工具幻觉五层探测：从内省信号到运行时校验全栈

class ToolCallHallucinationDetector:
    def __init__(self, model, threshold=0.35):
        self.model = model
        self.threshold = threshold
        # 预训练的探针头，基于线性探针分类器
        self.probe_head = nn.Linear(model.config.hidden_size, 1)

    def detect(self, messages, tools):
        # 步骤1: 获取模型内部表征
        with model.trace() as tracer:
            with tracer.invoke(messages, tools=tools):
                # 捕获倒数第二层的隐藏状态
                hidden_states = model.model.layers[-2].output
                # 捕获logits的熵
                logits = model.lm_head.output
                entropy = -torch.sum(
                    F.softmax(logits, dim=-1) * F.log_softmax(logits, dim=-1),
                    dim=-1
                )

        # 步骤2: 探针分类
        probe_score = torch.sigmoid(
            self.probe_head(hidden_states[:, -1, :])
        )

        # 步骤3: 综合判断
        is_hallucination = (
            probe_score > self.threshold or
            entropy > self.entropy_threshold
        )

        return {
            "is_hallucination": is_hallucination,
            "confidence": probe_score.item(),
            "entropy": entropy.item()
        }

from pydantic import BaseModel, field_validator
from datetime import datetime
from typing import Optional

class FlightSearchParams(BaseModel):
    origin: str
    destination: str
    departure_date: str
    return_date: Optional[str] = None
    passengers: int = 1

    @field_validator('origin', 'destination')
    @classmethod
    def validate_airport_code(cls, v):
        # Schema验证：检查是否为3字母大写
        if not v.isalpha() or len(v) != 3:
            raise ValueError(f"无效的机场代码: {v}")
        # 语义验证：检查是否为真实机场代码
        if v not in IATA_AIRPORT_CODES:
            raise ValueError(f"虚构的机场代码: {v}")
        return v.upper()

    @field_validator('departure_date')
    @classmethod
    def validate_date_semantics(cls, v):
        # Schema验证：检查日期格式
        date = datetime.strptime(v, "%Y-%m-%d")
        # 语义验证：检查是否为过去日期（常见幻觉模式）
        if date < datetime.now():
            raise ValueError(f"出发日期不能是过去: {v}")
        # 语义验证：检查是否超出合理预订范围
        if (date - datetime.now()).days > 365:
            raise ValueError(f"出发日期超出预订范围: {v}")
        return v

# 真实工具
tools = [
    {
        "name": "search_customer_orders",
        "description": "Search for orders placed by a specific customer",
        "parameters": {
            "customer_id": {"type": "string"},
            "status": {"type": "string", "enum": ["active", "completed", "cancelled"]}
        }
    },
    {
        "name": "search_all_orders",  # 陷阱工具
        "description": "Search across all orders with filters",
        "parameters": {
            "customer_id": {"type": "string", "optional": True},
            "status": {"type": "string", "enum": ["active", "completed", "cancelled"]},
            "date_range": {"type": "object", "optional": True}
        }
    }
]

工具数量    选择精度(GPT-5.2)    选择精度(Claude Opus 4.1)
1-5        98.2%               97.8%
6-10       96.1%               95.9%
11-20      92.4%               93.1%
21-50      85.7%               87.3%
51-100     74.2%               76.8%
100+       61.5%               64.1%

class PreExecutionVerifier:
    def __init__(self, main_model, verifier_model):
        self.main = main_model
        self.verifier = verifier_model

    async def execute_with_verification(self, user_request, tools):
        # 主模型生成工具调用
        tool_call = await self.main.generate_tool_call(
            messages=[{"role": "user", "content": user_request}],
            tools=tools
        )

        # 验证模型审查
        verification_prompt = f"""
        A model proposed the following tool call for a user request.
        User request: {user_request}
        Proposed tool call: {tool_call.function.name}(
            {tool_call.function.arguments}
        )
        Available tools: {[t['name'] for t in tools]}

        Is this tool call correct? Check:
        1. Is the correct tool selected?
        2. Are all parameter values real (not fabricated)?
        3. Are there unnecessary calls?

        Respond with: APPROVE or REJECT + reason
        """

        verdict = await self.verifier.generate(verification_prompt)

        if "APPROVE" in verdict:
            return await self.execute(tool_call)
        else:
            # 拒绝执行，要求主模型重新生成
            return await self.retry_with_feedback(
                user_request, tools, tool_call, verdict
            )

[Trace: user_request_12345]
├── [Span: intent_parsing] duration=120ms
│   └── detected_intent: "book_flight"
├── [Span: tool_selection] duration=340ms
│   ├── candidate_tools: ["search_flights", "book_flight", "get_airport_info"]
│   ├── selected_tool: "search_flights"
│   └── selection_confidence: 0.92
├── [Span: parameter_generation] duration=280ms
│   ├── origin: "PEK" ✓ (valid IATA)
│   ├── destination: "XYZ" ✗ (INVALID - hallucination detected)
│   └── departure_date: "2026-07-15" ✓
├── [Span: pre_execution_check] duration=150ms
│   └── verdict: REJECTED - invalid destination code
└── [Span: retry_with_correction] duration=520ms
    ├── corrected_destination: "SFO" ✓
    └── final_status: SUCCESS

# 幻觉：模型生成合法但不存在的枚举值
{"status": "in_progress"}  # Schema允许但业务不存在

# 自愈：将可用枚举值注入错误反馈
error_feedback = f"""
Invalid parameter value. 'status' must be one of: 
{valid_statuses}. Your value 'in_progress' is not valid.
"""

# 场景：用户要求"预订航班并发送确认邮件"
# 模型只调用book_flight，遗漏了send_confirmation_email

# 自愈：基于任务完成度检查
def check_task_completion(user_intent, executed_tools):
    required_for_intent = INTENT_TOOL_MAP[user_intent]
    missing = required_for_intent - set(executed_tools)
    if missing:
        return {
            "status": "incomplete",
            "missing_tools": missing,
            "prompt": f"You forgot to call: {missing}. Please complete."
        }

graph TB
    subgraph "Layer 1: 模型内省"
        A[工具调用请求] --> B{隐藏层探针}
        B -->|幻觉概率>阈值| C[标记预警]
        B -->|通过| D[继续]
    end

    subgraph "Layer 2: Schema语义守卫"
        D --> E{L1结构验证}
        E -->|失败| F[拒绝+反馈]
        E -->|通过| G{L2域约束}
        G -->|失败| F
        G -->|通过| H{L3业务逻辑}
        H -->|失败| F
        H -->|通过| I[继续]
    end

    subgraph "Layer 3: 工具选择探针"
        I --> J{选择置信度}
        J -->|低置信| K[触发二次验证]
        J -->|高置信| L[继续]
        K -->|验证通过| L
        K -->|验证失败| F
    end

    subgraph "Layer 4: 执行前验证"
        L --> M[第二意见审查]
        M -->|APPROVE| N[执行]
        M -->|REJECT| O[重试+修正反馈]
    end

    subgraph "Layer 5: 运行时审计"
        N --> P[执行结果校验]
        P -->|异常| Q[自愈循环]
        P -->|正常| R[记录审计日志]
        Q -->|成功| R
        Q -->|失败| S[升级人工]
    end

    C --> T[聚合幻觉报告]
    F --> T
    R --> T

    style B fill:#ff6b6b,stroke:#333,color:#fff
    style E fill:#ffa502,stroke:#333,color:#fff
    style J fill:#7bed9f,stroke:#333
    style M fill:#70a1ff,stroke:#333,color:#fff
    style P fill:#5352ed,stroke:#333,color:#fff