Function calling (LLM)

Function Calling is a mechanism in large language models (LLMs) that allows the model to interact with external tools and APIs by generating structured data (typically JSON) to call a function instead of a direct text response.

In other words, based on a user's query, the model determines which function from a provided set should be called and with what parameters. This mechanism expands the scope of LLM applications, allowing them to serve as an interface between natural language and practical actions. This opens up possibilities for integrating AI with external systems: the model can request up-to-date data, perform operations, or use services, which is particularly valuable for creating intelligent assistants and autonomous agents. The use of external tools also reduces the risk of hallucinations (fabricated facts) by relying on credible sources.

History and Implementation Approaches

Early Approaches (Prompting and Toolformer)

The idea of teaching language models to call tools emerged in 2022–2023. Early approaches were based on complex prompting techniques. For instance, in 2022, the ReAct framework was proposed, where the model alternates between reasoning and acting (calling tools) within a single text stream.

A key step was the introduction of the Toolformer model, presented by Meta researchers in early 2023. Toolformer demonstrated that an LLM could be specifically fine-tuned to independently call external tools (calculator, search engine, calendar) based on textual cues, inserting special API call tokens into the generated text.

Official Support and Development

A major milestone was marked by OpenAI, which officially integrated Function Calling support into its APIs for the GPT-3.5 and GPT-4 models in June 2023. The new model versions were fine-tuned to recognize situations where a user query implies calling an external function and to generate a precisely structured JSON object with the arguments. OpenAI described this capability as "a new way to more reliably connect GPT's capabilities with external tools and APIs."

Open Initiatives

Following commercial implementations, open-source models fine-tuned to generate correct function calls also appeared.

• Gorilla: A UC Berkeley project, a fine-tuned version of LLaMA, capable of formulating calls to thousands of different APIs. To evaluate such models, the Berkeley Function-Calling Leaderboard benchmark was created.
• ToolAlpaca, ToolLLaMA, Hermes: A series of open-source models fine-tuned on synthetic examples of function calls, often generated by more powerful models.

How It Works

The process of using Function Calling typically involves several steps:

1. Function Definition. The developer pre-defines a set of functions available to the model (e.g., external APIs) and describes their signatures and purpose, usually in JSON Schema format.
2. Query Analysis. During a conversation, the model analyzes the user's intent and independently decides whether to call one of the defined functions to provide an answer.
3. Call Generation. If an action is required, the LLM generates a special structured output (e.g., a JSON with the function name and arguments) instead of plain text. If no call is needed, the model returns a regular text response.
4. Function Execution. An external program (the chatbot's or agent's wrapper) receives the JSON, executes the actual call to the specified function with the proposed parameters, and passes the result back to the model.
5. Final Response Generation. The model uses the received data to generate a final response for the user.

To manage this multi-step process, special dialogue formats are used during model training, such as OpenAI's ChatML markup, which introduces a "function" role in addition to the "user" and "assistant" roles to pass the results of function calls.

Applications and Benefits

The ability to call functions significantly broadens the range of tasks that can be solved with LLMs.

• Integration with external APIs. The model can answer queries that require up-to-date information by calling external services (e.g., to get weather forecasts, currency exchange rates, or news).
• Automating user actions. The LLM can perform routine tasks: sending emails, creating calendar events, or placing orders in online stores.
• Access to databases and analytics. Natural language queries can be translated into calls to internal APIs or SQL queries to retrieve and analyze data.
• Extracting structured information. The LLM can extract facts from long texts (e.g., names, dates, addresses) and return them as a structured JSON array, which is convenient for subsequent programmatic processing.

Security Issues

While expanding the capabilities of models, Function Calling also introduces new risks.

• Unverified outputs. The model's interaction with external tools must be carefully secured. If the model receives a malicious or erroneous value from an API, it might include it in its response or call another function based on it, leading to unpredictable consequences.
• Attacks via function arguments. Researchers have discovered vulnerabilities specific to the Function Calling mode. In 2025, an attack dubbed "The Dark Side of Function Calling" was demonstrated. Its essence is to propose a special "function" to the model, with a prohibited instruction (a jailbreak payload) hidden within its arguments. The model, following the principle of calling a function, generates arguments containing content that violates its rules, thereby bypassing moderation filters. Testing showed the attack was successful in over 90% of cases on six modern models, including GPT-4 and Claude.

To prevent such incidents, it is recommended to provide the model with only trusted tools, implement user confirmation before executing critical actions, and use special "defensive" prompts and strict validation of arguments for malicious content.

External links

• Official announcement of Function Calling from OpenAI
• Gorilla LLM project page
• Apideck (2024). An Introduction to Function Calling and Tool Use. Apideck Blog.
• LangChain (2025). Tool Calling (Documentation). LangChain Docs.
• Mistral AI (2025). Function Calling – Documentation. Mistral Docs.
• Hopsworks (2024). What is Function Calling with LLMs?. Hopsworks Dictionary.
• Hopsworks (2024). Unlocking the Power of Function Calling with LLMs. Hopsworks Blog.
• University of California, Berkeley (2025). Berkeley Function Calling Leaderboard V3. Online Resource.
• Large language model — Wikipedia

Literature

• Wu, Z. et al. (2025). The Dark Side of Function Calling: Pathways to Jailbreaking Large Language Models. ACL 2025.
• OpenAI (2023). Function Calling and Other API Updates. OpenAI Blog.
• Schick, T. et al. (2023). Toolformer: Language Models Can Teach Themselves to Use Tools. arXiv:2302.04761.
• Patil, S. G. et al. (2023). Gorilla: Large Language Model Connected with Massive APIs. arXiv:2305.15334.
• Liu, W. et al. (2024). ToolACE: Winning the Points of LLM Function Calling. arXiv:2409.00920.
• Yao, S. et al. (2022). ReAct: Synergizing Reasoning and Acting in Language Models. arXiv:2210.03629.