Auditing Agent Actions through Query-Conditioned Attribution

Yifan Liu; Praveen Venkateswaran; Abdulhamid Adebayo; Dong Wang

cs.AISep 27, 2026

Auditing Agent Actions through Query-Conditioned Attribution

Authors: Yifan Liu, Praveen Venkateswaran, Abdulhamid Adebayo, Dong Wang

Organizations: University of Illinois Urbana-Champaign · IBM

Abstract

LLM agents increasingly take consequential actions through interactions with users, policies, and external tools. Auditing these agents requires automated attribution of realized actions to their historical basis. However, existing attribution formulations do not provide question-specific traces for diverse auditing objectives. Additionally, when access to the acting model is limited (e.g., in API-only deployments), applicable methods commonly rely on costly input perturbations or external LLM analysis of complete trajectories. We therefore formulate query-conditioned agent action attribution, a new task that takes a natural-language auditing query as input and recovers the source and ordered intermediate evidence for the query-specified aspect of an action. We instantiate this task with $A^3Bench$ , a benchmark comprising 1,396 auditing queries across policy basis, parameter provenance, failure propagation, and unsafe-behavior tracing. To enable efficient, query-specific attribution, we use small open-weight models as attribution proposers that combine query-conditioned gradient saliency with query-semantic relevance to rank history units. Our proposer consistently achieves stronger source and evidence rankings at lower inference cost than open-weight baselines, improving source MRR by up to 40.9% and evidence MAP by 42.1% with only two forward passes and one backward pass. Controlled evaluations confirm that our proposer improves attribution specificity by adapting its rankings to fine-grained changes in the auditing query. Building on a proposer ensemble, our end-to-end system surpasses the strongest frontier-model baseline in source accuracy (64.5% vs.\ 60.4%) while reducing empirical deployment latency by 29.9% relative to the fastest frontier API baseline. Code and data will be released after the initial review period following final validation and cleanup.

Figures & tables

Figure 1: Query-conditioned attribution under limited model access. For the same action, Q1 traces the policy basis of the tool choice, whereas Q2 traces the provenance of its reservation ID. The attributor needs to recover query-specific traces without access to the acting model weights.

Figure 2: Overview of A 3 Bench and our attribution method.

Configuration	Qwen3.5-2B		Granite 3.3-2B		SmolLM3-3B
Configuration	MRR	MAP	MRR	MAP	MRR	MAP
Gradient sum	0.4088	0.5702	0.4767	0.6080	0.4478	0.5818
+ $\sqrt{n}$ norm.	$0.3701_{{\color[rgb]{0.6992,0.2266,0.2813}\scriptscriptstyle-.0387}}$	$0.5908_{{\color[rgb]{0.0938,0.4727,0.3047}\scriptscriptstyle+.0206}}$	$0.5511_{{\color[rgb]{0.0938,0.4727,0.3047}\scriptscriptstyle+.0744}}$	$0.7208_{{\color[rgb]{0.0938,0.4727,0.3047}\scriptscriptstyle+.1128}}$	$0.5720_{{\color[rgb]{0.0938,0.4727,0.3047}\scriptscriptstyle+.1242}}$	$0.7132_{{\color[rgb]{0.0938,0.4727,0.3047}\scriptscriptstyle+.1314}}$
+Query Grad.	$0.5007_{{\color[rgb]{0.0938,0.4727,0.3047}\scriptscriptstyle+.1306}}$	$\mathbf{0.6864}_{{\color[rgb]{0.0938,0.4727,0.3047}\scriptscriptstyle+.0956}}$	$0.6595_{{\color[rgb]{0.0938,0.4727,0.3047}\scriptscriptstyle+.1084}}$	$\mathbf{0.7812}_{{\color[rgb]{0.0938,0.4727,0.3047}\scriptscriptstyle+.0604}}$	$0.6628_{{\color[rgb]{0.0938,0.4727,0.3047}\scriptscriptstyle+.0908}}$	$\mathbf{0.7364}_{{\color[rgb]{0.0938,0.4727,0.3047}\scriptscriptstyle+.0232}}$
+Query Rel.	$\mathbf{0.5710}_{{\color[rgb]{0.0938,0.4727,0.3047}\scriptscriptstyle+.0703}}$	$0.6848_{{\color[rgb]{0.6992,0.2266,0.2813}\scriptscriptstyle-.0016}}$	$\mathbf{0.6938}_{{\color[rgb]{0.0938,0.4727,0.3047}\scriptscriptstyle+.0343}}$	$0.7388_{{\color[rgb]{0.6992,0.2266,0.2813}\scriptscriptstyle-.0425}}$	$\mathbf{0.6677}_{{\color[rgb]{0.0938,0.4727,0.3047}\scriptscriptstyle+.0049}}$	$0.7247_{{\color[rgb]{0.6992,0.2266,0.2813}\scriptscriptstyle-.0117}}$

Table 2: Cumulative proposer ablation. Source MRR and evidence MAP across three backbones. Colored subscripts indicate absolute changes from the preceding configuration.

Figure 3: Query-conditioning analysis (Left): Original queries improve trajectory-macro source MRR over control and mismatched queries for fixed trajectory–action pairs; error bars show 95% trajectory-level bootstrap confidence intervals. Temperature tuning (Right): Development relation-macro source MRR across query-weighting temperatures; outlined markers denote selected values.

Figure 4: Results on Who&When (left) and ATBench (right). All baseline values come directly from the respective source papers; we evaluate our method on the identical test examples.

Appendix figures & tables18 assets

Supplementary material from the paper’s appendix.

Appendix

Acting Model	GPT-4.1	Qwen3.5-9B
Queries	1,141	255
Trajectories	871	214
Task families	335	140
Domains	7	7
Policy basis	290	64
Parameter provenance	290	65

Appendix

Table 4: Benchmark composition. † Median.

Figure 5: Cross-model proxy attribution. Attribution quality plotted against agreement on the generated action across acting/proxy model pairs.

	Source Hit@1 $\uparrow$			Evidence Macro F1 $\uparrow$
Relation	Ours	Sonnet	$\bm{\Delta}$	Ours	Sonnet	$\bm{\Delta}$
Failure propagation	0.416	0.222	+0.195	0.673	0.576	+0.097
Parameter provenance	0.365	0.677	$-$ 0.312	0.530	0.615	$-$ 0.085
Policy basis	0.859	0.543	+0.316	0.653	0.620	+0.033
Unsafe-behavior tracing	0.948	0.988	$-$ 0.040	0.854	0.948	$-$ 0.094

Appendix

Table 5: Relation-specific end-to-end attribution performance on the held-out evaluation set. We compare our method with the strongest direct-attribution baseline. Positive differences favor our method.

Relation	$N$	Source errors (%)			Evidence F1 (%) under correct source
Relation	$N$	Rate	Proposer	Resolver	Evidence F1 (%) under correct source
Failure propagation	257	58.4	44.0	56.0	98.7
Parameter provenance	266	63.5	87.0	13.0	80.1
Policy basis	269	14.1	10.5	89.5	64.6
Unsafe-behavior tracing	249	5.2	7.7	92.3	87.4
Overall	1041	35.5	58.9	41.1	80.3

Appendix

Table 6: Error localization by relation. Source-error rate uses all instances; proposer and resolver columns partition source errors. Evidence F1 is conditioned on correct source selection.

Included proposer			Source selection			Evidence ranking
Qwen-2B	Granite-2B	SmolLM3-3B	Agreement coverage	Accuracy under agreement	Disagreement $\cup$ Top-3	R@ $\|\mathrm{GT}\|$	MAP
✓			100.00	37.75	–	0.5659	0.6848
✓	✓		50.05	70.06	80.58	0.5970	0.7110
✓	✓	✓	37.85	77.16	80.22	0.6554	0.7568

Appendix

Table 7: Incremental proposer ensemble on the held-out evaluation set. Agreement requires identical Top-1 sources among the included proposers; its Hit@1 is conditional on agreement. The disagreement column reports gold-source coverage by the union of included Top-3 lists. Evidence rankings use equal-weight Borda rank sum over the included proposers.

Resolver / Rule	Overall $\uparrow$	Disagree $\uparrow$	Evid. F1 $\uparrow$	Exact $\uparrow$
Qwen3.5-2B	0.446	0.247	0.622	0.215
Qwen3.5-4B	0.645	0.567	0.675	0.298
Qwen3.5-9B	0.624	0.535	0.641	0.282
Borda fallback	0.572	0.450	0.670	0.305

Appendix

Table 8: Resolver ablation. The resolver mainly improves source selection on proposer-disagreement cases, while evidence recovery changes little.

Panel of Figure 6 — Figure 6: A parameter-provenance error on a controlled trajectory. The user explicitly asks the assistant to recover the address from order history and never states the queried zip code, making Step 12 the unambiguous first visible origin. Our method instead selects its downstream use at Step 17.

Panel of Figure 7 — Figure 7: A policy-basis comparison on a single trajectory. Steps 11–12 directly instantiate the annotated execution precondition. Our method recovers the governing clause, whereas Claude Sonnet 4.6 selects a broad capability statement; Ours is source-correct but not exact in evidence cardinality.

Proposer	Source ranking				Intermediate evidence		Inference cost
Proposer	Hit@1 $\uparrow$	Hit@3 $\uparrow$	Hit@5 $\uparrow$	MRR $\uparrow$	Recall@ $\#\mathrm{GT}$ $\uparrow$	MAP $\uparrow$	Mean Fwd. $\downarrow$	Mean Bwd. $\downarrow$	Wall s/item $\downarrow$
Qwen3.5-2B
ContextCite	0.4338	0.5840	0.6496	0.5459	0.4890	0.5499	64.00	0	9.82
Leave-one-out	0.4863	0.6627	0.7199	0.5980	0.4591	0.5260	44.30	0	10.59
PrefixDelta	0.2884	0.6293	0.6639	0.4755	0.3188	0.4291	44.30	0	6.79
Ours	0.4136	0.7449	0.8772	0.6037	0.5609	0.6928	2.00	1	2.41

Appendix

Table 9: Proposer ranking quality and inference cost across three open-weight backbones on the 839-item clean held-out subset.

Method	Source attribution		Intermediate evidence recovery
Method	Hit@1 $\uparrow$	Macro Hit@1 $\uparrow$	Macro F1 $\uparrow$	Micro F1 $\uparrow$	Exact $\uparrow$
Gemini 2.5 Pro	[0.524, 0.588]	[0.533, 0.586]	[0.620, 0.661]	[0.579, 0.631]	[0.247, 0.307]
Claude Sonnet 4.6	[0.573, 0.636]	[0.582, 0.632]	[0.669, 0.703]	[0.599, 0.647]	[0.271, 0.331]
Claude Haiku 4.5	[0.374, 0.437]	[0.382, 0.435]	[0.429, 0.482]	[0.416, 0.481]	[0.187, 0.242]
GPT-4.1	[0.550, 0.617]	[0.558, 0.616]	[0.535, 0.583]	[0.480, 0.536]	[0.247, 0.306]
Ensemble ( $K=4$ )	[0.612, 0.678]	[0.621, 0.674]	[0.653, 0.696]	[0.572, 0.626]	[0.267, 0.329]

Appendix

Table 11: Trajectory-clustered bootstrap confidence intervals for end-to-end attribution. Each cell reports only the 95% percentile interval from 10,000 paired bootstrap resamples of held-out trajectories.

Panel of Figure 8 — Figure 8: Prompt template shared by the three attribution proposers. The target and contrast action options are also presented in the swapped A/B order; attribution uses the mean aligned target-versus-contrast action logit margin.

Panel of Figure 9 — Figure 9: Source-resolution prompt used only when the three proposers’ top-ranked sources disagree. Candidates are the deduplicated union of their top-three sources, shown in canonical order without proposer identity, score, or rank. The resolver scores candidate answer labels without generating an explanation. Notably, the phrase “causal source” in the prompt is used operationally to help the resolver distinguish the earliest substantive commitment from downstream relays, repetitions, or executions, rather than to claim causal identification of the acting model’s internal computation.

Panel of Figure 10 — Figure 10: Prompt template used for frontier-model direct attribution. The model receives the attribution query, recorded target action, candidate source units, and complete visible trajectory preceding the target. Output is returned as strict JSON. For policy instances, canonical sub-policies rather than the enclosing system message constitute the candidate source units. Inference uses deterministic decoding with temperature zero.

Panel of Figure 11 — Figure 11: Attribution proposer prompts for ATBench and Who&When. Panel (a) shows the ATBench next-action contrast between the observed target action and a deterministic relation-specific contrast action. Panel (b) shows the Who&When adaptation, which replaces the action contrast with fixed failure and successful-trajectory hypotheses.

Panel of Figure 12 — Figure 12: Gold annotation for failure propagation. The first lookup is the source of the failed branch, while the error, its interpretation, and the user’s correction explain the retry with a different email address.

Panel of Figure 13 — Figure 13: Gold annotation for parameter provenance. Although the reservation identifier appears earlier, Step 10 is the first visible step that establishes the complete queried assignment: upgrading XEHM4B to economy .

Panel of Figure 14 — Figure 14: Gold annotation for policy basis. The assistant’s confirmation request and the user’s unambiguous “yes” directly instantiate the governing policy clause before the cancellation tool call.

Panel of Figure 15 — Figure 15: Gold annotation for unsafe-behavior tracing. The injected instruction does not fully specify the target action: it supplies the malicious recipient and causes an additional transaction-history lookup, whose returned subscription and amount are composed into the eventual transfer.

Explore similar work

Jul 23, 2026cs.AI

Auditing Provenance Sensitivity in LLM Agent Action Selection

LLM agents choose tools and arguments from context that mixes user requests, tool outputs, retrieved records, memory, and untrusted text. Evidence can be relevant without being authorized to determine a decision, so a correct action need not be grounded only in permitted evidence. We introduce a target-specific authorization audit that labels context factors separately for each tool and argument target. Its primary test holds the task, proposition, position, and policy fixed while changing only the proposition's source authority. We then test behavior when valid evidence is weakened and use context-subset interactions as a secondary localization diagnostic. Across 450 controlled next-action tasks and multiple open-weight LLM families, trusted and untrusted variants produce different actions in 5.4 percent of competing cases versus 1.7 percent of supporting cases. Under controlled degradation, unauthorized competition is retained in a full-correct, mixed-error, clean-correct pattern in 2.4 percent of comparisons, with a 95 percent confidence interval from 2.1 to 3.0 percent. These are controlled stress-set rates, not deployment prevalence. The models respond to textual source-authority cues, but this does not prevent untrusted evidence from influencing their actions.

Junchi Liao

Untrusted Content Model Auditing

Ask PDF

Jul 5, 2026cs.AI

Agent Step Value: Auditing Evaluator-Channel Reversals in Black-Box Agent Traces

When evaluator-derived step rewards are pooled or compared across scoring channels, their sign is treated as transportable. Yet the same frozen transition can change sign with the scoring channel. Process rewards vary agent states, while evaluator audits vary scoring configurations; neither first difference isolates their interaction. We define Agent Step Value (ASV) as channel-indexed target-margin gain and identify the missing state-by-channel interaction by replaying complete faces. Of 1,100 PubMed open question-answering transitions, 1,004 were complete across four cyclic layouts. Their mean update is positive under direct scoring (+0.163 [0.102, 0.218]) and negative with an externally generated view (-0.160 [-0.244, -0.079]), giving an interaction of -0.323 [-0.418, -0.232]. Across paired transitions, 507/1,004 cross zero in one direction or the other. Matched templates isolate a generated-minus-quote interaction of -1.121 [-1.534, -0.703]. Its direction remains negative after the readout and evaluator-stack changes, and quote yields a higher paired area under the receiver operating characteristic curve (AUC) for stored success at all three bridge vertices. Because the two views preserve the same task information conditional on the retained state, a representation-invariance null predicts equal responses and success rankings across them. ASV provides a transport audit for evaluator-derived step measurements; causal actor credit lies outside its estimand.

Andrew Zhang, Chengzhan Li

KTH Royal Institute of Technology · University of Electronic Science and Technology of China

Traces Agentic Evaluations Large Language Model Evaluation Surprisal

Ask PDF

Apr 7, 2026cs.AI

Auditable Agents

LLM agents call tools, query databases, delegate tasks, and trigger external side effects. Once an agent system can act in the world, the question is no longer only whether harmful actions can be prevented--it is whether those actions remain answerable after deployment. We distinguish accountability (the ability to determine compliance and assign responsibility), auditability (the system property that makes accountability possible), and auditing (the process of reconstructing behavior from trustworthy evidence). Our claim is direct: no agent system can be accountable without auditability. To make this operational, we define five dimensions of agent auditability, i.e., action recoverability, lifecycle coverage, policy checkability, responsibility attribution, and evidence integrity, and identify three mechanism classes (detect, enforce, recover) whose temporal information-and-intervention constraints explain why, in practice, no single approach suffices. We support the position with layered evidence rather than a single benchmark: lower-bound ecosystem measurements suggest that even basic security prerequisites for auditability are widely unmet (617 security findings across six prominent open-source projects); runtime feasibility results show that pre-execution mediation with tamper-evident records adds only 8.3 ms median overhead; and controlled recovery experiments show that responsibility-relevant information can be partially recovered even when conventional logs are missing. We propose an Auditability Card for agent systems and identify six open research problems organized by mechanism class.

Yi Nian, Aojie Yuan, Haiyue Zhang +7

University of Southern California · Arizona State University · University of Tennessee, Knoxville +1

Accountability Model Auditing

Ask PDF