Agent networks require reliable ways for requesting agents to verify where data is located, how it can be accessed, and whether the data received matches what the data owner made available. Checksum mismatches can reflect either altered content or serialization differences that preserve data equivalence under specified rules. Data identification mechanisms for agents, such as DataFacts, describe where data can be accessed and provide checksums for checking received data against published references. We propose a serialization-invariant identification method that assigns the same identifier to data representations equivalent under explicit rules. We use DataFacts as a case study, retaining its existing checksum alongside the proposed identifier. In a controlled agent study, we compare the proposed configuration with ordinary-tool and checksum baselines across equivalent re-encodings, altered content, and unavailable references. The study includes three model tiers from each of two providers. For equivalent re-encodings, the proposed configuration increased expected-outcome rates by 80.4 percentage points over the ordinary-tool baseline and by 70.2 percentage points over the checksum baseline. The proposed configuration also increased evidence-supported rejection of altered content by 3.5 percentage points over the checksum baseline. We contribute a serialization-invariant identification method with explicit equivalence rules, an integration approach illustrated through DataFacts, and an empirical evaluation against ordinary-tool and checksum baselines.
Figures & tables
Fig. 1: Illustrative DataFacts exchange. Re-encoding a numeric value from 34 to 34.0 changes the existing JSON checksum but preserves the proposed identifier; changing the value to 43 changes both. Hashes are shown as six-character prefixes.
1
q←CheckReference(R)
2
if q failed: return its status and reason
3
try
4
x←ParseExact(B)
5
y←NFCRecursive(x)
6
b←JCS(PrepareNumbers(y))
7
z←ParseExact(b)
Table 2
Case
Example
Expected
Equivalent re-encoding
Formatting
Change whitespace or key order
Accept
Integers
64 vs. 64.0
Accept
Trailing zeros
21.5 vs. 21.500
Accept
Exponents
-12.75 vs. -1275e-2 ; 0.0000001 vs. 1e-7
Accept
Fractions
0.1 vs. 1e-1
Accept
TABLE I: Exchange scenarios and test cases.
Comparison baseline
Baseline rate (%)
Proposed rate (%)
Gain (pp)
Equivalent re-encoding (accept)
Ordinary tools
18.4
98.8
+80.4
Checksum verifier
28.5
98.8
+70.2
Altered content (evidence-supported rejection)
Ordinary tools
65.9
97.4
+31.5
Checksum verifier
93.8
97.4
+3.5
TABLE II: Expected-outcome rates by scenario.
GPT
Claude
Configuration
Luna
Terra
Sol
Haiku
Sonnet
Opus
All
Equivalent re-encoding
Ordinary tools
42.6
28.7
33.3
4.6
0.9
0.0
18.4
Checksum
44.4
43.5
42.6
28.7
12.0
0.0
28.5
Proposed
99.1
100.0
100.0
99.1
100.0
94.4
98.8
Altered content
TABLE III: Expected-outcome rates by model and scenario (%).
Long-horizon agents execute thousands of actions, resulting in sequential failures rather than isolated errors. When a coding agent deletes a production database or a prompt injection spreads across agents, the incident raises questions of causality, authority, and non-repudiable third-party verification. The Agent Flight Recorder captures each agent action as a structured, canonically serialized event binding eight semantic fields from intent through execution to provenance. Hash chaining and Merkle batching provide tamper evidence and compact inclusion proofs. For cross-organizational disputes where no party's infrastructure qualifies as neutral ground, periodic on-chain anchoring of epoch roots lets any verifier with the disclosed payload and Merkle proof check the record independently, without pre-agreeing on a trusted intermediary. The on-chain footprint is minimal: each anchor stores a 32-byte epoch root and a back-pointer, and no event content touches the chain. We evaluate the system across five cumulative ablation configurations on synthetic agent workloads. The full system adds ~48 microseconds median per-event latency and 512 bytes per event. L2 anchoring costs $2.30 per 100K events at 100-event epochs. The full integrity stack detects edit, delete, reorder, and fork tampering at 100% with zero false positives. Structured forensic queries achieve 1.0 precision on guardrail and delegation lookups where unstructured text search yields 0.013 and 0.077 respectively.
Laurent Bindschaedler, Quentin Botha, Christoph Siebenbrunner
Max Planck Institute for Software Systems · Research Institute for Cryptoeconomics, Vienna University of Economics and Business
Agentic systems act, so a defect in the evidence they retrieve becomes a wrong action with a currency cost. The most dangerous enterprise defects are metadata-borne: a stale price or a superseded record, perfectly well-formed in the payload and betrayed only by freshness, lineage, or provenance. Such a defect never enters the agent's context, and an agent cannot doubt data it cannot see. On a priced replenishment benchmark, a competent agent silently converts an injected metadata-borne defect into a costly action about 60% of the time, with zero data-quality flags and behavioral doubt markers at chance (AUC <= 0.50). Across four model tiers spanning roughly 15x in inference price, the rate stays flat: capability does not buy skepticism. A metadata-aware pre-action gate with downstream-only remediation recovers the loss fully on the signals its predicates cover and not at all on those they miss. A model-free oracle derived from the task's decision geometry tracks the measured rates with MAE 0.015 (Pearson r = 0.876, interval coverage 15/16 cells), giving the flat ladder an analytical form. Evidence integrity is a systems axis distinct from model capability; mitigation depends on enforcement placement and predicate coverage. Code, frozen results, and a deterministic analysis pipeline: https://github.com/besanson/dqSarc
Benchmarks for agent-generated data work grade a pipeline by running it once against a fixed snapshot. ArrivalBench instead re-executes the pipeline an agent leaves behind under adversarial but replayable delivery schedules (late, duplicated, out-of-order and retried records) and requires its final state to equal a batch recomputation of the complete log. Because the oracle recomputes rather than classifies, a wrong table and a crash are distinct verdicts: a crash is visible to monitoring a team already runs, and a wrong table is not. On 40 tasks we built, our reimplementation of single-execution grading certifies 86-100% of the pipelines eleven models produce; re-executing the same artifacts finds 7.0-79.2% of the certified ones silently wrong. The gap is not produced by the repair loop: within the same model and task, pipelines repaired against the snapshot test fail replay about as often as those that passed it first time. In every model, idempotency hazards fail more often than ordering hazards. Separating a wrong answer from a crash also changes how interventions read: a hazard warning cuts one model's silent failure from 48.2% to 10.5% while raising its crash rate from 9.0% to 37.0%, so all-in failure moves only from 51.0% to 44.0%. All eleven arms were independently re-run, and rates moved by at most 5.9 points.
Pranay Kothari
Department of Computer Science, University of Oxford