Organizations: Department of Informatics and Telematics, Harokopio University of Athens, Athens, Greece · Department of Informatics, Faculty of Science, Democritus University of Thrace, Kavala, Greece · Department of Electrical and Computer Engineering, University of Western Macedonia, Kozani, Greece · Archimedes, Athena Research Center, Athens, Greece
Autonomous multi-agent systems nowadays act in finance, software supply chains, and security operations. Already, the first largely AI-orchestrated intrusion campaigns have been reported. Yet, when such a system causes harm, no method can robustly establish what happened, what caused it, or who is accountable. This is because provenance forensics works at the wrong abstraction, formal causality assumes the causal model, and agent auditing trusts self-recording. The target failure mode is, thus, attribution laundering, i.e., spreading an act across redundant agents until none is a but-for cause. Worse, the record is produced by the suspects, which comprises the assumption adopted throughout this work. Agents may therefore anticipate the investigation and the part of logging infrastructure may itself collude. In this paper, HANSARD is proposed, a reference architecture treating accountability as a life-cycle property. First, a readiness profile sealed before operation bounds what later findings may claim. Second, capturing at five choke points beyond the agents' reach makes omissions detectable, not only tampering. Third, a typed PROV-DM-aligned causal graph accrues as the system runs, and three indicators read it live to gate oversight without adjudicating. Fourth, post-incident replay yields contingent effects under the modified Halpern-Pearl definition, together with a compensation-set size. Finally, a synergy residual measures harm due to the combination rather than to individuals, making laundering visible. Cause, responsibility and accountability are then reported separately, each capped by an evidentiary tier, while a future research agenda is also provided.
Figures & tables
Capability
Req.
Countermeasure (component)
Injects instructions via untrusted content (A1)
R1
Provenance-labeled context segmentation, labels assigned at the witness boundary, not by the agent (Section IV-C )
Emits misleading rationale or uses a covert channel (A2)
R1, R3
Self-reports excluded from the causal model; content-blind mandatory capture at W 3 , so unexplained influence raises ρ (Section IV-C )
Attribution laundering (A2)
R4, R5
Contingent effects with minimal witness-set search; synergy residual ρ and its runtime shadow (Section IV-E , Section IV-D )
Omits or reorders entries; controls a trust domain or waits out retention (A3)
R2, R6, R7
Per-channel sequence numbers and hash chaining yield completeness proofs, not merely integrity proofs, and gaps raise live alarms (Section IV-B , Section IV-D ); cross-principal corroboration, with tier E3 required to name a principal (Section V ); commitment retention decoupled from content retention (Section IV-G )
TABLE I: Adversary capabilities, the requirements they induce, and architectural countermeasures
Fig. 1: The HANSARD reference architecture. The witness boundary is the only sanctioned path between the untrusted execution plane and the evidentiary plane; stages 1-4 constitute the post-incident examination and the runtime face reads the same sealed stream as it accrues. The readiness profile (Section IV-A ) and federation (Section IV-G ) are omitted from the figure.
Tier
Basis
May license
E0
Correlational narrative over the trace
Hypothesis generation only; not evidence
E1
Sealed trace, integrity and completeness proofs, one witness
Description of what was recorded; remediation advice
E2
(E1) plus counterfactual support, with stated interval and kmax coverage
A claim of causation
E3
(E2) corroborated by independent witnesses in distinct trust domains
A claim naming a principal
TABLE II: Evidentiary tiers and what each may license
Physical automation is scaling toward fleets of embodied machines commanded by an AI brain. Early deployments already run factories and warehouses at production rates beyond any human line, and their adoption is accelerating. But when their joint decisions cause harm, everyone involved has reason to blame everyone else, the machine vendor, the algorithm provider, the factory operator, the insurer, and the regulator, and no method can divide the responsibility between them. Existing methods read logs whose origin they cannot verify and name a single culprit, misrepresenting outcomes that are overdetermined, preempted, or caused by an omission. We present AUDITA, an audit layer pairing a tamper-evident record of every inter-agent command with a certified, graded causal-attribution engine. We prove its verdict cannot be gamed: a rule-following agent can never be made to look guilty, an attempt to shift blame is itself caught and graded, and we establish the exact limit of what an evidence-based auditor can certify. On live language-model pipelines it reduces the standard judge baseline's responsibility error roughly threefold; on a benchmark of accident-grounded structures it recovers responsibility where single-culprit baselines fail, and stays invariant under forgery. AUDITA turns the question of who is to blame from an argument about logs into a calculation over evidence.
Zhixu Du, Yiran Chen
Department of Electrical and Computer Engineering, Duke University, Durham, North Carolina, USA
When a multi-agent system produces an incorrect or harmful answer, who is accountable if execution logs and agent identifiers are unavailable? In practice, generated content is often detached from its execution environment due to privacy or system boundaries, leaving the final text as the only auditable artifact. Existing attribution methods rely on full execution traces and thus become ineffective in such metadata-deprived settings. We propose Implicit Execution Tracing (IET), a provenance-by-design framework that shifts attribution from post-hoc inference to built-in instrumentation. Rather than inferring provenance after the fact, IET embeds agent-specific, key-conditioned statistical signals into the token generation process at generation time, turning the output text into a self-verifying provenance record. An offline auditor, holding a verification registry that maps each agent to its key, then recovers segment-level provenance - segment boundaries and per-segment agent attribution - from the final text alone without access to execution logs or private traces. Experiments across diverse multi-agent coordination settings demonstrate that IET achieves accurate segment-level attribution and reliable transition recovery under identity removal, boundary corruption, and privacy-preserving redaction, while maintaining generation quality. These results show that embedding provenance into generation provides a practical foundation for accountability in multi-agent language systems under metadata loss.
Yi Nian, Haosen Cao, Shenzhe Zhu +4
University of Southern California · University of Toronto · University of Illinois Chicago +1
LLM agents call tools, query databases, delegate tasks, and trigger external side effects. Once an agent system can act in the world, the question is no longer only whether harmful actions can be prevented--it is whether those actions remain answerable after deployment. We distinguish accountability (the ability to determine compliance and assign responsibility), auditability (the system property that makes accountability possible), and auditing (the process of reconstructing behavior from trustworthy evidence). Our claim is direct: no agent system can be accountable without auditability. To make this operational, we define five dimensions of agent auditability, i.e., action recoverability, lifecycle coverage, policy checkability, responsibility attribution, and evidence integrity, and identify three mechanism classes (detect, enforce, recover) whose temporal information-and-intervention constraints explain why, in practice, no single approach suffices. We support the position with layered evidence rather than a single benchmark: lower-bound ecosystem measurements suggest that even basic security prerequisites for auditability are widely unmet (617 security findings across six prominent open-source projects); runtime feasibility results show that pre-execution mediation with tamper-evident records adds only 8.3 ms median overhead; and controlled recovery experiments show that responsibility-relevant information can be partially recovered even when conventional logs are missing. We propose an Auditability Card for agent systems and identify six open research problems organized by mechanism class.
Yi Nian, Aojie Yuan, Haiyue Zhang +7
University of Southern California · Arizona State University · University of Tennessee, Knoxville +1