Auditing Provenance Sensitivity in LLM Agent Action Selection

2026-07-23 · Source: Artificial Intelligence · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Cybersecurity & Data Privacy, Robotics & Autonomous Systems · Depth: Expert, quick

Summary

A new study introduces a target-specific authorization audit designed to evaluate how Large Language Model (LLM) agents select actions based on the provenance of information. This audit labels context factors for each tool and argument target, primarily testing behavior by fixing task parameters while altering only the source authority of a proposition. A secondary diagnostic uses context-subset interactions to localize issues. Across 450 controlled next-action tasks and various open-weight LLM families, the audit found that trusted and untrusted evidence led to different actions in 5.4 percent of competing scenarios, compared to 1.7 percent in supporting cases. Under controlled degradation, unauthorized competition persisted in 2.4 percent of comparisons, with a 95 percent confidence interval of 2.1 to 3.0 percent. These findings indicate that while LLMs acknowledge textual source-authority cues, untrusted evidence can still significantly influence their action selection.

Key takeaway

For AI Security Engineers deploying LLM agents, you must account for provenance sensitivity in action selection. While models respond to source authority cues, untrusted evidence can still influence decisions, as shown by 2.4 percent unauthorized competition retention under degradation. Implement robust authorization audits that specifically label context factors for each tool and argument target to mitigate risks from potentially compromised or unauthorized information sources. Your security protocols should anticipate and guard against these subtle influences.

Key insights

LLM agents are sensitive to source authority but can still be influenced by untrusted evidence in action selection.

Principles

• LLM agent action selection is provenance-sensitive.
• Untrusted evidence can still influence LLM agent decisions.
• Authorization audits require target-specific context labeling.

Method

The study proposes a target-specific authorization audit that labels context factors for each tool/argument, testing behavior by varying proposition source authority.

In practice

• Implement target-specific authorization audits.
• Monitor LLM agent actions for untrusted influence.
• Evaluate provenance sensitivity in agent deployments.

Topics

• LLM Agents
• Provenance Sensitivity
• Action Selection
• Authorization Audits
• Untrusted Evidence
• Context Management

Best for: CTO, VP of Engineering/Data, Director of AI/ML, AI Scientist, AI Security Engineer

Related on AIssential

• The Provenance Trap: Moving Accountability from the LLM to the Execution Path — The EU AI Act mandates full execution path provenance for agentic LLM pipelines, shifting accountability from models to emergent system behavior.
• When Lower Privileges Suffice: Investigating Over-Privileged Tool Selection in LLM Agents — LLM agents often select over-privileged tools, a risk mitigated by privilege-aware post-training.
• AgentAbstain: Do LLM Agents Know When Not to Act? — LLM agents lack calibrated abstention capabilities, independent of task success, posing risks of unintended actions.
• How Much Can We Trust LLM Search Agents? Measuring Endorsement Vulnerability to Web Content Manipulation — LLM search agents exhibit varied endorsement vulnerability to web content manipulation, requiring robust safety evaluations.
• VulnAgent-R2: Evidence-Calibrated Multi-Agent Auditing for Repository-Level Vulnerability Detection — Vulnerability detection is improved by a staged, evidence-driven auditing process using multi-agent collaboration and selective verification.
• Context-Fractured Decomposition Attacks on Tool-Using LLM Agents: Exploiting Artifact Provenance Gaps — Context-Fractured Decomposition (CFD) attacks exploit untracked artifact provenance in LLM agents, enabling delayed, multi-step jailbreaks.

See Counsel's argued verdicts on the open AI decisions leaders are weighing →

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by Artificial Intelligence.