arXiv cs.CL· Miaobo Hu, Shuhao Hu, Xiaobo Guo, Xin Wang, Bokun Wang, Yina Sa, Daren Zha·· 12 小时前AI 评分38
带凭证的动作：为可回放的工具智能体审计联合绑定声明、证据与执行
Actions with Receipts: Jointly Binding Claims, Evidence, and Execution for Replayable Tool-Agent Auditing
AI 导读
研究者提出一种以声明为锚点的执行契约，将智能体输出的声明、精确源文本片段、产生该声明的有序执行前缀，以及执行时观测到的源版本与访问状态联合绑定，并用确定性完整性验证器在语义标签接入前重建这些绑定。
正文 · 原文
Abstract:Tool-using agents can expose citations and execution logs while leaving a critical association unaudited: whether the claim shown to a user is the claim emitted by the committed execution and supported by the cited source. A valid citation and a valid trace can therefore remain individually well formed while being transplanted across claims, actions, runs, or source versions. We introduce a claim-anchored execution contract that jointly binds the emitted claim, its exact source span, the ordered execution prefix that produced it, and the source version and access state observed by that execution. Each receipt contains an emission anchor that deterministically locates the claim inside a committed answer or claim-bearing action, together with source identifiers, offsets, hashes, quotes, and a domain-separated execution commitment. A deterministic integrity verifier reconstructs these bindings before semantic or task labels are joined. We separate this integrity plane from a pluggable support plane, so structural validity is not used as a proxy for entailment. The contract exposes seven independently testable properties: claim-emission binding, source binding, ordered-execution binding, oracle separation, persisted-object replay, execution-rerun consistency, and version/access binding. Across 1,280 cross-object attacks, the joint contract detects 1,275 substitutions (0.9961). Removing a targeted property reduces its attack-detection rate to 0.0156-0.0625. On an independently adjudicated 384-pair split, the conflict-aware support guard reaches F1 0.8865 and false acceptance 0.0729; on unseen failure families, these rates are 0.8679 and 0.0938.
| Comments: | 35 pages, 8 figures |
| Subjects: | Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI); Computation and Language (cs.CL); Machine Learning (cs.LG) |
| Cite as: | arXiv:2610.00327 [cs.CR] |
| (or arXiv:2610.00327v2 [cs.CR] for this version) | |
| https://doi.org/10.48550/arXiv.2610.00327 arXiv-issued DOI via DataCite |
Submission history
From: Miaobo Hu [view email]
[v1]
Tue, 29 Sep 2026 08:36:16 UTC (1,548 KB)
[v2]
Fri, 16 Oct 2026 12:28:48 UTC (1,547 KB)
来源：arXiv cs.CL · arxiv.org