Auditing Tool Traces in Agentic LLMs: Source Localization and Counterfactual Dependence Testing

Junhao Liu; Tianxiao Li; Yongxian Wu; Ziheng Duan; Ren Li; Jing Zhang; Martin Renqiang Min

cs.AIOct 18, 2026

Auditing Tool Traces in Agentic LLMs: Source Localization and Counterfactual Dependence Testing

Authors: Junhao Liu, Tianxiao Li, Yongxian Wu, Ziheng Duan, Ren Li, Jing Zhang, Martin Renqiang Min

Organizations: University of California, Irvine · NEC Labs America

Abstract

Agentic LLMs increasingly support scientific prediction by grounding decisions in external evidence. In biology, they promise accurate, interpretable predictions for important problems by integrating complex experimental and computational evidence. However, serialized tool results can contain hidden label shortcuts, such as dataset identifiers or template artifacts, that create apparent success without biological reasoning. To address this risk, we introduce a two-stage audit. Stage 1, Per-Tool TF-IDF Decomposition (PT2D), localizes label-predictive patterns to individual tool results while avoiding signal dilution in the concatenated tool trace. Stage 2, Token-Class Redaction, counterfactually tests whether the frozen LLM depends on the localized shortcut. We apply this audit to TCR-pMHC binding, where tool augmentation substantially outperforms a no-evidence baseline. At face value, this suggests that the LLM has learned to use scientific evidence. The audit overturns this interpretation: PT2D localizes the strongest signal to identifiers in one tool result, and redacting them reduces performance to chance. These findings show how hidden label shortcuts can masquerade as scientific reasoning or discovery, motivating source-level audits before benchmark gains are trusted.

Figures & tables

Variant	AUROC $\uparrow$	$\Delta A_{c}$
Original	0.8136	—
PDB-ID redacted	0.4972	$+0.3163$
Peptide redacted	0.8152	$-0.0017$

Table 1: Frozen-checkpoint AUROC after targeted token-class redaction (

\Delta A_{c}=A_{\mathrm{orig}}-A_{R_{c}}

Appendix figures & tables9 assets

Supplementary material from the paper’s appendix.

Appendix

Split	Total	Positive	Negative
Train (C0)	12,940	3,483	9,457
Validation (C0)	1,438	397	1,041
Test C1	1,004	45	959
Test C2	994	38	956
Test C3	968	30	938
Test C4	968	109	859

Appendix

Table 2: Dataset composition. Test clusters C1–C5 contain peptides disjoint from cluster 0.

Step	Tool	Tool-result content
1	CDR3 $\beta$ biophysical analysis	Length, residue composition, charge, flexibility, and contact-potential descriptors.
2	McPAS-TCR retrieval	Database matches, sequence similarity, and associated epitope annotations.
3	ThermoMPNN $\Delta\Delta G$	Mutation-level stability predictions and the serialized inference filename.
4	Stability summary	Positional stability and hotspot summaries derived from Tool 3.
5	TCR–pMHC interface analysis	Buried surface area, contact distances, hydrogen bonds, salt bridges, and a serialized complex identifier.

Appendix

Table 3: Fixed tool-trace order used during SFT and evaluation.

Scope	Word 1–2	Char 2–5	Char 3–5
Full trace	0.4818	0.4677	0.4876
Tool 1	0.4569	0.4797	0.4733
Tool 2	0.4681	0.4839	0.4985
Tool 3	0.4946	0.6288	0.6365
Tool 4	0.4947	0.5050	0.5015
Tool 5	0.4833	0.5259	0.5310

Appendix

Table 4: PT2D AUROC computed jointly over all examples from test clusters C1–C5. Character features isolate Tool 3 despite the near-chance full-trace diagnostic.

Scope	All	C1	C2	C3	C4	C5
Full trace	0.4876	0.4888	0.5413	0.6359	0.4565	0.4216
Tool 1	0.4733	0.3769	0.4687	0.5548	0.4881	0.4403
Tool 2	0.4985	0.4997	0.5957	0.5708	0.4706	0.4160
Tool 3	0.6365	0.5566	0.6392	0.6109	0.6999	0.4874
Tool 4	0.5015	0.4510	0.5369	0.5727	0.4878	0.5037
Tool 5	0.5310	0.4982	0.5018	0.5445	0.5702	0.4717

Appendix

Table 5: Character

3

–

5

-gram PT2D AUROC by peptide-disjoint test cluster. All denotes AUROC computed jointly over C1–C5.

Prefix	All	C1	C2	C3	C4	C5
1 digit	0.6725	0.5776	0.5686	0.6542	0.7470	0.5202
2 digits	0.6967	0.5794	0.7416	0.5946	0.7716	0.4967
3 digits	0.6793	0.4820	0.6522	0.5614	0.8442	0.5817

Appendix

Table 6: Cross-split AUROC of an explicit PDB-prefix lookup learned on cluster 0. All denotes AUROC computed jointly over C1–C5.

Variant	Replacements	Placeholder
PDB ID	50,778	<PDB_ID>
Peptide	63,674	<PEPTIDE>
Format	3,582,603	<FORMAT>

Appendix

Table 7: Total replacements across the 4,898 test prompts and their duplicated prompt-bearing fields.

Variant	All	$\Delta A_{c}$	C1	C2	C3	C4	C5
Original	0.8136	—	0.5746	0.8298	0.8324	0.8686	0.8322
PDB-ID redacted	0.4972	$+0.3163$	0.5126	0.5241	0.4818	0.4963	0.4858
Peptide redacted	0.8152	$-0.0017$	0.5763	0.8535	0.8437	0.8646	0.8295
Format redacted	0.5189	$+0.2947$	0.4787	0.4829	0.4343	0.5747	0.5184

Appendix

Table 8: Formal frozen-checkpoint generation AUROC. All denotes AUROC computed jointly over C1–C5. Positive

\Delta A_{c}=A_{\mathrm{orig}}-A_{R_{c}}

denotes performance lost after redaction. The broad format intervention is a sensitivity analysis rather than a clean control.

Tools	$\|S\|$	AUROC	95% CI
{3}	1	0.6365	[0.6008, 0.6704]
{3,1}	2	0.6049	[0.5679, 0.6415]
{3,1,2}	3	0.5284	[0.4941, 0.5622]
{3,1,2,4}	4	0.4956	[0.4605, 0.5291]
{3,1,2,4,5}	5	0.4876	[0.4553, 0.5221]

Appendix

Table 9: Real-tool dilution sweep with Tool 3 fixed as the carrier.

$K$	Mean	SD	Min	Max
0	0.6365	0.0000	0.6365	0.6365
1	0.5701	0.0121	0.5590	0.5891
2	0.5429	0.0218	0.5256	0.5809
5	0.5064	0.0259	0.4821	0.5489
10	0.4749	0.0302	0.4464	0.5249
20	0.4900	0.0209	0.4669	0.5167

Appendix

Table 10: AUROC is computed jointly over test clusters C1–C5 and summarized over five synthetic-dilution seeds. The curve reaches chance by five added sections and remains near chance thereafter.

LLM Auditing

Large language model auditing tests models and deployed systems for bias, safety, privacy, reliability, and provenance using behavioral and internal evidence.

See all 621 papers

Auditing Provenance Sensitivity in LLM Agent Action Selection
Jul 23, 2026Junchi LiaoAI Agent Auditing LLM Auditing
AgentProv: Auditing Agentic LLM API Providers via Tool-use Policy Probes
Aug 30, 2026Xun Wang, Bihe Zhao, Michael Backes +2LLM Auditing Language Model Fingerprinting
CISPA Helmholtz Center for Information Security
LEDGER: Claim-to-Evidence Trace Graphs for Auditing LLM Agents
Aug 19, 2026Daehong Kim, Haichao Miao, Shusen LiuAI Agent Auditing Data Provenance
Carnegie Mellon University Pittsburgh, PA 15213 · Lawrence Livermore National Laboratory Livermore, CA 94550

Jul 23, 2026J/K move · Enter open · S save

Auditing Provenance Sensitivity in LLM Agent Action Selection

Junchi Liao

AI Agent Auditing LLM Auditing LLM Agents LLM Agent Safety

Open paper AskPDF arXiv

LLM agents choose tools and arguments from context that mixes user requests, tool outputs, retrieved records, memory, and untrusted text. Evidence can be relevant without being authorized to determine a decision, so a correct action need not be grounded only in permitted evidence. We introduce a target-specific authorization audit that labels context factors separately for each tool and argument target. Its primary test holds the task, proposition, position, and policy fixed while changing only the proposition's source authority. We then test behavior when valid evidence is weakened and use context-subset interactions as a secondary localization diagnostic. Across 450 controlled next-action tasks and multiple open-weight LLM families, trusted and untrusted variants produce different actions in 5.4 percent of competing cases versus 1.7 percent of supporting cases. Under controlled degradation, unauthorized competition is retained in a full-correct, mixed-error, clean-correct pattern in 2.4 percent of comparisons, with a 95 percent confidence interval from 2.1 to 3.0 percent. These are controlled stress-set rates, not deployment prevalence. The models respond to textual source-authority cues, but this does not prevent untrusted evidence from influencing their actions.

Abstract

LLM Auditing

Explore similar work

Auditing Provenance Sensitivity in LLM Agent Action Selection

AgentProv: Auditing Agentic LLM API Providers via Tool-use Policy Probes

LEDGER: Claim-to-Evidence Trace Graphs for Auditing LLM Agents