mlsanityData to 7 Oct 2026

From Agent Traces to Trust: A Survey of Evidence Tracing and Execution Provenance in LLM Agents

arXiv 2606.04990 ↗First posted 3 Jun 2026cs.CR cs.AIcited by 29

On the map: LLM agents and tool use → Agent threats, guardrails and governance

Abstract (arXiv)

Large language model (LLM)-based agents are evolving from passive text generators into autonomous systems capable of planning, tool use, retrieval, memory access, environmental interaction, and multi-agent collaboration. These capabilities expand agent autonomy, but also make agent behavior harder to verify, debug, and audit. Final-answer accuracy alone cannot explain how an output was produced, which evidence supported each claim, whether tool calls were justified, how memory influenced later decisions, or where failures originated. This survey examines evidence tracing and execution provenance as foundations for process-level accountability in trustworthy LLM agents. We define execution provenance as the typed graph of an agent execution and evidence tracing as its projection onto evidence-support relations. This perspective connects retrieval grounding, claim support, tool-use safety, memory lineage, observability, debugging, audit, and recovery within a unified framework. We introduce a taxonomy covering trace sources, evidence and execution units, provenance relations, tracing granularity and timing, representation forms, and trust functions. We then review key methodological directions, including provenance representation, evidence attribution, tool-use provenance, runtime guardrails, provenance-bearing memory, observability, and failure diagnosis. Finally, we discuss benchmarks, datasets, metrics, and open challenges for building provenance-aware, auditable, and recoverable agent systems.

Key facts. Cited by 29 papers in the map (data through 7 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 67 of its 82 references that are in the map. First posted on arXiv 3 Jun 2026.

Builds on

67 of 82 references.

Closest ancestors · 18

Same direction, newest first

  1. 2026Hidden in Memory: Sleeper Memory Poisoning in LLM Agents14 May
  2. 2026Ghost in the Agent: Redefining Information Flow Tracking for LLM Agents25 Apr
  3. 2026Auditable Agents7 Apr
  4. 2026Poison Once, Exploit Forever: Environment-Injected Memory Poisoning Attacks on Web Agents3 Apr
  5. 2026Agent-Sentry: Bounding LLM Agents via Execution Provenance24 Mar
  6. 2026ACRFence: Preventing Semantic Rollback Attacks in Agent Checkpoint-Restore21 Mar
  7. 2026AgentTrace: A Structured Logging Framework for Agent System Observability7 Feb
  8. 2025MCP-SafetyBench: A Benchmark for Safety Evaluation of Large Language Models with Real-World MCP Servers17 Dec
  9. 2025AgentBound: Securing Execution Boundaries of AI Agents24 Oct
  10. 2025A-MemGuard: A Proactive Defense Framework for LLM-Based Agent Memory29 Sep
  11. 2025OpenAgentSafety: A Comprehensive Framework for Evaluating Real-World AI Agent Safety8 Jul
  12. 2025Defeating Prompt Injections by Design24 Mar
6 more
  1. 2025AgentSpec: Customizable Runtime Enforcement for Safe and Reliable LLM Agents24 Mar
  2. 2025Memory Injection Attacks on LLM Agents via Query-Only Interaction5 Mar
  3. 2025Unveiling Privacy Risks in LLM Agent Memory17 Feb
  4. 2024AgentPoison: Red-teaming LLM Agents via Poisoning Memory or Knowledge Bases17 Jul
  5. 2024InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents5 Mar
  6. 2023Identifying the Risks of LM Agents with an LM-Emulated Sandbox25 Sep

Other references · 49

  1. 2022ReAct: Synergizing Reasoning and Acting in Language Modelscited by 8,355
  2. 2023Toolformer: Language Models Can Teach Themselves to Use Toolscited by 4,072
  3. 2023Reflexion: Language Agents with Verbal Reinforcement Learningcited by 4,064
  4. 2023Generative Agents: Interactive Simulacra of Human Behaviorcited by 3,500
  5. 2023WebArena: A Realistic Web Environment for Building Autonomous Agentscited by 1,908
  6. 2023AutoGen: Enabling Next-Gen LLM Applications via Multi-Agent Conversationcited by 1,906
  7. 2023ToolLLM: Facilitating Large Language Models to Master 16000+ Real-world APIscited by 1,880
  8. 2018FEVER: a large-scale dataset for Fact Extraction and VERificationcited by 1,362
  9. 2023CAMEL: Communicative Agents for "Mind" Exploration of Large Language Model Societycited by 1,348
  10. 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,339
  11. 2023MemGPT: Towards LLMs as Operating Systemscited by 1,295
  12. 2024τ-bench: A Benchmark for Tool-Agent-User Interaction in Real-World Domainscited by 1,280
37 more
  1. 2023FActScore: Fine-grained Atomic Evaluation of Factual Precision in Long Form Text Generationcited by 1,259
  2. 2023AgentBench: Evaluating LLMs as Agentscited by 1,211
  3. 2023Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversationscited by 1,124
  4. 2025A-MEM: Agentic Memory for LLM Agentscited by 1,000
  5. 2024Evaluating Very Long-Term Conversational Memory of LLM Agentscited by 800
  6. 2023CRITIC: Large Language Models Can Self-Correct with Tool-Interactive Critiquingcited by 751
  7. 2025Mem0: Building Production-Ready AI Agents with Scalable Long-Term Memorycited by 722
  8. 2024A Survey on the Memory Mechanism of Large Language Model based Agentscited by 622
  9. 2023Enabling Large Language Models to Generate Text with Citationscited by 584
  10. 2023Prompt Injection attack against LLM-integrated Applicationscited by 568
  11. 2025Why Do Multi-Agent LLM Systems Fail?cited by 559
  12. 2023MemoryBank: Enhancing Large Language Models with Long-Term Memorycited by 539
  13. 2024The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructionscited by 441
  14. 2023Ragas: Automated Evaluation of Retrieval Augmented Generationcited by 408
  15. 2023NeMo Guardrails: A Toolkit for Controllable and Safe LLM Applications with Programmable Railscited by 347
  16. 2024StruQ: Defending Against Prompt Injection with Structured Queriescited by 325
  17. 2023RAGTruth: A Hallucination Corpus for Developing Trustworthy Retrieval-Augmented Language Modelscited by 272
  18. 2023ARES: An Automated Evaluation Framework for Retrieval-Augmented Generation Systemscited by 259
  19. 2023Augmenting Language Models with Long-Term Memorycited by 186
  20. 2025Where LLM Agents Fail and How They can Learn From Failurescited by 118
  21. 2025Securing AI Agents with Information-Flow Controlcited by 108
  22. 2025AgenTracer: Who Is Inducing Failure in the LLM Agentic Systems?cited by 105
  23. 2025TRAIL: Trace Reasoning and Agentic Issue Localizationcited by 98
  24. 2026MemoryArena: Benchmarking Agent Memory in Interdependent Multi-Session Agentic Taskscited by 72
  25. 2026Memory for Autonomous LLM Agents:Mechanisms, Evaluation, and Emerging Frontierscited by 60
  26. 2024RAGChecker: A Fine-grained Framework for Diagnosing Retrieval-Augmented Generationcited by 59
  27. 2025SagaLLM: Context Management, Validation, and Transaction Guarantees for Multi-Agent LLM Planningcited by 58
  28. 2025LLM-based Agents Suffer from Hallucinations: A Survey of Taxonomy, Methods, and Directionscited by 49
  29. 2024AgentOps: Enabling Observability of LLM Agentscited by 46
  30. 2025PROV-AGENT: Unified Provenance for Tracking AI Agent Interactions in Agentic Workflowscited by 29
  31. 2026Graph-based Agent Memory: Taxonomy, Techniques, and Applicationscited by 22
  32. 2024How well do LLMs cite relevant medical references? An evaluation framework and analysescited by 20
  33. 2025Aegis: Automated Error Generation and Attribution for Multi-Agent Systemscited by 19
  34. 2026Audit Trails for Accountability in Large Language Modelscited by 10
  35. 2026DART: Semantic Recoverability for Structured Tool Agentscited by 9
  36. 2025Attribution, Citation, and Quotation: A Survey of Evidence-based Text Generation with Large Language Modelscited by 7
  37. 2026PaperTrail: A Claim-Evidence Interface for Grounding Provenance in LLM-based Scholarly Q&Acited by 2

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2026: 29.

29 papers.

Sort:

By area:

  1. 2026GRADE: Graph Representation of LLM Agent Dependency and Executioncited by 4
  2. 2026When Stale Constraints Go Unchecked: Budgeted Verification Failures in Inherited Agent Memorycited by 3
  3. 2026Local Epistemic Uncertainty Guided Active Sampling for Plug-and-play Diffusive Image Restorationcited by 2
  4. 2026APPA: Recoverable Information-Flow Control for Real-World LLM Agentscited by 1
  5. 2026You Don't Need To Stay in The Loop: An Agentic Robotics Loop for Robot-Policy Improvementcited by 1
  6. 2026Similarity Gates Approve Reversals: A Validity Audit of Embedding-Cosine Thresholds in Agent Systemscited by 1
  7. 2026Certifiable Semantic Agreement Among LLM Agents: What the Admissibility Instrument Decidescited by 0
  8. 2026Physiological Noise Augmentation Improves Non-Invasive Brain-to-Speechcited by 0
  9. 2026Skill Use or Skill Theater? Evaluating the Reasoning Backroom in Skill-Augmented Language Agentscited by 0
  10. 2026Toward Personal Intelligence Through Cooperative Observationcited by 0
  11. 2026Explicit State Elicitation Is Not Enough: A Controlled Audit of Memory-Policy Classificationcited by 0
  12. 2026ReguSim: Evaluating LLM Agent Rule Grounding in Financial Compliancecited by 0
17 more
  1. 2026Testing and Evaluation of Agentic AI Systems In Military Command and Controlcited by 0
  2. 2026Noise Floor Audit for Agent Benchmarkscited by 0
  3. 2026DIAG: Diagnostic Iterative Alignment and Generation for Data-Efficient Mathematical Preference Distillationcited by 0
  4. 2026Toward Effective and Reliable LLM Agents via Dynamic Ontologycited by 0
  5. 2026From Traceability to Justifiability: Accountability Structures in Agentic Software Engineeringcited by 0
  6. 2026Forward-Deployed Full-Stack Engineering for Autonomous Cloud MLOpscited by 0
  7. 2026Modality Disentangled Learning for Incomplete Multimodal Emotion Recognition: A Primitive Memory Distillation Perspectivecited by 0
  8. 2026Toward Workflow-Aware Benchmarking for Healthcare NLP Agentscited by 0
  9. 2026Causal Attribution for Agentic Decisions: Estimators, Coupling, and a Traceability Specificationcited by 0
  10. 2026MOLE: Detecting Insider Threats in AI Agentscited by 0
  11. 2026Uncertainty Quantification for LLM Agents: A Taxonomy, an Evaluation Protocol, and an Empirical Studycited by 0
  12. 2026LLM Agents Can Easily Tamper With Their Own Tracescited by 0
  13. 2026A Benchmark and Diagnostic Study of Epistemic Admission in Shared Agent Memorycited by 0
  14. 2026Janus: Evidence-Before-Effect Sagas and Offline-Verifiable Provenance for Agentic LLMscited by 0
  15. 2026NAQD Env: A benchmark for selective withdrawal in language agentscited by 0
  16. 2026K-Dense BYOK: An Open-Source AI Research Assistant That Runs Locally and Keeps a Hash-Chained Lab Notebookcited by 0
  17. 2026Federated Agent Optimizationcited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026LEDGER: Claim-to-Evidence Trace Graphs for Auditing LLM Agents
  2. 2026Auditing Provenance Sensitivity in LLM Agent Action Selection
  3. 2026MAP-Graph: Provenance-Aware Shared Memory for Multi-Agent Workflows
  4. 2026The Granularity Mismatch in Agent Security: Argument-Level Provenance Solves Enforcement and Isolates the LLM Reasoning Bottleneck
  5. 2026AgentTrails: Towards Trust and Reuse for Agentic Tasks
  6. 2026When Agents Overtrust Environmental Evidence: An Extensible Agentic Framework for Benchmarking Evidence-Grounding Defects in LLM Agents
  7. 2026Safeguarding LLM Agents from Misalignment through Provenance Analysis
  8. 2026PACE: Provenance-Aware Capability Enforcement for Tool-Using LLM Agents