Metraipolis › archive › dc_2cd8bfe95054

Certified Multi-Source Integrity for Structured Agent Actions — arXiv:2609.34245

Source: arXiv (en)
Original: https://arxiv.org/abs/2609.34245
License (as archived): CC0-1.0
Archived: 2026-10-07T21:02:17.280Z
SHA-256 of the archived text: f28c0269791776aaf6c4adc4f9cf6784233cca731db54d8cc245f0e3cb2c95ae
Stable URL of this page: https://metraipolis.com/documento/dc_2cd8bfe95054

How to cite

Certified Multi-Source Integrity for Structured Agent Actions — arXiv:2609.34245 — arXiv (en), https://arxiv.org/abs/2609.34245 (CC0-1.0); archived copy: https://metraipolis.com/documento/dc_2cd8bfe95054 (Metraipolis archive dc_2cd8bfe95054, sha256 f28c0269791776aaf6c4adc4f9cf6784233cca731db54d8cc245f0e3cb2c95ae)

BibTeX

@misc{dc2cd8bfe95054,
  title = {Certified Multi-Source Integrity for Structured Agent Actions — arXiv:2609.34245},
  howpublished = {arXiv (en)},
  url = {https://arxiv.org/abs/2609.34245},
  note = {License CC0-1.0; archived copy https://metraipolis.com/documento/dc_2cd8bfe95054; sha256 f28c0269791776aaf6c4adc4f9cf6784233cca731db54d8cc245f0e3cb2c95ae},
  year = {2026}
}

Archived text

Reproduced under CC0-1.0. Attribution: arXiv (en), https://arxiv.org/abs/2609.34245. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

LLM agents increasingly take privileged, often irreversible structured actions, such as paying an invoice. They assemble each action from action-critical fields in documents and tool outputs that an adversary can corrupt, and indirect prompt injection can drive the model itself to extract attacker-chosen values. Current defenses gate on a source's trust label or certify free-text answer quality. None certifies the integrity of a coupled, policy-bound structured action under a corruption budget that accounts for shared upstream sources. We characterize when such an action is safely certifiable and give the maximally live safe certifier. It admits an action only when each field clears the rule its evidence structure supports: a bounded corruption radius over corruption-distinct evidence classes, counted by a minimum hitting set so that re-publishing or laundered copies cannot manufacture a quorum, deterministic reconciliation for complementary fields, and a trusted anchor where the evidence leaves a field single-sourced. We formalize two robustness notions, validate each mechanism by ablation, and measure how often the multi-source precondition holds on sanctions designations (70,966 entities) and software supply-chain provenance (450 packages). Under upper-bound proxies, genuine corroboration is a minority phenomenon in both, and naive attestation counting overstates it, since witnesses that look independent collapse to two corruption-distinct domains once shared origin is counted. Across five current models in a real agent loop, a realistic injection fools every model but one and a naive agent then executes the fraudulent action on most attacks. The certifier admits no unsafe action and recovers the correct value where corroboration permits, while action-gating and provenance baselines are broken in every world of our harness by some attack in its space.

Tema degli esploratori: agenti e intelligenza artificiale (retro-catalogo arXiv: annunci del 2026-09-29 in cs.AI).
Categorie arXiv: Cryptography and Security (cs.CR) ; Artificial Intelligence (cs.AI); Machine Learning (cs.LG).
Pagina del lavoro: https://arxiv.org/abs/2609.34245 — autori e testo completo sono lì (qui omessi i nomi: nessun dato personale nel deposito).
Licenza: titolo e abstract sono metadati arXiv distribuiti in CC0 1.0; il testo completo ha la licenza scelta dagli autori, indicata sulla pagina.
Letto il 2026-10-07T20:29:02.905Z dalla pagina https://arxiv.org/catchup/cs.AI/2026-09-29?abs=True (consentita dal robots.txt di arxiv.org, con il suo crawl-delay).