Regularizing agents across renamed tool interfaces — CIPR consistency KL — What does it mean?

The news. On October 14, 2026, a University of Washington and Uniphore team posted a paper showing that simple interface changes, such as renaming an action or adding a worse duplicate of the right tool, make a post-trained function-calling agent clearly worse. They propose CIPR as a fix that needs no extra labels. Read the paper →

Picture a stockroom clerk who has learned the job by shelf label. Ask for a "bracket" and the clerk walks to the bin marked bracket, never reading the card that says what is inside. Then the shelves are relabeled and shuffled, and a cheaper "slower" twin bin appears next to the right one. The task has not changed, but the clerk now grabs the wrong bin. That is a post-trained agent facing a renamed tool: the familiar name is a shortcut, and the task loss cannot tell a decision that depends on the task from one that depends on how the tools are presented.

CIPR removes the shortcut in three steps. First it canonicalizes the interface: every tool name becomes a neutral identifier like function_01 and every argument becomes arg_01, so only the description tells the tools apart. Second it builds a perturbed copy of each training interface by adding a degraded twin of every tool (a description that says "deprecated" or "slower", or a schema with a needed argument swapped for an unrelated one), relabeling everything, and shuffling the order. Third it adds a consistency KL: the distance between the agent's action distribution under the canonical interface and under the perturbed one.

Because the correct response changes with the interface, the paper compares odds over actions, not tokens. Two terms do this. The rescoring term holds one response fixed, relabels the tool names inside it, and compares the agent's decision odds at each step; it needs only forward passes. The rollout term lets each interface produce its own responses, since a new twin should change the reasoning, and compares the average odds of the two groups. In both, the reference is the policy itself under the canonical interface with its gradient stopped, so no teacher model is needed, and a twin that only the perturbed interface lists has reference probability zero, so any odds placed on it count as disagreement. The penalty is added to the loss, not the reward, so agreement cannot replace task success. Good tool descriptions still matter, as the tool schema step and the ACI design step explain, because after canonicalization the description is the only signal left.

A toy case (illustrative) shows how the penalty composes. Hold the task and the agent fixed. Under the canonical interface the agent calls function_01 with probability 0.8 and function_02 with 0.2. After relabeling and shuffling, the same agent calls them with 0.5 and 0.5, because it leaned on the old order. The KL between the two is roughly 0.2 nats, and it falls to 0 only when the odds match, so gradient descent pushes the perturbed odds back toward 0.8 and 0.2. Add a degraded twin that the agent calls 30% of the time and the penalty grows, because the twin has reference probability zero. Over a whole training set these small pushes teach the agent to read descriptions instead of labels.

Now the numbers, read from Table 1 of the paper (accuracy in percent on single-turn BFCL v4 items; the three held-out groups are typos and distractor tools, explicit cost and latency, and implicit cost and latency). On Qwen2.5-3B, ordinary ToolRL training lifts original accuracy to 73.3 but drops it to 20.9 when a cheaper twin exists and the query only asks the agent to describe the tools, because the familiar name now points at the worse tool. Multi-interface training raises that implicit score to 39.6, and CIPR raises it to 42.3, while original accuracy stays at 74.9 against 73.3. The mean held-out score rises from 40.6 to 56.1, and the gap to the original interface shrinks from 32.7 to 18.8 points. The gain over multi-interface training is largest on the cost and latency groups, which look least like anything in training. On Qwen3.5-4B, which is already tuned for tool use, the implicit score goes from 52.3 (ToolRL on canonical names) to 70.7 (multi-interface) to 73.0 (CIPR). Back in the stockroom: the clerk who trained on shuffled, twinned shelves does well, and the clerk who was also penalized for choosing differently across layouts does a little better where it counts.

The method has clear limits. It needs the canonicalization adapter at inference: a name that misleads, such as swapping search and click in the paper's WebShop test, still fools an agent that sees it directly. The penalty covers which tool is called and whether one is called, while arguments are learned from the task loss alone, and argument errors barely changed in the paper's error analysis. The rollout term needs extra rollouts per prompt, and the experiments use models up to about 4B parameters, one training run per configuration and mostly single-turn function calling, so the effect at larger scale and in long multi-turn tasks is not yet established. Interfaces can also be edited by an attacker, which is a separate problem covered in tools as attack surface.

Goes deeper in: AI Agents → Tool Use & Function Calling → The Tool Schema

Related explainers

• MCPEvol-Bench and tool-interface drift — the benchmark side of the same problem: how much agents lose when real MCP tools change shape.