From Agent Traces to Trust: A Survey of Evidence Tracing and Execution Provenance in LLM Agents
On the map: LLM agents and tool use → Agent threats, guardrails and governance
Abstract (arXiv)
Large language model (LLM)-based agents are evolving from passive text generators into autonomous systems capable of planning, tool use, retrieval, memory access, environmental interaction, and multi-agent collaboration. These capabilities expand agent autonomy, but also make agent behavior harder to verify, debug, and audit. Final-answer accuracy alone cannot explain how an output was produced, which evidence supported each claim, whether tool calls were justified, how memory influenced later decisions, or where failures originated. This survey examines evidence tracing and execution provenance as foundations for process-level accountability in trustworthy LLM agents. We define execution provenance as the typed graph of an agent execution and evidence tracing as its projection onto evidence-support relations. This perspective connects retrieval grounding, claim support, tool-use safety, memory lineage, observability, debugging, audit, and recovery within a unified framework. We introduce a taxonomy covering trace sources, evidence and execution units, provenance relations, tracing granularity and timing, representation forms, and trust functions. We then review key methodological directions, including provenance representation, evidence attribution, tool-use provenance, runtime guardrails, provenance-bearing memory, observability, and failure diagnosis. Finally, we discuss benchmarks, datasets, metrics, and open challenges for building provenance-aware, auditable, and recoverable agent systems.
Key facts. Cited by 29 papers in the map (data through 7 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 67 of its 82 references that are in the map. First posted on arXiv 3 Jun 2026.
Builds on
67 of 82 references.
Closest ancestors · 18
Same direction, newest first
- 2026Hidden in Memory: Sleeper Memory Poisoning in LLM Agents14 May
- 2026Ghost in the Agent: Redefining Information Flow Tracking for LLM Agents25 Apr
- 2026Auditable Agents7 Apr
- 2026Poison Once, Exploit Forever: Environment-Injected Memory Poisoning Attacks on Web Agents3 Apr
- 2026Agent-Sentry: Bounding LLM Agents via Execution Provenance24 Mar
- 2026ACRFence: Preventing Semantic Rollback Attacks in Agent Checkpoint-Restore21 Mar
- 2026AgentTrace: A Structured Logging Framework for Agent System Observability7 Feb
- 2025MCP-SafetyBench: A Benchmark for Safety Evaluation of Large Language Models with Real-World MCP Servers17 Dec
- 2025AgentBound: Securing Execution Boundaries of AI Agents24 Oct
- 2025A-MemGuard: A Proactive Defense Framework for LLM-Based Agent Memory29 Sep
- 2025OpenAgentSafety: A Comprehensive Framework for Evaluating Real-World AI Agent Safety8 Jul
- 2025Defeating Prompt Injections by Design24 Mar
6 more
- 2025AgentSpec: Customizable Runtime Enforcement for Safe and Reliable LLM Agents24 Mar
- 2025Memory Injection Attacks on LLM Agents via Query-Only Interaction5 Mar
- 2025Unveiling Privacy Risks in LLM Agent Memory17 Feb
- 2024AgentPoison: Red-teaming LLM Agents via Poisoning Memory or Knowledge Bases17 Jul
- 2024InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents5 Mar
- 2023Identifying the Risks of LM Agents with an LM-Emulated Sandbox25 Sep
Other references · 49
- 2022ReAct: Synergizing Reasoning and Acting in Language Modelscited by 8,355
- 2023Toolformer: Language Models Can Teach Themselves to Use Toolscited by 4,072
- 2023Reflexion: Language Agents with Verbal Reinforcement Learningcited by 4,064
- 2023Generative Agents: Interactive Simulacra of Human Behaviorcited by 3,500
- 2023WebArena: A Realistic Web Environment for Building Autonomous Agentscited by 1,908
- 2023AutoGen: Enabling Next-Gen LLM Applications via Multi-Agent Conversationcited by 1,906
- 2023ToolLLM: Facilitating Large Language Models to Master 16000+ Real-world APIscited by 1,880
- 2018FEVER: a large-scale dataset for Fact Extraction and VERificationcited by 1,362
- 2023CAMEL: Communicative Agents for "Mind" Exploration of Large Language Model Societycited by 1,348
- 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,339
- 2023MemGPT: Towards LLMs as Operating Systemscited by 1,295
- 2024τ-bench: A Benchmark for Tool-Agent-User Interaction in Real-World Domainscited by 1,280
37 more
- 2023FActScore: Fine-grained Atomic Evaluation of Factual Precision in Long Form Text Generationcited by 1,259
- 2023AgentBench: Evaluating LLMs as Agentscited by 1,211
- 2023Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversationscited by 1,124
- 2025A-MEM: Agentic Memory for LLM Agentscited by 1,000
- 2024Evaluating Very Long-Term Conversational Memory of LLM Agentscited by 800
- 2023CRITIC: Large Language Models Can Self-Correct with Tool-Interactive Critiquingcited by 751
- 2025Mem0: Building Production-Ready AI Agents with Scalable Long-Term Memorycited by 722
- 2024A Survey on the Memory Mechanism of Large Language Model based Agentscited by 622
- 2023Enabling Large Language Models to Generate Text with Citationscited by 584
- 2023Prompt Injection attack against LLM-integrated Applicationscited by 568
- 2025Why Do Multi-Agent LLM Systems Fail?cited by 559
- 2023MemoryBank: Enhancing Large Language Models with Long-Term Memorycited by 539
- 2024The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructionscited by 441
- 2023Ragas: Automated Evaluation of Retrieval Augmented Generationcited by 408
- 2023NeMo Guardrails: A Toolkit for Controllable and Safe LLM Applications with Programmable Railscited by 347
- 2024StruQ: Defending Against Prompt Injection with Structured Queriescited by 325
- 2023RAGTruth: A Hallucination Corpus for Developing Trustworthy Retrieval-Augmented Language Modelscited by 272
- 2023ARES: An Automated Evaluation Framework for Retrieval-Augmented Generation Systemscited by 259
- 2023Augmenting Language Models with Long-Term Memorycited by 186
- 2025Where LLM Agents Fail and How They can Learn From Failurescited by 118
- 2025Securing AI Agents with Information-Flow Controlcited by 108
- 2025AgenTracer: Who Is Inducing Failure in the LLM Agentic Systems?cited by 105
- 2025TRAIL: Trace Reasoning and Agentic Issue Localizationcited by 98
- 2026MemoryArena: Benchmarking Agent Memory in Interdependent Multi-Session Agentic Taskscited by 72
- 2026Memory for Autonomous LLM Agents:Mechanisms, Evaluation, and Emerging Frontierscited by 60
- 2024RAGChecker: A Fine-grained Framework for Diagnosing Retrieval-Augmented Generationcited by 59
- 2025SagaLLM: Context Management, Validation, and Transaction Guarantees for Multi-Agent LLM Planningcited by 58
- 2025LLM-based Agents Suffer from Hallucinations: A Survey of Taxonomy, Methods, and Directionscited by 49
- 2024AgentOps: Enabling Observability of LLM Agentscited by 46
- 2025PROV-AGENT: Unified Provenance for Tracking AI Agent Interactions in Agentic Workflowscited by 29
- 2026Graph-based Agent Memory: Taxonomy, Techniques, and Applicationscited by 22
- 2024How well do LLMs cite relevant medical references? An evaluation framework and analysescited by 20
- 2025Aegis: Automated Error Generation and Attribution for Multi-Agent Systemscited by 19
- 2026Audit Trails for Accountability in Large Language Modelscited by 10
- 2026DART: Semantic Recoverability for Structured Tool Agentscited by 9
- 2025Attribution, Citation, and Quotation: A Survey of Evidence-based Text Generation with Large Language Modelscited by 7
- 2026PaperTrail: A Claim-Evidence Interface for Grounding Provenance in LLM-based Scholarly Q&Acited by 2
Built on by
Citing papers per year: 2026: 29.
29 papers.
Sort:
By area:
- 2026GRADE: Graph Representation of LLM Agent Dependency and Executioncited by 4
- 2026When Stale Constraints Go Unchecked: Budgeted Verification Failures in Inherited Agent Memorycited by 3
- 2026Local Epistemic Uncertainty Guided Active Sampling for Plug-and-play Diffusive Image Restorationcited by 2
- 2026APPA: Recoverable Information-Flow Control for Real-World LLM Agentscited by 1
- 2026You Don't Need To Stay in The Loop: An Agentic Robotics Loop for Robot-Policy Improvementcited by 1
- 2026Similarity Gates Approve Reversals: A Validity Audit of Embedding-Cosine Thresholds in Agent Systemscited by 1
- 2026Certifiable Semantic Agreement Among LLM Agents: What the Admissibility Instrument Decidescited by 0
- 2026Physiological Noise Augmentation Improves Non-Invasive Brain-to-Speechcited by 0
- 2026Skill Use or Skill Theater? Evaluating the Reasoning Backroom in Skill-Augmented Language Agentscited by 0
- 2026Toward Personal Intelligence Through Cooperative Observationcited by 0
- 2026Explicit State Elicitation Is Not Enough: A Controlled Audit of Memory-Policy Classificationcited by 0
- 2026ReguSim: Evaluating LLM Agent Rule Grounding in Financial Compliancecited by 0
17 more
- 2026Testing and Evaluation of Agentic AI Systems In Military Command and Controlcited by 0
- 2026Noise Floor Audit for Agent Benchmarkscited by 0
- 2026DIAG: Diagnostic Iterative Alignment and Generation for Data-Efficient Mathematical Preference Distillationcited by 0
- 2026Toward Effective and Reliable LLM Agents via Dynamic Ontologycited by 0
- 2026From Traceability to Justifiability: Accountability Structures in Agentic Software Engineeringcited by 0
- 2026Forward-Deployed Full-Stack Engineering for Autonomous Cloud MLOpscited by 0
- 2026Modality Disentangled Learning for Incomplete Multimodal Emotion Recognition: A Primitive Memory Distillation Perspectivecited by 0
- 2026Toward Workflow-Aware Benchmarking for Healthcare NLP Agentscited by 0
- 2026Causal Attribution for Agentic Decisions: Estimators, Coupling, and a Traceability Specificationcited by 0
- 2026MOLE: Detecting Insider Threats in AI Agentscited by 0
- 2026Uncertainty Quantification for LLM Agents: A Taxonomy, an Evaluation Protocol, and an Empirical Studycited by 0
- 2026LLM Agents Can Easily Tamper With Their Own Tracescited by 0
- 2026A Benchmark and Diagnostic Study of Epistemic Admission in Shared Agent Memorycited by 0
- 2026Janus: Evidence-Before-Effect Sagas and Offline-Verifiable Provenance for Agentic LLMscited by 0
- 2026NAQD Env: A benchmark for selective withdrawal in language agentscited by 0
- 2026K-Dense BYOK: An Open-Source AI Research Assistant That Runs Locally and Keeps a Hash-Chained Lab Notebookcited by 0
- 2026Federated Agent Optimizationcited by 0
- 2026Federated Agent Optimization1 Oct 2026
- 2026NAQD Env: A benchmark for selective withdrawal in language agents29 Sep 2026
- 2026Janus: Evidence-Before-Effect Sagas and Offline-Verifiable Provenance for Agentic LLMs29 Sep 2026
- 2026A Benchmark and Diagnostic Study of Epistemic Admission in Shared Agent Memory25 Sep 2026
- 2026LLM Agents Can Easily Tamper With Their Own Traces24 Sep 2026
- 2026Uncertainty Quantification for LLM Agents: A Taxonomy, an Evaluation Protocol, and an Empirical Study7 Sep 2026
- 2026MOLE: Detecting Insider Threats in AI Agents7 Sep 2026
- 2026Causal Attribution for Agentic Decisions: Estimators, Coupling, and a Traceability Specification6 Sep 2026
- 2026K-Dense BYOK: An Open-Source AI Research Assistant That Runs Locally and Keeps a Hash-Chained Lab Notebook4 Sep 2026
- 2026Toward Workflow-Aware Benchmarking for Healthcare NLP Agents31 Aug 2026
- 2026Modality Disentangled Learning for Incomplete Multimodal Emotion Recognition: A Primitive Memory Distillation Perspective31 Aug 2026
- 2026Forward-Deployed Full-Stack Engineering for Autonomous Cloud MLOps30 Aug 2026
17 more
- 2026When Stale Constraints Go Unchecked: Budgeted Verification Failures in Inherited Agent Memory26 Aug 2026
- 2026Toward Effective and Reliable LLM Agents via Dynamic Ontology24 Aug 2026
- 2026DIAG: Diagnostic Iterative Alignment and Generation for Data-Efficient Mathematical Preference Distillation24 Aug 2026
- 2026Noise Floor Audit for Agent Benchmarks23 Aug 2026
- 2026From Traceability to Justifiability: Accountability Structures in Agentic Software Engineering21 Aug 2026
- 2026Testing and Evaluation of Agentic AI Systems In Military Command and Control20 Aug 2026
- 2026ReguSim: Evaluating LLM Agent Rule Grounding in Financial Compliance20 Aug 2026
- 2026Explicit State Elicitation Is Not Enough: A Controlled Audit of Memory-Policy Classification18 Aug 2026
- 2026Toward Personal Intelligence Through Cooperative Observation17 Aug 2026
- 2026Similarity Gates Approve Reversals: A Validity Audit of Embedding-Cosine Thresholds in Agent Systems10 Aug 2026
- 2026Local Epistemic Uncertainty Guided Active Sampling for Plug-and-play Diffusive Image Restoration7 Aug 2026
- 2026You Don't Need To Stay in The Loop: An Agentic Robotics Loop for Robot-Policy Improvement2 Aug 2026
- 2026Skill Use or Skill Theater? Evaluating the Reasoning Backroom in Skill-Augmented Language Agents29 Jul 2026
- 2026APPA: Recoverable Information-Flow Control for Real-World LLM Agents27 Jul 2026
- 2026Physiological Noise Augmentation Improves Non-Invasive Brain-to-Speech6 Jul 2026
- 2026GRADE: Graph Representation of LLM Agent Dependency and Execution22 Jun 2026
- 2026Certifiable Semantic Agreement Among LLM Agents: What the Admissibility Instrument Decides5 Jun 2026
- 2026GRADE: Graph Representation of LLM Agent Dependency and Executioncited by 4
- 2026When Stale Constraints Go Unchecked: Budgeted Verification Failures in Inherited Agent Memorycited by 3
- 2026APPA: Recoverable Information-Flow Control for Real-World LLM Agentscited by 1
- 2026You Don't Need To Stay in The Loop: An Agentic Robotics Loop for Robot-Policy Improvementcited by 1
- 2026Certifiable Semantic Agreement Among LLM Agents: What the Admissibility Instrument Decidescited by 0
- 2026ReguSim: Evaluating LLM Agent Rule Grounding in Financial Compliancecited by 0
- 2026Testing and Evaluation of Agentic AI Systems In Military Command and Controlcited by 0
- 2026Noise Floor Audit for Agent Benchmarkscited by 0
- 2026Toward Effective and Reliable LLM Agents via Dynamic Ontologycited by 0
- 2026From Traceability to Justifiability: Accountability Structures in Agentic Software Engineeringcited by 0
- 2026Toward Workflow-Aware Benchmarking for Healthcare NLP Agentscited by 0
- 2026Causal Attribution for Agentic Decisions: Estimators, Coupling, and a Traceability Specificationcited by 0
12 most cited of 16 All 16 (JSON)
- 2026Federated Agent Optimization1 Oct 2026
- 2026Janus: Evidence-Before-Effect Sagas and Offline-Verifiable Provenance for Agentic LLMs29 Sep 2026
- 2026LLM Agents Can Easily Tamper With Their Own Traces24 Sep 2026
- 2026Uncertainty Quantification for LLM Agents: A Taxonomy, an Evaluation Protocol, and an Empirical Study7 Sep 2026
- 2026Causal Attribution for Agentic Decisions: Estimators, Coupling, and a Traceability Specification6 Sep 2026
- 2026Toward Workflow-Aware Benchmarking for Healthcare NLP Agents31 Aug 2026
- 2026When Stale Constraints Go Unchecked: Budgeted Verification Failures in Inherited Agent Memory26 Aug 2026
- 2026Toward Effective and Reliable LLM Agents via Dynamic Ontology24 Aug 2026
- 2026Noise Floor Audit for Agent Benchmarks23 Aug 2026
- 2026From Traceability to Justifiability: Accountability Structures in Agentic Software Engineering21 Aug 2026
- 2026Testing and Evaluation of Agentic AI Systems In Military Command and Control20 Aug 2026
- 2026ReguSim: Evaluating LLM Agent Rule Grounding in Financial Compliance20 Aug 2026
12 newest of 16 All 16 (JSON)
- 2026MOLE: Detecting Insider Threats in AI Agentscited by 0
- 2026MOLE: Detecting Insider Threats in AI Agents7 Sep 2026
- 2026Similarity Gates Approve Reversals: A Validity Audit of Embedding-Cosine Thresholds in Agent Systemscited by 1
- 2026Physiological Noise Augmentation Improves Non-Invasive Brain-to-Speechcited by 0
- 2026Toward Personal Intelligence Through Cooperative Observationcited by 0
- 2026Explicit State Elicitation Is Not Enough: A Controlled Audit of Memory-Policy Classificationcited by 0
- 2026Forward-Deployed Full-Stack Engineering for Autonomous Cloud MLOpscited by 0
- 2026Modality Disentangled Learning for Incomplete Multimodal Emotion Recognition: A Primitive Memory Distillation Perspectivecited by 0
- 2026A Benchmark and Diagnostic Study of Epistemic Admission in Shared Agent Memorycited by 0
- 2026NAQD Env: A benchmark for selective withdrawal in language agentscited by 0
- 2026K-Dense BYOK: An Open-Source AI Research Assistant That Runs Locally and Keeps a Hash-Chained Lab Notebookcited by 0
- 2026NAQD Env: A benchmark for selective withdrawal in language agents29 Sep 2026
- 2026A Benchmark and Diagnostic Study of Epistemic Admission in Shared Agent Memory25 Sep 2026
- 2026K-Dense BYOK: An Open-Source AI Research Assistant That Runs Locally and Keeps a Hash-Chained Lab Notebook4 Sep 2026
- 2026Modality Disentangled Learning for Incomplete Multimodal Emotion Recognition: A Primitive Memory Distillation Perspective31 Aug 2026
- 2026Forward-Deployed Full-Stack Engineering for Autonomous Cloud MLOps30 Aug 2026
- 2026Explicit State Elicitation Is Not Enough: A Controlled Audit of Memory-Policy Classification18 Aug 2026
- 2026Toward Personal Intelligence Through Cooperative Observation17 Aug 2026
- 2026Similarity Gates Approve Reversals: A Validity Audit of Embedding-Cosine Thresholds in Agent Systems10 Aug 2026
- 2026Physiological Noise Augmentation Improves Non-Invasive Brain-to-Speech6 Jul 2026
Similar, not cited
Close in wording, no citation either way
- 2026LEDGER: Claim-to-Evidence Trace Graphs for Auditing LLM Agents
- 2026Auditing Provenance Sensitivity in LLM Agent Action Selection
- 2026MAP-Graph: Provenance-Aware Shared Memory for Multi-Agent Workflows
- 2026The Granularity Mismatch in Agent Security: Argument-Level Provenance Solves Enforcement and Isolates the LLM Reasoning Bottleneck
- 2026AgentTrails: Towards Trust and Reuse for Agentic Tasks
- 2026When Agents Overtrust Environmental Evidence: An Extensible Agentic Framework for Benchmarking Evidence-Grounding Defects in LLM Agents
- 2026Safeguarding LLM Agents from Misalignment through Provenance Analysis
- 2026PACE: Provenance-Aware Capability Enforcement for Tool-Using LLM Agents