Auditing Provenance Sensitivity in LLM Agent Action Selection

This paper investigates whether Large Language Model (LLM) agents can effectively distinguish between authorized and unauthorized evidence when selecting tools and arguments. While LLMs are often evaluated on whether they produce the correct final output, this study asks a more granular question: is the model's decision-making process actually grounded in permitted information, or is it being inappropriately influenced by 'untrusted' context—such as stale memory, irrelevant retrieved records, or adversarial notes—that happens to be present in the prompt?

To test this, the author introduces a target-specific authorization audit. This method decomposes the agent's context into semantic factors and labels them based on whether they are authorized to influence specific tool or argument targets. The study employs three diagnostic techniques: matched source interventions (changing only the source authority of a proposition), controlled evidence degradation (removing valid evidence to see if unauthorized competition takes over), and coalition analysis (using Shapley-style interactions to localize how combinations of factors influence the model).

The audit reveals that LLMs are sensitive to textual source-authority cues but fail to fully isolate their actions from unauthorized evidence. Across 450 controlled tasks, changing the source of a proposition from 'trusted' to 'untrusted' significantly shifted target scores. In behavioral tests, untrusted evidence altered the final action in 5.4% of competing cases. Furthermore, in controlled degradation tests, the study identified a pattern where the model produced the correct action only when unauthorized competitors were removed, confirming that these models often rely on invalid context to reach their conclusions.

Standard benchmarks for LLM agents typically focus on whether the final action is correct, which can mask brittle decision-making. If an agent arrives at the right answer by relying on unauthorized or stale information, it remains vulnerable to errors if that context changes or if the 'trusted' evidence is temporarily unavailable. This research provides a framework for auditing the provenance sensitivity of agents, which is critical for building robust, reliable systems that adhere to strict authorization policies in sensitive domains like finance or healthcare.