Closed-World Resolution Against Tool Hallucination in LLM Agents

What it is

The Resolution Rung: a training-free, closed-world check (Algorithm 1) that sits before any causal gate in a tool-calling LLM agent pipeline. It is pure registry-membership plus signature validation — no model access, no fine-tuning, no decoder changes.

How it works

Given a call (n, α) against registry R:

1. Reject if n ∉ R (H1 — nonexistent tool).
2. Reject if any key in α is not declared in the tool's signature σ(n), or a required key is missing (H2).
3. Reject if any argument value fails its declared type/enum/range check (H3/H5-detectable).
4. Otherwise ALLOW.

The paper proves (Prop. 1–2) that placing this check after the causal gate cannot work: the gate's admissibility function reads risk/authorization fields off the tool's contract, which doesn't exist for a fabricated tool, so an undefined lookup can never produce a REJECT under a fail-open executor. A post-gate contract verifier fails for the same reason — no trusted contract to diff against. So the ordering constraint is load-bearing, not stylistic: Resolution Rung → causal gate → contract verifier.

One residue survives by construction: H5 calls where a model borrows tool m's argument shape but the values happen to satisfy tool n's own schema — schema-indistinguishable from a legitimate call, provably undetectable by any closed-world checker (Prop. 4). That case reduces to the tool-selection problem, not resolution.

flowchart LR
    Call --> Rung[Resolution Rung]
    Rung -->|H1/H2/H3 fail| Reject1[REJECT]
    Rung -->|pass| Gate[Causal Gate]
    Gate -->|H4 off-frontier| Reject2[REJECT]
    Gate -->|pass| Verifier[Contract Verifier]
    Verifier --> Exec[Execute]
    Rung -.->|H5 schema-valid residue| Exec

Preconditions / Affected

Applies to any fail-open function-calling executor (the paper's stated default config for unguarded runtimes) and assumes a trusted, honest registry — a compromised registry is explicitly out of scope and left to contract-verification layers. Hallucinations concentrate on unconstrained raw-JSON tool-call surfaces (34 fabricated-tool calls) versus schema-enforced APIs like Bedrock Converse or OpenAI function calling (3), since schema enforcement structurally blocks naming an unlisted tool at generation time.

What to do

Insert the membership-plus-signature check as its own pipeline stage strictly before any causal/least-privilege gate, not folded into the gate or the contract verifier — the paper shows relocating the existence check into the verifier reintroduces the exact unsoundness it fixes. For MCP deployments, use the closed-world MCP variant that resolves to a (server, tool) pair rather than a bare tool name, since namespace merging across servers is what produces collisions and shadowing.

Caveats

Guarantees for H1–H3 rejection and zero honest over-rejection are stated by the authors as construction-consistent restatements of the algorithm's definition, not independent empirical discoveries — only the ordering result (must precede the gate) is non-definitional. The H5 borrowed-argument residue is proven irreducible by any closed-world method, by the paper's own analysis.