OpenAI API 加入函数调用

函数调用发布之前，许多语言模型应用都藏着一小段令人不放心的解析代码。

开发者会要求模型按照某种约定回答：先写函数名，再列参数，最好不要多说一句。模型大多数时候照办，偶尔加一段礼貌解释，漏掉一个字段，或者把本该是数字的内容写成一串自然语言。应用只好用正则表达式、字符串切割和重试提示，把一个善于变化的输出硬塞进软件要求稳定的入口。演示可以运转，生产系统却会在那些「偶尔」里逐渐变脆。

2023 年 6 月 13 日，OpenAI 给 0613 版 GPT-4 与 GPT-3.5 Turbo 加入函数调用。开发者向 API 提供函数名、说明和 JSON Schema；模型不再只返回一段要由人猜测意图的文字，也可以返回某个函数及其结构化参数。应用仍然负责校验参数、决定是否执行、真正调用数据库或外部服务，再把结果送回模型。模型提出调用，软件掌握执行——这条边界非常重要。发布材料同时讨论了并行与多轮工具循环的使用方式；后续版本会继续改接口细节，但合同的核心没有变：结构化意图不等于授权执行。

应用侧循环通常是：接收 function_call → 本地或远端执行 → 以角色消息返回结果 → 再请模型总结或继续调用。错误处理从此分成两层：schema 校验失败可以重试或拒绝；业务逻辑错误则要决定是否让模型看见报错文本。这条循环后来被称为 Agent 的最小内核；2023 年 6 月它的名字还更朴素，叫函数调用。

它没有让语言模型变得确定。一个看起来格式正确的参数仍可能选错城市、误解时间，甚至带来安全问题。JSON 解决的是「怎样表达调用」，不是「调用是否合理」。提示注入也没有消失；当外部内容能够影响模型的选择，开发者仍需把授权、验证和审计放在模型之外。结构化并不等于可信，只是终于让错误有了可以被程序检查的形状——字段缺失可以被拒绝，类型错误可以被拦截，未知函数名可以被丢弃。

与聊天插件不同，函数调用首先服务开发者后端：用户可能从未看见 JSON，只看见应用根据调用结果渲染的界面。这种「不可见的工具层」降低了终端用户复杂度，也把安全审查责任集中到应用所有者。0613 模型更新还常与 JSON 模式、系统消息改进等 API 变化一同被开发者记忆：那是工具化接口密集出现的几周。

这个接口的分量来自它的克制。函数调用没有发明搜索、数据库或业务 API，也不替应用运行任何代码。它给两种完全不同的系统安排了一处接缝：语言模型处理模糊意图，传统软件遵守类型、权限和执行规则。后来「Agent」成为更响亮的名字，工具数量增加，调用可以并行，框架开始管理状态与重试；但很多复杂系统的起点仍是这份朴素合同：这里有几个工具，这是它们的参数；模型可以选择，应用必须判断。技术进步有时表现为模型能说出更多话，有时则表现为软件终于知道，模型的哪一部分话可以被认真地接下去。

Before function calling shipped, many language-model applications hid a nervous little parser.

Developers asked the model to answer under a convention: function name first, then parameters, preferably nothing else. Most of the time it complied. Sometimes it added a polite explanation, dropped a field, or wrote a number as natural language. Applications reached for regular expressions, string splits, and retry prompts to force a changeable output into an entry software needed to be stable. Demos could run. Production systems grew brittle on those “sometimes.”

On 13 June 2023 OpenAI added function calling to the 0613 GPT-4 and GPT-3.5 Turbo models. Developers supplied names, descriptions, and JSON Schema to the API; the model could return not only free text whose intent humans had to guess, but a function and structured arguments. The application still validated parameters, decided whether to execute, actually called databases or external services, and sent results back. The model proposes a call; software holds execution—that boundary matters. Release materials also discussed parallel and multi-turn tool loops. Later versions would change interface details; the core contract did not: structured intent is not authorization to run.

The application loop is usually: receive a function_call → execute locally or remotely → return results as role messages → ask the model to summarize or call again. Errors split into two layers: schema failures can be retried or rejected; business failures require a decision about whether the model sees the error text. That loop would later be called the minimal kernel of an agent. In June 2023 its name was plainer: function calling.

It did not make language models deterministic. A well-formed parameter can still pick the wrong city, misread a time, or create a safety problem. JSON solves how a call is expressed, not whether the call is sound. Prompt injection did not vanish; when external content can steer model choices, authorization, validation, and audit still sit outside the model. Structure is not trust. It only gives errors a shape programs can check—missing fields rejected, type errors blocked, unknown function names discarded.

Unlike chat plugins, function calling first served developer backends: users might never see JSON, only UI rendered from call results. That invisible tool layer lowers end-user complexity and concentrates security review on the application owner. The 0613 model update is often remembered alongside JSON mode and system-message improvements—weeks when tool-facing interfaces clustered.

The interface’s weight is its restraint. Function calling did not invent search, databases, or business APIs, and it does not run application code. It arranges a seam between two different systems: language models handle fuzzy intent; ordinary software keeps types, permissions, and execution rules. Later “Agent” became the louder name; tool counts rose; calls could run in parallel; frameworks managed state and retries. Many complex systems still begin with this plain contract: here are tools, here are their parameters; the model may choose, the application must decide. Progress sometimes looks like models saying more. Sometimes it looks like software finally knowing which part of the model’s speech can be taken seriously.