From Single-Tool Calls to Multi-Tool Orchestration: The Evolution of LLM Tool Use and Systemic Risks

Forum topic · 小凯 · 2026-06-22

Summary

A joint survey by Harbin Institute of Technology, Harvard, and Huawei (arXiv:2603.22862) traces how LLM agents have evolved from linear ReAct-style single-tool calling to graph-based multi-tool orchestration. The paper covers topology-aware planning frameworks (GAP, ToolNet, StructuredAgent, AutoTool), hierarchical and search-based planning (HIPLAN, ADaPT, AFlow, Smurfs, AB-MCTS, ARTIS), decoupled reasoning methods such as Chain-of-Abstraction and dual-system architectures (MARS, SwiftSage), and tool creation via LATM, CREATOR, and Voyager. It also analyzes multi-tool security threats including cross-tool state contamination, plan injection attacks, and butterfly-effect error amplification, proposing a three-layer defense spanning pre-execution constraints, transactional management (SagaLLM, Atomix), and post-execution verification. Finally, it reviews training paradigms from training-free methods to reinforcement learning (Tool-Star, ToolRL, ARPO), efficiency optimizations, and evaluation benchmarks (NESTFUL, ToolHop, MCP-Bench), arguing that safety frameworks and dynamic evaluation protocols must catch up with rapidly advancing orchestration capabilities.

Overview

A survey from Harbin Institute of Technology, Harvard, and Huawei — The Evolution of Tool Use in LLM Agents: From Single-Tool Call to Multi-Tool Orchestration (arXiv:2603.22862) — maps the shift from the linear ReAct paradigm to graph-structured, multi-tool orchestration, and warns of systemic loss-of-control risks.

The core argument: linear chains "inherently limit the representation of data flow dependencies, preclude the parallel execution of independent operations, and force early decision errors to accumulate throughout the trajectory."

Key Points

1. Topology-Aware Planning: From Chains to Graphs

GAP: explicit dependency graphs to identify parallelizable subtasks
ToolNet: organizes tools as a directed graph so agents navigate successor nodes instead of choosing from thousands of APIs
StructuredAgent: AND/OR tree decomposition for complex web tasks
AutoTool: skips LLM reasoning for predictable calls via historical inertia, cutting cost ~30%

Hierarchical planners (HIPLAN, ADaPT, AFlow, D-PoT) split macro-level milestones from micro-level execution; ADaPT decomposes only on failure. Search-based methods include Smurfs (DFS with stable rollback isolating failed-branch logs), AB-MCTS (Bayesian adaptive branching), and ARTIS — a shift from "act-first" to "think–simulate–act" for irreversible high-risk operations.

2. Combating Goal Drift with Abstraction and Dual Systems

Long-horizon agents suffer *agent drift*: context contamination, cross-tool state pollution, and butterfly-effect error amplification. Countermeasures:

Chain-of-Abstraction: two-phase decoding — an abstract reasoning chain with placeholders is generated first, then filled with tool outputs, decoupling generic reasoning from domain data
MARS / SwiftSage: dual-system architectures separating fast parsing of large tool outputs from slow deliberative reasoning
Plan-and-Act / MPO: environment-agnostic meta-plans refined via preference optimization

3. Multi-Tool Security: From Instruction Injection to Structure Injection

Risk escalation from single-tool to multi-tool settings:

| Single-tool risk | Multi-tool escalation | |---|---| | Indirect prompt injection | Cross-tool state contamination | | Malicious instruction execution | Plan injection (manipulating reasoning structure itself) | | Data leakage | Butterfly-effect cascade amplification |

The paper outlines a three-layer defense: pre-execution static constraints (AARM, AgentSpec), transactional in-execution management (SagaLLM with compensations, Atomix epoch-based isolation), and post-execution verification (CRITIC, VerifiAgent, DVR). It notes that safety benchmarks (NESTFUL, ToolSword, RoTBench) remain largely static and under-test interactive settings.

4. Tool-Creating Agents

LATM: separates a tool *maker* (writes and tests Python functions for novel tasks) from a tool *user*
CREATOR, ToolMaker, MetaAgent: dynamic synthesis, context reuse, experience distillation
Voyager / ExpeL: lifelong skill libraries and distilled cross-task insights — agents stop starting from scratch

5. Training and Efficiency

A spectrum from training-free retrieval (ToolLLM, AnyTool) → trajectory synthesis (Seal-Tools, APIGen, LoopTool) → SFT (Hammer, ToolGen, Granite-Function Calling) → RL (Tool-Star's hierarchical rewards, ToolRL, GTPO's turn-level credit assignment, ARPO's entropy-based rollback). Efficiency work includes LLMCompiler's parallel DAG execution, asynchronous planning/execution decoupling, and cost cuts via caching and model routing.

6. Evaluation and Open Problems

Benchmarks are evolving from single-call verification (ToolBench, APIBench) to system-level orchestration (NESTFUL: 900+ tools; ToolHop: 3,912 tools, multi-hop) and interactive closed-loop testing (MCP-Bench with live MCP servers; ST-WebAgentBench making trustworthy execution a primary metric).

Future directions: richer stateful orchestration abstractions (conditionals, loops, concurrency, exception handling), dynamic long-horizon evaluation protocols, tighter model–system co-design, and governance of self-created tools.

Takeaway

> "This is a necessary path toward AGI — and a systemic loss-of-control risk we must confront."

Orchestration capabilities are advancing fast, but safety frameworks, evaluation protocols, and system-level guarantees are lagging behind — an industry-wide challenge rather than any single company's responsibility.

Reference

Xu, H., Li, C., Ma, X., Ou, X., Zhang, Z., et al. (2026). *The Evolution of Tool Use in LLM Agents: From Single-Tool Call to Multi-Tool Orchestration*. arXiv:2603.22862. https://arxiv.org/abs/2603.22862