When Only the Final Text Survives: Implicit Execution Tracing for Multi-Agent Auditing

Yi Nian; Haosen Cao; Shenzhe Zhu; Henry Peng Zou; Qingqing Luan; Yudi Zhang; Yue Zhao

cs.AIMar 18, 2026

When Only the Final Text Survives: Implicit Execution Tracing for Multi-Agent Auditing

Authors: Yi Nian, Haosen Cao, Shenzhe Zhu, Henry Peng Zou, Qingqing Luan, Yudi Zhang, Yue Zhao

Organizations: University of Southern California · University of Toronto · University of Illinois Chicago · Independent Researcher

Abstract

When a multi-agent system produces an incorrect or harmful answer, who is accountable if execution logs and agent identifiers are unavailable? In practice, generated content is often detached from its execution environment due to privacy or system boundaries, leaving the final text as the only auditable artifact. Existing attribution methods rely on full execution traces and thus become ineffective in such metadata-deprived settings. We propose Implicit Execution Tracing (IET), a provenance-by-design framework that shifts attribution from post-hoc inference to built-in instrumentation. Rather than inferring provenance after the fact, IET embeds agent-specific, key-conditioned statistical signals into the token generation process at generation time, turning the output text into a self-verifying provenance record. An offline auditor, holding a verification registry that maps each agent to its key, then recovers segment-level provenance - segment boundaries and per-segment agent attribution - from the final text alone without access to execution logs or private traces. Experiments across diverse multi-agent coordination settings demonstrate that IET achieves accurate segment-level attribution and reliable transition recovery under identity removal, boundary corruption, and privacy-preserving redaction, while maintaining generation quality. These results show that embedding provenance into generation provides a practical foundation for accountability in multi-agent language systems under metadata loss.

Figures & tables

		#Agents = 4			#Agents = 5			#Agents = 6
Method Metric		Star-Pure	Chain	Tree	Star-Pure	Chain	Tree	Star-Pure	Chain	Tree
End-to-end Attribution
ChatGPT	IoU	0.191	0.185	0.178	0.157	0.143	0.133	0.111	0.110	0.119
	TokenAcc	0.314	0.321	0.306	0.249	0.257	0.259	0.192	0.198	0.211
	EdgeSim	N/A
DeepSeek	IoU	0.175	0.165	0.178	0.149	0.140	0.156	0.111	0.111	0.125

Table 1: Sequential attribution performance across end-to-end attribution baselines, segmentation methods, signal-aware watermarking baselines, and our method, under different agent counts and coordination topologies. Bold highlights our method and underline the best-performing baseline for each metric and setting.

	Baseline						Ours
	Clean		Remove ID		Boundary		Clean		Remove ID		Boundary
Method	Agent	Step	Agent	Step	Agent	Step	Agent	Step	Agent	Step	Agent	Step
All-at-Once	54.33	12.50	4.17	9.69	24.54	9.19	54.16	10.47	24.45	10.71	36.67	9.54
Step-by-Step	35.20	25.51	0.00	10.28	33.54	14.41	33.13	23.51	21.51	14.71	37.00	18.84
Binary Search	44.13	23.98	0.00	3.17	31.71	1.59	42.71	21.00	21.98	4.45	35.28	2.38

Table 2: Failure attribution accuracy under metadata corruption. Left: baseline methods without trace signals. Right: our tracing-enabled method. Agent and Step denote agent-level and step-level attribution accuracy (%).

Figure 2: IET preserves task performance

Appendix figures & tables8 assets

Supplementary material from the paper’s appendix.

Appendix

Dataset	Subset / File	Source	Role in Experiments
Arithmetic	synthetic	composable-models/llm_multiagent_debate (GH)	Generation quality evaluation
GSM8K	test	openai/gsm8k (HF), via composable-models/llm_multiagent_debate (GH)	Generation quality evaluation
MAMA topology	llama3.1_num484_nopii.csv	Liu et al. (2025)	Topology-based multi-agent experiments
Who & When	Algorithm-Generated , Hand-Crafted	mingyin1/Agents_Failure_Attribution (GH)	Failure attribution under metadata corruption

Appendix

Table 3: Datasets used in different stages of our experiments. HF: HuggingFace Hub; GH: GitHub.

Attribute	Value
File name	llama3.1_num484_nopii.csv
Number of examples	484
Columns	text , pii , generated_texts , task_backgrounds , questions
Data granularity	Instance-level source records
Intended role	Source material for topology-based multi-agent experiments

Appendix

Table 4: Basic statistics of the MAMA topology dataset file used in our experiments.

Attribute	Value
Benchmark name	Who & When
Repository organization	Who&When/Algorithm-Generated Who&When/Hand-Crafted
Number of failure tasks	184 annotated failure tasks
Storage format	One JSON file per task instance
Core supervision	Failure-responsible agent, decisive error step, natural-language explanation
Representative fields	history , question , ground_truth , question_ID , mistake_agent , mistake_step , mistake_reason

Appendix

Table 5: Summary of the Who & When benchmark used for robustness evaluation.

Figure 3: Original vs. PII-redacted attribution performance. IoU (left) and token-level accuracy (right) of IET across nine topology–agent-count settings (Star-Pure, Chain, Tree $\times$ 4, 5, 6 agents), computed on the original transcripts ( Orig ) and on the same transcripts after PII redaction ( Cens ). The two curves nearly overlap everywhere except 6-star-pure and 6-tree, where redaction causes a small, localized drop.

Category	Transformation	SemSim	ROUGE-L	$\Delta$ TokenAcc	$\Delta$ IoU	$\Delta$ EdgeSim
Clean	No transformation	—	—	$\pm 0.0$	$\pm 0.0$	$\pm 0.0$
Content removal (text not rewritten)	Truncation (90% kept)	0.9871	0.9444	$-0.3$	$-0.8$	$+2.3$
Content removal (text not rewritten)	Truncation (75% kept)	0.9734	0.8542	$-0.6$	$-1.5$	$+2.1$
Structure-preserving rewriting	Backtranslation (EN-FR-EN)	0.9251	0.7131	$-2.4$	$-4.4$	$+0.8$
Structure-preserving rewriting	Backtranslation (EN-ZH-EN)	0.9156	0.6375	$-5.3$	$-5.6$	$-3.3$
Partial regeneration $\dagger$	10% replaced	0.9741	0.9118	$-5.6$	$-3.6$	$-2.4$

Appendix

Table 6: Sensitivity of IET to post-generation text transformations ( chain_4 ). We characterize where the tracing signal degrades rather than claiming invariance to text transformation.

\Delta

columns give the relative change (%) in the Section 3.3 metrics w.r.t. clean generation; ROUGE-L is measured against the untransformed text. All transformations are non-adversarial.

Figure 4: Attribution accuracy as a function of perturbation strength

\kappa

. TokenAcc, IoU, and EdgeSim

Figure 5: Attribution accuracy as a function of sliding-window width

w

True $K$	Candidate Keys	TokenAcc	$\Delta$ TokenAcc
4	4	0.863	—
4	8	0.861	$-0.002$
4	12	0.860	$-0.003$
6	6	0.829	—
6	8	0.829	$0.000$
6	14	0.827	$-0.002$

Appendix

Table 7: Attribution remains stable as the verifier’s candidate-key set grows beyond the number of active agents (chain setting,

\kappa=0.8

, same pipeline as Table 1).

\Delta

TokenAcc is measured relative to the matched-key setting (Candidate Keys

=

True

K

Data Provenance in Language Models

See all 19 papers

From Agent Traces to Trust: A Survey of Evidence Tracing and Execution Provenance in LLM Agents
Jun 3, 2026Yiqi Wang, Jiaqi Zhang, Zhangkai Wu +8AI Agent Reliability Data Provenance
Griffith University · Jiangsu University · The University of Sydney +4
Cascade Failure Attribution for Multi-Agent Systems
Aug 30, 2026Jiayi Zhang, Zexin Wang, Degang Sun +4Agent Failure Analysis Multi-Agent LLM Systems
Computer Network Information Center, Chinese Academy of Sciences · Institute of Computing Technology, Chinese Academy of Sciences
Observability for Delegated Execution in Agentic AI Systems
Jun 8, 2026Abhinav Mishra, Kumar SharadAI Agent Auditing AI Agent Monitoring
Splunk, Cisco Inc

Jun 3, 2026J/K move · Enter open · S save

From Agent Traces to Trust: A Survey of Evidence Tracing and Execution Provenance in LLM Agents

Yiqi Wang, Jiaqi Zhang, Zhangkai Wu, Taotao Cai+7

Griffith University · Jiangsu University · The University of Sydney+4

AI Agent Reliability Data Provenance AI Agent Monitoring

Open paper AskPDF arXiv

Large language model (LLM)-based agents are moving beyond text generation to planning, tool use, retrieval, memory access, environmental interaction, and multi-agent collaboration. Because their outputs depend on information and execution steps across an agent run, their execution processes are difficult to verify, debug, and audit. Even a correct final answer does not reveal which evidence supported its claims, whether tool calls were justified, how memory shaped decisions, or where execution failures originated. Relevant research addresses these questions across evidence attribution, tool-use safety, agent memory, and observability, but these areas emphasize different parts of the execution process. This survey brings them into a common framework through execution provenance, a typed graph of an agent run, and evidence tracing, its projection onto evidence-support relations, distinguishing evidence that supports a conclusion from execution that influences it. We introduce a six-dimensional taxonomy covering trace sources, evidence and execution units, provenance relations, tracing granularity and timing, representation forms, and trust functions, complemented by operational definitions of nine provenance relations and two cross-cutting attributes, provenance origin and trace assurance. Applying this framework to the surveyed systems and benchmarks reveals three gaps: limited integration of fine-grained provenance with multiple trust functions, no benchmark in our catalog that evaluates the complete provenance chain, and little reporting of tamper-evident or attested traces. These findings motivate research on unified trace schemas, semantic provenance, memory and multi-agent lineage, provenance-aware safety and recovery, realistic benchmarks, trace assurance, and privacy-aware auditing. Resources are available at https://github.com/xiaoqi-7/Agent-Tracing-Survey.

Abstract

Data Provenance in Language Models

Explore similar work

From Agent Traces to Trust: A Survey of Evidence Tracing and Execution Provenance in LLM Agents

Cascade Failure Attribution for Multi-Agent Systems

Observability for Delegated Execution in Agentic AI Systems