Certified Multi-Source Integrity for Structured Agent Actions

Anmol Pandey; Aditya Jain; Liang Chen; Carsten Maple; Christo Panchev

cs.CRSep 28, 2026

Certified Multi-Source Integrity for Structured Agent Actions

Authors: Anmol Pandey, Aditya Jain, Liang Chen, Carsten Maple, Christo Panchev

Organizations: University of Warwick · University of Hertfordshire

Abstract

LLM agents increasingly take privileged, often irreversible structured actions, such as paying an invoice. They assemble each action from action-critical fields in documents and tool outputs that an adversary can corrupt, and indirect prompt injection can drive the model itself to extract attacker-chosen values. Current defenses gate on a source's trust label or certify free-text answer quality. None certifies the integrity of a coupled, policy-bound structured action under a corruption budget that accounts for shared upstream sources. We characterize when such an action is safely certifiable and give the maximally live safe certifier. It admits an action only when each field clears the rule its evidence structure supports: a bounded corruption radius over corruption-distinct evidence classes, counted by a minimum hitting set so that re-publishing or laundered copies cannot manufacture a quorum, deterministic reconciliation for complementary fields, and a trusted anchor where the evidence leaves a field single-sourced. We formalize two robustness notions, validate each mechanism by ablation, and measure how often the multi-source precondition holds on sanctions designations (70,966 entities) and software supply-chain provenance (450 packages). Under upper-bound proxies, genuine corroboration is a minority phenomenon in both, and naive attestation counting overstates it, since witnesses that look independent collapse to two corruption-distinct domains once shared origin is counted. Across five current models in a real agent loop, a realistic injection fools every model but one and a naive agent then executes the fraudulent action on most attacks. The certifier admits no unsafe action and recovers the correct value where corroboration permits, while action-gating and provenance baselines are broken in every world of our harness by some attack in its space.

Figures & tables

model	inj. follow	naive unsafe	false-abstain	cert. unsafe
Claude Opus 4.8	0%	0%	3.8%	0%
GPT-5.5	100%	72%	0%	0%
Gemini 3.1 Pro	100%	100%	0%	0%
Gemini 3.5 Flash	100%	98%	0%	0%
Claude Haiku 4.5	100%	100%	0%	0%

Table 1: Each of five current models runs in a real agent loop (OpenRouter) for

80

episodes,

54

with an injection in one of

N=5

sources and

26

clean. The injection fools every model but Opus 4.8 and the naive agent’s unsafe rate reaches

100\%

, yet the certifier admits no unsafe action.

Appendix figures & tables6 assets

Supplementary material from the paper’s appendix.

Appendix

mapped-domain count $\hat{m}$	raw dataset	control domain
$\hat{m}=1$ (single domain)	62.5%	74.6%
$\hat{m}\geq 2$ (two or more)	37.5%	25.4%
$\hat{m}\geq 3$ (three or more)	22.7%	14.9%
$\hat{m}\geq 4$ (four or more)	14.5%	11.7%

Appendix

Table 2: Mapped issuing domains per designated entity in OpenSanctions (

N=70{,}966

, Section 4 ). The control-domain column collapses datasets that share a jurisdiction or body. Both columns are upper-bound proxies for corruption-distinctness, not operational corruption radii.

Payment-field mechanisms
configuration	one-source	mule acct.	amount-splice	omission
full	0%	0%	0%	0%
no join key	0%	0%	100%	0%
no account policy	0%	100%	0%	0%
no mandatory source	0%	0%	0%	100%
Counting mechanisms (unsafe-certified rate)

Appendix

Table 3: Mechanism ablation under a single corrupted class (Section 3 ). Each ablation opens exactly one attack while the full certifier stays safe. Values are attacker success rates.

budget	$N{=}2$	$N{=}3$	$N{=}4$	$N{=}5$	$N{=}6$	$N{=}7$	$N{=}8$
$k=1$	$\cdot$	C	C	C	C	C	C
$k=2$	–	$\cdot$	$\cdot$	C	C	C	C
$k=3$	–	–	$\cdot$	$\cdot$	$\cdot$	C	C

Appendix

Table 4: Outcome of the certifier rule under a

k

-domain Byzantine adversary (Proposition 2 ). C marks a cell certified under every adversarial configuration drawn, including the coordinated worst case, a dot a cell in which at least one configuration forces a safe abstention, and a dash a cell with no more classes than the budget (

N\leq k

). No cell with

N>k

ever certifies a wrong value.

$N$	orig	per attestation	per root	per domain (ours)
2	1	unsafe	abstain	abstain
2	2	unsafe	unsafe	abstain
3	1	abstain	certify	certify
3	2	abstain	abstain	certify

Appendix

Table 5: Certified outcome under a single compromised control domain (

k=1

) that emits several distinct original records for the wrong value plus copies, by vote identity. Only counting per authenticated control domain preserves the guarantee. “Unsafe” means the wrong value was certified.

system	radius	typed	shared-orig.	copy-safe	executes	coverage
RobustRAG [ 2 ]	$\bullet$	–	–	–	$\bullet$	–
CaMeL [ 4 ]	–	$\circ$	–	–	–	–
FIDES [ 5 ]	–	$\circ$	–	–	–	–
PCAS [ 6 ]	–	$\bullet$	–	–	$\bullet$	–
ARGUS [ 10 ]	–	$\bullet$	–	–	$\bullet$	–
AuthGraph [ 7 ]	–	$\bullet$	–	–	$\bullet$	–

Appendix

Table 6: Where the certificate sits among neighboring systems (

\bullet

present,

\circ

partial, – absent): corruption radius, field-typed action, shared-origin modelling, copy-laundering resistance, executing a value rather than refusing, and real-data coverage, meaning the mechanism is measured on a real deployed corpus rather than on synthetic evidence alone. The columns are the dimensions this work targets, so the table shows where the certificate differs from its neighbours rather than ranking them overall.

baseline	vendor	mule	x-vendor	amount	currency	full alt.
action-gating	U	–	U	U	U	U
provenance-only	U	U	U	U	–	U
full certifier	C	–	–	–	–	–

Appendix

Table 7: Outcome by attack family under the adaptive one-source attacker (Section 6 ). The two proxy baselines each block one family the other misses and both stay unsafe on the four they share. U is an unsafe execution, a dash a safe abstention, C a correct execution under attack. The families are a vendor substitution, a fresh mule account, an account carried across vendors, an inflated amount, a currency swap, and a fully alternate invoice.

Explore similar work

Jul 23, 2026cs.AI

Auditing Provenance Sensitivity in LLM Agent Action Selection

LLM agents choose tools and arguments from context that mixes user requests, tool outputs, retrieved records, memory, and untrusted text. Evidence can be relevant without being authorized to determine a decision, so a correct action need not be grounded only in permitted evidence. We introduce a target-specific authorization audit that labels context factors separately for each tool and argument target. Its primary test holds the task, proposition, position, and policy fixed while changing only the proposition's source authority. We then test behavior when valid evidence is weakened and use context-subset interactions as a secondary localization diagnostic. Across 450 controlled next-action tasks and multiple open-weight LLM families, trusted and untrusted variants produce different actions in 5.4 percent of competing cases versus 1.7 percent of supporting cases. Under controlled degradation, unauthorized competition is retained in a full-correct, mixed-error, clean-correct pattern in 2.4 percent of comparisons, with a 95 percent confidence interval from 2.1 to 3.0 percent. These are controlled stress-set rates, not deployment prevalence. The models respond to textual source-authority cues, but this does not prevent untrusted evidence from influencing their actions.

Junchi Liao

Untrusted Content Model Auditing

Ask PDF

May 11, 2026cs.CR

The Granularity Mismatch in Agent Security: Argument-Level Provenance Solves Enforcement and Isolates the LLM Reasoning Bottleneck

Tool-using LLM agents must act on untrusted webpages, emails, files, and API outputs while issuing privileged tool calls. Existing defenses often mediate trust at the granularity of an entire tool invocation, forcing a brittle choice in mixed-trust workflows: allow external content to influence a call and risk hijacked destinations or commands, or quarantine the call and block benign retrieval-then-act behavior. The key observation behind this paper is that indirect prompt injection becomes dangerous not when untrusted content appears in context, but when it determines an authority-bearing argument. We present \textsc{PACT} (\emph{Provenance-Aware Capability Contracts}), a runtime monitor that assigns semantic roles to tool arguments, tracks value provenance across replanning steps, and checks whether each argument's origin satisfies its role-specific trust contract. Under oracle provenance, \textsc{PACT} achieves 100% utility and 100% security on mixed-trust diagnostic suites, while flat invocation-level monitors incur false positives or false negatives. In full AgentDojo deployments across five models, \textsc{PACT} reaches 100% security on the three strongest models while recovering 38.1--46.4% utility, 8--16 percentage points above CaMeL at the same security level. Ablations show that both semantic roles and cross-step provenance are necessary. \textsc{PACT} reframes agent security as authority binding, and isolates the remaining deployment bottleneck to provenance inference and contract synthesis.

Linfeng Fan, Ziwei Li, Yuan Tian +3

Gaoling School of Artificial Intelligence, Renmin University of China, Beijing, China · King Abdullah University of Science and Technology, Thuwal, Saudi Arabia · Dongbei University of Finance and Economics, Dalian, China +1

Untrusted Content Agentic Deployments AI Trustworthiness Security LLM Reasoning Strategies

Ask PDF

May 13, 2026cs.LO

Proof-Carrying Certificates for LLM Pipelines: A Trust-Boundary Architecture

We present a framework for verifying the deterministic structured computations surrounding a large language model rather than the model itself, extending a Lean 4 trust-boundary architecture to the generic interfaces of modern LLM pipelines. Certificate validity is a Lean 4 kernel type-check plus a sorry-free transitive axiom audit against the trusted set {propext, Classical.choice, Quot.sound}; other assumptions are declared and partitioned by tier (mathematical placeholders, cryptographic assumptions, ML/human oracles). The technical contribution comprises three local certificate families and two operators. The families are conflict-aware bilattice grounding (with an emission-gate soundness lemma), embedding sensitivity and paraphrase stability, and Hoare-style agent action. The operators are a Maximal Certifiable Residue, which turns abstention into the maximum-weight certifiable residue with audit-logged dropped claims, and a Compositional Stability theorem, which yields a closed-form pipeline-wide perturbation budget from per-layer gains and margins. The three families plus a Universal Assurance Card consolidator form the per-call deliverable for high-stakes deployments: patent and legal retrieval, regulated finance, clinical decision support, and agentic systems with irreversible side effects. A compiled Lean 4 reference artifact (Lean v4.30.0-rc2, Mathlib) covers all 22 certificate types, with 17 of 46 kernel-audited declarations axiom-free, the rest depending only on the trusted set and declared assumptions, and zero uses of sorryAx or Lean.ofReduceBool. The three families are empirically tested through four registered pilots: bilattice grounding on adversarially perturbed HotpotQA, embedding sensitivity in short- and long-form settings, and Hoare-style agent action on a filesystem sandbox with adversarial prompt injection.

George Koomullil

Ascendr, Inc.

Large Language Model Reliability Certificates Finite-Sample Certificates AI Trustworthiness Large Language Model Pipelines Axiom

Ask PDF