Chapter 5 · From model to chatbotPuff 23 of 23
Using tools and acting on its own
You ask a chatbot what fourteen train tickets cost with the booking fee. It answers instantly, and the pennies are wrong. Language models are brilliant with words and shaky with long sums. But nobody does long sums in their head when a calculator is to hand. What if the model could use one?
Guess first
A model is great at language but often slips on long arithmetic. What’s the cleverest fix?
Play with it
Task…
Illustrative, scripted trace: the model’s words are written for this page. Calculator results are worked out live by the page.Press “Next step” to walk through the loop, or “Run” to watch it go. Then switch the tools off and compare.
How it works
Tap a step to see it in the figure.
Check yourself
What is the biggest new risk once a chatbot can take actions, not just talk?
Go deeper: the detailsTool requests, the loop in code, and the page’s calculator
Requests as structured text
The program tells the model which tools exist, each with a name and the inputs it takes. When the model wants one, it writes a request in a fixed format, usually JSON (a standard way of writing labelled data), instead of ordinary words:
{ "tool": "calculator", "expression": "14 * 37.50" }
Because the format is fixed, the program can check the request before running anything. This is often called function calling.
The loop, in code
context ← the task
repeat, at most 10 times:
reply ← model(context)
if reply is a tool request:
result ← run the tool
context ← context + reply + result
else:
return reply
Only the line model(context) is the language model, predicting the next words. Running the
tool is done by the ordinary program around it.
Yao and colleagues (2022) called this pattern ReAct: the model writes a short thought, then an action, then reads the observation, and repeats. Schick and colleagues (2023) showed with Toolformer that a model can teach itself where calling a calculator, a search engine or a calendar would help it predict text better.
The page’s calculator
The calculator tool here is a small parser written for this page: it reads numbers, + − × ÷ and brackets, does multiplying and dividing before adding and subtracting, and refuses anything else. It never runs the text as code. Its last job: nothing yet.
When actions are real
Tools that only read (a calculator, a search) are fairly safe. Tools that change things (send, buy, delete) need care: give the agent only the permissions it needs, ask a person before anything that matters, and cap the number of loops. There is a sneakier risk too. Text the agent reads, such as a web page, can contain instructions aimed at the model, and the model may follow them. Greshake and colleagues (2023) called this indirect prompt injection.
You made it
Back in puff 1, a machine nudged a straight line through ten days of iced-coffee sales. That was the whole secret: a guess with knobs, a number that says how wrong it is, and small steps downhill.
Stack simple neurons in layers and the line can bend into any shape, with backpropagation passing the blame back to every knob. Chop text into tokens, place them on a map of meanings, and the one job becomes guessing the next word. Attention lets each word look back at the others, and dozens of stacked blocks make a transformer.
Then the model reads the internet, learns from people to be helpful, sees only what fits in its window, fills gaps with likely words when facts run out, and finally reaches for tools in a loop. Under every answer it gives is the same move you watched in puff 1: guess, check, nudge, billions of times over.
Sources
- S. Yao et al., ReAct: Synergizing Reasoning and Acting in Language Models, 2022.
- T. Schick et al., Toolformer: Language Models Can Teach Themselves to Use Tools, 2023.
- K. Greshake et al., Not what you’ve signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection, 2023.
- The traces, the slip without tools and the search result are made up for this page. Only the calculator results are computed.