ProbeID: Verifying MCP Tool Identity for LLM Agents under Registry Drift

Guanxing Chen; Sining Zhang; Haohuai He; Qiujie Lv; Yu-An Huang; Zhi-An Huang

cs.CROct 24, 2026

ProbeID: Verifying MCP Tool Identity for LLM Agents under Registry Drift

Authors: Guanxing Chen, Sining Zhang, Haohuai He, Qiujie Lv, Yu-An Huang, Zhi-An Huang

Organizations: City University of Hong Kong (Dongguan), Dongguan, China · The Hong Kong Polytechnic University, Hong Kong SAR, China · Zhengzhou University, Zhengzhou, China · Northwestern Polytechnical University, Xi’an, China

Abstract

Agents select tools by copyable descriptions, which cannot establish which implementation runs. ProbeID compares canonicalized responses to schema-valid probes with a trusted admission reference and abstains on ambiguity, so a squatter must copy probe-observable behavior. With the gold present, independent probes and a fixed margin, standard concentration arguments give a shared probe budget logarithmic in the candidate count and bound the joint probability of a wrong decision. On cached MCP-IdentityDrift cases, strict choice reaches $0.956$ hit@1 while description routers fall near chance, but simpler exact comparisons tie it, MMD better tolerates heavy value noise, and a 32B behavioral judge is similarly accurate at higher cost. Random probes from agent banks and a prospective held-out study of 38 tools test theory-set thresholds. On the agent banks, equality refuses every reachable replacement from 64 probes and the bounded distance from 512, and sharper post hoc gates halve both. Two tools whose drift no bank probe reaches always pass. In an MCP-Bench agent, verification cuts tainted tasks from 15 to 9 of 16 at unchanged task success. Over eleven weeks, 7 of 59 real tools changed responses despite version pins. Verification depends on reference integrity, probe coverage, and response noise.

Figures & tables

Figure 1: Behavior decides what copied metadata cannot. (a) Identical tool metadata can hide different responses. (b) Admission stores canonicalized trusted responses to schema-valid probes (M1). (c) Selection sends secret bank probes to candidates and compares their paired responses with the stored reference (M2 to M4). (d) Multiple candidates pass the distance and gap gates (M5), while a sole candidate faces only the distance gate. ProbeID otherwise abstains (M6). Glyphs, names, and distances are schematic.

evidence	probes	rule	decided	wrong
cached cases, gold present	fixed, $\leq 12$	strict choice	1.000	0.044
cached cases, gold present	fixed, $\leq 12$	per-case radius	0.153	0.000
banks, gold present, 8 reachable tools	random, $m{=}32$	Algorithm 1 , equality	0.784	0.000
banks, gold absent, 8 reachable tools	random, $m{=}32$	single gate, equality	0.006	0.006
banks, gold absent, 2 unreachable tools	random, any $m$	single gate, either	1.000	1.000
banks, 77 golds and 67 unaffected tools	random, any $m$	single gate, either	1.000	0.000

Table 1: Operating points kept apart. Decided and wrong are fractions of all checks. With the gold present, wrong is the joint rate Theorem 2 bounds, and with the gold absent it is the acceptance of a replacement. Cached rows use the fixed cache-order probes of the

450

headline cases at

k{=}8

, which meet no sampling condition, and strict choice scores a tie as wrong. Bank rows draw

m

probes at random from the agent study’s banks,

1{,}000

draws per tool, with theory-set thresholds at

\delta{=}0.05

(Appendix Q ). The two unreachable tools match the gold on every bank probe but corrupt agent calls. A check costs

\min(m,B)

probe calls per candidate.

Figure 2: Identity and abstention across operating regimes. (a) Strict-choice hit@1 on the headline and judge cohorts, with routers near chance under copied descriptions. (b) Probe budget against margin. (c) Fresh live probes against a near twin, with the sampling prediction dashed. (d) Acceptance of a rug-pull replacement, gold absent, under random bank probes and theory-set thresholds, averaged over the eight reachable tools. No draw refuses a gold. (e) Comparison methods under retained value noise. (f) Identification and abstention against a committed coverage squatter.

Figure 3: Visible and missed drift. (a) A changed validation error after reinstall is visible, while bank probes miss a tensor value changed on an agent call. (b) Per-tool distance from admission over eleven weeks. (c) Refused and corrupted agent calls by tool. (d) Tainted tasks and probe calls under structural distance and exact equality, one run each.

Appendix figures & tables27 assets

Supplementary material from the paper’s appendix.

Appendix

$\rho$	$m{=}2$	$m{=}4$	$m{=}8$	$m{=}16$
$0.1$	1.000 / 0.000	1.000 / 0.000	1.000 / 0.000	1.000 / 0.000
$0.3$	0.950 / 0.050	0.981 / 0.019	1.000 / 0.000	1.000 / 0.000
$0.5$	0.700 / 0.300	0.956 / 0.044	1.000 / 0.000	1.000 / 0.000
$0.7$	0.425 / 0.575	0.794 / 0.206	0.938 / 0.062	0.994 / 0.006
$0.9$	0.163 / 0.838	0.362 / 0.637	0.619 / 0.381	0.844 / 0.156
$0.95$	0.087 / 0.912	0.163 / 0.838	0.306 / 0.694	0.550 / 0.450

Appendix

Table G.1: An adaptive squatter induces abstention without certification while the gold is a candidate (live get-sum tool, bank of

256

probes,

160

trials per cell). Each entry is correct / abstain, and the misidentification rate is

0.000

in every cell. Raising the committed coverage

\rho

converts correct identifications into escalations, and a larger secret subsample converts them back.

attacker	$k$	hit@1	abstain
blind	1	0.86	0.14
blind	8	0.84	0.16
verifier-aware	1	0.42	0.58
verifier-aware	8	0.10	0.90

Appendix

Table G.2: No misidentification of an independently authored squatter, including a white-box one, with the gold among the candidates (

50

gold benchmark tools). A blind code-model squatter is detected or causes abstention when it is a behavioral twin. A verifier-aware squatter that knows the distance and thresholds can only drive ProbeID to abstain, since a deterministic gold at distance zero cannot be undercut, and the misidentification rate stays

0

over these cases.

$k$	ProbeID	judge view, exact	7B judge	32B judge	Random	Oracle
1	1.000	0.997	0.973	0.996	0.498	1.000
2	0.952	0.951	0.923	0.968	0.352	1.000
4	0.952	0.951	0.906	0.967	0.190	1.000
8	0.952	0.951	0.844	0.950	0.103	1.000

Appendix

Table H.1: Behavioral judges against ProbeID on the judge cohort (

300

gold per seed,

3

seeds,

900

case-runs per

k

, same pool as Table J.1 ). The judges read the probe responses, not the descriptions, so they stay well above the

1/(k+1)

random bound. The judge-view column is an exact-match rule that reads each response as the judges’ prompt shows it, cut to

200

characters. Best non-oracle result in bold.

$k$	sent	200 characters	complete	ProbeID	complete, all
1	827	0.995	0.998	1.000	0.917
2	817	0.965	0.961	0.947	0.872
4	792	0.962	0.957	0.946	0.842
8	746	0.946	0.945	0.946	0.783

Appendix

Table H.2: The 32B judge on complete responses matches the truncated condition where it can read them. Same

900

case-runs per

k

and one serving session for both conditions. Sent counts the case-runs whose complete-response prompt fits the

32{,}768

-token context. The first four columns are hit@1 on the sent case-runs, and the last counts unsent case-runs as misses.

Figure I.1: ProbeID remains flat as description routers recover. Similarity

s

moves from

1

0

k{=}4

, with behavior still mutated. Routers recover away from copied descriptions, while ProbeID is independent of

s

$k$	ProbeID abstain	lexical hit@1
1	1.00	0.998
2	1.00	0.991
4	1.00	0.983

Appendix

Table I.1: Behavioral twins require routing or escalation. Results use 300 gold tools and 3 seeds. ProbeID abstains while lexical routing identifies the gold. The two signals address different failure modes (Table J.1 ).

group ( $\|C\|$ )	ProbeID	abstain	dense	Jaccard	chance
listing (3)	1.00	0.00	0.33	0.33	0.33
reading (2)	–	1.00	0.50	0.50	0.50

Appendix

Table I.2: The admission reference separates natural siblings, and ProbeID abstains on an alias (live filesystem server, real vendor descriptions, all-MiniLM-L6-v2 dense router,

30

seeds, strict tie-breaking). The listing group has three behaviorally distinct siblings, the reading group has a tool and its deprecated alias (a behavioral twin). ProbeID recovers the recorded tool by behavior, or abstains on the twin, while a dense embedding router and a lexical Jaccard router, which lack the reference, sit at the

1/|C|

chance line. Best in bold.

margin $\phi$	$m{=}1$	$m{=}2$	$m{=}4$	$m{=}8$	$m{=}16$
$0.15$	0.15	0.34	0.38	0.65	0.93
$0.30$	0.29	0.58	0.74	0.95	1.00
$0.50$	0.49	0.75	0.94	0.99	1.00

Appendix

Table I.3: Probe budgets resolve two close JSON implementations (the CPython and V8 serializers, live over stdio JSON-RPC,

100

seeds). The tools agree on most inputs and diverge only on integer-valued floats and non-ASCII escaping, a small natural margin

\phi

. Identity hit@1 rises with the probe budget

m

and tracks

1-(1-\phi)^{m}

. No wrong candidate was selected in any of the

100

seeded trials of any cell, since the gold matches its own reference, and the remainder abstains.

$k$	ProbeID	BM25	Dense	LLM-card	Random	Oracle
1	1.000	0.496	0.516	0.496	0.538	1.000
2	0.956	0.344	0.344	0.344	0.349	1.000
4	0.956	0.200	0.207	0.200	0.191	1.000
8	0.956	0.111	0.111	0.111	0.107	1.000

Appendix

Table J.1: ProbeID recovers identity where copied descriptions reduce routers to chance. Identity hit@1 under rug pull drift, on 402 tools with real ToolBench descriptions (150 gold per seed, 3 seeds). BM25, dense retrieval, and an LLM reranker all match random because the squatter copies the gold description. Best non-oracle result in bold.

	no noise		ten volatile fields		leaf jitter, canon on
selector	canon on	canon off	listed, off	unlisted, on	$\rho{=}0.1$	$\rho{=}0.2$
ProbeID (structural $d_{Y}$ )	0.952	0.974	0.952	0.950	0.950	0.927
per-probe vote	0.952	0.974	0.952	0.950	0.943	0.920
MET style MMD	0.952	0.974	0.953	0.951	0.956	0.949
embedding NN	0.952	0.974	0.899	0.868	0.928	0.917
exact equality (0/1)	0.952	0.974	0.083	0.083	0.761	0.641

Appendix

Table J.2: On one fixed cohort, the structural distance does not dominate every behavioral comparison (

k{=}4

, 300 gold per seed, 3 seeds). Volatile fields named on the drop list leave every selector at the clean value when the canonicalizer is on, by construction, and that column is omitted. A canonicalizer tolerates only fields it names, 0/1 tests fall furthest under noise it does not remove, the set-level MMD degrades least under value jitter, and on the clean cache even type and length separates most cases.

Figure K.1: The probe budget binds on real recorded behavior. Identity hit@1 against probe budget

m

when the squatter diverges on a

\gamma

fraction of real cached probes (

k{=}4

). Solid is measured, dashed is the matching closed form conditional on a separable case. Each probe replays a recorded response of a real API, so the budget effect is not an artifact of the simulated channel of Figure 2 (b).

	$\gamma{=}0.1$	$0.15$	$0.2$	$0.3$	$0.4$
$m^{\star}$ (self dist. $0.18$ )	256	128	128	64	32
$m^{\star}\gamma^{2}$	2.6	2.9	5.1	5.8	5.1
$m^{\star}$ (self dist. $0.34$ )	$>$ 256	256	128	64	64
$m^{\star}\gamma^{2}$	–	5.8	5.1	5.8	10.2

Appendix

Table K.1: The 0.99 hit@1 budget is consistent with

m^{\star}\!\propto\!\sigma^{2}/\gamma^{2}

. Results use 200 gold and 3 seeds. The product

m^{\star}\gamma^{2}

is approximately constant across nominal margins and rises with self distance, consistent with the

\sigma^{2}

factor.

source	$\phi$	identity hit@1 at $m$
		$1$	$2$	$4$	$8$	$16$
uniform	$0.15$	0.10	0.33	0.53	0.73	0.90
	$0.30$	0.27	0.50	0.70	0.93	1.00
	$0.50$	0.40	0.67	0.93	1.00	1.00
M1 schema	$0.15$	0.60	0.70	0.83	1.00	1.00
	$0.30$	0.63	0.80	0.87	1.00	1.00

Appendix

Table L.1: Fresh probes recover identity on a live server without cached replay (live get-sum tool, graded near twin at margin

\phi

k{=}1

, 30 fresh probe draws per cell, no cache consulted). The uniform control’s hit@1 tracks

1-(1-\phi)^{m}

at its realized divergence. The proposed M1 generator reaches

1.00

at least as fast, since its boundary values over-cover the tested drift region.

family	$k$	ProbeID hit@1 at $m$				router
(tool)		$1$	$2$	$4$	$8$	$\tfrac{1}{k+1}$
filesystem	$1$	0.53	0.77	0.93	1.00	0.50
(read_text_file)	$2$	0.27	0.70	0.93	1.00	0.33
	$3$	0.00	0.43	0.90	1.00	0.25
memory	$1$	0.60	0.77	0.97	1.00	0.50
(open_nodes)	$2$	0.33	0.73	0.93	1.00	0.33

Appendix

Table L.2: Identity hit@1 on three live MCP server families over stdio JSON-RPC,

30

seeds per cell, strict tie-breaking. The description router over the byte-identical tool cards can only guess at

1/(k{+}1)

. ProbeID recovers identity as the probe budget grows on the filesystem and memory families, where each squatter is the same official binary on tampered data, and saturates at one probe on the everything family, whose squatter drifts on every input.

tool	sloppy	faithful	twin	self	twin
(server)	$m{=}1$	$m{=}1$	abstain	dist	dist
get-sum (everything)	1.00	1.00	1.00	0.00	0.00
echo (everything)	1.00	1.00	1.00	0.00	0.00
read_text_file (fs)	1.00	1.00	1.00	0.00	0.00
open_nodes (memory)	1.00	1.00	1.00	0.00	0.00

Appendix

Table L.3: Tested value drift separates re-implemented squatters, identity hit@1 over live stdio JSON-RPC (

k{=}3

squatters in two distinct codebases,

30

seeds, strict tie-breaking). A format-faithful squatter that copies the gold’s exact output envelope but returns a wrong value is caught at a single probe, identically to a sloppy one, because the behavioral distance compares canonicalized values, not format. Under the gated rule, ProbeID abstains on the exact behavioral twin. Self distance is the gold against itself and twin distance is the re-implemented twin against the gold, both

0.00

on the sampled responses.

probing	self dist	abstain	wrong, all trials	hit@1
naive (shared)	1.00	1.00	0.00	–
sandboxed (fresh)	0.00	0.00	0.00	1.00

Appendix

Table M.1: Sandboxed state restores identity in the counter experiment. Gold step

1

, squatter step

2

m{=}8

30

trials. Shared sessions produce abstention, while a fresh sandbox restores zero self distance and identifies the gold.

tool	squatter drift	hit@1	misident.
store	write semantics	1.00	0.00
read_secret	auth bypass	1.00	0.00

Appendix

Table M.2: Observed writes and authentication checks distinguish the tested squatters. Live FastMCP,

30

trials, strict ties, and identical tool cards. Reset sandboxes expose changed overwrite semantics or bypassed authentication, with no observed misidentification.

output size $N$	1	2	5	10	20	40
margin $\gamma$	0.083	0.042	0.017	0.008	0.004	0.002
identity hit@1	1.00	1.00	1.00	1.00	1.00	1.00
passes margin gate ( $\gamma{\geq}\gamma_{\min}$ )	yes	no	no	no	no	no

Appendix

Table N.1: Large outputs dilute the observed margin and increase abstention. Memory queries use

f{=}1

changed node and

\gamma_{\min}{=}0.05

. The margin shrinks as

1/N

. Ranking remains correct, while a one-field difference below the threshold triggers escalation.

regime	servers	tools probed	mean self distance
deterministic	10	35	0.00
nondeterministic	4	16	0.10–0.92

Appendix

Table O.1: In-the-wild self distance on

16

real MCP servers (read-only tools,

3

probe passes, canonicalization on). Under canonicalization most real tools are deterministic (self distance

0

), which says nothing about whether squatters are separable. A minority are nondeterministic, the

\sigma>0

regime that the variance-aware budget and the abstention rule address. Canonicalization succeeds on every response of every server.

arm	agent calls	replayed	corrupted	rate	tainted	refused
benign, no gate	1453	1388	0	0.000	0/16	0
benign, gate	1417	1347	0	0.000	0/16	0
rug pull, no gate	1575	1476	93	0.063	15/16	0
rug pull, gate	1323	1159	20	0.017	9/16	102

Appendix

Table P.1: Verification cuts corrupted calls in four arms over

16

MCP-Bench tasks , ground truth by gold-server replay. Corrupted calls are values the agent was given that the gold server would not have returned. With the verifier they fall from

93

20

, and

102

calls are refused instead, at zero refusals in the benign arm. Each arm was run three times, and the table reports the first, with the spread below.

per-probe comparison	$m$	corrupted	tainted	refused	probe calls
no gate	$0$	93	15/16	0	0
structural $d_{Y}$	$32$	35	13/16	31	8,398
structural $d_{Y}$	$128$	35	13/16	68	33,891
structural $d_{Y}$	$512$	20	9/16	102	126,428
exact equality	$32$	22	8/16	84	8,412

Appendix

Table P.2: Exact equality verifies deterministic drift at a fraction of the probe calls, end to end. Rug pull arm over the same

16

tasks, one run each, the

m{=}512

row being run 1 of Table P.1 . Corrupted calls and tainted tasks come from the gold replay, refusals from the call log and probe calls from the gate’s own log. Every gated row retains the corruption of the stateful tensor tool and of the batch converter, whose probes never reach the drift, and the lower structural budgets retain more.

		structural $d_{Y}$		exact equality
bound	premise	cells	violations	cells	violations
replacement refused, rate $\geq 1-\delta$	$\mu_{s}-s>2\epsilon_{1}$	16	0	43	0
gold accepted, rate $\geq 1-\delta$	$s\geq\mu_{g}$	539	0	539	0
joint wrong decision, rate $\leq\delta$	gold present, $\mu_{s}>\mu_{g}$	56	0	56	0
gold returned, rate $\geq 1-\delta$	$\mu_{s}-\mu_{g}\geq 4\epsilon_{2}$ , $s\geq\mu_{g}$	6	0	27	0

Appendix

Table Q.1: Every observed rate respects its bound on the bank distribution. A cell is one tool, comparison and budget, scored over

1{,}000

random draws. Premise cells are those where the stated condition holds for the bank means. A violation is an observed rate on the wrong side of the bound.

	margin		structural $d_{Y}$ at $m$				exact equality at $m$
tool	$d_{Y}$	equality	32	128	256	512	8	16	32	64
mean	0.941	0.941	0.000	0.000	0.000	0.000	0.000	0.000	0.000	0.000
round	0.465	0.465	0.003	0.000	0.000	0.000	0.460	0.184	0.003	0.000
bmi_bsa_calculator	0.093	0.371	1.000	0.997	0.060	0.000	0.651	0.435	0.046	0.000
convert_density	0.177	0.883	1.000	0.000	0.000	0.000	0.001	0.000	0.000	0.000
convert_force	0.163	0.814	1.000	0.000	0.000	0.000	0.008	0.000	0.000	0.000

Appendix

Table Q.2: Acceptance of a replacement with the gold absent , the fraction of

1{,}000

random bank draws on which the single-candidate gate accepts the rug-pull squatter, for the ten tools whose squatter corrupted agent calls. Margins are the squatter’s bank mean distance. The last two tools match the gold on every bank entry.

			structural $d_{Y}$		exact equality
rule	bound	premise	cells	violations	cells	violations
fixed	accept, rate $\geq 1-\delta$	$\mu\leq s$	879	0	936	0
fixed	refuse, rate $\geq 1-\delta$	$\mu-s>2\epsilon_{1}$	586	0	615	0
fixed	joint wrong decision, rate $\leq\delta$	$\mu>\mu_{g}$	1153	0	1096	0
fixed	gold returned, rate $\geq 1-\delta$	$\mu-\mu_{g}\geq 4\epsilon_{2}$ , $s\geq\mu_{g}$	272	0	313	0
sequential	refuse, rate $\leq\delta$	$\mu\leq s$	262	0	280	0

Appendix

Table R.1: No observed rate breaks its bound in the held-out study. Cells are tool, candidate, comparison and budget for the fixed rules, and tool, candidate, comparison and resolution for the sequential rules, over all

38

tools, the gold and the seven policies. Premises are checked on the bank means. A violation is an observed rate on the wrong side of the bound.

		structural $d_{Y}$			exact equality
candidate	changed	fixed	sequential	calls	fixed	sequential	calls
$22$ local tools
gold (unchanged server)	–	1.000	1.000	128	1.000	1.000	128
value drift, $\phi{=}1$	22	0.000	0.000	8	0.045	0.045	14
value drift, $\phi{=}0.25$	22	0.000	0.011	82	0.045	0.056	80
value drift, $\phi{=}0.05$	22	0.636	0.744	163	0.636	0.744	163

Appendix

Table R.2: Held-out outcomes by candidate , averaged over tools with at least

16

distinct inputs. Changed counts the tools on which the policy alters at least one answer. Fixed is the acceptance rate of the single-candidate gate at the full bank, sequential its acceptance rate at

\gamma_{\mathrm{res}}{=}0.2

with the mean number of probe calls per check.

	equality, gold absent		structural $d_{Y}$ , gold absent		$d_{Y}$ , gold returned
$m$	Hoeffding	exact	Hoeffding	finite pop.	Hoeffding	finite pop.
8	0.154	0.004	0.807	0.807	0.000	0.000
16	0.079	0.000	0.773	0.760	0.128	0.128
32	0.006	0.000	0.750	0.750	0.158	0.158
64	0.000	0.000	0.552	0.238	0.244	0.247
128	0.000	0.000	0.135	0.075	0.250	0.250

Appendix

Table S.1: Sharper gates halve the observed refusal budget on the agent banks. Acceptance of a reachable rug-pull replacement with the gold absent, averaged over the eight reachable tools, and the rate at which the pair rule returns the gold with it present, over

1{,}000

paired draws per budget. Values are rounded, so a printed zero need not mean zero acceptances. The sharper rules were added after the Hoeffding results were known.

study	rule	$\tau_{\mathrm{hi}}$	$\gamma_{\min}$
Tables J.1 , H.1 and H.2 (ProbeID and judge view; the judges abstain on 0), J.2 , L.1 , L.2 , L.3 (sloppy and faithful); Figures 2 (c), I.1 , K.1 ; Appendices J.1 , K.2	forced choice	–	–
Tables G.1 , G.2 , I.2 , I.3 , L.3 (twin), M.1 , M.2 ; sibling groups	gated	$0.5$	$0.05$
Table I.1	gated	$0.6$	$0.05$
Table N.1	margin $\geq\gamma_{\min}$	–	$0.05$
Appendix K.3	calibrated, swept	–	–
Tables P.1 , P.2 ; census gate (Appendix O )	one-sided gate	self dist. $+\,\epsilon$	–

Appendix

Table T.1: Study conclusions depend on the decision rule. Forced choice treats a gold tie as a miss. Gated selection uses Algorithm 1 . The single-candidate gate accepts distance at most

\tau_{\mathrm{hi}}

(Appendix C ). The gated thresholds

0.5

and

0.05

are fixed defaults of the released configuration, not derived from the theory, and the twin family uses

0.6

. Appendix K.3 scores the theory-calibrated radius on the cached cases. The sequential gate also accepts once

d^{(j)}+\epsilon_{j}\leq s+\gamma_{\mathrm{res}}

, and its paired form uses the gap

2\epsilon_{j}

LLM Agent Verification

LLM agent verification checks whether agents’ actions, evidence, policies, and completion claims satisfy explicit requirements.

See all 147 papers

Jul 13, 2026

AgentCheck: A Reproduce-Intervene-Mitigate Workbench for LLM Agents over MCP

Tool-using LLM agents are mostly evaluated assuming all tools work. When a tool times out, returns a week-stale value, or has its description poisoned in deployment, the developer needs a controlled way to reproduce the failure, test a fix, and confirm the fix worked before deployment. We present AgentCheck, an open-source web workbench that turns an MCP server into an intervention surface. AgentCheck runs an agent against its real tools and records every tool response, then re-runs the agent with the response perturbed by a fault (12 types) injector. Matching tool calls are replayed from cache, and later tool calls go live after the agent diverges. This yields a reproduce-intervene-confirm loop: the developer toggles a mitigation, re-runs against the identical fault, and sees if the failure goes away. Scoring has two parts: deterministic pass/fail rules, plus an LLM judge for interpretive labels, validated against human annotations. Across five agents, the best passes 105/120 scenarios and the weakest only 77. The failures are usually silent, confident use of incorrect tool outputs rather than crashes. On the weakest agent, a retry mitigation raises success on timeout error faults from as few as 30% of cases to 100%, whereas stale-data faults remain near 3-4 of 10 regardless of the mitigation. AgentCheck makes these failure modes reproducible, comparable, and verifiable before deployment.

Aritra Mazumder, Nusrat jahan Lia

University of Utah · University of Dhaka

AI Agent Reliability LLM Agent Evaluation LLM Agent Verification Tool-Using Agents LLM Agent Reliability

Ask PDF

Aug 30, 2026

AgentProv: Auditing Agentic LLM API Providers via Tool-use Policy Probes

Commercial LLM APIs advertise a specific foundation model, but the served backbone may be silently substituted, quantized, or wrapped, for example to save deployment costs. All existing audits decide backbone identity from the text-output channel, which is structurally fragile for agentic APIs because modern serving stacks (OpenAI, Anthropic, Gemini, Cloudflare Workers AI, LangGraph) discard text and expose only structured actions when the model calls a tool, and provider-injected system prompts can distort text distributions enough that text-channel tests falsely accuse honest providers of substituting the claimed model. We observe that recent agentic post-training internalizes tool-use directly into the weights, opening a new audit channel that the serving stack still exposes and that is largely invariant to deployment context. We introduce Agentic Provenance (AgentProv), the first action-based identity audit for agentic LLM APIs: AgentProv fingerprints a deployed model through its categorical tool-call distribution and decides identity via an MMD permutation test. AgentProv catches every substituted model (100% on 630 evaluated checkpoint pairs), while holding the false-positive rate under system-prompt injection at 7% (vs. 67% for MET and 53% for RUT). On third-party API endpoints, AgentProv's disagreements with MET are consistent with an independent token-count side-channel that detects provider-injected system prompts.

Xun Wang, Bihe Zhao, Michael Backes +2

CISPA Helmholtz Center for Information Security

LLM Auditing Language Model Fingerprinting

Ask PDF

Apr 1, 2026

Beyond Task Completion: A Verification-vs.-Conformance Gap in Tool-Evolving Agents

Agents that synthesize their own tools ship a second artifact alongside each answer: a software library that future tasks reuse, compose, and depend on. Task completion (TC) certifies the answer; it does not certify the library. On a Claude Haiku 4.5 pilot, we patch the harness to preserve per-tool source and replay every synthesised tool against a held-out conformance suite. Across 222 preserved tools and three protocols, 96.8% record per-tool correctness C=0.00: two protocols silent-rot at 100%, one at 91.7%. Hand-written reference implementations score C=1.00 on all 16 capability suites. The synthesised tools execute cleanly and the in-session verifier raises no flag; on held-out inputs they simply return wrong answers. This is the verification-vs.-conformance gap a pass-rate benchmark cannot see. EvolveTool-Bench makes that gap measurable. Sessions are structured into seed, gap, variant, composition, regression, and adversarial roles; runs emit per-tool manifests, verified-subset TC, correct-vs.-incorrect reuse, and audit traces for post-deployment monitoring. In the Haiku pilot over five protocols (3 seeds, 8 sessions, 51 verified decisions per pass), TC alone does not separate the protocols; the audit layer does. One pre-specified contrast shows the adapted decision-split synthesis protocol underperforming one-shot synthesis (-7.1 pp, 95% CI [-13.9,-0.1]; not significant after BH correction) -- a hypothesis-generating signal, not a confirmed effect. We release the harness, per-tool source preservation, conformance replay, and reproducibility manifests. An audit schema of this shape -- verifier coverage, reuse decomposition, held-out conformance -- is the minimum a deployed tool-evolving agent should emit between releases.

Alibek Kaliyev, Artem Maryanskyy

The University of Texas at Austin · Austin, Texas, USA · Uber +1

AI Agent Reliability Tool-Use Evaluation Automated Software Testing LLM-Based Program Synthesis LLM Agent Verification AI Agent Benchmarks+1

Ask PDF

Abstract

LLM Agent Verification

Explore similar work

AgentCheck: A Reproduce-Intervene-Mitigate Workbench for LLM Agents over MCP

AgentProv: Auditing Agentic LLM API Providers via Tool-use Policy Probes

Beyond Task Completion: A Verification-vs.-Conformance Gap in Tool-Evolving Agents