AI Agent Auditing

Follow this topic Ask about this topic

AI agent auditing studies whether autonomous systems follow their instructions and policies as they use tools, exchange information, and change external state. Researchers combine trace analysis, runtime monitoring and authorization, static and dynamic security testing, adversarial benchmarks, and tamper-evident logs to detect violations and reconstruct how they occurred. A central lesson is that correct final answers or benchmark scores do not establish safe or faithful execution; audits increasingly examine intermediate decisions, permissions, evidence provenance, and effects on the environment. The field still faces challenges in obtaining complete, independent records and reliable evaluators, while balancing stronger oversight with task utility, cost, and agent autonomy.

Latest papers

269 papers79 papers in the last four weeks, up 39% on the four weeks before. 0.5% of all new papers.

Fidelity Is Not Enough: Dispatch-Level Instrumentation for Agentic Datasheet Extraction
Aug 28, 2026Qing Ye, Meng-Hsuan LinLLM Agent Evaluation Document Information Extraction
Infineon Technologies AG Neubiberg, Germany
Beyond Execution: Auditing Experimental Fidelity in LLM-Driven Scientific Research
Aug 27, 2026Lezhi Yu, Xiaogang Xu, Yuhua Zhou +2AI Agent Auditing AI-Assisted Scientific Research
College of Computer Science and Technology, Zhejiang University, Hangzhou, China · Zhejiang Lab, Hangzhou, China
Five Primitives for Governing Autonomous AI Agents at Runtime
Aug 27, 2026Jiten Oswal, John CadedduAI Agent Governance Runtime Enforcement for AI Agents
Aurite AI
Knowledge-Verified Emergent Deception in LLM Agents Under Conflicting Incentives
Aug 26, 2026Zheyuan Liu, Weiliang Zhao, Xiangchi Yuan +3Deception in Language Models LLM Honesty
University of Notre Dame · Columbia University · Georgia Institute of Technology +1
How Do LLM Agents Actually Get the Flag? Trace-Level Provenance for Agentic Offensive Security Evaluation
Aug 26, 2026Kimberly Milner, Minghao Shao, Nanda Rani +8AI Agent Security Benchmarks LLMs for Cybersecurity
NYU Tandon School of Engineering · NYU Abu Dhabi · CISPA - Helmholtz Center for Information Security, Saarbrücken +2
Beyond the Mandate: A Systematic Security Analysis of the Agent Payments Protocol (AP2)
Aug 24, 2026Avital Aviv, Parth A. Gandh, Ron Bitton +1LLM Agent Security AI Agent Security
Ben-Gurion University of the Negev Beer-Sheva, Israel
Automata from Agent Traces: Failure and Next-Step Prediction
Aug 24, 2026Seonglae Cho, Franklin Cardenoso Fernandez, Umar Mohammed +4AI Agent Monitoring AI Agent Auditing
Holistic AI · PUC-Rio · University College London
CatchBench: When Can an Agent Failure Be Caught?
Aug 24, 2026Yue Zhao, Mengyuan Li, Ruolin Li +5Agent Failure Analysis Benchmark Auditing
University of Southern California · Carnegie Mellon University · AWS Agentic AI +3
HANSARD: A Reference Architecture for Forensic Readiness, Runtime Witnessing, and Graded Attribution in Autonomous Multi-Agent AI Systems
Aug 23, 2026Christos Sardianos, Iliana Pla, Vasilis Efthymiou +4AI Agent Monitoring Algorithmic Accountability
Department of Informatics and Telematics, Harokopio University of Athens, Athens, Greece · Department of Informatics, Faculty of Science, Democritus University of Thrace, Kavala, Greece · Department of Electrical and Computer Engineering, University of Western Macedonia, Kozani, Greece +1
Noise Floor Audit for Agent Benchmarks
Aug 23, 2026Yihang Chen, Pin Qian, Su Wang +4Benchmark Reproducibility LLM Agent Reliability
AUDITA: certified auditing and causal attribution of adverse outcomes in autonomous multi-agent systems
Aug 23, 2026Zhixu Du, Yiran ChenAI Agent Auditing AI Accountability
Department of Electrical and Computer Engineering, Duke University, Durham, North Carolina, USA
Rebuild Dossier: Mechanically-Enforced Specs for Agentic App Rebuilds, and What Model-Tier Failures Reveal
Aug 22, 2026Parker FawcettAgentic Code Generation LLM Agent Reliability
Independent Researcher
BeTaL-GBI: Admission-Aware Benchmark Tuning and Full-Stack Verification of Geometric Belief Interfaces
Aug 21, 2026Alvin Spivey, Yu HuangFormal Verification Benchmark Auditing
Light Imaging Technologies, Inc.
$Z^2$ -ACT: End-to-End Verifiable Agentic Intent Control for Open 6G RAN
Aug 21, 2026Sunder Ali Khowaja, Kapal Dev, George C. AlexandropoulosAI Agent Security Intent-Based Networking
School of Computer Science, Dublin City University, Dublin, Ireland · Department of Computer Science, Munster Technological University, Cork, Ireland · Department of Informatics and Telecommunications, National and Kapodistrian University of Athens, Athens, Greece
Why2Speak: Faithful Reasoning for Abstaining Action Policies
Aug 21, 2026Shreya Mendi, Brinnae BentFaithfulness of Language Model Explanations AI Agent Auditing
Pratt School of Engineering, Duke University
ReguSim: Evaluating LLM Agent Rule Grounding in Financial Compliance
Aug 20, 2026Yiyang Luo, Yihang Jiang, Qijun Xie +4LLM Agent Evaluation AI Regulatory Compliance
HKUST · HKBU · NTU
Symposium: Trust via Auditable Records for Communities of AI Scientist Agents
Aug 20, 2026Dexter PrattAI Agent Auditing Trust in AI
Department of Medicine, University of California San Diego La Jolla, CA 92093, United States
LEDGER: Claim-to-Evidence Trace Graphs for Auditing LLM Agents
Aug 19, 2026Daehong Kim, Haichao Miao, Shusen LiuAI Agent Auditing Data Provenance
Carnegie Mellon University Pittsburgh, PA 15213 · Lawrence Livermore National Laboratory Livermore, CA 94550
Task-Conditioned Least-Privilege Learning for Executable Terminal and MCP Agents
Aug 18, 2026Alexander Tu, Michael TuLLM Agent Safety Tool Access Control for LLM Agents
Center for Cybersecurity, College of Technology, Purdue University Northwest, Hammond, IN, USA · Columbia College, Columbia University, New York, NY, USA
What Confidence Routing Is Actually Doing: Auditing Routing, Calibration, and Commitment in Multi-Agent Deliberation
Aug 18, 2026Jingyan Jiang, Huihuo Zheng, Rajeev Thakur +1Multi-Agent Deliberation LLM Agent Routing
Argonne National Laboratory, Lemont, IL 60439, USA
Artifact-centered Claim-aware Observability for Autonomous Scientific Agents
Aug 18, 2026Xiangyu Yin, Ming Du, Michael H. Prince +1AI Agent Auditing AI Agent Monitoring
Advanced Photon Source, Argonne National Laboratory, Lemont IL, USA
Auditing Self-Evolution in Financial Agents: Capability Gains, Security Drift, and Execution-Interface Mismatch
Aug 18, 2026Jialong Li, Jialing ZhuAI Agent Auditing AI Agent Security
Independent Researcher
Beyond the Text: Verifying That Agent-Written Papers Are Backed by Their Artifacts
Aug 18, 2026Qiuhong Shen, Benlong Wu, Hanjin Liu +2AI Agent Auditing AI Agent Evaluation
University of Science and Technology of China
The Evaluation Context Protocol (ECP): A Portable Contract for AI Agent Evaluation
Aug 18, 2026Aniket Wattamwar, Manav Anandani, Mrunal KakirwarAI Agent Evaluation AI Agent Auditing
Explicit State Elicitation Is Not Enough: A Controlled Audit of Memory-Policy Classification
Aug 18, 2026Yihang Chen, Pin Qian, Su Wang +4AI Agent Auditing LLM Agent Evaluation
A Policy Algebra for Trust-Preserving Agentic AI Execution
Aug 17, 2026Bhaskar Tripathi, Anurag Kumar, Ramendra Kumar +1AI Agent Reliability Runtime Enforcement for AI Agents
Volkswagen Digital Services · Scania CV AB
Counterfactual Sensitivity Is Not Repairability: Auditing Replay Probes for Video Evidence
Aug 16, 2026Rama AlHamidi, Rasul Khanbayov, Erchin Serpedin +1AI Agent Auditing Counterfactual Evaluation
Department of Computer and Electrical Engineering, Texas A&M University at Qatar, Doha, Qatar · College of Science and Engineering, Hamad Bin Khalifa University, Doha, Qatar · Department of Computer and Electrical Engineering, Texas A&M University, College Station, TX, USA
ATLAS: Discovering Agent Strategies through LLM-Guided Abstraction and Automata Learning
Aug 14, 2026Ignacio D. Lopez-Miguel, Andreas Happe, Jürgen Cito +3Automata Learning LLM Agents
TU Wien Vienna, Austria · TU Graz Graz, Austria
Mandato: Protocol-Level Enforcement of Digitally Signed Mandates on AI Agent Actions with Cryptographically Chained Audit Trails
Aug 14, 2026Giovanni RacioppiAI Agent Governance Runtime Enforcement for AI Agents
Hyperlabs, Italy
$A^2E$ : An End-to-End Agent Auditing Engine
Aug 7, 2026Haoning Wang, Mingxun Zhang, Chenyue Yu +4Tool-Use Evaluation AI Agent Auditing
Shanghai Artificial Intelligence Laboratory

Aug 28, 2026J/K move · Enter open · S save

Fidelity Is Not Enough: Dispatch-Level Instrumentation for Agentic Datasheet Extraction

Qing Ye, Meng-Hsuan Lin

Infineon Technologies AG Neubiberg, Germany

LLM Agent Evaluation Document Information Extraction Agent Failure Analysis AI Agent Auditing

Open paper AskPDF arXiv

One model passed our fidelity check without ever opening the datasheet. We found it while qualifying models for an internal extraction service: a structured-output constraint had silently disabled tool use, and the model answered anyway, with fabricated source text. Only the per-tool trace exposed it. Fidelity -- whether an extracted value matches the source -- is the standard measure for agentic document extraction, and it scores that run a success. We therefore log every tool call in an agentic benchmark of 25 hand-curated claims over three components, with 12 more on a fourth, 37 in all. From that dispatch record we build two instruments: a rule-based failure-attribution classifier, and a silent-failure detector whose two rules check only which tools were called, never the extracted value. The detector raises no flag on 207 clean fidelity-passing extractions across three model families, and recovers all 50 planted faults that withhold exactly the tools its rules check. The two results are not symmetric: the first bounds the false-positive rate, the second is recall by construction, and detection power against runs that call their tools and still answer wrongly is unmeasured. A second, independent oracle, a causal chamber that tests whether the datasheet's claims hold under physical measurement, is intentionally partial: it confirms only what the apparatus can exercise, a verifiable envelope of 2 of those 37 claims, and we give a taxonomy of why the rest are not physically gradable. Under a controlled perturbation, fidelity passes throughout while the chamber verdict flips exactly at the measurement uncertainty. Across three deployed model stacks (one destabilised by its serving stack, not by any capability gap) the tool layer buys portability and observability rather than accuracy, and earns its premium only once a document outgrows the context window.