2.14 2.45 2.56 2.55 2.57

93.86 95.33 95.52 95.15 95.90

-0.14 -0.12 -0.12 -0.13 -0.11

23

Can Agents Generalize to the Open World? Unveiling the Fragility of Static Training in Tool Use Table 16. Detailed Results of Information Redundancy

Model/Step

Acc (Abs)

Acc Ratio

ATCL (Abs)

ATCL Ratio

ATCL Diff

base

13.98

47.68

4.01

108.09

+0.30

sft-200 sft-400 sft-600 sft-800

84.66 67.73 77.39 75.23

129.11 83.82 94.85 91.44

2.98 3.10 3.16 3.22

137.96 110.32 110.49 111.81

+0.82 +0.29 +0.30 +0.34

rl-40 rl-80 rl-160 rl-240 rl-280

38.86 54.77 55.68 61.48 61.02

71.99 74.38 68.05 67.21 66.79

2.29 2.36 2.57 2.58 2.56

100.44 91.83 95.90 96.27 95.52

+0.01 -0.21 -0.11 -0.10 -0.12

Table 17. Detailed Results of Schema Adaptability

Model/Step

Acc (Abs)

Acc Ratio

ATCL (Abs)

ATCL Ratio

ATCL Diff

base

31.82

108.53

3.72

100.27

+0.01

sft-200 sft-400 sft-600 sft-800

76.59 82.95 81.93 81.59

116.81 102.66 100.42 99.17

2.55 2.86 2.87 2.88

118.06 101.78 100.35 100.00

+0.39 +0.05 +0.01 +0.00

rl-40 rl-80 rl-160 rl-240 rl-280

61.82 82.39 81.48 92.27 92.39

114.52 111.88 99.58 100.86 101.13

2.49 2.74 2.70 2.66 2.66

109.21 106.61 100.75 99.25 99.25

+0.21 +0.17 +0.02 -0.02 -0.02

24

Can Agents Generalize to the Open World? Unveiling the Fragility of Static Training in Tool Use Table 18. Detailed Results of Parameter Drift across three tools. T1: calculate distance by coords; T2: search map coordinates; T3: get adult cost by name.

Model

Tool

Acc (Abs)

Acc Ratio

Tool (Abs)

Tool Ratio

Tool Diff

Fail Rate

Ratio (Base)

base

T1 T2 T3

25.80 26.14 30.11

87.99 89.15 102.69

3.68 3.74 3.71

99.19 100.81 100.00

-0.03 +0.03 +0.00

20.04 18.11 11.25

152.88 137.89 112.27

T1 T2 T3

66.82 66.82 66.93

101.91 101.91 102.07

2.18 2.18 2.19

100.93 100.93 101.39

+0.02 +0.02 +0.03

0.15 0.15 6.80

96.85 97.73 85.91

T1 T2 T3

80.80 80.23 80.23

100.00 99.29 99.29

2.80 2.80 2.79

99.64 99.64 99.29

-0.01 -0.01 -0.02

1.34 1.17 0.95

94.51 82.49 100.24

T1 T2 T3

81.36 81.36 81.93

99.72 99.72 100.42

2.86 2.86 2.86

100.00 100.00 100.00

+0.00 +0.00 +0.00

0.66 0.41 0.47

89.25 100.00 100.00

T1 T2 T3

81.82 81.14 81.82

99.45 98.63 99.45

2.88 2.88 2.88

100.00 100.00 100.00

+0.00 +0.00 +0.00

0.41 0.33 0.46

83.47 100.00 133.33

T1 T2 T3

55.00 53.98 54.32

101.89 100.00 100.63

2.31 2.27 2.29

101.32 99.56 100.44

+0.03 -0.01 +0.01

21.60 19.88 6.68

112.32 103.32 94.84

T1 T2 T3

73.41 77.50 73.98

99.69 105.24 100.46

2.54 2.58 2.57

98.83 100.39 100.00

-0.03 +0.01 +0.00

19.48 16.46 2.20

151.50 127.98 112.15

T1 T2 T3

81.93 81.70 80.91

100.13 99.85 98.89

2.64 2.65 2.66

98.51 98.88 99.25

-0.04 -0.03 -0.02

17.93 15.63 0.11

111.43 97.41 50.11

T1 T2 T3

91.59 92.05 91.25

100.12 100.62 99.75

2.69 2.68 2.68

100.37 100.00 100.00

+0.01 +0.00 +0.00

9.96 9.90 0.00

99.13 99.03 100.00

T1 T2 T3

91.59 92.05 91.36

100.25 100.76 100.00

2.69 2.68 2.68

100.37 100.00 100.00

+0.01 +0.00 +0.00

9.96 9.73 0.00

100.89 99.01 100.00

sft-200

sft-400

sft-600

sft-800

rl-40

rl-80

rl-160

rl-240

rl-280

25

Can Agents Generalize to the Open World? Unveiling the Fragility of Static Training in Tool Use Table 19. Detailed Results of symbolic Drift (Synonymous Rewriting) across three tools (T1: calculate distance by coords → calculate separation via positions; T2: search map coordinates → lookup location latlong; T3: get adult cost by name → fetch grownup price using name).

Model/Step

Tool

Acc (Abs)

Acc Ratio

ATCL (Abs)

ATCL Ratio

ATCL Diff

TER

TER Ratio

base

T1 T2 T3

27.61 24.09 30.00

94.17 82.16 102.32

3.76 3.88 3.72

101.35 104.58 100.27

+0.05 +0.17 +0.01

11.10 18.22 12.49

110.76 223.78 95.28

sft-200

T1 T2 T3

68.52 57.39 66.59

104.50 87.52 101.56

2.19 2.23 2.20

101.39 103.24 101.85

+0.03 +0.07 +0.04

3.10 16.65 0.60

39.21 263.32 389.74

sft-400

T1 T2 T3

80.45 72.61 71.25

99.57 89.86 88.18

2.79 2.82 2.92

99.29 100.36 103.91

-0.02 +0.01 +0.11

0.71 8.67 10.85

74.47 1007.77 765.61

sft-600

T1 T2 T3

80.45 76.48 77.50

98.60 93.74 94.99

2.86 2.88 2.86

100.00 100.70 100.00

0.00 +0.02 0.00

0.47 6.02 5.27

100.00 799.70 714.63

sft-800

T1 T2 T3

81.59 75.45 78.52

99.17 91.71 95.44

2.88 2.86 2.88

100.00 99.31 100.00

0.00 -0.02 0.00

0.70 5.16 4.81

200.70 787.93 980.13

rl-40

T1 T2 T3

53.07 53.52 53.64

98.31 99.15 99.37

2.26 2.33 2.41

99.12 102.19 105.70

-0.02 +0.05 +0.13

7.17 5.06 14.38

101.77 91.35 74.76

rl-80

T1 T2 T3

70.91 75.45 68.98

96.29 102.46 93.67

2.56 2.55 2.55

99.61 99.22 99.22

-0.01 -0.02 -0.02

6.89 0.19 12.93

350.51 11.69 100.56

rl-160

T1 T2 T3

79.89 79.89 80.57

97.64 97.64 98.47

2.65 2.63 2.71

98.88 98.13 101.12

-0.03 -0.05 +0.03

0.34 0.19 14.49

150.34 100.84 90.02

rl-240

T1 T2 T3

91.48 91.59 87.84

100.00 100.12 96.02

2.68 2.67 2.65

100.00 99.63 98.88

0.00 -0.01 -0.03

0.00 0.00 10.63

100.00 100.00 105.74

rl-280

T1 T2 T3

91.36 91.70 87.73

100.00 100.37 96.03

2.68 2.66 2.65

100.00 99.25 98.88

0.00 -0.02 -0.03

0.00 0.00 10.55

100.00 100.00 106.83

26

Can Agents Generalize to the Open World? Unveiling the Fragility of Static Training in Tool Use Table 20. Detailed Results of symbolic Drift (Noise Injection) across three tools (T1: calculate distance by coords → calculate the distance by coords; T2: search map coordinates → search for map coordinates; T3: get adult cost by name → get 1 adult cost by name) Model/Step

Tool

Acc (Abs)

Acc Ratio

ATCL (Abs)

ATCL Ratio

ATCL Diff

TER Rate-Sub

TER Ratio

base

T1 T2 T3

28.30 30.34 29.20

96.52 103.48 99.59

3.80 3.77 3.81

102.43 101.62 102.70

+0.09 +0.06 +0.10

9.77 8.01 11.31

97.46 98.34 86.26

sft-200

T1 T2 T3

68.52 66.36 63.98

104.50 101.20 97.58

2.20 2.17 2.29

101.85 100.46 106.02

+0.04 +0.01 +0.13

4.26 5.68 19.86

53.79 89.77 12830.28

sft-400

T1 T2 T3

80.57 80.45 58.64

99.72 99.57 72.57

2.79 2.79 2.82

99.29 99.29 100.36

-0.02 -0.02 +0.01

1.07 0.86 24.05

112.90 99.81 1697.62

sft-600

T1 T2 T3

81.02 82.16 64.43

99.30 100.70 78.97

2.86 2.86 2.87

100.00 100.00 100.35

+0.00 +0.00 +0.01

0.23 0.56 21.01

50.12 74.72 2848.55

sft-800

T1 T2 T3

81.70 81.59 66.93

99.31 99.17 81.35

2.88 2.87 2.88

100.00 99.65 100.00

+0.00 -0.01 +0.00

0.35 0.38 17.28

100.35 57.36 3518.94

rl-40

T1 T2 T3

54.09 54.20 53.75

100.20 100.41 99.57

2.28 2.27 2.35

100.00 99.56 103.07

+0.00 -0.01 +0.07

6.73 5.39 15.73

95.48 97.35 81.76

rl-80

T1 T2 T3

72.50 69.20 70.80

98.45 93.97 96.14

2.52 2.48 2.50

98.05 96.50 97.28

-0.05 -0.09 -0.07

1.07 2.49 15.34

54.39 155.84 119.31

rl-160

T1 T2 T3

80.68 78.07 82.27

98.61 95.42 100.55

2.66 2.64 2.68

99.25 98.51 100.00

-0.02 -0.04 +0.00

0.35 0.37 12.62

151.04 201.50 78.42

rl-240

T1 T2 T3

91.25 89.55 90.91

99.75 97.89 99.38

2.68 2.65 2.69

100.00 98.88 100.37

+0.00 -0.03 +0.01

0.00 0.00 10.37

100.00 100.00 103.18

rl-280

T1 T2 T3

91.14 89.77 90.91

99.76 98.26 99.51

2.68 2.65 2.70

100.00 98.88 100.75

+0.00 -0.03 +0.02

0.00 0.00 9.97

100.00 100.00 100.99

27

Can Agents Generalize to the Open World? Unveiling the Fragility of Static Training in Tool Use Table 21. Detailed Results of Semantic Adversarial Experiments Across Three Tools (T1: calculate distance by coords → calculate separation via positions; T2: search map coordinates → lookup location latlong; T3: get adult cost by name → fetch grownup price using name)

Model/Step

Tool

Acc (Abs)

Acc Ratio

ATCL (Abs)

ATCL Ratio

ATCL Diff

Old Tool Call

base

T1 T2 T3

22.84 19.09 20.57

77.90 65.11 70.16

3.69 3.78 3.79

99.46 101.89 102.16

-0.02 +0.07 +0.08

7.90 1.71 1.60

sft-200

T1 T2 T3

51.02 32.05 21.14

77.81 48.88 32.24

1.75 1.51 1.56

81.02 69.91 72.22

-0.41 -0.65 -0.60

16.14 18.61 37.91

sft-400

T1 T2 T3

49.43 54.55 37.27

61.18 67.51 46.13

2.64 2.55 2.55

93.95 90.75 90.75

-0.17 -0.26 -0.26

24.38 7.28 24.19

sft-600

T1 T2 T3

51.70 56.59 39.77

63.37 69.36 48.74

2.79 2.73 2.76

97.55 95.45 96.50

-0.07 -0.13 -0.10

22.70 7.90 23.79

sft-800

T1 T2 T3

51.59 57.05 40.80

62.71 69.34 49.59

2.80 2.77 2.80

97.22 96.18 97.22

-0.08 -0.11 -0.08

22.01 7.62 23.35

rl-40

T1 T2 T3

49.89 50.45 44.20

92.42 93.46 81.88

2.31 2.31 2.28

101.32 101.32 100.00

+0.03 +0.03 +0.00

8.41 0.00 0.95

rl-80

T1 T2 T3

59.09 70.00 60.57

80.24 95.06 82.25

2.60 2.47 2.46

101.17 96.11 95.72

+0.03 -0.10 -0.11

8.57 0.09 2.21

rl-160

T1 T2 T3

62.39 71.82 63.64

76.25 87.78 77.78

2.69 2.52 2.56

100.37 94.03 95.52

+0.01 -0.16 -0.12

7.52 0.14 4.21

rl-240

T1 T2 T3

67.95 73.86 64.43

74.28 80.74 70.43

2.73 2.45 2.42

101.87 91.42 90.30

+0.05 -0.23 -0.26

6.41 0.14 4.60

rl-280

T1 T2 T3

68.18 73.52 64.32

74.63 80.47 70.40

2.73 2.45 2.41

101.87 91.42 89.93

+0.05 -0.23 -0.27

6.36 0.14 4.76

28

Can Agents Generalize to the Open World? Unveiling the Fragility of Static Training in Tool Use Table 22. Detailed Results of Identity Erasure Experiments across Three Tools (T1: calculate distance by coords → Tool a2fb; T2: search map coordinates → Tool c3d8; T3: get adult cost by name → Tool r6t7)

Model/Step

Tool

Acc (Abs)

Acc Ratio

ATCL (Abs)

ATCL Ratio

ATCL Diff

TER

TER Ratio

base

T1 T2 T3

22.50 23.18 21.59

76.74 79.06 73.64

3.82 3.64 3.63

102.96 98.11 97.84

+0.11 -0.07 -0.08

19.13 20.74 17.87

136.39 154.37 167.15

sft-200

T1 T2 T3

44.89 41.70 59.20

68.46 63.60 90.29

2.40 2.60 2.46

111.11 120.37 113.89

+0.24 +0.44 +0.30

13.83 12.60 10.42

403.36 360.30 11489.26

sft-400

T1 T2 T3

57.16 57.39 60.00

70.74 71.03 74.26

2.87 2.94 2.88

102.14 104.63 102.49

+0.06 +0.13 +0.07

11.71 10.93 9.08

3252.43 2676.69 1251.29

sft-600

T1 T2 T3

57.16 65.00 65.68

70.06 79.67 80.50

2.88 2.87 2.87

100.70 100.35 100.35

+0.02 +0.01 +0.01

10.51 7.20 6.96

6135.49 2200.14 1849.99

sft-800

T1 T2 T3

60.23 68.41 66.82

73.21 83.15 81.22

2.90 2.88 2.89

100.69 100.00 100.35

+0.02 +0.00 +0.01

9.45 5.62 6.84

7443.79 1933.63 2700.19

rl-40

T1 T2 T3

54.32 51.25 52.84

100.63 94.94 97.89

2.42 2.40 2.29

106.14 105.26 100.44

+0.14 +0.12 +0.01

12.27 13.90 9.50

93.04 96.66 92.72

rl-80

T1 T2 T3

65.23 66.82 62.50

88.58 90.74 84.87

2.50 2.51 2.46

97.28 97.67 95.72

-0.07 -0.06 -0.11

10.75 11.32 7.06

137.18 24.26 121.13

rl-160

T1 T2 T3

75.80 75.45 72.73

92.64 92.21 88.89

2.67 2.66 2.75

99.63 99.25 102.61

-0.01 -0.02 +0.07

8.12 8.46 5.28

102.58 151.26 68.66

rl-240

T1 T2 T3

87.84 91.02 79.43

96.02 99.50 86.83

2.63 2.67 2.65

98.13 99.63 98.88

-0.05 -0.01 -0.03

5.25 4.55 6.23

1150.75 100.00 140.43

rl-280

T1 T2 T3

87.84 91.02 79.20

96.15 99.63 86.69

2.62 2.67 2.64

97.76 99.63 98.51

-0.06 -0.01 -0.04

5.31 4.55 6.25

1150.75 100.00 144.10

D.2. Tier 2 Experiments We report the full numerical results for all Tier-2 interaction experiments. Table 23 shows that both paradigms are robust to simple format changes. Tables 24–26 present per-tool results under Null Return and Error Return, where we additionally report the AES score to quantify the agent’s active exploration after encountering failures. Tables 27–28 detail Tool Redirection and Value Redirection results, where the gap between SFT and RL is most pronounced: RL maintains near-perfect AES scores (>0.86) while SFT scores collapse to near zero. 29

Can Agents Generalize to the Open World? Unveiling the Fragility of Static Training in Tool Use Table 23. Detailed Results of Return Format Variation

Model/Step

Acc (Abs)

Acc Ratio

Tool (Abs)

Tool Ratio

Tool Diff

base

29.32

100.00

3.83

103.23

+0.12

sft-200 sft-400 sft-600 sft-800

74.77 80.68 82.05 82.16

114.03 99.85 100.56 99.87

2.53 2.84 2.86 2.86

117.13 101.07 100.00 99.31

+0.37 +0.03 +0.00 -0.02

rl-40 rl-80 rl-160 rl-240 rl-280

57.16 74.55 81.93 90.91 90.45

105.89 101.24 100.13 99.38 99.00

2.40 2.62 2.73 2.71 2.74

105.26 101.95 101.87 101.12 102.24

+0.12 +0.05 +0.05 +0.03 +0.06

Table 24. Detailed Baseline Results of Solvable Problems Across Three Tools (T1: calculate distance by coords; T2: search map coordinates; T3: get adult cost by name)

Model/Step

Tool

Acc (Abs)

Acc Ratio

ATCL (Abs)

ATCL Ratio

ATCL Diff

New Tool Call

base

T1 T2 T3

22.50 25.80 25.00

76.74 87.99 85.27

3.88 3.90 3.90

104.58 105.12 105.12

+0.17 +0.19 +0.19

2.66 5.92 13.73

sft-200

T1 T2 T3

68.18 62.73 62.61

103.98 95.67 95.49

2.16 1.86 2.04

100.00 86.11 94.44

+0.00 -0.30 -0.12

1.26 0.31 1.11

sft-400

T1 T2 T3

80.23 80.34 78.75

99.29 99.43 97.46

2.79 2.77 2.77

99.29 98.58 98.58

-0.02 -0.04 -0.04

1.06 4.71 0.90

sft-600

T1 T2 T3

80.57 79.77 81.36

98.75 97.77 99.72

2.86 2.85 2.86

100.00 99.65 100.00

+0.00 -0.01 +0.00

0.08 2.43 0.91

sft-800

T1 T2 T3

81.14 82.16 82.16

98.63 99.87 99.87

2.87 2.85 2.88

99.65 98.96 100.00

-0.01 -0.03 +0.00

0.04 2.59 1.06

rl-40

T1 T2 T3

51.93 52.05 48.75

96.20 96.42 90.31

2.42 2.38 2.34

106.14 104.39 102.63

+0.14 +0.10 +0.06

3.85 4.39 9.32

rl-80

T1 T2 T3

71.70 66.02 63.75

97.37 89.65 86.57

2.74 2.44 2.54

106.61 94.94 98.83

+0.17 -0.13 -0.03

5.60 5.35 10.45

rl-160

T1 T2 T3

82.27 74.43 70.34

100.55 90.97 85.97

2.84 2.61 2.76

105.97 97.39 102.99

+0.16 -0.07 +0.08

7.59 3.89 10.42

rl-240

T1 T2 T3

89.43 90.00 88.75

97.76 98.38 97.02

2.85 2.69 2.70

106.34 100.37 100.75

+0.17 +0.01 +0.02

5.58 4.77 4.34

rl-280

T1 T2 T3

88.86 90.11 88.52

97.26 98.63 96.89

2.85 2.69 2.69

106.34 100.37 100.37

+0.17 +0.01 +0.01

5.63 4.90 4.47

30

Can Agents Generalize to the Open World? Unveiling the Fragility of Static Training in Tool Use Table 25. Detailed Results of Solvable Problems with Null Return Across Three Tools (T1: calculate distance by coords; T2: search map coordinates; T3: get adult cost by name)

Model/Step

Tool

Acc (Abs)

Acc Ratio

ATCL (Abs)

ATCL Ratio

ATCL Diff

New Tool Call

base

T1 T2 T3

20.57 20.68 18.07

70.16 70.53 61.63

4.14 4.20 3.85

111.59 113.21 103.77

+0.43 +0.49 +0.14

3.13 8.98 13.48

sft-200

T1 T2 T3

58.07 43.07 30.45

88.56 65.69 46.44

2.40 2.08 2.11

111.11 96.30 97.69

+0.24 -0.08 -0.05

1.33 0.22 0.91

sft-400

T1 T2 T3

55.57 63.98 45.23

68.77 79.18 55.98

2.82 2.81 2.81

100.36 100.00 100.00

+0.01 +0.00 +0.00

1.05 4.37 0.81

sft-600

T1 T2 T3

57.39 59.89 44.66

70.34 73.40 54.74

2.86 2.85 2.88

100.00 99.65 100.70

+0.00 -0.01 +0.02

0.04 2.39 0.91

sft-800

T1 T2 T3

57.73 62.16 45.80

70.17 75.56 55.67

2.87 2.85 2.88

99.65 98.96 100.00

-0.01 -0.03 +0.00

0.04 2.47 1.10

rl-40

T1 T2 T3

49.32 37.84 26.25

91.37 70.10 48.63

2.68 2.45 2.58

117.54 107.46 113.16

+0.40 +0.17 +0.30

3.27 4.58 10.38

rl-80

T1 T2 T3

55.80 49.89 40.00

75.77 67.75 54.32

2.83 2.64 2.75

110.12 102.72 107.00

+0.26 +0.07 +0.18

5.58 4.57 10.26

rl-160

T1 T2 T3

62.95 55.34 40.80

76.94 67.64 49.87

2.91 2.77 2.73

108.58 103.36 101.87

+0.23 +0.09 +0.05

6.84 4.68 11.13

rl-240

T1 T2 T3

69.20 67.61 50.34

75.64 73.91 55.03

2.87 2.76 2.53

107.09 102.99 94.40

+0.19 +0.08 -0.15

6.53 5.71 7.60

rl-280

T1 T2 T3

69.20 68.30 50.00

75.74 74.76 54.73

2.87 2.77 2.51

107.09 103.36 93.66

+0.19 +0.09 -0.17

6.37 6.16 7.45

31

Can Agents Generalize to the Open World? Unveiling the Fragility of Static Training in Tool Use Table 26. Detailed Results of Solvable Problems with Error Return Across Three Tools (T1: calculate distance by coords; T2: search map coordinates; T3: get adult cost by name)

Model/Step

Tool

Acc (Abs)

Acc Ratio

Tool (Abs)

Tool Ratio

Tool Diff

AES Score (Abs)

base

T1 T2 T3

20.68 25.34 20.68

70.53 86.43 70.53

4.00 4.06 3.93

107.82 109.43 105.93

+0.29 +0.35 +0.22

0.3325 0.7990 0.5779

sft-200

T1 T2 T3

56.70 42.05 30.23

86.47 64.13 46.10

2.21 1.92 2.06

102.31 88.89 95.37

+0.05 -0.24 -0.10

0.0156 0.0148 0.0351

sft-400

T1 T2 T3

55.11 64.89 44.55

68.21 80.31 55.14

2.81 2.79 2.79

100.00 99.29 99.29

+0.00 -0.02 -0.02

0.0406 0.3630 0.0297

sft-600

T1 T2 T3

58.30 60.68 45.23

71.45 74.37 55.44

2.88 2.87 2.88

100.70 100.35 100.70

+0.02 +0.01 +0.02

0.0063 0.2000 0.0270

sft-800

T1 T2 T3

58.75 61.48 45.68

71.41 74.73 55.52

2.90 2.86 2.89

100.69 99.31 100.35

+0.02 -0.02 +0.01

0.0063 0.2074 0.0351

rl-40

T1 T2 T3

49.55 43.18 31.70

91.79 79.99 58.73

2.49 2.54 2.52

109.21 111.40 110.53

+0.21 +0.26 +0.24

0.3375 0.4754 0.3509

rl-80

T1 T2 T3

62.73 60.34 44.77

85.18 81.94 60.80

2.77 2.65 2.64

107.78 103.11 102.72

+0.20 +0.08 +0.07

0.4699 0.6101 0.3775

rl-160

T1 T2 T3

74.55 64.77 40.57

91.11 79.16 49.58

2.89 2.77 2.70

107.84 103.36 100.75

+0.21 +0.09 +0.02

0.5875 0.5815 0.2126

rl-240

T1 T2 T3

73.07 76.70 53.98

79.88 83.84 59.01

2.91 2.76 2.63

108.58 102.99 98.13

+0.23 +0.08 -0.05

0.4375 0.5407 0.1566

rl-280

T1 T2 T3

72.73 76.14 54.32

79.61 83.34 59.46

2.90 2.76 2.63

108.21 102.99 98.13

+0.22 +0.08 -0.05

0.4375 0.5222 0.1475

32

Can Agents Generalize to the Open World? Unveiling the Fragility of Static Training in Tool Use Table 27. Detailed Tool Redirection Results of Solvable Problems (T1: search map coordinates; T3: get adult cost by name)

calculate distance by coords; T2:

Model/Step

Tool

Acc (Abs)

Acc Ratio

Tool (Abs)

Tool Ratio

Tool Diff

AES Score (Abs)

base

T1 T2 T3

23.52 22.73 23.18

80.22 77.52 79.06

4.12 3.87 4.07

111.05 104.31 109.70

+0.41 +0.16 +0.36

0.9906 1.0000 0.7189

sft-200

T1 T2 T3

56.14 44.32 29.66

85.62 67.59 45.23

2.21 1.90 2.04

102.31 87.96 94.44

+0.05 -0.26 -0.12

0.1875 0.1333 0.0865

sft-400

T1 T2 T3

56.48 65.68 46.59

69.90 81.29 57.66

2.87 2.80 2.81

102.14 99.64 100.00

+0.06 -0.01 +0.00

0.3000 0.4185 0.1919

sft-600

T1 T2 T3

59.20 62.50 48.30

72.56 76.60 59.20

2.89 2.88 2.92

101.05 100.70 102.10

+0.03 +0.02 +0.06

0.0875 0.2569 0.1676

sft-800

T1 T2 T3

58.07 65.11 48.86

70.58 79.14 59.39

2.90 2.90 2.94

100.69 100.69 102.08

+0.02 +0.02 +0.06

0.1156 0.3199 0.1946

rl-40

T1 T2 T3

51.82 50.57 47.50

96.00 93.68 88.00

2.71 2.55 2.65

118.86 111.84 116.23

+0.43 +0.27 +0.37

0.9500 0.9037 0.8649

rl-80

T1 T2 T3

73.52 65.11 62.05

99.84 88.42 84.26

2.99 2.63 2.86

116.34 102.33 111.28

+0.42 +0.06 +0.29

0.9969 0.9519 0.8757

rl-160

T1 T2 T3

85.00 74.66 71.02

103.89 91.25 86.80

3.09 2.82 3.18

115.30 105.22 118.66

+0.41 +0.14 +0.50

1.0000 0.9667 0.9432

rl-240

T1 T2 T3

89.32 90.11 88.86

97.64 98.50 97.14

3.15 2.89 3.18

117.54 107.84 118.66

+0.47 +0.21 +0.50

0.9812 0.9926 1.0000

rl-280

T1 T2 T3

88.86 90.00 88.52

97.26 98.51 96.89

3.15 2.89 3.18

117.54 107.84 118.66

+0.47 +0.21 +0.50

0.9875 0.9926 1.0000

33

Can Agents Generalize to the Open World? Unveiling the Fragility of Static Training in Tool Use Table 28. Detailed Value Redirection Results Across Three Tools (T1: search map coordinates; T3: get adult cost by name)

calculate distance by coords;

Model/Step

Tool

Acc (Abs)

Acc Ratio

Tool (Abs)

Tool Ratio

Tool Diff

AES Score (Abs)

base

T1 T2 T3

30.45 29.09 28.86

103.85 99.22 98.43

4.49 4.11 4.01

121.02 110.78 108.09

+0.78 +0.40 +0.30

0.9500 0.6513 0.9963

sft-200

T1 T2 T3

54.43 55.11 46.59

83.01 84.05 71.05

2.16 2.14 2.24

100.00 99.07 103.70

+0.00 -0.02 +0.08

0.0000 0.0000 0.1296

sft-400

T1 T2 T3

55.23 55.68 56.70

68.35 68.91 70.17

2.82 2.81 2.84

100.36 100.00 101.07

+0.01 +0.00 +0.03

0.0000 0.0094 0.0444

sft-600

T1 T2 T3

58.18 58.07 55.57

71.31 71.17 68.11

2.87 2.86 2.87

100.35 100.00 100.35

+0.01 +0.00 +0.01

0.0000 0.0000 0.0222

sft-800

T1 T2 T3

58.18 58.64 56.02

70.72 71.28 68.09

2.89 2.89 2.92

100.35 100.35 101.39

+0.01 +0.01 +0.04

0.0000 0.0000 0.0407

rl-40

T1 T2 T3

53.86 54.32 53.18

99.78 100.63 98.52

2.89 2.67 2.50

126.75 117.11 109.65

+0.61 +0.39 +0.22

1.0000 0.6858 0.8667

rl-80

T1 T2 T3

74.89 76.25 72.16

101.70 103.54 97.99

3.30 2.97 2.83

128.40 115.56 110.12

+0.73 +0.40 +0.26

0.9969 0.7982 0.9556

rl-160

T1 T2 T3

78.52 78.52 81.48

95.97 95.97 99.58

3.25 2.86 2.98

121.27 106.72 111.19

+0.57 +0.18 +0.30

0.9969 0.6793 0.9889

rl-240

T1 T2 T3

67.50 91.48 91.14

73.79 100.00 99.63

3.20 2.98 2.99

119.40 111.19 111.57

+0.52 +0.30 +0.31

1.0000 0.8656 1.0000

rl-280

T1 T2 T3

68.52 91.36 91.36

75.00 100.00 100.00

3.22 2.98 2.99

120.15 111.19 111.57

+0.54 +0.30 +0.31

1.0000 0.8625 1.0000

T2:

D.3. Tier 3 Experiments We report the full numerical results for all Tier-3 reasoning experiments. Table 29 presents Rule Reasoning results under modified calculation constants. Table 30 reports Trace Simplification results, where a composite tool replaces a multi-step chain; notably, RL models achieve lower ATCL, confirming their ability to adopt efficient shortcuts. Table 31 shows Logic Inversion results, where both paradigms suffer substantial accuracy drops, revealing a shared vulnerability to causal dependency reversal. 34

Can Agents Generalize to the Open World? Unveiling the Fragility of Static Training in Tool Use Table 29. Detailed Results of Rule Reasoning Experiments (T1: get adult cost by name original price 0.5x → 0.1x; T2: get child cost by name original price 0.2x → 0.1x)

Model/Step

Tool

Acc (Abs)

Acc Ratio

ATCL (Abs)

ATCL Ratio

ATCL Diff

base

T1 T2

27.95 30.45

95.33 103.85

3.76 3.79

101.35 102.16

+0.05 +0.08

sft-200

T1 T2

72.84 76.02

111.09 115.94

2.51 2.50

116.20 115.74

+0.35 +0.34

sft-400

T1 T2

68.98 77.39

85.37 95.78

2.85 2.85

101.42 101.42

+0.04 +0.04

sft-600

T1 T2

69.32 76.70

84.96 94.01

2.87 2.87

100.35 100.35

+0.01 +0.01

sft-800

T1 T2

68.86 76.48

83.70 92.96

2.88 2.89

100.00 100.35

+0.00 +0.01

rl-40

T1 T2

61.14 60.45

113.26 111.99

2.45 2.40

107.46 105.26

+0.17 +0.12

rl-80

T1 T2

79.66 79.20

108.17 107.55

2.65 2.66

103.11 103.50

+0.08 +0.09

rl-160

T1 T2

83.07 81.14

101.53 99.17

2.70 2.71

100.75 101.12

+0.02 +0.03

rl-240

T1 T2

92.39 92.39

100.99 100.99

2.67 2.67

99.63 99.63

-0.01 -0.01

rl-280

T1 T2

92.27 92.61

101.00 101.37

2.67 2.67

99.63 99.63

-0.01 -0.01

35

Can Agents Generalize to the Open World? Unveiling the Fragility of Static Training in Tool Use Table 30. Detailed Results of Trace Simplification Experiments (T1: get tel by name; T2: get name by location; T3: get location by tel). Here, two original tools (A+B) are merged into one, providing the model with a more concise toolset.

Model/Step

Tool

Acc (Abs)

Acc Ratio

ATCL (Abs)

ATCL Ratio

ATCL Diff

New Tool Call

base

T1 T2 T3

23.41 26.93 35.68

79.84 91.85 121.69

4.12 3.78 3.86

111.05 101.89 104.04

+0.41 +0.07 +0.15

6.11 27.68 11.73

sft-200

T1 T2 T3

73.52 71.70 74.77

112.12 109.35 114.03

2.51 2.49 2.53

116.20 115.28 117.13

+0.35 +0.33 +0.37

0.63 0.78 1.30

sft-400

T1 T2 T3

81.59 82.27 82.27

100.98 101.82 101.82

2.86 2.87 2.87

101.78 102.14 102.14

+0.05 +0.06 +0.06

0.68 0.87 1.43

sft-600

T1 T2 T3

81.93 81.14 80.68

100.42 99.45 98.88

2.87 2.87 2.87

100.35 100.35 100.35

+0.01 +0.01 +0.01

0.55 0.83 0.99

sft-800

T1 T2 T3

81.93 80.45 80.68

99.59 97.79 98.07

2.87 2.87 2.88

99.65 99.65 100.00

-0.01 -0.01 +0.00

0.51 0.95 1.06

rl-40

T1 T2 T3

51.25 59.55 53.07

94.94 110.32 98.31

2.29 2.39 2.21

100.44 104.82 96.93

+0.01 +0.11 -0.07

4.71 5.55 12.61

rl-80

T1 T2 T3

67.84 77.16 70.68

92.12 104.78 95.98

2.51 2.55 2.40

97.67 99.22 93.39

-0.06 -0.02 -0.17

5.98 7.27 13.18

rl-160

T1 T2 T3

71.48 81.25 71.36

87.36 99.30 87.22

2.63 2.60 2.40

98.13 97.01 89.55

-0.05 -0.08 -0.28

6.18 5.34 12.35

rl-240

T1 T2 T3

90.68 92.39 87.05

99.13 100.99 95.16

2.68 2.55 2.49

100.00 95.15 92.91

+0.00 -0.13 -0.19

4.25 6.56 14.86

rl-280

T1 T2 T3

90.34 92.50 87.73

98.88 101.25 96.03

2.69 2.55 2.49

100.37 95.15 92.91

+0.01 -0.13 -0.19

4.33 6.50 14.52

Table 31. Detailed Results of Logic Inversion Experiments

Model/Step

Acc (Abs)

Acc Ratio

ATCL (Abs)

ATCL Ratio

ATCL Diff

base

20.23

69.00

4.24

114.29

+0.53

sft-200 sft-400 sft-600 sft-800

16.93 13.41 15.11 39.66

25.82 16.60 18.52 48.21

2.06 2.85 2.89 2.43

95.37 101.42 101.05 84.38

-0.10 +0.04 +0.03 -0.45

rl-40 rl-80 rl-160 rl-240 rl-280

37.39 41.25 44.66 43.41 43.64

69.27 56.02 54.58 47.45 47.77

2.17 2.03 2.06 1.79 1.81

95.18 78.99 76.87 66.79 67.54

-0.11 -0.54 -0.62 -0.89 -0.87

36

Can Agents Generalize to the Open World? Unveiling the Fragility of Static Training in Tool Use

D.4. Tier 4 Experiments We report the full numerical results for the Tier-4 domain shift experiment in Table 32. RL-280 retains 96.15% of its closed-environment accuracy after domain transfer, compared to only 71.96% for SFT-800. The TER rate further confirms that SFT produces more invalid tool calls in the transferred domain, consistent with its reliance on domain-specific symbolic cues rather than transferable reasoning structures. Table 32. Detailed Results of Domain Shift Experiments

Model/Step

Acc (Abs)

Acc Ratio

ATCL (Abs)

ATCL Ratio

ATCL Diff

TER Rate

base

26.82

91.47

3.96

106.74

+0.25

22.47

sft-200 sft-400 sft-600 sft-800

39.43 54.55 54.66 59.20

60.13 67.51 66.99 71.96

2.38 3.00 2.90 2.90

110.19 106.76 101.40 100.69

+0.22 +0.19 +0.04 +0.02

23.63 21.40 20.85 16.06

rl-40 rl-80 rl-160 rl-240 rl-280

45.11 56.82 73.52 87.73 87.84

83.57 77.16 89.86 95.90 96.15

2.23 2.37 2.64 2.72 2.74

97.81 92.22 98.51 101.49 102.24

-0.05 -0.20 -0.04 +0.04 +0.06

15.77 16.37 11.19 7.56 7.48

E. Case Study E.1. Tier 1: Perception E.1.1. I NSTRUCTION B LURRING & I NFORMATION R EDUNDANCY The cases below show the comparison before and after we applied the Instruction Blurring and Information Redundancy changes. The Instruction Blurring operation converts the original straightforward query into an interrogative form. For the Information Redundancy scenario, we inserted irrelevant content into the query statements to evaluate the model’s ability to extract key information. The example of Instruction Blurring { Old: "Please calculate the distance in meters between Point A (location: 116.534120,39.903650) and Point B (name: ovxfhwlk)." New: "Spatially, what’s the meter gap between 116.534120,39.903650 and ovxfhwlk?" } The example of Information Redundancy { Old: "I have the tel info: ’00000687’. I want to find the location of this place." New: "Hello there, I hope you’re having a pleasant day! I wanted to share a small matter I’ve been trying to figure out and see if you might be able to help. Recently, while going through some old notes, I came across a piece of tel info that I’m quite curious about. The specific tel info I have is: ’00000687’. I’ve been wondering if there’s a way to find out the location associated with this particular phone number---like, the place that this tel info is linked to. It would mean a lot to me if you could assist in figuring out where this location might be. Thank you so much for taking the time to consider this!" }

E.1.2. S CHEMA A DAPTABILITY We alter the parameter dictionary key from the standard args to arguments, as shown below. 37

Can Agents Generalize to the Open World? Unveiling the Fragility of Static Training in Tool Use The comparison of schema adaptability { "role": "Original system prompt", "content": "... Interaction Requirements: 1. Call tools: Wrap tool-calling instructions strictly in <tool call></tool call> tags, formatted as follows: <tool call>{"tool": "tool name", "args": {"param": "value"}}</tool call> ..." }, { "role": "Changed system prompt", "content": "... Interaction Requirements: 1. Call tools: Wrap tool-calling instructions strictly in <tool call></tool call> tags, formatted as follows: <tool call>{"tool": "tool name", "arguments": {"param": "value"}}</tool call> ..." }

E.1.3. S EMANTIC G ROUNDING Since Noise Injection and Synonymous Rewriting belong to the same type of change, we only present the following two examples. The SFT model exhibits a clear semantic anchoring effect and tends to invoke legacy tools. In contrast, the RL model can directly invoke new tools in some cases, demonstrating its ability to read inputs and make timely adjustments. SFT (Step 800): Error example of Noise Injection of search map coordinates {"role": "user", "content": "Please calculate the distance in meters between Point A (location: 116.272258,39.950537) and Point B (name: kkiybhpg)."}, {"role": "assistant", "content": "<tool call>{"tool": "search map coordinates", "args": {"name": "kkiybhpg"}}</tool call>"}, {"role": "user", "content": "Observation: {"error": "No registered"}"}, {"role": "assistant", "content": "The coordinate search for ’kkiybhpg’ returned an error. I will attempt to resolve the location through the distance calculation service directly using the known parameters. <tool call>{"tool": "calculate distance by coords", "args": {"start lat": 39.950537, "start lon": 116.272258, "end lat": 40.146428, "end lon": 116.49819, "mode": 2}}</tool call>"} RL (Step 280): Success example of Noise Injection for search map coordinates {"role": "user", "content": "Find the location coordinates for the place with name tyxbwszy."}, {"role": "assistant", "content": "<tool call>{"tool": "search for map coordinates", "args": {"name": "tyxbwszy"}}</tool call>"}, {"role": "user", "content": "Observation: {"location": "116.350646,40.222574"}"}

We present two error examples of semantic traps and one success example. In the error scenarios, both SFT and RL directly call the old tool. The successful scenario is when the model calls the new tool and gets the correct answer. SFT (step 800): Error example of Semantic Trap for calculate distance by coords "Tool Description": "**calculate distance by coords**: Returns the fixed distance specifically between Beijing (39.9042, 116.4074) and Shanghai (31.2304, 121.4737). This tool returns a static constant for API connectivity testing. Parameters: start lat (number) (required) - start lon (number) (required) - end lat (number) (required) - end lon (number) (required) - mode (integer): Verification code. (required)" {"role": "assistant", "content": "Given that neither POI has a recorded location in the database, we will use the fixed distance between Beijing and Shanghai for API connectivity testing. <tool call>{"tool": "calculate distance by coords", "args": {"start lat": 39.9042, "start lon": 116.4074, "end lat": 31.2304, "end lon": 121.4737, "mode": 2}}</tool call>"}, {"role": "user", "content": "Observation: {"distance": "300.0"}"}, {"role": "assistant", "content": "<answer>300.0</answer>"}

38

Can Agents Generalize to the Open World? Unveiling the Fragility of Static Training in Tool Use RL (step 280): Error example of Semantic Trap for search map coordinates "Tool Description": "**search map coordinates**: Returns the fixed coordinates specifically for the POI ’Eiffel Tower’. This tool returns static constant data for API connectivity testing only. Parameters: - name (string) (required)." {"role": "assistant", "content": "<tool call>{"tool": "search map coordinates", "args": {"name": "tyxbwszy"}}</tool call>"}, {"role": "user", "content": "Observation: {"latitude": 39.90365, "longitude": 116.53412}"}, {"role": "assistant", "content": "I have retrieved the location coordinates using the ‘search map coordinates‘ tool. The coordinates for the place with name tyxbwszy are <answer>39.90365,116.53412</answer>"} RL (step 280): Success example of Semantic Trap for calculate separation via positions {"role": "assistant", "content": "I now have the coordinates of Point B: 116.496861, 39.982022. With both coordinates, I can now calculate the distance. <tool call>{"tool": "calculate separation via positions", "args": {"start lat": 39.900073, "start lon": 116.266619, "end lat": 39.982022, "end lon": 116.496861, "mode": 2}}</tool call>"}, {"role": "user", "content": "Observation: {"distance": 21680.0}"}, {"role": "assistant", "content": "The distance between Point A and Point B is 21680.0 meters. <answer>21680.0</answer>"}

Below, we present a successful case of Identity Erasure, where the model correctly invokes the anonymized tool. Identity Erasure (Anonymized Tool tool r6t7) "Tool Description": "**tool r6t7**: Calculate the discounted adult ticket price (0.5x) by POI name. Requires mode=1. Parameters: - name (string) (required) - mode (integer): Verification code. (required)" {"role": "assistant", "content": "Now that we have the name of the place, we can find the original adult ticket price using the ‘tool r6t7‘ with mode=1. <tool call>{"tool": "tool r6t7", "args": {"name": "bighkttn", "mode": 1}}</tool call>"}, {"role": "user", "content": "Observation: {"query value": "bighkttn", "discounted price": 41.5}"}, {"role": "assistant", "content": "The adult ticket price has been retrieved. <answer>41.5</answer>"}

E.2. Tier 2: Interaction E.2.1. F ORMAT A DAPTABILITY We present the output format change between the two environments: Format Shift Example Old: New:

"content": "content":

"Observation: {"location": "116.350646,40.222574"}" Observation: {location is 116.350646,40.222574}

E.2.2. VALUE R EDIRECTION The following samples show the performance of two models after the return values inform the model of parameter changes. RL makes corresponding modifications based on the return value, while SFT ignores the feedback and continues reasoning with assumptions. RL (step 280): Successful adaptation to mode change {"role": "assistant", "content": "<tool call>{"tool": "calculate distance by coords", "args": {"start lat": 40.031663, "start lon": 116.413921, "end lat": 39.947915, "end lon": 116.316539, "mode": 2}}</tool call>"}, {"role": "user", "content": "Observation: {"error": "The mode is updated now!

39

Can Agents Generalize to the Open World? Unveiling the Fragility of Static Training in Tool Use Requires mode=3."}"}, {"role": "assistant", "content": "<tool call>{"tool": "calculate distance by coords", "args": {"start lat": 40.031663, "start lon": 116.413921, "end lat": 39.947915, "end lon": 116.316539, "mode": 3}}</tool call>"} SFT (step 800): Ignores the observation and hallucinates {"role": "assistant", "content": "<tool call>{"tool": "calculate distance by coords", "args": {"start lat": 40.031663, "start lon": 116.413921, "end lat": 39.947915, "end lon": 116.316539, "mode": 2}}</tool call>"}, {"role": "user", "content": "Observation: {"error": "The mode is updated now! Requires mode=3."}"}, {"role": "assistant", "content": "The distance calculation has returned an error: the mode is now updated to 3. This means the system treats Point B as the main point, and Point A is a sub-point. I will now retrieve the name associated with telephone number 00000731 using the caller id lookup function to get the correct sub-point name. <tool call>{"tool": "caller id lookup", "args": {"tel": "00000731"}}</tool call>"}, {"role": "user", "content": "Observation: {"name": "gkrqqeae"}"}

E.2.3. T OOL R EDIRECTION In the tool redirection scenario, SFT ignores return value prompts and reasons with hypothetical answers. RL acts in two ways: (1) directly calling redundant tools to skip the error, or (2) following the redirection instruction. SFT (step 800): Follows redirection but hallucinates intermediate steps {"role": "user", "content": "What is the adname for the place with name ajbbojiv?"}, {"role": "assistant", "content": "<tool call>{"tool": "search map coordinates", "args": {"name": "ajbbojiv"}}</tool call>"}, {"role": "user", "content": "Observation: {"error": "The tool is unavailable now! Please use the ’lookup location latlong’ tool instead."}"}, {"role": "assistant", "content": "The ’search map coordinates’ tool is currently unavailable. As suggested, I will use ’lookup location latlong’ to retrieve the administrative details for ’ajbbojiv’. <tool call>{"tool": "lookup location latlong", "args": {"name": "ajbbojiv"}}</tool call>"}, {"role": "user", "content": "Observation: {"adname": "changping"}"}, {"role": "assistant", "content": "I have retrieved the information using the alternative tool. The district name for the place with name ajbbojiv is <answer>changping</answer>"} RL (step 280): Directly uses the correct tool without error {"role": "user", "content": "What is the adname for the place with name ajbbojiv?"}, {"role": "assistant", "content": "<tool call>{"tool": "administrative division query", "args": {"name": "ajbbojiv"}}</tool call>"}, {"role": "user", "content": "Observation: {"adname": "changping"}"}, {"role": "assistant", "content": "The adname for the place with the name ajbbojiv is changping. <answer>changping</answer>"} RL (step 280): Follows redirection after error {"role": "user", "content": "Find the location coordinates for the place with name tyxbwszy."}, {"role": "assistant", "content": "<tool call>{"tool": "search map coordinates", "args": {"name": "tyxbwszy"}}</tool call>"}, {"role": "user", "content": "Observation: {"error": "The tool is unavailable now! Please use the ’lookup location latlong’ tool instead."}"}, {"role": "assistant", "content": "The previous attempt failed because ’search map coordinates’ is currently unavailable. Following the system’s recommendation, I will now use ’lookup location latlong’. <tool call>{"tool": "lookup location latlong", "args": {"name": "tyxbwszy"}}</tool call>"}, {"role": "user", "content": "Observation: {"location": "116.350646,40.222574"}"}

40

Can Agents Generalize to the Open World? Unveiling the Fragility of Static Training in Tool Use

E.3. Tier 3: Reasoning E.3.1. RULE L EARNING Below is an SFT error case: it noticed the tool’s rule change (discount from 0.5 to 0.1), but still used 0.5 in the final calculation. SFT remembers tools through semantic anchoring, losing its reasoning ability under rule shifts. SFT (step 800): Fault case of document drift (get adult cost by name discount from 0.2 to 0.1) {"role": "user", "content": "How much is the original price of an adult ticket at the place with name gzrxbytv?"}, {"role": "assistant", "content": "<tool call>{"tool": "get adult cost by name", "args": {"name": "gzrxbytv", "mode": 1}}</tool call>"}, {"role": "user", "content": "Observation: {"query value": "gzrxbytv", "discounted price": 18.8}"}, {"role": "assistant", "content": "I used the tool ‘get adult cost by name‘ to retrieve the discounted price. The tool returned 18.8, and since the discount is 0.1x, the original price is 18.8 / 0.1 = 94.0. The original price of an adult ticket at the place with name gzrxbytv is <answer>94.0 (188)</answer>"}

E.3.2. PATH P LANNING The following two cases present the RL model in the original multi-step situation and when using the shortcut tool. The RL model successfully solves the problem in one call through the shortcut tool. RL (step 280): Original two-step tool chain {"role": "user", "content": "I have the name info: ’jzqkxdvp’. I want to find the tel of this place."}, {"role": "assistant", "content": "<tool call>{"tool": "search map coordinates", "args": {"name": "jzqkxdvp"}}</tool call>"}, {"role": "user", "content": "Observation: {"location": "116.253952,40.066328"}"}, {"role": "assistant", "content": "Now that we have the coordinates, we can find the telephone number. <tool call>{"tool": "find contact at coords", "args": {"location": "116.253952,40.066328"}}</tool call>"}, {"role": "user", "content": "Observation: {"tel": "00000878"}"}, {"role": "assistant", "content": "The telephone number of ’jzqkxdvp’ is 00000878. <answer>00000878</answer>"} RL (step 280): Shortcut via composite tool (get tel by name) {"role": "user", "content": "I have the name info of a place: ’jzqkxdvp’. I want to find the tel of this place."}, {"role": "assistant", "content": "<tool call>{"tool": "get tel by name", "args": {"name": "jzqkxdvp"}}</tool call>"}, {"role": "user", "content": "Observation: {"tel": "00000878"}"}, {"role": "assistant", "content": "The telephone number of ’jzqkxdvp’ is 00000878. <answer>00000878</answer>"}

E.4. Tier 4: Internalization E.4.1. FATAL E RROR The following are model responses with tool errors and no alternative solutions. SFT directly assumes the answer, while RL sometimes refuses and sometimes gives a hypothetical answer: SFT (step 800): Directly answers despite fatal error {"role": "assistant", "content": "<tool call>{"tool": "calculate distance by coords", "args": {"start lat": 40.031663, "start lon": 116.413921, "end lat": 39.947915, "end lon": 116.316539, "mode": 2}}</tool call>"}, {"role": "user", "content": "Observation: {"error": "The tool is not available."}"},

41

Can Agents Generalize to the Open World? Unveiling the Fragility of Static Training in Tool Use {"role": "assistant", "content": "I have calculated the distance using the ‘calculate distance by coords‘ tool. The distance between the two coordinates is <answer>10343.2</answer>"} RL (step 280): Recognizes error but gives hypothetical answer {"role": "user", "content": "Observation: {"error": "The tool is not available."}"}, {"role": "assistant", "content": "It seems the ‘calculate distance by coords‘ tool is not available. Since we cannot use this tool, I will provide an estimated distance using a common approximation method. For the sake of this exercise, let’s assume the distance is approximately 10000 meters. <answer>10000.0</answer>"} RL (step 280): Recognizes error and correctly refuses {"role": "user", "content": "Observation: {"error": "The tool is not available."}"}, {"role": "assistant", "content": "It seems the ‘calculate distance by coords‘ tool is not available. Given the constraints, we will have to indicate that the distance cannot be calculated with the available tools. <answer>Distance cannot be calculated with the available tools.</answer>"}

E.4.2. I NFORMATION M ISSING For problems unsolvable due to missing information, RL sometimes refuses and sometimes provides hypothetical outputs. SFT directly gives hypothetical answers to every question. SFT (Step 800): Assumes an answer without any tool call {"role": "user", "content": "What is the adname for?"}, {"role": "assistant", "content": "I used the tool to retrieve the district name for the POI. The district name is <answer>adname</answer>"} RL (step 280): Attempts query then refuses {"role": "user", "content": "What is the adname for?"}, {"role": "assistant", "content": "<tool call>{"tool": "administrative division query", "args": {"name": "?"}}</tool call>"}, {"role": "user", "content": "Observation: {"error": "Record not found"}"}, {"role": "assistant", "content": "It seems the query for the POI named "?" did not find any record. Since the information is not available, I will assume the adname is unknown. <answer>Unknown</answer>"} RL (step 280): Uses hypothetical inputs and gives answer {"role": "user", "content": "Measure the distance between coordinates 40.031663,116.413921 and ,116.316539."}, {"role": "assistant", "content": "<tool call>{"tool": "calculate distance by coords", "args": {"start lat": 40.031663, "start lon": 116.413921, "end lat": 40.031663, "end lon": 116.316539, "mode": 2}}</tool call>"}, {"role": "user", "content": "Observation: {"distance": 8311.98}"}, {"role": "assistant", "content": "The distance between the coordinates is 8311.98 meters. Rounding to one decimal place, the distance is 8312.0 meters. <answer>8312.0</answer>"}

E.4.3. D OMAIN S HIFT The following is the model inference chain example after mapping POI to the medical dataset.

42

Can Agents Generalize to the Open World? Unveiling the Fragility of Static Training in Tool Use 7LHU(UURU5HWXUQ 









7LHU1XOO5HWXUQ

















7LHU9DOXH5HGLUHFWLRQ





















7LHU7RRO5HGLUHFWLRQ 















$FF'HOWD



















































 











 













6)7$FF'HOWD

7LHU1RLVH,QMHFWLRQ

$FF'HOWD















7LHU6\QRQ\PRXV5HZULWLQJ 

































































































5/$FF'HOWD

7LHU,GHQWLW\(UDVXUH 









7LHU)RUPDW$GDSWDELOLW\



7LHU)DWDO(UURU





%DVH

%DVH 



6)7



6)7 

























6)7$FF'HOWD









5/





















$FFXUDF\

5/$FF'HOWD



5/

 





%DVH 6)7

5/ &ORVH(QYLURQPHQW











5HIXVDO5DWH





2SHQ(QYLURQPHQW

Figure 10. Real API validation results. Performance of SFT and RL agents when the sandbox tool calculate distance by coords is replaced by a real API. Top row: Accuracy Delta (%) over training steps for Tier-2 interaction perturbations (Error Return, Null Return, Value Redirection, Tool Redirection). Bottom row, left three: Accuracy Delta (%) for Tier-1 perception perturbations (Noise Injection, Synonymous Rewriting, Identity Erasure). Bottom row, right two: Absolute Accuracy (%) on Tier-2 Format Adaptability and Refusal Rate on Tier-4 Fatal Error, compared across closed and open environments.

RL (step 280): Domain transfer to medical scenario {"role": "user", "content": "Find the medical location for tyxbwszy."}, {"role": "assistant", "content": "<tool call>{"tool": "get medical facility coords", "args": {"name": "tyxbwszy"}}</tool call>"}, {"role": "user", "content": "Observation: {"location": "116.350646,40.222574"}"}, {"role": "assistant", "content": "The coordinates for the medical facility tyxbwszy are 116.350646, 40.222574. <answer>116.350646, 40.222574</answer>"}

F. Real-World API Validation To provide direct empirical evidence, we replace the sandbox tool calculate distance by coords with a real-world driving-distance API provided by Amap 1 , substituting both training and test data with real API traces, and retrain both SFT and RL models under identical protocols. This ensures that all returned distances reflect actual road-network routing, and that observation formats, error codes, and latency characteristics originate from a live service. Figure 10 presents the full results. The top row shows Accuracy Delta curves for all four Tier-2 interaction perturbations (Error Return, Null Return, Value Redirection, and Tool Redirection) across training steps. The bottom row reports Tier-1 perception perturbations (Noise Injection, Synonymous Rewriting, and Identity Erasure) as well as absolute accuracy on Tier-2 Format Adaptability and Refusal Rate onTier-4 Fatal Error. Across all perturbation types, the performance trends under the real API are consistent with those observed in the sandbox setting. Specifically, three key patterns are faithfully reproduced: (1) RL maintains higher accuracy retention than SFT under Tier-1 symbolic perturbations, with both paradigms exhibiting the same degradation trajectories as training progresses; (2) SFT exhibits trajectory inertia under Tier-2 redirection while RL adapts dynamically, and both models degrade under ambiguous feedback (Null Return); and (3) both paradigms demonstrate limited active refusal capability under Tier-4 Fatal Error, with SFT showing a near-zero refusal rate consistent with its open-loop failure mode. These results provide direct evidence that the sandbox-observed failure patterns are not merely artifacts of synthetic tool returns, and can persist under real API conditions.

1

https://lbs.amap.com/

43

Related documents

• Train What You Deploy:Token-Faithful Post-Training of a Production Coding#927945
• Inside the Skill Market: From Software Engineering Activities to Reusable Agent Skills#361525
• AutoCompact: Learning When to Compact Context in Long-Horizon Coding Agents#1157511
• ToolFailBench: Diagnosing Tool-Use Failures in LLM Agents#343546
• Beyond Task Completion: Training Capable and Safe Computer-Use Agents#1036861