Auditing Provenance Sensitivity in LLM Agent Action Selection
Junchi Liao
Why It Matters
What makes this one worth your time
Understanding how LLM agents are influenced by trusted and untrusted evidence is crucial for improving their decision-making reliability and security.
The paper audits how LLM agents' actions are influenced by the provenance of evidence.
Summary
The paper introduces a method for auditing the sensitivity of large language model (LLM) agents to the provenance of evidence used in action selection. It proposes a target-specific authorization audit to label context factors for each tool and argument target, testing how changes in source authority affect decision-making. The study finds that LLMs respond to source-authority cues but are still influenced by untrusted evidence.
Key contributions
- Introduction of a target-specific authorization audit for LLM agents.
- Empirical evaluation of LLM behavior under controlled conditions with varying source authority.
Notable insights
- The study uses a target-specific authorization audit to evaluate context factors for each tool and argument target.
- LLMs show different actions based on trusted versus untrusted evidence, indicating sensitivity to source authority.
Possible limitations
- Not stated in the abstract
Abstract
arXiv:2607.20827v1 Announce Type: new Abstract: LLM agents choose tools and arguments from context that mixes user requests, tool outputs, retrieved records, memory, and untrusted text. Evidence can be relevant without being authorized to determine a decision, so a correct action need not be grounded only in permitted evidence. We introduce a target-specific authorization audit that labels context factors separately for each tool and argument target. Its primary test holds the task, proposition, position, and policy fixed while changing only the proposition's source authority. We then test behavior when valid evidence is weakened and use context-subset interactions as a secondary localization diagnostic. Across 450 controlled next-action tasks and multiple open-weight LLM families, trusted and untrusted variants produce different actions in 5.4 percent of competing cases versus 1.7 percent of supporting cases. Under controlled degradation, unauthorized competition is retained in a full-correct, mixed-error, clean-correct pattern in 2.4 percent of comparisons, with a 95 percent confidence interval from 2.1 to 3.0 percent. These are controlled stress-set rates, not deployment prevalence. The models respond to textual source-authority cues, but this does not prevent untrusted evidence from influencing their actions.