A Few Neurons Reveal When LLMs Misuse Tools: Sparse Detection and Selective Steering for Reliable Tool Use

# A Few Neurons Reveal When LLMs Misuse Tools: Sparse Detection and Selective Steering for Reliable Tool Use
Source: [https://arxiv.org/html/2608.00218](https://arxiv.org/html/2608.00218)
###### Abstract

Agentic LLMs exhibit three consequential tool\-use failures: invalid arguments \(*validity*\), unnecessary calls \(*over\-calling*\), and omitted calls when tools are needed \(*missing*\)\. We find that a small, failure\-specific set of MLP neurons could distinguish such failure with linearly separable decision boundaries\. Building on this observation, we introducePRISMS\(ProbingRepresentationsInSupport ofMonitoring andSteering\), a closed\-loop framework that shares a failure\-specific neuron basis between sparse detection and activation steering\.PRISMSselects contribution\-critical MLP neurons and fits anL1L\_\{1\}\-regularized detector on their activations\. Across six models from the Qwen3, Llama, and Gemma families, over\-calling and missing are detected at the pre\-generation prompt boundary with ROC\-AUC0\.900\.90–1\.001\.00, while validity is detected from the generated tool\-call span with ROC\-AUC0\.860\.86–0\.900\.90\. These results are achieved with highly sparse readouts: only11–22MLP neurons for missing,22–1616for over\-calling, and approximately128128for validity\. These sparse detectors match or outperform dense residual\-stream baselines using2323–627×627\\timesfewer features\. The shared neuron basis also supports bidirectional control over tool\-calling behavior, suppressing unnecessary calls and eliciting omitted ones\.PRISMStherefore gates intervention on predicted failure risk to mitigate the collateral effects of unconditional steering\. Across all six models,PRISMSreduces pooled over\-calling rate by80%80\\%\(0\.131→0\.0260\.131\\rightarrow 0\.026\) while increasing tool\-required accuracy by14\.214\.2percentage points \(0\.689→0\.8310\.689\\rightarrow 0\.831\)\.PRISMSthus provides lightweight failure detection and selective intervention across model families\.

## 1Introduction

Large language models \(LLMs\) increasingly act through external tools, including search engines, code interpreters, databases, and real\-world APIs\. Tool use expands what an LLM can know and execute, but it also introduces failures at the boundary between reasoning and action\. A model may invoke a tool that does not apply to the request \(*over\-calling*\), fail to invoke an available tool when needed \(*missing*\), or select an applicable tool but generate incorrect argument values \(*validity*\)\. Over\-calling wastes latency and API budget, missing leaves the model to answer beyond its capabilities, and invalid arguments may trigger unintended actions\. Reliable agents must therefore improve tool selection and argument correctness: they should recognize decision failures before acting and validate a generated call before external execution\(Patilet al\.[2025](https://arxiv.org/html/2608.00218#bib.bib1); Liuet al\.[2025](https://arxiv.org/html/2608.00218#bib.bib2); Zhanget al\.[2025](https://arxiv.org/html/2608.00218#bib.bib3)\)\.

Recent work has pursued complementary approaches to improving agentic decision making\. Reasoning\-centric methods such as ReAct and Reflexion provide additional deliberation through interleaved reasoning and action or feedback\-induced verbal reflection\(Yaoet al\.[2023](https://arxiv.org/html/2608.00218#bib.bib11); Shinnet al\.[2023](https://arxiv.org/html/2608.00218#bib.bib12)\), but they do not explicitly monitor whether a particular tool\-use failure is present\.When2Toolshows that tool necessity is linearly readable from hidden states and uses the prediction to encourage tool calling or abstention\(Sunet al\.[2026](https://arxiv.org/html/2608.00218#bib.bib10)\)\. Yet its all\-layer dense residual readout is high\-dimensional and potentially redundant, while the textual prefix used for control modifies the generation context\. More broadly, stricter prompting, explicit reasoning, and unconditional activation steering modify the model’s overall tendency to call tools\. As Figure[1](https://arxiv.org/html/2608.00218#S1.F1)illustrates, these controls trade reduced over\-calling for increased missing or reduced legitimate tool use\. They therefore shift the global call\-versus\-abstain operating point rather than determining which individual prompts require correction\.

![Refer to caption](https://arxiv.org/html/2608.00218v1/x1.png)Figure 1:Global controls expose a tool\-use trade\-off\.\(a\)Thinking reduces over\-calling but increases missing; gatedPRISMS\(green diamond\) approaches the ideal\.\(b\)Unconditional steering reduces the non\-existent\-tool call rate \(NTA\) at a capability cost, whereas gatedPRISMSimproves both\.Selective correction therefore requires a closed loop with two separate capabilities: determining*when*a failure is likely and determining*how*to change the model only then\. Existing work provides pieces of this loop: dense\-state monitors can trigger external execution policies\(Healyet al\.[2026](https://arxiv.org/html/2608.00218#bib.bib9)\), while activation steering offers an internal control mechanism\(Zouet al\.[2023](https://arxiv.org/html/2608.00218#bib.bib23); Turneret al\.[2023](https://arxiv.org/html/2608.00218#bib.bib22); Wanget al\.[2026](https://arxiv.org/html/2608.00218#bib.bib25)\)\. We study the complete loop for three naturally occurring failure modes—over\-calling, missing, and validity—using the models’ own rollouts\. We evaluate both failure detection and behavioral control, distinguishing erroneous calls when no tool is supplied \(NTA\) from calls to an inapplicable distractor \(DT\); their prompt\-weighted combination is pooled over\-calling \(OC\), while capability accuracy \(CA\) measures correct calls when a tool is required\.

Related representation\-engineering work probes internal truthfulness and tool\-use decisions\(Azaria and Mitchell[2023](https://arxiv.org/html/2608.00218#bib.bib8); Wuet al\.[2026](https://arxiv.org/html/2608.00218#bib.bib13); Chenget al\.[2026](https://arxiv.org/html/2608.00218#bib.bib14)\), localizes hallucination\-relevant neurons\(Gaoet al\.[2025](https://arxiv.org/html/2608.00218#bib.bib18)\), and steers truthfulness, agent behavior, and tool invocation through sparse internal directions\(Liet al\.[2023](https://arxiv.org/html/2608.00218#bib.bib21); Suiet al\.[2026](https://arxiv.org/html/2608.00218#bib.bib24); Chenet al\.[2026](https://arxiv.org/html/2608.00218#bib.bib26)\)\.PRISMSextends these ideas to naturally occurring tool\-use failures by coupling compact FFN monitors with detector\-gated correction\.

We ask whether these failures can be monitored through compact, individually addressable FFN features at decision\-appropriate locations, whether strong decodability identifies a causal control handle, and whether intervention can be applied selectively\. Since probe performance need not imply behavioral use of the encoded signal\(Elazaret al\.[2021](https://arxiv.org/html/2608.00218#bib.bib27); Ilyaset al\.[2019](https://arxiv.org/html/2608.00218#bib.bib28)\), we explicitly separate*reading*from*controlling*a failure\. We address these questions withPRISMS\(ProbingRepresentationsInSupport ofMonitoring andSteering\), a novel closed\-loop framework that separates*when*to intervene from*how*to change the model\. A sparse detector reads failure risk from contribution\-selected FFN writes, while independently constructed layerwise directions determine how to intervene\. Across six instruction\-tuned models from the Qwen3, Llama\-3\.1, and Gemma families, all three failures are linearly readable when sufficient natural positive examples are available\. On Qwen3, over\-calling and missing reach ROC\-AUC0\.980\.98–1\.001\.00before generation, while validity reaches0\.860\.86–0\.900\.90from the generated call span\. These results are achieved with highly sparse readouts: only11–22MLP neurons for missing,22–1616for over\-calling, and approximately128128for validity\. Under chain\-of\-thought reasoning, the most informative decision readout shifts from the prompt boundary to the reasoning end\.

High detectability does not make the selected neurons causally special: at the main feature budget, matched random subsets achieve nearly identical detection \(Δ​AUC≤0\.011\\Delta\\mathrm\{AUC\}\\leq 0\.011\), and direct intervention on probe\-weighted neurons does not separate from controls\. Contribution\-selected layerwise directions, in contrast, produce a strong bidirectional change in tool\-calling and clearly outperform profile\-matched random directions\. Closing the loop then converts this general propensity control into a selective intervention\. Across all six models, detector\-gated steering simultaneously lowers pooled over\-calling \(OC\) and raises capability accuracy \(CA\), reducing OC by80%80\\%on average \(0\.131→0\.0260\.131\\to 0\.026\) and increasing CA by an average of14\.214\.2percentage points \(0\.689→0\.8310\.689\\to 0\.831\)\.

Our contributions are as follows:

- •We identify decision\-appropriate readouts for three naturally occurring tool\-use failures: over\-calling and missing before generation \(or at the reasoning end under chain\-of\-thought\), and validity over the generated call span\. The signals exhibit distinct sparsity and depth profiles, with decision failures decodable from only a few MLP neurons\.
- •We identify contribution\-selected, layerwise steering directions that bidirectionally control tool\-calling behavior\. Intervening along these directions suppresses unnecessary calls or elicits omitted ones, demonstrating causal control over tool\-call decisions\.
- •We introduce a detector\-gated controller that combines sparse monitoring with failure\-specific steering\. It leaves unflagged computation unchanged, suppresses predicted over\-calling, elicits calls under predicted missing, and monitors argument validity before execution\.

![Refer to caption](https://arxiv.org/html/2608.00218v1/x2.png)Figure 2:Overview ofPRISMS\. Natural rollouts define a contribution\-ranked shared basis𝒮f\\mathcal\{S\}\_\{f\}\. A sparse detector determines*when*to intervene, while independent layerwise directions determine*how*\. The risk gate preserves unflagged computation and applies matched steering only to predicted failures; validity is checked before tool execution\.
## 2Method

### 2\.1Overview and Failure\-Aware Readouts

We introducePRISMS, a closed\-loop framework for monitoring and correcting tool\-use failures\. We study three failure modes:*over\-calling*, an unnecessary call when no offered tool applies;*missing*, failure to call an available, required tool; and*validity*, an applicable call whose generated arguments disagree with the reference\. For modeff, letℋf\\mathcal\{H\}\_\{f\}andℬf\\mathcal\{B\}\_\{f\}denote failed and matched correct rollouts\.

Each failure is read where it first becomes observable\. Decision failures are read at the final prompt token without explicit reasoning and at the token immediately before</think\>when reasoning precedes the action\. Validity instead pools the complete generated call span, including the tool name, argument keys and values, and delimiters\. We write𝒯f​\(x,r\)\\mathcal\{T\}\_\{f\}\(x,r\)for the corresponding one\-token or call\-span readout in rollout\(x,r\)\(x,r\)\.

From correct and failed rollouts,PRISMSconstructs a contribution\-selected shared basis𝒮f\\mathcal\{S\}\_\{f\}\. AnL1L\_\{1\}\-regularized probe within this basis yields a compact detector support𝒟f⊆𝒮f\\mathcal\{D\}\_\{f\}\\subseteq\\mathcal\{S\}\_\{f\}, which determines*when*intervention is needed\. Independently constructed layerwise directions from the full basis determine*how*to change the model\. Over\-calling and missing form the online control loop; validity is monitored after generation and before tool execution\. Figure[2](https://arxiv.org/html/2608.00218#S1.F2)summarizes this read–steer pipeline\.

### 2\.2Contribution\-Selected Shared Neuron Basis

#### Neuron writes and contribution\.

Letht\(ℓ\)∈ℝdmodelh\_\{t\}^\{\(\\ell\)\}\\in\\mathbb\{R\}^\{d\_\{\\mathrm\{model\}\}\}be the residual state at tokenttand layerℓ\\ell\. For neuron\(ℓ,i\)\(\\ell,i\)in a gated FFN, define its scalar activationat,i\(ℓ\)a\_\{t,i\}^\{\(\\ell\)\}, down\-projection valuevi\(ℓ\)v\_\{i\}^\{\(\\ell\)\}, and residual\-stream writegt,i\(ℓ\)g\_\{t,i\}^\{\(\\ell\)\}by

at,i\(ℓ\)\\displaystyle a\_\{t,i\}^\{\(\\ell\)\}:=\[σ​\(ht\(ℓ\)​Wgate\(ℓ\)\)⊙\(ht\(ℓ\)​Wup\(ℓ\)\)\]i,\\displaystyle=\\big\[\\sigma\(h\_\{t\}^\{\(\\ell\)\}W\_\{\\mathrm\{gate\}\}^\{\(\\ell\)\}\)\\odot\(h\_\{t\}^\{\(\\ell\)\}W\_\{\\mathrm\{up\}\}^\{\(\\ell\)\}\)\\big\]\_\{i\},\(1\)vi\(ℓ\)\\displaystyle v\_\{i\}^\{\(\\ell\)\}:=Wdown\(ℓ\)​\[:,i\],gt,i\(ℓ\):=at,i\(ℓ\)​vi\(ℓ\),\\displaystyle=W\_\{\\mathrm\{down\}\}^\{\(\\ell\)\}\[:,i\],\\qquad g\_\{t,i\}^\{\(\\ell\)\}=a\_\{t,i\}^\{\(\\ell\)\}v\_\{i\}^\{\(\\ell\)\},MLP\(ℓ\)⁡\(ht\(ℓ\)\)=∑igt,i\(ℓ\)\\displaystylect,i\(ℓ\)\\displaystyle c\_\{t,i\}^\{\(\\ell\)\}:=‖gt,i\(ℓ\)‖2=\|at,i\(ℓ\)\|​‖vi\(ℓ\)‖2\.\\displaystyle=\\\|g\_\{t,i\}^\{\(\\ell\)\}\\\|\_\{2\}=\|a\_\{t,i\}^\{\(\\ell\)\}\|\\\|v\_\{i\}^\{\(\\ell\)\}\\\|\_\{2\}\.This definition follows the FFN key–value\-memory view, in which the output is a weighted sum of value vectors\(Gevaet al\.[2021](https://arxiv.org/html/2608.00218#bib.bib16)\)\. The scorect,i\(ℓ\)c\_\{t,i\}^\{\(\\ell\)\}is also a column\-grouped WANDA analogue: it combines input activation with down\-projection magnitude and equals the norm of the neuron’s actual residual write\(Sunet al\.[2024](https://arxiv.org/html/2608.00218#bib.bib15)\)\. Related work uses WANDA\-style attribution to isolate sparse safety\-critical regions\(Weiet al\.[2024](https://arxiv.org/html/2608.00218#bib.bib17)\)\.

#### Corpus aggregation and global selection\.

For either corpus𝒜∈\{ℋf,ℬf\}\\mathcal\{A\}\\in\\\{\\mathcal\{H\}\_\{f\},\\mathcal\{B\}\_\{f\}\\\}, we average the contribution over examples and the appropriate readout positions\. With failure and correct selection budgetskkandmm, respectively,

Cf,i\(ℓ\),𝒜\\displaystyle C\_\{f,i\}^\{\(\\ell\),\\mathcal\{A\}\}:=𝔼\(x,r\)∼𝒜​\[1\|𝒯f​\(x,r\)\|​∑t∈𝒯f​\(x,r\)ct,i\(ℓ\)​\(x,r\)\],\\displaystyle=\\mathbb\{E\}\_\{\(x,r\)\\sim\\mathcal\{A\}\}\\left\[\\frac\{1\}\{\|\\mathcal\{T\}\_\{f\}\(x,r\)\|\}\\sum\_\{t\\in\\mathcal\{T\}\_\{f\}\(x,r\)\}c\_\{t,i\}^\{\(\\ell\)\}\(x,r\)\\right\],\(2\)𝒮f\\displaystyle\\mathcal\{S\}\_\{f\}:=Topk⁡\(Cfℋf\)∪Topm⁡\(Cfℬf\),\\displaystyle=\\operatorname\{Top\}\_\{k\}\\\!\\left\(C\_\{f\}^\{\\mathcal\{H\}\_\{f\}\}\\right\)\\cup\\operatorname\{Top\}\_\{m\}\\\!\\left\(C\_\{f\}^\{\\mathcal\{B\}\_\{f\}\}\\right\),𝒮f\(ℓ\)\\displaystyle\\mathcal\{S\}\_\{f\}^\{\(\\ell\)\}:=\{i:\(ℓ,i\)∈𝒮f\}\.\\displaystyle=\\\{i:\(\\ell,i\)\\in\\mathcal\{S\}\_\{f\}\\\}\.The ranking is global across all layer–neuron pairs, without a per\-layer quota\. The basis can therefore concentrate in layers that carry more information for failure modeff\.

### 2\.3Sparse Monitoring

#### Signed detector features\.

Basis selection uses unsigned contribution magnitude\. Monitoring instead preserves activation sign and normalizes each write by the scale of its layer’s MLP output:

ϕt,i\(ℓ\)​\(x,r\)\\displaystyle\\phi\_\{t,i\}^\{\(\\ell\)\}\(x,r\):=at,i\(ℓ\)​\(x,r\)​‖vi\(ℓ\)‖2‖MLP\(ℓ\)⁡\(ht\(ℓ\)\)‖2\+ϵ,\\displaystyle=\\frac\{a\_\{t,i\}^\{\(\\ell\)\}\(x,r\)\\\|v\_\{i\}^\{\(\\ell\)\}\\\|\_\{2\}\}\{\\\|\\operatorname\{MLP\}^\{\(\\ell\)\}\(h\_\{t\}^\{\(\\ell\)\}\)\\\|\_\{2\}\+\\epsilon\},zf,i\(ℓ\)​\(x,r\)\\displaystyle z\_\{f,i\}^\{\(\\ell\)\}\(x,r\):=1\|𝒯f​\(x,r\)\|​∑t∈𝒯f​\(x,r\)ϕt,i\(ℓ\)​\(x,r\),\(ℓ,i\)∈𝒮f\.\\displaystyle=\\frac\{1\}\{\|\\mathcal\{T\}\_\{f\}\(x,r\)\|\}\\sum\_\{t\\in\\mathcal\{T\}\_\{f\}\(x,r\)\}\\phi\_\{t,i\}^\{\(\\ell\)\}\(x,r\),\\quad\(\\ell,i\)\\in\\mathcal\{S\}\_\{f\}\.Hereϵ\>0\\epsilon\>0ensures numerical stability, andzf​\(x,r\)z\_\{f\}\(x,r\)collects these components over𝒮f\\mathcal\{S\}\_\{f\}\. The full shared\-basis probe uses exactly this feature set, not a full\-width residual or MLP representation\.

#### Sparse detector\.

For each failure mode, we fit anL1L\_\{1\}\-regularized logistic probe within the selected basis:

pf​\(x,r\)\\displaystyle p\_\{f\}\(x,r\):=σ​\(wf⊤​zf​\(x,r\)\+bf\),\\displaystyle=\\sigma\\\!\\left\(w\_\{f\}^\{\\top\}z\_\{f\}\(x,r\)\+b\_\{f\}\\right\),\(3\)𝒟f\\displaystyle\\mathcal\{D\}\_\{f\}:=supp⁡\(wf\)⊆𝒮f\.\\displaystyle=\\operatorname\{supp\}\(w\_\{f\}\)\\subseteq\\mathcal\{S\}\_\{f\}\.Only the compact support𝒟f\\mathcal\{D\}\_\{f\}is required at inference\.

Detector fitting uses training prompts only\. The decision thresholdτf\\tau\_\{f\}and intervention strengthαf\\alpha\_\{f\}are selected jointly on a prompt\-disjoint validation split and frozen before test evaluation\. Among validation settings on the OC–CA Pareto frontier, we select the largest threshold and then the smallest strength whose target\-metric gain is within95%95\\%of the best validation gain\. Threshold and strength sweeps are reported in Appendix[A\.7](https://arxiv.org/html/2608.00218#A1.SS7)\.

### 2\.4Layerwise Causal Control

Sparse decodability establishes that failure information is readable, not that probe\-supported neurons are causal handles\. We therefore construct control directions from the complete contribution\-selected basis𝒮f\\mathcal\{S\}\_\{f\}, rather than from probe weights or𝒟f\\mathcal\{D\}\_\{f\}alone, and test their downstream effect through intervention\.

#### Failure\-contrast directions\.

For corpus𝒜∈\{ℬf,ℋf\}\\mathcal\{A\}\\in\\\{\\mathcal\{B\}\_\{f\},\\mathcal\{H\}\_\{f\}\\\}, letu¯f,𝒜\(ℓ\)\\bar\{u\}\_\{f,\\mathcal\{A\}\}^\{\(\\ell\)\}be the mean residual write of the selected neurons at layerℓ\\ell\. The normalized correct\-minus\-failure direction is

u¯f,𝒜\(ℓ\)\\displaystyle\\bar\{u\}\_\{f,\\mathcal\{A\}\}^\{\(\\ell\)\}:=𝔼\(x,r\)∼𝒜​\[1\|𝒯f​\(x,r\)\|​∑t∈𝒯f​\(x,r\)∑i∈𝒮f\(ℓ\)gt,i\(ℓ\)​\(x,r\)\],\\displaystyle=\\mathbb\{E\}\_\{\(x,r\)\\sim\\mathcal\{A\}\}\\left\[\\frac\{1\}\{\|\\mathcal\{T\}\_\{f\}\(x,r\)\|\}\\sum\_\{t\\in\\mathcal\{T\}\_\{f\}\(x,r\)\}\\sum\_\{i\\in\\mathcal\{S\}\_\{f\}^\{\(\\ell\)\}\}g\_\{t,i\}^\{\(\\ell\)\}\(x,r\)\\right\],df\(ℓ\)\\displaystyle d\_\{f\}^\{\(\\ell\)\}:=u¯f,ℬf\(ℓ\)−u¯f,ℋf\(ℓ\),d^f\(ℓ\):=df\(ℓ\)‖df\(ℓ\)‖2\.\\displaystyle=\\bar\{u\}\_\{f,\\mathcal\{B\}\_\{f\}\}^\{\(\\ell\)\}\-\\bar\{u\}\_\{f,\\mathcal\{H\}\_\{f\}\}^\{\(\\ell\)\},\\qquad\\widehat\{d\}\_\{f\}^\{\(\\ell\)\}=\\frac\{d\_\{f\}^\{\(\\ell\)\}\}\{\\\|d\_\{f\}^\{\(\\ell\)\}\\\|\_\{2\}\}\.Each selected layer has its own direction; directions are not collapsed into one global vector\. At an intervention token, the layer’s MLP branch becomes

MLP~\(ℓ\)​\(ht\(ℓ\)\):=MLP\(ℓ\)⁡\(ht\(ℓ\)\)\+αf​γ\(ℓ\)​d^f\(ℓ\),\\widetilde\{\\operatorname\{MLP\}\}^\{\(\\ell\)\}\\\!\\left\(h\_\{t\}^\{\(\\ell\)\}\\right\):=\\operatorname\{MLP\}^\{\(\\ell\)\}\\\!\\left\(h\_\{t\}^\{\(\\ell\)\}\\right\)\+\\alpha\_\{f\}\\gamma^\{\(\\ell\)\}\\widehat\{d\}\_\{f\}^\{\(\\ell\)\},\(4\)whereαf\\alpha\_\{f\}is the validation\-selected strength for branchff, andγ\(ℓ\)\\gamma^\{\(\\ell\)\}matches the intervention to the scale of layerℓ\\ell’s MLP output\. The detector therefore answers*when*; the independently normalized layerwise direction answers*how*\.

### 2\.5Detector\-Gated Closed Loop

Over\-calling and missing use separate detectors, thresholds, and correcting directions\. At the decision readout, the controller first checks whetherpover​\(x,r\)\>τoverp\_\{\\mathrm\{over\}\}\(x,r\)\>\\tau\_\{\\mathrm\{over\}\}; if so, it applies Eq\.[4](https://arxiv.org/html/2608.00218#S2.E4)with the over\-calling direction\. Otherwise, ifpmiss​\(x,r\)\>τmissp\_\{\\mathrm\{miss\}\}\(x,r\)\>\\tau\_\{\\mathrm\{miss\}\}, it applies the missing direction\. If neither detector fires, the original forward computation is preserved\.

This ordering also resolves the rare case in which both detectors fire\. The two branches target mutually exclusive failures, and a validation comparison selects over\-calling priority as the more conservative policy\. We report conflict frequency and alternative policies in Appendix[A\.7](https://arxiv.org/html/2608.00218#A1.SS7)\. The over\-calling direction moves the model toward correct abstention; the missing direction moves it toward correct tool use\. They are independent correct\-minus\-failure directions, not opposite signs of one shared vector\.

Without explicit reasoning, the gate is read at prompt end; with reasoning, it is read immediately before</think\>\. The validity detector instead reads the generated call span before execution, after which a downstream agent may execute, block, flag, or regenerate the call\.

## 3Sparse Readouts and Causal Directions

We first validate the two components behindPRISMS: whether tool\-use failures admit sparse readouts, and whether the contribution\-selected neurons support causal control\. The following protocol is shared across these component analyses and the closed\-loop evaluation in Section[4](https://arxiv.org/html/2608.00218#S4)\.

#### Models\.

Our six\-model intervention suite spans Qwen3\-\{1\.7B, 4B, 8B, 14B\}, Llama\-3\.1\-8B\-Instruct, and Gemma\-3\-4B\-IT, covering three model families\. Qwen3’s optional thinking mode is evaluated separately in Section[4\.3](https://arxiv.org/html/2608.00218#S4.SS3); all other main results use neutral prompts without thinking\.

#### Natural\-rollout datasets and labels\.

Rather than inject synthetic errors, we label behavior produced by the models’ own stochastic rollouts \(R=8R=8for decision failures andR=16R=16for validity, temperature0\.70\.7\)\. The*validity*set uses reference\-backed calls from Glaive\(Glaive AI[2024](https://arxiv.org/html/2608.00218#bib.bib4)\), ToolACE\(Liuet al\.[2025](https://arxiv.org/html/2608.00218#bib.bib2)\), and xLAM\(Zhanget al\.[2025](https://arxiv.org/html/2608.00218#bib.bib3)\): a parseable, applicable call is invalid when its argument values disagree with the reference under AST and normalized\-value matching\. The*over\-calling*set contains prompts for which no offered tool is applicable; an error is any emitted call, either with no tool supplied \(NTA\) or with only an inapplicable distractor supplied \(DT\)\. The*missing*set contains prompts with an available, required tool; an error is failure to call it\. We construct separate datasets for over\-calling, missing, and validity, each using a prompt\-grouped70/15/1570/15/15train/validation/test split\. Contribution bases and steering directions are estimated from balanced, equal\-sized sets of failure and correct development prompts\. Exact sources, endpoint thresholds, counts, parsing, and formal label definitions appear in Appendix[A](https://arxiv.org/html/2608.00218#A1)\.

#### Metrics\.

Monitoring is evaluated with held\-out ROC\-AUC and average precision \(AP\)\. Behavioral control reports NTA and DT error rates separately, capability accuracy \(CA\) on tool\-required prompts, and their prompt\-count\-weighted pooled over\-call rate

OC=nNTA​rNTA\+nDT​rDTnNTA\+nDT\.\\mathrm\{OC\}=\\frac\{n\_\{\\mathrm\{NTA\}\}r\_\{\\mathrm\{NTA\}\}\+n\_\{\\mathrm\{DT\}\}r\_\{\\mathrm\{DT\}\}\}\{n\_\{\\mathrm\{NTA\}\}\+n\_\{\\mathrm\{DT\}\}\}\.\(5\)Thus OC measures erroneous calling when no valid tool is available, whereas CA measures preservation or recovery of legitimate tool use\. Direct\-steering and supplementary tables retain NTA and DT separately even when the main gate figure reports OC\.

#### Baselines and controls\.

We reproduce the closest dense hidden\-state detectors on matched data and models: the final\-layer three\-position MLP ofHealyet al\.\([2026](https://arxiv.org/html/2608.00218#bib.bib9)\)for validity andWhen2Tool’s last\-input\-token linear probe\(Sunet al\.[2026](https://arxiv.org/html/2608.00218#bib.bib10)\)for tool necessity\. For the contribution basis, we usek=m=⌈0\.03​N⌉k=m=\\lceil 0\.03N\\rceilover theNNlayer–neuron pairs; this3%3\\%budget is an experimental setting, not part of the method\. Controls include prompt\-only and Reason\-then\-Act baselines, label\-shuffled and layer\-profile\-matched random directions, probe\-selected neurons, shuffled gates, random vectors routed by the real gate, and degeneration screening\. Complete implementations, generation parameters, operating\-point selection, and screening criteria are deferred to Appendix[A](https://arxiv.org/html/2608.00218#A1)\.

#### Validation\-only operating points\.

All detector thresholds and steering strengths are selected on prompt\-disjoint validation data and then frozen for the test set\. We search their joint OC–CA trade\-off and conservatively choose the largest threshold and smallest strength within95%95\\%of the best validation gain for the target branch\. The validation sweeps give a broad stable region aroundαover=αmiss=\.2\\alpha\_\{\\rm over\}=\\alpha\_\{\\rm miss\}=\.2across all six models; neighboring\-parameter sensitivity and dual\-detector conflict audits appear in Appendix[A\.7](https://arxiv.org/html/2608.00218#A1.SS7)\.

#### One basis for everything\.

All experiments share a single neuron basis per model and signal\. Each MLP neuron is scored by its*contribution*cli=\|ali\|¯⋅‖Wdown​\[:,i\]‖c^\{i\}\_\{l\}=\\overline\{\|a^\{i\}\_\{l\}\|\}\\cdot\\\|W\_\{\\text\{down\}\}\[:,i\]\\\|on an error corpusHHand a correct corpusBBdrawn from the model’s own rollouts; in the main setting, the basis is the*union*obtained withk=m=⌈0\.03​N⌉k=m=\\lceil 0\.03N\\rceil\. Detection fits an L1\-logistic probe on*signed*per\-token contribution features \(z⋅‖Wdown‖/‖mlp\_out‖z\\cdot\\\|W\_\{\\text\{down\}\}\\\|/\\\|\\text\{mlp\\\_out\}\\\|\) restricted to this set; steering perturbs alongd=pB−pHd=p^\{B\}\-p^\{H\}built on the*same*set; the gated repair combines the two\. Selection corpora are drawn from training prompts only, and all test prompts are disjoint from them\. The six\-model intervention suite comprises Qwen3\-\{1\.7B, 4B, 8B, 14B\}, Llama\-3\.1\-8B\-Instruct, and Gemma\-3\-4B\-IT\. Unless stated otherwise, results use the neutral prompt and no\-think setting\.

### 3\.1Sparse Failure Readouts

Table 1:Detection on the unified basis \(held\-out test; neutral/no\-think\)\. Cells report ROC\-AUC \(AP\)\. Decision signals are read pre\-generation per prompt; validity is read over the generated call span per rollout\.Table[1](https://arxiv.org/html/2608.00218#S3.T1)reports held\-out detection at one operating point for all models\. On Qwen3, over\-calling and missing reach ROC\-AUC0\.980\.98–1\.001\.00, with over\-calling AP0\.920\.92–0\.990\.99\. Llama reaches AUC/AP0\.996/0\.9810\.996/0\.981for over\-calling and0\.895/0\.790\.895/0\.79for missing; Gemma reaches0\.908/0\.840\.908/0\.84and0\.927/1\.000\.927/1\.00, respectively\. Validity is moderately decodable across all three families, with AUC0\.8560\.856–0\.8950\.895\. Thus, decision failures are strongly readable before generation, while validity remains readable from the generated call span\.

We deliberately make*no*claim here that the contribution\-selected basis detects better than a size\- and profile\-matched random one: at a3%3\\%budget the readable signal is redundant enough that detection cannot separate selections \(Δ\\DeltaAUC vs\. random≤\+0\.011\\leq\+0\.011\)\. Whether the selected set is*special*is a causal question, answered by the steering and gating experiments \(Sections[3\.3](https://arxiv.org/html/2608.00218#S3.SS3)and[4\.1](https://arxiv.org/html/2608.00218#S4.SS1)\)\.

Signed activations are important: magnitude\-only features reduce validity AUC by0\.020\.02–0\.040\.04\(8B:0\.854→0\.8910\.854\\to 0\.891with sign restored\), showing that part of the validity signal is direction\-encoded\.

### 3\.2Sparsity, Independence, & Readout Location

#### Sparsity\.

Table[2](https://arxiv.org/html/2608.00218#S3.T2)tracks detection as the budget shrinks from the full selected basis \(5,5875\{,\}587–30,55630\{,\}556features, or3\.13\.1–4\.6%4\.6\\%of the all\-layer MLP feature space\) to a per\-layer\-equivalent budget of one\. AtK=1K\{=\}1\(3535–5959actual union features\), over\-calling and missing retain near\-full AUC in almost every cell, whereas validity degrades more visibly\. A modest increase inKKlargely recovers validity\. An unconstrained L1 search over raw activations puts the signal\-level limit lower still \(11–22neurons for missing,22–1616for over\-calling,∼\\sim128128for validity\), so sparsity is a property of the*signal*; the basis buys causal addressability at the price of a few dozen features\. Consistently with the framing above, the sparse end shows no detection advantage over matched random subsets—specialness is established causally, not by AUC deltas\. Complete six\-model results appear in Appendix[A\.8](https://arxiv.org/html/2608.00218#A1.SS8)\.

Table 2:Detection AUC as the unified\-basis budget shrinks for representative Qwen, Llama, and Gemma models\. Full\-basis cells also give the selected\-feature count; other cells give AUC \(union count\)\. The complete six\-model table is in Appendix[A\.8](https://arxiv.org/html/2608.00218#A1.SS8)\.
#### Restricted overlap diagnostic\.

In the fixed six\-layer Qwen3\-4B subspace used for the original diagnostic, the three failure\-specific top\-KKsets show no excess overlap beyond chance \(Table[3](https://arxiv.org/html/2608.00218#S3.T3)\)\. Pairwise overlap is zero forK≤200K\\leq 200, below expectation atK=500K\{=\}500, and near chance atK=1,000K\{=\}1\{,\}000\(1818observed vs\.17\.117\.1expected\); the three\-way intersection is empty in this restricted analysis\. The complete all\-layer audit finds small, configuration\-sensitive shared components while preserving very low Jaccard overlap \(Appendix Tables[S6](https://arxiv.org/html/2608.00218#A1.T6)and[S7](https://arxiv.org/html/2608.00218#A1.T7)\)\.

Table 3:Restricted six\-layer three\-signal overlap vs\. chance \(Qwen3\-4B, common58,36858\{,\}368\-feature space\)\. Within this diagnostic, overlap never exceeds the hypergeometric expectation and the three\-way intersection is empty\.
#### Depth\.

The sets also sit at different depths \(Figure[3](https://arxiv.org/html/2608.00218#S3.F3)\)\. The decision signals are*late\-localized*—missing’s top\-100100neurons lie entirely in the late half \(mean relative depth0\.870\.87\), its per\-layer AUC snapping to1\.0001\.000at L21; over\-calling is intermediate \(69%69\\%late\)\. Validity is*layer\-flat*\(43%43\\%late, no dominant layer\)\. Quantified as early→\\tolate\-half*error*reduction \(AUC ranges are distorted by ceiling effects\):97\.0%97\.0\\%missing,44\.2%44\.2\\%over\-calling,4\.4%4\.4\\%validity\. The steering direction concentrates in the same place: layers2121–2727carry∼\\sim74%74\\%of‖d‖\\\|d\\\|\. The call/no\-call decision crystallizes near the output; judging an emitted call’s correctness does not\.

![Refer to caption](https://arxiv.org/html/2608.00218v1/x3.png)Figure 3:Per\-layer detection AUC, all3636layers \(Qwen3\-4B\)\. Two regimes: the decision signals are late\-localized—missing snaps to1\.0001\.000at L21 and stays there; over\-calling climbs from≈\\approx0\.940\.94to≈\\approx0\.970\.97after L19—while validity is layer\-flat \(0\.850\.85–0\.890\.89at every depth, no dominant layer\)\.

### 3\.3Contribution\-Selected Neurons Enable Causal Control

Detection could not distinguish the contribution basis from random; intervention can\. Steering the*probe’s*own top\-weight neurons never separates from controls \(permutationp=0\.238p=0\.238\), which motivated selecting by contribution in the first place\. Along the basis directiondd, additive steering moves over\-calling monotonically and bidirectionally \(\+d\+dsuppresses tool\-calling,−d\-delicits it; e\.g\. 4B non\-existent\-tool hallucination0\.534→0\.0000\.534\\to 0\.000and→0\.886\\to 0\.886at the dose extremes\), while*validity does not move in either direction*—mirroring its diffuse, sign\-encoded readout\.

The decisive control compares the real direction with a*matched\-random*one that preserves neuron count and per\-layer profile but randomizes neuron identity \(Table[4](https://arxiv.org/html/2608.00218#S3.T4)\)\. Across Qwen, the real direction removes7979–100%100\\%of over\-calling while the matched\-random direction is largely ineffective; on 4B, random steering is even worse than baseline \(0\.5800\.580vs\.0\.5340\.534\)\. Thus causal specificity lies in the selected neurons, not merely their number or depth profile\. The effect extends beyond Qwen: on Llama, the real direction reduces DT from\.228\.228to\.101\.101, compared with\.201\.201for the matched control; on Gemma, it reduces DT from\.054\.054to zero, whereas the control raises it to\.144\.144\. Unconditional steering can nevertheless reduce capability at stronger doses, motivating the detector gate below\. Post\-hoc screening found no repetition or overlength degeneration\.

Table 4:Real vs\. matched\-random steering direction \(suppress arm, relativeα\\alpha\)\.NTAis erroneous calling when no tool is supplied;DTis erroneous calling when only an inapplicable distractor tool is supplied;CAis capability accuracy on tool\-required prompts\. Random preserves neuron count and layer profile\.

## 4Closed\-Loop Tool\-Use Control

Having established sparse failure readouts and contribution\-specific causal directions separately, we now evaluate their combination as a detector\-gated controller and test its robustness across models and reasoning modes\.

### 4\.1Main Detector\-Gated Steering Results

![Refer to caption](https://arxiv.org/html/2608.00218v1/x4.png)Figure 4:Bidirectional detector\-gated steering\. Pooled over\-call rate \(OC↓\\downarrow\) combines NTA and DT by prompt count; CA↑\\uparrowmeasures correct calls on tool\-required prompts\. The full NTA/DT decomposition appears in Appendix Table[S11](https://arxiv.org/html/2608.00218#A1.T11)\.Unconditional steering is a*propensity*knob—suppressing hallucinated calls also suppresses legitimate ones\. Because the detector reads the same basis the vector writes, the fix is architectural: a bidirectional gate that intervenes only where the probe predicts a failure \(pover\>τover⇒\+αover​doverp\_\{\\text\{over\}\}\>\\tau\_\{\\text\{over\}\}\\Rightarrow\+\\alpha\_\{\\text\{over\}\}d\_\{\\text\{over\}\}to suppress;pmiss\>τmiss⇒\+αmiss​dmissp\_\{\\text\{miss\}\}\>\\tau\_\{\\text\{miss\}\}\\Rightarrow\+\\alpha\_\{\\text\{miss\}\}d\_\{\\text\{miss\}\}to elicit\), leaving every other forward pass untouched\.

Figure[4](https://arxiv.org/html/2608.00218#S4.F4)reports the pooled OC metric from Equation[5](https://arxiv.org/html/2608.00218#S3.E5); NTA and DT remain separate in the appendix\. Operating points are selected on validation data and frozen for test, withα=\.2\\alpha=\.2lying in a broad stable region \(Appendix[A\.7](https://arxiv.org/html/2608.00218#A1.SS7)\)\. Across all six models, the complete controller lowers macro OC by80%80\\%\(\.131→\.026\.131\\to\.026\) and raises CA by14\.214\.2points \(\.689→\.831\.689\\to\.831\)\. It improves different regimes: Qwen3\-4B moves from\.271/\.756\.271/\.756to\.034/\.911\.034/\.911OC/CA; Llama\-8B reduces DT from\.228\.228to\.096\.096while raising CA from\.685\.685to\.751\.751; and Gemma\-3\-4B keeps its low OC nearly fixed while recovering CA from\.078\.078to\.508\.508\. Thus gating can suppress erroneous calls, recover required calls, or do both\.

Controls show that both routing and direction matter\. On Qwen3\-4B, shuffled gating reaches\.243/\.711\.243/\.711OC/CA and a random direction\.056/\.800\.056/\.800, versus\.034/\.911\.034/\.911for the complete controller\. Neither control matches the real controller on Llama or Gemma either\. These failures rule out intervention frequency and indiscriminate tool\-call elicitation; complete subtype results and prompt counts appear in Table[S11](https://arxiv.org/html/2608.00218#A1.T11)\.

### 4\.2Comparison with Prior Tool\-Use Methods

Table[5](https://arxiv.org/html/2608.00218#S4.T5)compares our sparse probe with faithfully reproduced detectors in three matched Qwen3\-4B comparisons\. On our over\-calling corpus,PRISMSreaches0\.9940\.994AUC versus0\.9780\.978forWhen2Tool’s final\-input dense probe\. OnWhen2Tool’s original tool\-necessity benchmark and prompt wrapper,PRISMSreaches0\.9340\.934versus0\.8800\.880for its all\-layer dense probe\. On our natural\-rollout validity data,PRISMSreaches0\.8860\.886, versus0\.8690\.869forWhen2Tooland0\.8560\.856for the three\-position MLP ofHealyet al\.\([2026](https://arxiv.org/html/2608.00218#bib.bib9)\)\. Across these settings,PRISMSuses2323–627×627\\timesfewer individually addressable inputs\. Substituting our sparse gate intoWhen2Tool’s unchanged prefill controller raises robust accuracy by1\.71\.7–2\.22\.2points at matched call rates\. A natural\-over\-calling suppress direction also transfers without refitting, reducing unnecessary calls by18\.518\.5points against matched random atα=\.4\\alpha=\.4with no degeneration\. Full frontiers, controls, and per\-source results appear in Appendix[C](https://arxiv.org/html/2608.00218#A3)\.

Table 5:Matched Qwen3\-4B detector comparisons\. Input dim\. is the number of features presented to each probe\.SignalMethodInput dim\.AUCOver\-callingWhen2Tool2,5600\.978PRISMS\(ours\)∼\\sim640\.994NecessityWhen2Tool94,7200\.880PRISMS\(ours\)1510\.934ValidityWhen2Tool92,1600\.869Healy et al\.7,6800\.856PRISMS\(ours\)3300\.886
### 4\.3Reasoning\-Mode Monitoring

Reasoning changes where a decision should be read\. We rebuild the unified basis at the token before</think\>and compare it with the prompt\-end readout; the response\-side tag is present on≈100%\\approx 100\\%of rollouts, avoiding contamination from an empty prompt\-side<think\></think\>\. Across every Qwen3 setting, the readable decision shifts toward the reasoning end \(Appendix Table[S5](https://arxiv.org/html/2608.00218#A1.T5)\)\. The migration is signal\-dependent\. On Qwen3\-4B, over\-calling AP rises from0\.0830\.083at prompt end to0\.6760\.676at think end \(Δ\\DeltaAP\+0\.59\+0\.59\), with large gaps at every scale: the decision is formed during reasoning\. Missing migrates more softly \(Δ\\DeltaAP\+0\.07\+0\.07to\+0\.18\+0\.18\), because prompt\-end AP is already0\.810\.81–0\.930\.93\. Thus a reasoning\-mode monitor should read over\-calling at</think\>, while missing is partly visible earlier\.

Thinking also sharpens validity without relocating it: using the same generated\-call span, row\-AUC increases from0\.8890\.889to0\.9130\.913\(1\.7B\) and from0\.8860\.886to0\.9340\.934\(4B\)\. A back\-off sweep provides a temporal view of the over\-calling signal\. On Qwen3\-1\.7B it is detectable at least100100tokens before</think\>but remains diffuse; moving backward from the commitment point, AP falls from1\.001\.00to0\.900\.90while detector support expands from3838to714714neurons\. The signal therefore crystallizes as the model commits, consistent with thinking’s observed abstention bias\.

Table 6:Representative Qwen3\-4B reasoning results\. Decision cells compare prompt\-end with think\-end AUC/AP; validity compares no\-think with thinking call\-span AUC\. Complete results are in Appendix Table[S5](https://arxiv.org/html/2608.00218#A1.T5)\.
### 4\.4Additional Experiments

Complete results and implementation details are provided in the supplement:

- •Complete experimental setup and results \(Appendix[A](https://arxiv.org/html/2608.00218#A1)\):Models, data, controls, reasoning, calibration, sparsity, and per\-model intervention results\.
- •Reproducibility details \(Appendix[B](https://arxiv.org/html/2608.00218#A2)\):Hyperparameter ranges, seeds, compute, runs, uncertainty, and statistical tests\.
- •Prior\-method comparisons and transfer \(Appendix[C](https://arxiv.org/html/2608.00218#A3)\):Matched detectors, gate substitution, and cross\-corpus steering\.
- •Extended related work \(Appendix[D](https://arxiv.org/html/2608.00218#A4)\):Tool\-use evaluation, probing, sparse neurons, and activation steering\.

## 5Conclusion

We introducedPRISMS, a closed\-loop framework for monitoring and selectively correcting naturally occurring tool\-use failures\. Across model families, compact FFN feature sets reliably detect over\-calling and missing before generation and validity errors from the generated call span\. Sparse decodability alone does not identify causal neurons; effective control instead requires contribution\-selected layerwise directions\. Gating these directions with failure\-specific detectors suppresses predicted over\-calling and elicits omitted calls while leaving unflagged computation unchanged, whereas validity remains a post\-generation safety check before tool execution\. These results demonstrate that sparse internal monitoring can provide an effective trigger for selective, failure\-aware tool\-use correction\.

## References

- A\. Azaria and T\. Mitchell \(2023\)The internal state of an LLM knows when it’s lying\.InFindings of the Association for Computational Linguistics: EMNLP 2023,pp\. 967–976\.External Links:[Document](https://dx.doi.org/10.18653/v1/2023.findings-emnlp.68),[Link](https://aclanthology.org/2023.findings-emnlp.68/)Cited by:[Appendix D](https://arxiv.org/html/2608.00218#A4.SS0.SSS0.Px2.p1.1),[§1](https://arxiv.org/html/2608.00218#S1.p4.1)\.
- Y\. Chen, V\. Siu, Y\. Liu, D\. Song, and C\. Wang \(2026\)Controlling tool use with heading\-specific activation steering\.arXiv preprint arXiv:2607\.05790\.External Links:[Link](https://arxiv.org/abs/2607.05790)Cited by:[Appendix D](https://arxiv.org/html/2608.00218#A4.SS0.SSS0.Px4.p1.1),[§1](https://arxiv.org/html/2608.00218#S1.p4.1)\.
- Y\. Cheng, C\. Fan, M\. JafariRaviz, K\. Rezaei, and S\. Feizi \(2026\)Model\-adaptive tool necessity reveals the knowing–doing gap in LLM tool use\.arXiv preprint arXiv:2605\.14038\.External Links:[Link](https://arxiv.org/abs/2605.14038)Cited by:[Appendix D](https://arxiv.org/html/2608.00218#A4.SS0.SSS0.Px2.p1.1),[§1](https://arxiv.org/html/2608.00218#S1.p4.1)\.
- Y\. Elazar, S\. Ravfogel, A\. Jacovi, and Y\. Goldberg \(2021\)Amnesic probing: behavioral explanation with amnesic counterfactuals\.Transactions of the Association for Computational Linguistics9,pp\. 160–175\.External Links:[Document](https://dx.doi.org/10.1162/tacl%5Fa%5F00359),[Link](https://aclanthology.org/2021.tacl-1.10/)Cited by:[§1](https://arxiv.org/html/2608.00218#S1.p5.9)\.
- C\. Gao, H\. Chen, C\. Xiao, Z\. Chen, Z\. Liu, and M\. Sun \(2025\)H\-neurons: on the existence, impact, and origin of hallucination\-associated neurons in LLMs\.arXiv preprint arXiv:2512\.01797\.External Links:[Link](https://arxiv.org/abs/2512.01797)Cited by:[Appendix D](https://arxiv.org/html/2608.00218#A4.SS0.SSS0.Px3.p1.1),[§1](https://arxiv.org/html/2608.00218#S1.p4.1)\.
- M\. Geva, R\. Schuster, J\. Berant, and O\. Levy \(2021\)Transformer feed\-forward layers are key\-value memories\.InProceedings of the 2021 Conference on Empirical Methods in Natural Language Processing,pp\. 5484–5495\.External Links:[Document](https://dx.doi.org/10.18653/v1/2021.emnlp-main.446),[Link](https://aclanthology.org/2021.emnlp-main.446/)Cited by:[§2\.2](https://arxiv.org/html/2608.00218#S2.SS2.SSS0.Px1.p1.8)\.
- Glaive AI \(2024\)glaiveai/glaive\-function\-calling\-v2\.Note:Datasets at Hugging FaceAvailable at:https://huggingface\.co/datasets/glaiveai/glaive\-function\-calling\-v2Cited by:[§A\.3](https://arxiv.org/html/2608.00218#A1.SS3.p1.1),[Appendix D](https://arxiv.org/html/2608.00218#A4.SS0.SSS0.Px1.p1.1),[§3](https://arxiv.org/html/2608.00218#S3.SS0.SSS0.Px2.p1.4)\.
- Y\. Hao, Z\. Jin, H\. Liao, K\. Liu, and J\. Zhao \(2026\)Pushing the limits of LLM tool calling via experiential knowledge integration and activation\.InFindings of the Association for Computational Linguistics: ACL 2026,pp\. 14470–14497\.External Links:[Document](https://dx.doi.org/10.18653/v1/2026.findings-acl.710),[Link](https://aclanthology.org/2026.findings-acl.710/)Cited by:[Appendix D](https://arxiv.org/html/2608.00218#A4.SS0.SSS0.Px1.p1.1)\.
- K\. Healy, B\. Srinivasan, V\. Madathil, and J\. Wu \(2026\)Internal representations as indicators of hallucinations in agent tool selection\.InAAAI 2026 Workshop on Trustworthy Agentic AI,External Links:[Link](https://openreview.net/forum?id=QbuBZvwcDZ)Cited by:[§A\.2](https://arxiv.org/html/2608.00218#A1.SS2.SSS0.Px1),[§C\.7](https://arxiv.org/html/2608.00218#A3.SS7.p1.8),[Appendix D](https://arxiv.org/html/2608.00218#A4.SS0.SSS0.Px2.p1.1),[§1](https://arxiv.org/html/2608.00218#S1.p3.1),[§3](https://arxiv.org/html/2608.00218#S3.SS0.SSS0.Px4.p1.3),[§4\.2](https://arxiv.org/html/2608.00218#S4.SS2.p1.13)\.
- A\. Ilyas, S\. Santurkar, D\. Tsipras, L\. Engstrom, B\. Tran, and A\. Madry \(2019\)Adversarial examples are not bugs, they are features\.InAdvances in Neural Information Processing Systems,Vol\.32\.External Links:[Link](https://proceedings.neurips.cc/paper/2019/hash/e2c420d928d4bf8ce0ff2ec19b371514-Abstract.html)Cited by:[§1](https://arxiv.org/html/2608.00218#S1.p5.9)\.
- H\. Kazemi, A\. Chegini, and M\. Safi \(2026\)A single neuron is sufficient to bypass safety alignment in large language models\.arXiv preprint arXiv:2605\.08513\.External Links:[Link](https://arxiv.org/abs/2605.08513)Cited by:[Appendix D](https://arxiv.org/html/2608.00218#A4.SS0.SSS0.Px3.p1.1)\.
- K\. Li, O\. Patel, F\. Viégas, H\. Pfister, and M\. Wattenberg \(2023\)Inference\-time intervention: eliciting truthful answers from a language model\.InAdvances in Neural Information Processing Systems,Vol\.36\.External Links:[Link](https://proceedings.neurips.cc/paper_files/paper/2023/hash/81b8390039b7302c909cb769f8b6cd93-Abstract-Conference.html)Cited by:[Appendix D](https://arxiv.org/html/2608.00218#A4.SS0.SSS0.Px4.p1.1),[§1](https://arxiv.org/html/2608.00218#S1.p4.1)\.
- W\. Liu, X\. Huang, X\. Zeng, X\. Hao, S\. Yu, D\. Li, S\. Wang, W\. Gan, Z\. Liu, Y\. Yu, Z\. Wang, Y\. Wang, W\. Ning, Y\. Hou, B\. Wang, C\. Wu, X\. Wang, Y\. Liu, Y\. Wang, D\. Tang, D\. Tu, L\. Shang, X\. Jiang, R\. Tang, D\. Lian, Q\. Liu, and E\. Chen \(2025\)ToolACE: winning the points of LLM function calling\.InThe Thirteenth International Conference on Learning Representations,External Links:[Link](https://openreview.net/forum?id=8EB8k6DdCU)Cited by:[§A\.3](https://arxiv.org/html/2608.00218#A1.SS3.p1.1),[Appendix D](https://arxiv.org/html/2608.00218#A4.SS0.SSS0.Px1.p1.1),[§1](https://arxiv.org/html/2608.00218#S1.p1.1),[§3](https://arxiv.org/html/2608.00218#S3.SS0.SSS0.Px2.p1.4)\.
- S\. G\. Patil, H\. Mao, F\. Yan, C\. C\. Ji, V\. Suresh, I\. Stoica, and J\. E\. Gonzalez \(2025\)The berkeley function calling leaderboard \(BFCL\): from tool use to agentic evaluation of large language models\.InProceedings of the 42nd International Conference on Machine Learning,Proceedings of Machine Learning Research, Vol\.267,pp\. 48371–48392\.External Links:[Link](https://proceedings.mlr.press/v267/patil25a.html)Cited by:[Appendix D](https://arxiv.org/html/2608.00218#A4.SS0.SSS0.Px1.p1.1),[§1](https://arxiv.org/html/2608.00218#S1.p1.1)\.
- N\. Shinn, F\. Cassano, A\. Gopinath, K\. Narasimhan, and S\. Yao \(2023\)Reflexion: language agents with verbal reinforcement learning\.InAdvances in Neural Information Processing Systems,Vol\.36,pp\. 8634–8652\.Cited by:[§1](https://arxiv.org/html/2608.00218#S1.p2.1)\.
- Y\. Sui, Y\. Chen, Y\. Li, X\. Jiang, Y\. He, Y\. Dong, X\. He, T\. Gao, and B\. Hooi \(2026\)TACT: mitigating overthinking and overacting in coding agents via activation steering\.arXiv preprint arXiv:2605\.05980\.External Links:[Link](https://arxiv.org/abs/2605.05980)Cited by:[Appendix D](https://arxiv.org/html/2608.00218#A4.SS0.SSS0.Px4.p1.1),[§1](https://arxiv.org/html/2608.00218#S1.p4.1)\.
- C\. Sun, L\. Liu, G\. Yan, Z\. Wang, and T\. Weng \(2026\)LLM agents already know when to call tools—even without reasoning\.arXiv preprint arXiv:2605\.09252\.External Links:[Link](https://arxiv.org/abs/2605.09252)Cited by:[§A\.2](https://arxiv.org/html/2608.00218#A1.SS2.SSS0.Px2),[§C\.1](https://arxiv.org/html/2608.00218#A3.SS1.p1.8),[Appendix D](https://arxiv.org/html/2608.00218#A4.SS0.SSS0.Px2.p1.1),[§1](https://arxiv.org/html/2608.00218#S1.p2.1),[§3](https://arxiv.org/html/2608.00218#S3.SS0.SSS0.Px4.p1.3)\.
- M\. Sun, Z\. Liu, A\. Bair, and J\. Z\. Kolter \(2024\)A simple and effective pruning approach for large language models\.InThe Twelfth International Conference on Learning Representations,External Links:[Link](https://openreview.net/forum?id=PxoFut3dWW)Cited by:[Appendix D](https://arxiv.org/html/2608.00218#A4.SS0.SSS0.Px3.p1.1),[§2\.2](https://arxiv.org/html/2608.00218#S2.SS2.SSS0.Px1.p1.8)\.
- A\. M\. Turner, L\. Thiergart, G\. Leech, D\. Udell, J\. J\. Vazquez, U\. Mini, and M\. MacDiarmid \(2023\)Steering language models with activation engineering\.arXiv preprint arXiv:2308\.10248\.External Links:[Link](https://arxiv.org/abs/2308.10248)Cited by:[Appendix D](https://arxiv.org/html/2608.00218#A4.SS0.SSS0.Px4.p1.1),[§1](https://arxiv.org/html/2608.00218#S1.p3.1)\.
- Y\. Wang, R\. Zhou, Y\. Ma, R\. Fu, J\. Liang, S\. Cao, M\. Huang, T\. Fang, and L\. Pan \(2026\)ASA: backbone\-training\-free representation engineering for tool\-calling agents\.arXiv preprint arXiv:2602\.04935\.External Links:[Link](https://arxiv.org/abs/2602.04935)Cited by:[Appendix D](https://arxiv.org/html/2608.00218#A4.SS0.SSS0.Px4.p1.1),[§1](https://arxiv.org/html/2608.00218#S1.p3.1)\.
- B\. Wei, K\. Huang, Y\. Huang, T\. Xie, X\. Qi, M\. Xia, P\. Mittal, M\. Wang, and P\. Henderson \(2024\)Assessing the brittleness of safety alignment via pruning and low\-rank modifications\.InProceedings of the 41st International Conference on Machine Learning,Proceedings of Machine Learning Research, Vol\.235,pp\. 52588–52610\.External Links:[Link](https://proceedings.mlr.press/v235/wei24f.html)Cited by:[Appendix D](https://arxiv.org/html/2608.00218#A4.SS0.SSS0.Px3.p1.1),[§2\.2](https://arxiv.org/html/2608.00218#S2.SS2.SSS0.Px1.p1.8)\.
- Z\. Wu, Z\. Wang, S\. Cho, Y\. Yang, A\. Koshiyama, S\. Bulathwela, and M\. Pérez\-Ortiz \(2026\)Tool calling is linearly readable and steerable in language models\.arXiv preprint arXiv:2605\.07990\.External Links:[Link](https://arxiv.org/abs/2605.07990)Cited by:[Appendix D](https://arxiv.org/html/2608.00218#A4.SS0.SSS0.Px2.p1.1),[§1](https://arxiv.org/html/2608.00218#S1.p4.1)\.
- H\. Xu, Z\. Zhu, L\. Pan, Z\. Wang, S\. Zhu, D\. Ma, R\. Cao, L\. Chen, and K\. Yu \(2025\)Reducing tool hallucination via reliability alignment\.InProceedings of the 42nd International Conference on Machine Learning,Proceedings of Machine Learning Research, Vol\.267,pp\. 69992–70006\.External Links:[Link](https://proceedings.mlr.press/v267/xu25ap.html)Cited by:[Appendix D](https://arxiv.org/html/2608.00218#A4.SS0.SSS0.Px1.p1.1)\.
- S\. Yao, J\. Zhao, D\. Yu, N\. Du, I\. Shafran, K\. Narasimhan, and Y\. Cao \(2023\)ReAct: synergizing reasoning and acting in language models\.InInternational Conference on Learning Representations,Cited by:[§1](https://arxiv.org/html/2608.00218#S1.p2.1)\.
- C\. Yin, Z\. Sha, S\. Cui, C\. Meng, and Z\. Li \(2026\)The reasoning trap: how enhancing LLM reasoning amplifies tool hallucination\.InProceedings of the 64th Annual Meeting of the Association for Computational Linguistics \(Volume 1: Long Papers\),pp\. 8310–8328\.External Links:[Document](https://dx.doi.org/10.18653/v1/2026.acl-long.376),[Link](https://aclanthology.org/2026.acl-long.376/)Cited by:[Appendix D](https://arxiv.org/html/2608.00218#A4.SS0.SSS0.Px1.p1.1)\.
- J\. Zhang, T\. Lan, M\. Zhu, Z\. Liu, T\. Hoang, S\. Kokane, W\. Yao, J\. Tan, Z\. Liu, Y\. Feng, J\. C\. Niebles, S\. Heinecke, H\. Wang, S\. Savarese, and C\. Xiong \(2025\)XLAM: a family of large action models to empower AI agent systems\.InProceedings of the 2025 Conference of the Nations of the Americas Chapter of the Association for Computational Linguistics: Human Language Technologies \(Volume 1: Long Papers\),pp\. 11583–11597\.External Links:[Document](https://dx.doi.org/10.18653/v1/2025.naacl-long.578),[Link](https://aclanthology.org/2025.naacl-long.578/)Cited by:[§A\.3](https://arxiv.org/html/2608.00218#A1.SS3.p1.1),[Appendix D](https://arxiv.org/html/2608.00218#A4.SS0.SSS0.Px1.p1.1),[§1](https://arxiv.org/html/2608.00218#S1.p1.1),[§3](https://arxiv.org/html/2608.00218#S3.SS0.SSS0.Px2.p1.4)\.
- C\. Zhao, Y\. Ke, and K\. Huang \(2026\)Unraveling LLM jailbreaks through safety knowledge neurons\.InProceedings of the 19th Conference of the European Chapter of the Association for Computational Linguistics \(Volume 1: Long Papers\),pp\. 1889–1906\.External Links:[Document](https://dx.doi.org/10.18653/v1/2026.eacl-long.83),[Link](https://aclanthology.org/2026.eacl-long.83/)Cited by:[Appendix D](https://arxiv.org/html/2608.00218#A4.SS0.SSS0.Px3.p1.1)\.
- A\. Zou, L\. Phan, S\. Chen, J\. Campbell, P\. Guo, R\. Ren, A\. Pan, X\. Yin, M\. Mazeika, A\. Dombrowski, S\. Goel, N\. Li, M\. J\. Byun, Z\. Wang, A\. Mallen, S\. Basart, S\. Koyejo, D\. Song, M\. Fredrikson, J\. Z\. Kolter, and D\. Hendrycks \(2023\)Representation engineering: a top\-down approach to AI transparency\.arXiv preprint arXiv:2310\.01405\.External Links:[Link](https://arxiv.org/abs/2310.01405)Cited by:[Appendix D](https://arxiv.org/html/2608.00218#A4.SS0.SSS0.Px4.p1.1),[§1](https://arxiv.org/html/2608.00218#S1.p3.1)\.

## Appendix AComplete Experimental Setup

### A\.1Evaluated Models and Sampling

We evaluate six models spanning Qwen3\-1\.7B, Qwen3\-4B, Qwen3\-8B, Qwen3\-14B, Llama\-3\.1\-8B\-Instruct, and Gemma\-3\-4B\-IT\. Qwen3 exposes an optional*thinking*mode; the other families are no\-think only\. We sampleR=8R=8generations for the decision signals andR=16R=16for validity at temperature0\.70\.7, using each model’s own chat template\. All final results use held\-out test prompts, with prompt\-level disjointness enforced across training, validation, and test splits\.

### A\.2Baseline Implementations

#### Validity: internal\-representation tool\-hallucination detection\(Healyet al\.[2026](https://arxiv.org/html/2608.00218#bib.bib9)\)\.

Healy et al\. detect tool\-call hallucinations using a two\-layer MLP over final\-layer residual states extracted at three positions: the function token, the mean argument\-span representation, and the end of the call,

h​\[tfunc\]​‖h​\[Targs\]¯‖​h​\[tend\]\.h\[t\_\{\\mathrm\{func\}\}\]\\,\\\|\\,\\overline\{h\[T\_\{\\mathrm\{args\}\}\]\}\\,\\\|\\,h\[t\_\{\\mathrm\{end\}\}\]\.Their labels are generated through mask\-and\-replace corruption of ground\-truth calls, whereas ours are derived from errors naturally produced by model rollouts\.

#### Over\-calling: pre\-generation tool\-necessity probing and steering\(Sunet al\.[2026](https://arxiv.org/html/2608.00218#bib.bib10)\)\.

Sun et al\. read the last\-input\-token residual state with a linear probe to predict whether a tool is needed\. Although their label captures ground\-truth tool necessity rather than naturally observed over\-calling, it provides the closest pre\-generation baseline for our decision signal\. TheirProbe&Prefillmethod controls tool use by inserting a steering sentence into the response instead of intervening on internal activations\. We reproduce their dense residual\-state probe on our over\-calling data and additionally compare the two feature spaces on theWhen2Toolbenchmark\.

### A\.3Dataset Construction and Processing

Validitydata derive from four single\-turn function\-calling sources with ground\-truth calls: Glaive\(Glaive AI[2024](https://arxiv.org/html/2608.00218#bib.bib4)\), ToolACE\(Liuet al\.[2025](https://arxiv.org/html/2608.00218#bib.bib2)\), and xLAM\(Zhanget al\.[2025](https://arxiv.org/html/2608.00218#bib.bib3)\); BFCL is collected but excluded from pooled validity scoring because its near\-zero error rate \(3\.5%3\.5\\%\) would allow a probe to rank source signature instead of call validity\.Decisiondata are built from tool\-necessity scenarios\. Over\-calling prompts have no suitable available tool and comprisenon\_existent\_tool\(no tools offered\) andnon\_existent\_tool\_with\_distractor\(one plausible but wrong tool\)\. Missing examples are capability prompts for which a suitable tool exists and should be called\.

#### Formal natural\-rollout labels\.

For each promptxx, we sample responses\{y^x\(r\)\}r=1R\\\{\\hat\{y\}\_\{x\}^\{\(r\)\}\\\}\_\{r=1\}^\{R\}and parse an emitted tool callcx\(r\)c\_\{x\}^\{\(r\)\}when present\. Validity is evaluated only for parseable calls against the reference callcx⋆c\_\{x\}^\{\\star\}:

yval\(r\):=𝟏​\[args⁡\(cx\(r\)\)≢args⁡\(cx⋆\)\]\.y\_\{\\mathrm\{val\}\}^\{\(r\)\}:=\\mathbf\{1\}\\\!\\left\[\\operatorname\{args\}\(c\_\{x\}^\{\(r\)\}\)\\not\\equiv\\operatorname\{args\}\(c\_\{x\}^\{\\star\}\)\\right\]\.\(S1\)For decision failures, the natural label combines tool applicability with the model’s emitted action:

yover\(r\):=𝟏​\[cx\(r\)≠∅∧applicable⁡\(x\)=0\],y\_\{\\mathrm\{over\}\}^\{\(r\)\}:=\\mathbf\{1\}\\\!\\left\[c\_\{x\}^\{\(r\)\}\\neq\\varnothing\\land\\operatorname\{applicable\}\(x\)=0\\right\],\(S2\)ymiss\(r\):=𝟏​\[cx\(r\)=∅∧applicable⁡\(x\)=1\]\.y\_\{\\mathrm\{miss\}\}^\{\(r\)\}:=\\mathbf\{1\}\\\!\\left\[c\_\{x\}^\{\(r\)\}=\\varnothing\\land\\operatorname\{applicable\}\(x\)=1\\right\]\.\(S3\)These labels preserve errors generated by the model itself rather than corrupting a correct reference call\.

#### Stable\-endpoint decision labels\.

The decision readout is taken before generation and is therefore shared by all stochastic rollouts of the same prompt\. We avoid assigning conflicting labels to this shared representation by summarizing theR=8R=8rollout labels at the prompt level\. Forf∈\{over,miss\}f\\in\\\{\\mathrm\{over\},\\mathrm\{miss\}\\\}, let

sf​\(x\):=∑r=1Ryf\(r\)​\(x\)\.s\_\{f\}\(x\):=\\sum\_\{r=1\}^\{R\}y\_\{f\}^\{\(r\)\}\(x\)\.We retain only the two stable endpoints,

yf​\(x\):=\{0,sf​\(x\)=0,1,sf​\(x\)=R,excluded,0<sf​\(x\)<R\.y\_\{f\}\(x\):=\\begin\{cases\}0,&s\_\{f\}\(x\)=0,\\\\ 1,&s\_\{f\}\(x\)=R,\\\\ \\text\{excluded\},&0<s\_\{f\}\(x\)<R\.\\end\{cases\}\(S4\)Thus the decision probes distinguish prompts that consistently produce the correct call/no\-call decision from prompts that consistently exhibit the corresponding failure\. Mixed\-outcome prompts are excluded from decision\-basis construction, probe fitting, and decision\-probe evaluation\. This setup evaluates stable prompt\-level failure propensity rather than stochastic variation among repeated rollouts of one prompt\.

#### Filtering, splitting, and class balance\.

For validity, an AST\- and normalized\-value\-based judge compares argument values with the reference on each parseable generated call\. For over\-calling and missing, the stable label follows the scenario type and whether a call was emitted across all rollouts\. Splits are grouped by prompt so that no prompt appears in multiple splits\. Contribution\-basis construction uses equal\-sized stable failure and stable\-correct development corpora, whereas detector evaluation retains the natural class balance and reports ROC\-AUC and average precision\. Under thinking, we split each response at</think\>and parse only the post\-thinking answer, so a tool mention inside reasoning is never counted as a call; think\-end features are taken strictly before</think\>to avoid leakage\.

Table[S1](https://arxiv.org/html/2608.00218#A1.T1)reports representative over\-calling prompt counts under the unified stable\-endpoint definition\. Retained is the sum of stable\-correct and stable\-failure prompts after mixed outcomes are excluded, andπ\+\\pi\_\{\+\}is the stable\-failure prevalence among retained prompts\.

Table S1:Representative over\-calling stable\-endpoint data audit\. Initial, stable\-correct \(sc\), mixed excluded, and stable\-failure \(sf\) are prompt counts\.The Qwen family produces sufficiently stable decision outcomes on the canonical prompt pool, so this pool is adequate for fitting its detectors; Qwen3\-4B and Qwen3\-14B are shown as representative examples\. For model families such as Llama and Gemma, some target failures occur less frequently as stable endpoints, and we therefore expand the construction pool to obtain enough examples; the Llama row illustrates this case\. This difference affects only detector construction: for each model, the pre\- and post\-intervention results are evaluated on the same fixed held\-out evaluation set\. It therefore cannot explain the reported intervention effects\.

Table[S2](https://arxiv.org/html/2608.00218#A1.T2)reports the size of each contribution basis and the nonzero support retained by its operational detector\. As described above, each basis is estimated from equal\-sized stable\-failure and stable\-correct development corpora\.

Table S2:Contribution\-basis and operational\-detector audit\. Basis is the global3%3\\%union input dimension; support is the exact nonzeroL1L\_\{1\}support of the final operational detector\.Validity is generated fromR=16R=16source prompts and then filtered to parseable calls\. Table[S3](https://arxiv.org/html/2608.00218#A1.T3)reports the original rollout and parseable\-call counts and the final calls retained by the detector assets\. BFCL is omitted from the table because it is excluded from final pooled scoring\.

Table S3:Source\-wise validity filtering audit across all splits\. Invalid counts and prevalence are computed on the final retained calls\.
#### Scope of validity and capability accuracy\.

Validity is evaluated only after a parseable call has been generated\. It does not decide whether a tool should be called, and our experiments do not establish an automatic argument\-repair or regeneration procedure\. Blocking, flagging, or regeneration are possible downstream policies rather than evaluated outcomes\. Capability accuracy measures whether the model recovers a parseable call to the required tool on prompts for which it previously demonstrated the corresponding tool\-use capability\. A call is counted as successful when it invokes the required tool and contains the required argument fields\. CA evaluates recovery of tool invocation and selection; fine\-grained argument correctness is evaluated separately by the validity task\.

### A\.4Prompt\-Only and Reason\-then\-Act Controls

We vary the system prompt style \(guarded, neutral, or directive\) and whether thinking is enabled\. Both are blunt global levers rather than targeted interventions\. Table[S4](https://arxiv.org/html/2608.00218#A1.T4)shows that thinking induces an abstention bias for every prompt style: over\-calling nearly vanishes while missed calls rise\. Prompt wording only shifts the operating point and does not do so monotonically\. The emphatic directive gives the lowest over\-calling, whereas the terse guarded prompt gives the lowest missing rate, because a strong “MUST NOT call” clause carries over to tool\-applicable cases\. No wording escapes this trade\-off, motivating per\-prompt detector gating\. Argument validity is unaffected by decision prompt style because it is evaluated on a separate function\-calling set without that system prompt\.

Table S4:Prompt\-only and Reason\-then\-Act controls \(Qwen3\-4B\): positive rate of each decision signal by prompt style and thinking mode\. Thinking trades over\-calling for missed calls across all styles; no style minimizes both\.
### A\.5Complete Reasoning\-Mode Readout Results

Table[S5](https://arxiv.org/html/2608.00218#A1.T5)reports every Qwen3 reasoning\-mode readout used to summarize migration in the main paper\. Decision features are compared at the prompt end and the reasoning end under thinking; validity is read from the same generated call span under no\-think and thinking\.

Table S5:Complete chain\-of\-thought monitoring results\.*Decisions*report per\-prompt AUC/AP from prompt\-end to think\-end readouts under thinking\.*Validity*reports call\-span AUC from no\-think to thinking\.TaskModelearlierlaterΔ\\Delta*Decision readout: prompt\-end→\\tothink\-end \(AUC / AP\)*Over\-calling1\.7B\.975 / \.9071\.00 / 1\.00\+\.09\+\.094B\.609 / \.083\.789 / \.676\+\.59\\mathbf\{\+\.59\}8B\.927 / \.415\.743 / \.674\+\.26\+\.2614B\.987 / \.6671\.00 / 1\.00\+\.33\+\.33Missing1\.7B\.946 / \.812\.997 / \.991\+\.18\+\.184B\.970 / \.831\.991 / \.948\+\.12\+\.128B\.978 / \.9171\.00 / 1\.00\+\.08\+\.0814B\.972 / \.9331\.00 / 1\.00\+\.07\+\.07*Validity readout: no\-think→\\tothinking \(AUC\), same call span*Validity1\.7B\.889\.913\+\.024\+\.0244B\.886\.934\+\.048\+\.048
### A\.6Intervention Conditions and Controls

LetNNdenote the number of layer–neuron pairs\. We setk=m=⌈0\.03​N⌉k=m=\\lceil 0\.03N\\rceil, retaining the top3%3\\%separately under the failure and correct corpora before taking their union\. Thus,3%3\\%is an experimental setting rather than part of the method definition\. Monitoring uses held\-out ROC\-AUC and AP, with all splits grouped by prompt\.

For closed\-loop intervention, we compare four operating conditions: no steering, unconditional steering on every prompt, detector\-gated steering, and oracle\-gated steering using the ground\-truth failure label\. Oracle gating upper\-bounds the benefit of perfect failure detection\. We report NTA, the erroneous\-call rate when no tool is supplied; DT, the erroneous\-call rate when only an inapplicable distractor is supplied; and capability accuracy on tool\-required prompts\. The main gate figure summarizes the first two with the prompt\-count\-weighted pooled rate

OC=nNTA​rNTA\+nDT​rDTnNTA\+nDT,\\mathrm\{OC\}=\\frac\{n\_\{\\mathrm\{NTA\}\}r\_\{\\mathrm\{NTA\}\}\+n\_\{\\mathrm\{DT\}\}r\_\{\\mathrm\{DT\}\}\}\{n\_\{\\mathrm\{NTA\}\}\+n\_\{\\mathrm\{DT\}\}\},while the tables retain both strata\. This distinguishes targeted correction from a global shift in calling propensity\.

For direction\-level controls, we shuffle correct/failure labels, reconstruct the direction, and repeat the intervention across multiple seeds\. Our matched\-random selection control preserves the selected\-neuron count and per\-layer profile, randomizes neuron identity, constructs directions by the same procedure, and uses the same relative\-α\\alphaschedule and token window\. This is a selection ablation rather than a strict statistical null because randomly selected neurons can still encode the label\-derived class contrast\. We also compare the contribution\-first basis against direct intervention on neurons selected only by probe coefficients\.

For the closed\-loop gate, a*shuffled\-gate*control preserves the intervention rate but permutes which prompts are steered\. A*random\-vector\-in\-real\-gate*control retains the detector’s routing decisions but replaces each correcting direction with a matched random vector\. Together, these controls separate neuron selection, steering direction, and prompt routing\.

Finally, we apply a basic output\-collapse screen to every generation\. It flags a response if its stripped output is empty, or if it contains at least 12 whitespace\-delimited tokens with a unique\-token ratio below\.35\.35\. Intervention strengths that trigger either empty or repetitively collapsed output are excluded from claims about behavioral control\. This screen tests for gross generation failure rather than every possible change in output quality\.

#### What is shared and why\.

The term “shared basis” refers to sharing within a fixed failure mode\. For eachff, the same contribution\-selected set𝒮f\\mathcal\{S\}\_\{f\}restricts the detector feature space and constructs the layerwise intervention directions\. The basis is not one tied set shared across over\-calling, missing, and validity: each failure basis is constructed separately, although the resulting sets may overlap\. Contribution ranking first reduces the all\-layer feature space to𝒮f\\mathcal\{S\}\_\{f\}; the operationalL1L\_\{1\}probe is then fit only inside this reduced space\. This avoids materializing and optimizing each operational detector over the full set of layer–neuron features\.

#### Three distinct neuron counts\.

Three quantities serve different purposes and should not be conflated\. The smallest unconstrained sparse support measures the readable signal’s sparsity limit \(11–22neurons for missing,22–1616for over\-calling, and approximately128128for validity\)\. The operational detector uses a contribution\-restricted input and retains only its nonzero support at inference, typically tens of features for decision failures and several hundred for validity\. Steering deliberately uses the broader3%3\\%contribution basis, containing thousands of neurons, to construct stable layerwise directions\. The “few\-neuron” result therefore characterizes sparse monitoring; it does not claim that every steering direction is constructed from only one or two neurons\.

#### Validity detector operating points\.

For Qwen3\-4B validity, the full contribution basis contains 11,126 candidate features, and the fitted full\-basis detector retains 330 nonzero coefficients while reaching0\.8860\.886AUC\. TheK=4K\{=\}4budget contains 152 candidate features and reaches0\.8410\.841AUC\. The approximately 150\-feature count and the0\.8860\.886AUC therefore correspond to different operating points\. Using the full\-basis operational support, the detector uses23×23\\timesfewer features than the 7,680\-dimensional Healy baseline and279×279\\timesfewer features than the 92,160\-dimensionalWhen2Toolbaseline\. Using operational supports consistently, the reduction range across the main comparison table is2323–627×627\\times\.

#### Scope of the overlap diagnostic\.

The overlap analysis in the main paper was computed using the fixed six\-layer feature space retained from an earlier experimental configuration\. These layers define the reported common universe of6×9,728=58,3686\\times 9\{,\}728=58\{,\}368layer–neuron pairs\. We retain that table as a restricted diagnostic and report a complete\-space audit below\. The six\-layer result also replicates qualitatively across solver seeds: pairwise top\-100 overlaps remain between zero and three, at or below a layer\-profile\-matched null, and the three\-way intersection remains empty\. Exact feature identities and exact\-zero counts should nevertheless not be interpreted as seed\-invariant\. The main text therefore identifies this explicitly as a restricted six\-layer diagnostic rather than an all\-layer independence result\.

#### All\-Layer Overlap Reveals a Small, Configuration\-Sensitive Shared Component\.

We extend the same\|L1​coefficient\|\|L\_\{1\}\\text\{ coefficient\}\|ranking to the complete Qwen3\-4B MLP feature space of36×9,728=350,20836\\times 9\{,\}728=350\{,\}208layer–neuron features\. Fits and rankings use the training split only\. The null independently randomizes neuron identity within each layer while exactly preserving each signal’s selected count in that layer \(10,00010\{,\}000draws\)\. Full\-space probe performance remains strong: over\-calling, missing, and validity reach AUC\.974\.974,1\.0001\.000, and\.869\.869, respectively, at the headlineC=\.5C=\.5setting\.

Table S6:All\-layer sparse\-readout overlap for Qwen3\-4B atC=\.5C=\.5\. Sets are ranked by absoluteL1L\_\{1\}coefficient\. The hypergeometric expectation is\|A\|​\|B\|/N\|A\|\|B\|/N; the layer\-matched null preserves both sets’ per\-layer profiles\. Sizes belowKKreflect the number of nonzero coefficients\.The complete\-space audit preserves the magnitude\-level separation conclusion but refines the null\-relative conclusion\. Pairwise Jaccard similarity never exceeds\.0153\.0153, and no pair shares more than eight selected features\. Nevertheless, seven of the twelve pairwise cells lie strictly above the layer\-matched 95% interval, eight have an uncorrected one\-sided empiricalp<\.05p<\.05, and one feature appears in all three sets at every budget\. We therefore describe these sparse readouts as largely failure\-specific, not literally disjoint\. These permutation results are a descriptive robustness audit rather than a familywise\-corrected significance test\.

The shared component is configuration\-sensitive\. With stronger regularization \(C=\.05C=\.05\), the test AUCs remain\.976\.976,1\.0001\.000, and\.881\.881, yet no pairwise cell exceeds its matched null and the three\-way intersection is empty at every budget\. Changing only theC=\.5C=\.5solver seed produces similar small overlap counts but different shared identities\. Across those two fits, only12%12\\%,36%36\\%, and61%61\\%of the over\-calling, missing, and validity top\-100 sets reproduce, respectively\. Thus the count\-level pattern is more reproducible than any particular shared neuron\.

Where decision features overlap in the headline fit, over\-calling and missing read them with opposite polarity\. This is consistent with a general tool\-invocation\-versus\-abstention signal whose opposite deviations contribute to the two decision failures, while the much larger nonoverlapping periphery may reflect failure\-specific information\. The set overlap and coefficient signs alone do not establish a unified geometric axis\. The all\-layer depth profile supports the more limited conclusion that decision information is late: only16%16\\%and10%10\\%of the over\-calling and missing top\-100 features fall in the original six\-layer window, while29%29\\%and70%70\\%lie in layers 28–35\. For validity, the corresponding fractions are15%15\\%and18%18\\%\.

Table S7:Ranking sensitivity atK=100K=100\. Entries in the overlap column are over\-call–missing / over\-call–validity / missing–validity\. “Above” counts pairwise cells above the layer\-matched 95% interval across all fourKKbudgets\.The ranking comparison distinguishes sparse failure readout from the contribution rankings used to construct the broader operational basis\. RawcHc^\{H\}, used to identify neurons with large failure\-corpus residual writes, has substantial cross\-signal overlap; within a signal it correlates\.946\.946with its correct\-corpus counterpartcBc^\{B\}\. It therefore primarily captures a shared contribution\-magnitude scaffold and should not itself be read as a failure\-specific coding score\. Contrastive contribution rankings also exceed the matched null, although much of their support remains nonoverlapping\. Restricted\-space contribution checks show the same ranking dependence, so it is not created by expanding from six to 36 layers\. These results do not alter the role of each separately constructed failure basis in the controller; they delimit what cross\-failure circuit specificity can be inferred from feature\-set overlap alone\.

#### Online gating and intervention implementation\.

Basis selection scores the unsigned magnitude of each neuron’s residual write, while detector features preserve the sign of the SwiGLU activation at the input tomlp\.down\_proj\. At each selected layer, the unit direction is scaled by

γ\(ℓ\):=𝔼\(x,t\)∈𝒟dev​\[‖MLP\(ℓ\)⁡\(ht\(ℓ\)​\(x\)\)‖2\],\\gamma^\{\(\\ell\)\}:=\\mathbb\{E\}\_\{\(x,t\)\\in\\mathcal\{D\}\_\{\\mathrm\{dev\}\}\}\\left\[\\left\\\|\\operatorname\{MLP\}^\{\(\\ell\)\}\(h\_\{t\}^\{\(\\ell\)\}\(x\)\)\\right\\\|\_\{2\}\\right\],computed at the relevant readout positions on development data, and then by the relative strengthα\\alpha\. The update is added to the output ofmlp\.down\_proj, before the MLP branch joins the residual stream\. It is applied at the final prompt token and the first five generated tokens at every layer with a nonempty selected set\.

The experimental controller first performs prompt scoring and then a hooked generation pass\. Because the decision readout precedes generation, a deployment implementation may combine these operations while reusing the prompt cache\. Over\-calling is checked first; the missing branch is checked only if the over\-calling detector does not fire\. Under thinking, the decision score is read immediately before</think\>\.

#### Scope of the causal claim\.

Our interventions establish causal control at the level of directions constructed from contribution\-selected neuron writes: adding these directions changes subsequent tool\-call behavior, while matched\-random, label\-shuffled, and probe\-selected controls do not reproduce the same effect\. We do not claim that every selected neuron is individually necessary, that the sparse detector support alone is the model’s native causal circuit, or that decodability by itself establishes causal mediation\.

### A\.7Calibration Sensitivity and Detector Conflicts

Detector fitting and basis construction use training prompts only\. We evaluate detector thresholdsτ∈\{\.3,\.5,\.7,\.9\}\\tau\\in\\\{\.3,\.5,\.7,\.9\\\}on prompt\-disjoint validation and test splits atαdown=αup=\.2\\alpha\_\{\\rm down\}=\\alpha\_\{\\rm up\}=\.2\. This common setting was chosen using the validation\-only operating\-point protocol described in the main paper and was then locked across all six models\. The evaluated suppression and elicitation grids are\{\.05,\.1,\.2\}\\\{\.05,\.1,\.2\\\}and\{\.1,\.2\}\\\{\.1,\.2\\\}, respectively; the neighboring grid points are reported only as sensitivity checks rather than as model\-specific operating points or test\-set reselection\. No model\-specific strength cap or generation safeguard was used\.

The implementation checks suppression first if both detectors fire\. We audit the number and rate of such events on held\-out prompts and report whether this implementation choice affects any output\.

#### Qwen3\-4B threshold sensitivity\.

Table[S8](https://arxiv.org/html/2608.00218#A1.T8)reports the sensitivity of the Qwen3\-4B controller to the detector threshold\. Performance is stable forτ∈\{\.3,\.5,\.7\}\\tau\\in\\\{\.3,\.5,\.7\\\}\. The lockedτ=\.7\\tau=\.7point retains the highest observed test CA while intervening less often thanτ=\.3\\tau=\.3or\.5\.5; atτ=\.9\\tau=\.9, uncorrected over\-calling rises substantially\. Every routed condition has zero empty outputs and zero repetition flags\. The same serialized fitted detector objects are used on validation and test\. Suppression and elicitation IRs are the mutually exclusive actions after suppression\-priority routing;*both*counts raw detector co\-firing before routing\.

Table S8:Qwen3\-4B failure\-specific threshold sensitivity at locked relative strength\.2/\.2\.2/\.2\. IR is intervention rate; OC is pooled over\-calling; CA is capability accuracy\. The sweep is reported as a sensitivity audit, not as test\-set threshold selection\.
#### Qwen3\-4B dual\-fire audit\.

At the lockedτ=\.7\\tau=\.7point, neither validation nor test contains a dual fire\. Consequently, suppression priority, missing priority, and no\-steering\-on\-conflict are empirically equivalent on these streams; no additional conflict generation is required\.

Table S9:Qwen3\-4B detector firing on the 222\-prompt test stream atτover=τmiss=\.7\\tau\_\{\\rm over\}=\\tau\_\{\\rm miss\}=\.7\.

### A\.8Complete Six\-Model Sparsity Results

Table[S10](https://arxiv.org/html/2608.00218#A1.T10)expands the representative main\-paper table to all six evaluated models\. Decision AUC is per prompt; validity AUC is per rollout\. Full\-basis cells report AUC, the exact selected\-feature count and its percentage of the complete all\-layer MLP feature space, and the final detector’s nonzero support\. Other cells report AUC and the actual union count\.

Table S10:Complete detection AUC as the unified\-basis budget shrinks\.KKis the per\-layer\-equivalent budget applied separately to the error and correct rankings, so their union need not equalKKtimes the number of layers\. Full\-basis cells contain three lines: AUC; basis size \(all\-layer percentage\); and nonzero support \(*sup\.*\)\.
### A\.9Complete Gated\-Intervention Results

Table[S11](https://arxiv.org/html/2608.00218#A1.T11)decomposes the pooled over\-call metric used in the main figure\. All six models use the same validation\-chosen and subsequently lockedαdown=αup=\.2\\alpha\_\{\\rm down\}=\\alpha\_\{\\rm up\}=\.2protocol setting\. The neighboring suppression and elicitation grid points are reported only as supplementary sensitivity checks\.

#### Qwen3\-4B gate decomposition\.

Panel \(c\) of Table[S11](https://arxiv.org/html/2608.00218#A1.T11)compares all controller components on the same88/89/4588/89/45NTA/DT/capability prompts\. Unconditional suppression and elicitation are separate because a single prompt cannot receive both signs without a routing rule\. The oracle row routes baseline over\-calling errors to the saved unconditional\-down output and baseline missing errors to the saved unconditional\-up output\. Since generation is greedy and the hook is row\-independent, this cache composition is equivalent to an oracle\-routed pass at the same strength\.

Table S11:Complete bidirectional gate results and controller decomposition\. Panels \(a–b\) report all six models; NTA and DT are the two over\-calling strata; OC is their prompt\-count\-weighted pooled rate\. CA is capability accuracy\. Shuffled preserves intervention rate but changes prompt timing; randomddpreserves the real gate but replaces the intervention direction\. Panel \(c\) decomposes the Qwen3\-4B controller at relative strength\.2\.2; IR is the fraction of the 222 prompts edited, and collapse is the maximum rate under the empty\-output and repetitive\-output checks\.\(a\) Qwen3\-1\.7B, 4B, and 8B

\(b\) Qwen3\-14B, Llama\-3\.1\-8B, and Gemma\-3\-4B

\(c\) Qwen3\-4B controller decomposition

## Appendix BAdditional Reproducibility Details

The code and processed natural\-rollout datasets used in this work will be released publicly upon publication under a license permitting research use\. This section records the settings needed to reconstruct the sparse detectors and intervention pipeline\.

### B\.1Hyperparameter Search Space and Selection

#### Generation and rollout parameters\.

Decision datasets useR=8R=8stochastic rollouts per prompt and validity usesR=16R=16, with temperature0\.70\.7and each checkpoint’s native chat template\. Qwen3 thinking\-mode experiments use the model’s native thinking configuration; all other primary results use no\-think generation\. Rollout generation uses top\-p=\.95p=\.95and at most512512new tokens\. Intervention evaluation is greedy and uses at most128128new tokens\. The checkpoint identifiers areQwen/Qwen3\-\{1\.7B,4B,8B,14B\},meta\-llama/Llama\-3\.1\-8B\-Instruct, andgoogle/gemma\-3\-4b\-it\.

#### Contribution\-basis construction\.

ForNNlayer–neuron pairs, we usek=m=⌈\.03​N⌉k=m=\\lceil\.03N\\rceiland take the union of the globally top\-ranked failure and stable\-correct contributions\. The ranking uses\|ai\(ℓ\)\|​‖vi\(ℓ\)‖2\|a\_\{i\}^\{\(\\ell\)\}\|\\\|v\_\{i\}^\{\(\\ell\)\}\\\|\_\{2\}, whereai\(ℓ\)a\_\{i\}^\{\(\\ell\)\}is the signed SwiGLU gated product at the input tomlp\.down\_projandvi\(ℓ\)v\_\{i\}^\{\(\\ell\)\}is the corresponding down\-projection column\. There is no per\-layer quota\. Restricted top\-KKprobes refit their regularization on validation data; the reported sufficient size is the smallestKKsatisfyingAUCK≥\.95​AUCfull\\mathrm\{AUC\}\_\{K\}\\geq\.95\\,\\mathrm\{AUC\}\_\{\\mathrm\{full\}\}\. The complete sweep isK∈\{1,2,4,8,16,32,64,128,256,512\}K\\in\\\{1,2,4,8,16,32,64,128,256,512\\\}, in addition to the full3%3\\%basis\. The locked3%3\\%setting is used in the final cross\-model tables\. Signed CETT divides bymax⁡\(‖MLPout\(ℓ\)‖2,10−6\)\\max\(\\\|\\mathrm\{MLP\}^\{\(\\ell\)\}\_\{\\rm out\}\\\|\_\{2\},10^\{\-6\}\)\. Direction normalization separately uses a10−810^\{\-8\}norm floor\.

#### Probe fitting\.

The operational detector is anL1L\_\{1\}\-regularized logistic regression fit on signed, layer\-normalized features inside the selected basis\. Hyperparameters are selected using training and validation data only, and the held\-out test set is evaluated once after freezing the configuration\. Each feature is standardized with aStandardScalerfit on the training split\. The classifier uses theliblinearsolver, balanced class weights, andC∈\{\.01,\.03,\.1,\.3\}C\\in\\\{\.01,\.03,\.1,\.3\\\}\. Candidate values are selected using validation ROC–AUC and thresholded F1\. Reported support counts the nonzero fitted coefficients\.

The matched dense residual baseline uses standardized features and anL2L\_\{2\}logistic regression withC∈\{\.01,\.1,1\}C\\in\\\{\.01,\.1,1\\\}\. The all\-layerWhen2Toolreproduction uses the published classifier configuration\.

#### Steering and gate calibration\.

Directions are injected at the output ofmlp\.down\_projfor the final prompt token and first five generated tokens\. The common closed\-loop operating point isτover=τmiss=\.7\\tau\_\{\\rm over\}=\\tau\_\{\\rm miss\}=\.7andαover=αmiss=\.2\\alpha\_\{\\rm over\}=\\alpha\_\{\\rm miss\}=\.2in the submitted protocol\. The threshold audit uses\{\.3,\.5,\.7,\.9\}\\\{\.3,\.5,\.7,\.9\\\}\. Across the six\-model closed\-loop sweeps, the suppression grid isαdown∈\{\.05,\.1,\.2\}\\alpha\_\{\\rm down\}\\in\\\{\.05,\.1,\.2\\\}and the elicitation grid isαup∈\{\.1,\.2\}\\alpha\_\{\\rm up\}\\in\\\{\.1,\.2\\\}\. The commonαdown=αup=\.2\\alpha\_\{\\rm down\}=\\alpha\_\{\\rm up\}=\.2setting was chosen using the validation\-only operating\-point protocol described in the main paper and was then locked across all six models\. The neighboring grid points are reported only as sensitivity checks rather than as model\-specific operating points or test\-set reselection\. Over\-calling is checked first if both detectors fire\. The basic output\-collapse screen flags stripped empty responses and responses of at least 12 whitespace\-delimited tokens whose unique\-token ratio is below\.35\.35\. No retry, fallback, or additional model\-specific generation safeguard was found in the audited implementation\.

### B\.2Randomness and Repeated Controls

Train, validation, and test splits are grouped by prompt and are fixed before model fitting\. Model rollouts are stochastic; contribution ranking and deterministic probe fitting introduce no additional randomness once their inputs and solver state are fixed\. Randomized controls independently resample the relevant component while preserving the comparison’s remaining structure: matched\-random neuron selection preserves the selected count and per\-layer profile, random directions are renormalized and use the same layer scales, label shuffling reconstructs the direction after permuting labels, and gate shuffling preserves the intervention count\.

#### Repeated randomized controls\.

Prompt splits are fixed before fitting\. Primary detector and steering results use one frozen split and one evaluation pass\. Matched\-random detection uses five draws in the main tables and ten draws in the representative Qwen3\-4B audit\. The representative matched\-random steering audit uses five draws\. Label\-shuffle audits use 20 permutations, except for the explicitly stated three\-run resource\-limited cases\. Shuffled\-gate and random\-vector rows are single control draws rather than stability intervals\.

#### Representative resampling audit\.

To keep the robustness analysis computationally focused, we use Qwen3\-4B as the representative model for additional random\-basis and matched\-random\-direction resampling\. The six\-model tables retain the originally reported fixed\-split results\. Table[S12](https://arxiv.org/html/2608.00218#A2.T12)reports the five draws originally saved together with five additional independently resampled draws\. The table reports population standard deviations and ranges across all ten draws for both AUC and AP\. Table[S13](https://arxiv.org/html/2608.00218#A2.T13)separately reports five matched\-random steering draws\.

Table S12:Qwen3\-4B layer\-profile\-matched random\-subset stability over ten draws\. Standard deviations are population standard deviations; brackets give the draw\-wise minimum and maximum\.Table S13:Mean±\\pmpopulation standard deviation for Qwen3\-4B unconditional matched\-random\-basis suppression over five draws at relativeα=\.2\\alpha=\.2\. Every run edits all 222 prompts using 13,440 neurons while preserving the real basis’s layer profile\. Empty and Rep\. are the implemented empty\-output and repetition proxies; Malf\. is malformed\-call rate\.The random\-basis detection audit is stable at the full budget: over\-calling remains at\.9938±\.0009\.9938\\pm\.0009AUC, missing is perfect, and validity reaches\.8739±\.0052\.8739\\pm\.0052\. Validity is more sensitive at the one\-neuron\-per\-layer\-equivalent budget \(\.7476±\.0287\.7476\\pm\.0287\)\. Matched\-random steering, however, varies substantially across draws \(OC standard deviation\.1221\.1221and CA standard deviation\.0896\.0896\)\. This control preserves the real basis’s per\-layer allocation, so it retains coarse information about which layers are emphasized, and randomly sampled neurons in those layers can still carry part of the relevant signal\. Nevertheless, its mean residual OC is\.1672\.1672, compared with\.006\.006for the contribution\-selected unconditional suppress direction\. The detector\-gated contribution\-selected controller further attains OC\.034\.034with CA\.911\.911\. Thus, matched\-random directions can be behaviorally active but are substantially less effective and much less reliable than the systematically constructed direction\. Empty\-output and repetition rates remain zero, while malformed calls average\.0162±\.0199\.0162\\pm\.0199\.

### B\.3Software Environment

The recorded environment uses Python 3\.12\.13, PyTorch 2\.8\.0 with CUDA 12\.8, Transformers 4\.56\.1, scikit\-learn 1\.8\.0, NumPy 2\.2\.6, Accelerate 1\.13\.0, and vLLM 0\.11\.0\. Model forward passes use bfloat16\.

### B\.4Runs, Uncertainty, and Statistical Tests

Detection AUC and AP use prompt as the evaluation unit for decision failures and retained generated calls for validity\. The primary six\-model tables report the frozen train/validation/test split rather than treating repeated rollouts of one prompt as independent decision examples\. Additional random\-basis variation is reported only for the representative Qwen3\-4B audit described above\.

For the pairedWhen2Toolsuppression analysis, we use two\-sided exact McNemar tests on examples whose baseline call is suppressed; the corresponding sample sizes andppvalues appear in Table[S19](https://arxiv.org/html/2608.00218#A3.T19)\. Random\-direction, label\-shuffle, and gate\-shuffle experiments are control interventions rather than substitutes for uncertainty over the full model population\.

#### Run and uncertainty inventory\.

Each real detection cell is one selected fit on one fixed split\. Each real direct\-steering or gated\-steering condition is one greedy generation pass over the fixed prompt stream\. Repeated randomized controls report the number of draws stated above\. No prompt\-bootstrap confidence intervals or multiple\-comparison correction are reported for the primary six\-model tables\.

### B\.5Computational Cost and Detector\-Side Overhead

Contribution selection reduces the feature space before fitting the operational detector, and the fitted linear heads retain sparse nonzero supports\. The current prototype gathers the selected contribution bases before applying these sparse heads, so the timing reported below includes this feature\-gather cost\. These reductions do not imply an equal\-factor reduction in the cost of the underlying language\-model forward pass\. For Qwen3\-4B, the all\-layer space contains350,208350\{,\}208MLP features\. The over\-calling, missing, and validity bases contain13,44013\{,\}440,15,73615\{,\}736, and11,12611\{,\}126features, respectively; their final operational supports contain5151,2929, and330330nonzero coefficients\. These counts describe detector\-side reduction rather than end\-to\-end language\-model acceleration\.

In a representative Qwen3\-4B component\-level benchmark, the sparse detector head requires approximately1\.61\.6ms per prompt, or0\.25%0\.25\\%of the corresponding unsteered generation time\. Applying the gated steering vectors through the current prototype hooks adds approximately141141ms per prompt \(a median overhead of21\.6%21\.6\\%\) relative to unsteered generation, without a measurable increase in peak allocated memory\. The latter figure includes overhead from the current unfused hook implementation and should not be interpreted as the cost of the vector addition alone\. These component\-level timings exclude the language\-model forward pass used to obtain detector features and therefore do not represent end\-to\-end controller latency\.

#### AI Use Declaration\.

Generative AI tools were used for minor language polishing, manuscript organization, andLaTeXpreparation\. The authors verified all technical content, experimental results, and references\.

## Appendix CDetailed Comparison and Transfer onWhen2Tool

### C\.1Matched Detector Comparison

When2Toolreads last\-input\-token residual states with anL2L\_\{2\}\-regularized linear probe\(Sunet al\.[2026](https://arxiv.org/html/2608.00218#bib.bib10)\)\. We first compare detectors using its original prompt wrapper, the same900/2,250900/2\{,\}250train/test split, and identical necessity labels and scorer\. Our sparse CETT probe reaches0\.9340\.934pooled AUROC with151151nonzero inputs, versus0\.8800\.880for the94,72094\{,\}720\-dimensional dense probe, and leads at every difficulty \(Table[S14](https://arxiv.org/html/2608.00218#A3.T14)\)\. The dense probe nearly saturates training AUROC \(0\.99980\.9998\), whereas the sparse probe generalizes better from the same900900training prompts\.

Table S14:Matched necessity detection onWhen2Tool’s original prompt wrapper \(Qwen3\-4B\)\. Both probes use the same900/2,250900/2\{,\}250split, labels, and scorer\.The ordering is robust to prompt format\. Under our wrapper, the sparse and dense probes reach0\.9370\.937and0\.8680\.868, respectively, with gains at every difficulty\. Thus the difference is not explained by either labels or prompt formatting\. This comparison is limited to the faithfully reproduced benchmark and does not imply that dense residual probes are uniformly weak\.

### C\.2Replacing the Gate while Retaining Textual Prefill

To isolate detector quality from the intervention mechanism, we retainWhen2Tool’s textual\-prefill actuator and replace only its dense probability estimate with our sparse detector\. At matched average tool\-call rates, the sparse gate raises robust accuracy by1\.71\.7–2\.22\.2points throughout the evaluated frontier \(Table[S15](https://arxiv.org/html/2608.00218#A3.T15)\)\. This controlled swap shows that detection quality is a practical bottleneck even when the original actuator is left unchanged\.

Table S15:Gate substitution with the textual\-prefill actuator fixed\. Cells report robust accuracy at matched average tool calls on the750750\-prompt stratified subset\.
### C\.3Cross\-Corpus Transfer of the Steering Direction

We next test whether the actuator itself transfers\. A suppress direction estimated on our natural over\-calling corpus is applied toWhen2Toolwithout refitting\. The source corpus defines failure as calling a nonexistent tool, whereasWhen2Toollabels benchmark\-level unnecessary calls\. Despite this mismatch, the transferred direction lowers the misuse rate by18\.518\.5points relative to its layer\-profile\-matched random direction atα=\.4\\alpha=\.4, with no observed degeneration \(Table[S16](https://arxiv.org/html/2608.00218#A3.T16)\)\. A direction estimated locally onWhen2Toolis also specific but weaker at the same dose\.

Table S16:Suppress\-direction transfer atα=\.4\\alpha=\.4\. “Random” uses a matched random direction; gap is real minus random\. Accuracy uses the robust scorer\.At comparable accuracy cost, the local and transferred directions reach similar points: localα=\.5\\alpha=\.5gives a19\.719\.7\-point net reduction for a4\.14\.1\-point accuracy decrease, while transferredα=\.4\\alpha=\.4gives an18\.518\.5\-point reduction for a3\.83\.8\-point decrease\. We therefore interpret this result as cross\-corpus transfer of a tool\-calling tendency, not evidence for a universal tool\-use direction\.

### C\.4Intervention Frontier and Causal Controls

Table[S17](https://arxiv.org/html/2608.00218#A3.T17)reports the complete effect–cost frontier for the local per\-layer direction\. The real direction separates increasingly from the matched random control throughα=\.6\\alpha=\.6without degeneration; stronger intervention reveals a degeneration cliff\. Forα≤\.4\\alpha\\leq\.4, accuracy on tool\-required prompts remains exactly at the baseline value \(0\.8080\.808\), so the low\-dose effect does not spill into the need side\.

Table S17:Per\-layer suppress\-direction frontier\. Net is real minus matched random misuse\. Degeneration is measured among touched prompts\.The routing controls separate*when*from*how*\(Table[S18](https://arxiv.org/html/2608.00218#A3.T18)\)\. A random direction under the real gate is inert, whereas shuffling the gate weakens suppression, damages need\-side coverage, and introduces degeneration\. Thus the direction supplies behavioral leverage and the detector supplies selectivity\.

Table S18:Causal controls atα=\.6\\alpha=\.6\(per\-layer direction\)\.Per\-layer selection is also materially safer than global selection on this benchmark\. The global rule concentrates55\.5%55\.5\\%of its budget in the final five layers, becomes indistinguishable from its random control at high dose, and degenerates one step earlier\. The per\-layer rule keeps its random control flat and preserves a specific effect\. The concentration pattern is a plausible explanation, but we do not claim it as a separately identified mechanism\.

### C\.5Benchmark\-Dependent Accuracy Trade\-Off

When2Tool’s necessity labels are task\-level and model\-independent, whereas whether a tool helps can depend on model capability\. On paired prompts that the baseline calls but an intervention suppresses, answering without the tool significantly reduces robust accuracy under both steering and prefill \(Table[S19](https://arxiv.org/html/2608.00218#A3.T19)\)\. This explains why all call\-suppression methods face a nontrivial accuracy cost in this Qwen3\-4B evaluation\.

Table S19:Paired accuracy on examples labeled unnecessary whose baseline call is suppressed\. Exact McNemar tests are two\-sided\.
### C\.6Scoring Protocol and Scope

All intervention accuracies above use a robust answer extractor: after removing any control prefix, it checks boxed answers, “answer is” constructions, the final nonempty line, and a final literal throughWhen2Tool’s value comparator\. The original exact whole\-response fallback penalizes explanatory answers induced by textual prefill and also changes baseline scores\. Manual inspection of all6868baseline corrections found them to be genuine formatting\-equivalent answers\. We therefore exclude strict\-extraction accuracy from all claims\.

We also determine the steering sign from the semantic roles of the source corpora: the correct\-minus\-failure direction suppresses calling when the correct side abstains\. All reported intervention results use this corrected convention; exploratory runs with the opposite sign are excluded\. The transfer and frontier analyses are currently limited to Qwen3\-4B and one external benchmark, and a two\-tailed prefill prototype is excluded because it does not match the suppress\-only touched set\.

### C\.7Comparison with a Prior Validity Detector

For the internal\-representation validity detector ofHealyet al\.\([2026](https://arxiv.org/html/2608.00218#bib.bib9)\), per\-source comparisons are more informative than the pooled score because source prevalence is heterogeneous\. We outperform the reproduced recipe on Glaive \(0\.9050\.905vs\.0\.8690\.869\) but trail it on xLAM \(0\.8170\.817vs\.0\.8630\.863\) and ToolACE \(0\.8230\.823vs\.0\.8460\.846\)\. Running their detector unchanged on our natural rollout\-error labels raises its AUROC from their reported0\.7210\.721on mask\-and\-replace labels to0\.8560\.856\. This cross\-paper gap also includes a model change; the controlled claim is therefore the per\-source comparison above\.

## Appendix DExtended Related Work

#### Tool use and function calling in LLMs\.

Function\-calling research has largely focused on improving and behaviorally evaluating whether models select the right API and generate valid arguments\. BFCL introduced AST\- and execution\-based evaluation across simple, parallel, and relevance\-detection settings\(Patilet al\.[2025](https://arxiv.org/html/2608.00218#bib.bib1)\); ToolACE and xLAM developed scalable data pipelines and specialized models for these tasks\(Liuet al\.[2025](https://arxiv.org/html/2608.00218#bib.bib2); Zhanget al\.[2025](https://arxiv.org/html/2608.00218#bib.bib3)\), while Glaive released a public function\-calling corpus\(Glaive AI[2024](https://arxiv.org/html/2608.00218#bib.bib4)\)\. Reliability\-oriented work further distinguishes tool\-selection from tool\-usage hallucinations and trains models to defer or seek clarification\(Xuet al\.[2025](https://arxiv.org/html/2608.00218#bib.bib5)\)\. Most recently,Yinet al\.\([2026](https://arxiv.org/html/2608.00218#bib.bib6)\)show that stronger explicit reasoning can amplify tool hallucination, while KATE improves multi\-step execution by integrating experiential knowledge across inference and post\-training\(Haoet al\.[2026](https://arxiv.org/html/2608.00218#bib.bib7)\)\. These studies measure or train observable tool behavior; we instead ask where naturally occurring validity, over\-calling, and missing failures are represented and whether those representations are causally controllable\.

#### Probing internal representations\.

Linear probes have shown that hidden states encode information about truthfulness even when model outputs are wrong\(Azaria and Mitchell[2023](https://arxiv.org/html/2608.00218#bib.bib8)\)\. This idea has recently reached tool\-using agents\. Dense residual\-stream features can detect incorrect tool selection and malformed parameters\(Healyet al\.[2026](https://arxiv.org/html/2608.00218#bib.bib9)\), and tool necessity is decodable before generation\(Sunet al\.[2026](https://arxiv.org/html/2608.00218#bib.bib10)\)\. Concurrent work also finds that tool identity is linearly readable and steerable across model families\(Wuet al\.[2026](https://arxiv.org/html/2608.00218#bib.bib13)\)\. A complementary model\-adaptive analysis separates a model’s internal judgment of tool necessity from its executed action and finds that the two probe directions become nearly orthogonal at the late\-layer readout\(Chenget al\.[2026](https://arxiv.org/html/2608.00218#bib.bib14)\)\. We extend this line from dense, task\-level representations to signed activations of individual MLP neurons, distinguish three failure modes at their appropriate readout locations, and quantify both layer locality and the minimum sufficient support\.

#### Sparse neurons and contribution\-based localization\.

Our selection score is related to Wanda’s activation\-weight criterion for identifying consequential parameters\(Sunet al\.[2024](https://arxiv.org/html/2608.00218#bib.bib15)\), but we rank raw MLP neurons globally across layers to construct a behavioral intervention basis\. This grouped use of WANDA also connects to safety attribution, where it has identified sparse safety\-critical regions whose removal breaks refusal behavior\(Weiet al\.[2024](https://arxiv.org/html/2608.00218#bib.bib17)\)\. Sparse neuron\-level mechanisms have been reported for factual hallucination: H\-Neurons use fewer than0\.1%0\.1\\%of neurons to predict hallucinations and link them causally to over\-compliance\(Gaoet al\.[2025](https://arxiv.org/html/2608.00218#bib.bib18)\)\. In safety, manipulating knowledge neurons controls refusal and motivates neuron\-specific SafeTuning\(Zhaoet al\.[2026](https://arxiv.org/html/2608.00218#bib.bib19)\), while single\-neuron interventions can bypass refusal alignment\(Kazemiet al\.[2026](https://arxiv.org/html/2608.00218#bib.bib20)\)\. These results establish fine\-grained localization for factuality and safety; our focus is tool\-use reliability and a single contribution\-selected basis shared by monitoring and intervention\.

#### Activation steering and causal intervention\.

Representation engineering and activation addition control high\-level behavior by shifting internal states at inference time\(Zouet al\.[2023](https://arxiv.org/html/2608.00218#bib.bib23); Turneret al\.[2023](https://arxiv.org/html/2608.00218#bib.bib22)\); ITI learns sparse attention\-head directions that improve truthfulness\(Liet al\.[2023](https://arxiv.org/html/2608.00218#bib.bib21)\)\. Agent\-specific extensions steer residual states to reduce overthinking and overacting\(Suiet al\.[2026](https://arxiv.org/html/2608.00218#bib.bib24)\), while ASA uses router\-conditioned, probe\-gated activation steering for training\-free tool\-domain adaptation\(Wanget al\.[2026](https://arxiv.org/html/2608.00218#bib.bib25)\)\. Very recent work demonstrates bidirectional control of tool invocation from heading\-position steering vectors, while also finding that tool\-use geometry is diffuse and tool\-dependent\(Chenet al\.[2026](https://arxiv.org/html/2608.00218#bib.bib26)\)\. In contrast to unconditional or task\-wide steering,PRISMSconstructs an independent direction at each selected layer from the same neuron basis used for detection, separates over\-calling from missing, and gates each direction with its corresponding sparse failure detector\.