Certified Multi-Source Integrity for Structured Agent Actions

2026-09-28

AI Summary

This work addresses the security vulnerabilities arising from multi-source data tampering during structured operations by LLM agents, a threat against which existing defenses fail to certify action integrity. We propose the Maximum Safety Certifier, which introduces the first formal definition of certifiability under a shared upstream corruption budget. To prevent forged consensus, this method establishes the concept of corruption-independent evidence classes. By computing the corruption radius via minimum hitting sets alongside deterministic reconciliation and trusted anchors, it ensures that field-level evidence independently satisfies compliance requirements before any operation is executed. Experiments on sanctions list and software supply chain datasets demonstrate that the proposed mechanism successfully blocks all unsafe actions and recovers correct values, whereas baseline methods consistently fail.

Abstract

LLM agents increasingly take privileged, often irreversible structured actions, such as paying an invoice. They assemble each action from action-critical fields in documents and tool outputs that an adversary can corrupt, and indirect prompt injection can drive the model itself to extract attacker-chosen values. Current defenses gate on a source's trust label or certify free-text answer quality. None certifies the integrity of a coupled, policy-bound structured action under a corruption budget that accounts for shared upstream sources. We characterize when such an action is safely certifiable and give the maximally live safe certifier. It admits an action only when each field clears the rule its evidence structure supports: a bounded corruption radius over corruption-distinct evidence classes, counted by a minimum hitting set so that re-publishing or laundered copies cannot manufacture a quorum, deterministic reconciliation for complementary fields, and a trusted anchor where the evidence leaves a field single-sourced. We formalize two robustness notions, validate each mechanism by ablation, and measure how often the multi-source precondition holds on sanctions designations (70,966 entities) and software supply-chain provenance (450 packages). Under upper-bound proxies, genuine corroboration is a minority phenomenon in both, and naive attestation counting overstates it, since witnesses that look independent collapse to two corruption-distinct domains once shared origin is counted. Across five current models in a real agent loop, a realistic injection fools every model but one and a naive agent then executes the fraudulent action on most attacks. The certifier admits no unsafe action and recovers the correct value where corroboration permits, while action-gating and provenance baselines are broken in every world of our harness by some attack in its space.

Problem

• LLM agents
• indirect prompt injection
• structured action integrity
• multi-source certification
• data corruption

Innovation

• Certified Multi-Source Integrity
• Structured Agent Actions
• Indirect Prompt Injection
• Minimum Hitting Set
• Corruption Budget