Actions with Receipts: Jointly Binding Claims, Evidence, and Execution for Replayable Tool-Agent Auditing
Not on the map. Why?
Abstract (arXiv)
Tool-using agents can expose citations and execution logs while leaving a critical association unaudited: whether the claim shown to a user is the claim emitted by the committed execution and supported by the cited source. A valid citation and a valid trace can therefore remain individually well formed while being transplanted across claims, actions, runs, or source versions. We introduce a claim-anchored execution contract that jointly binds the emitted claim, its exact source span, the ordered execution prefix that produced it, and the source version and access state observed by that execution. Each receipt contains an emission anchor that deterministically locates the claim inside a committed answer or claim-bearing action, together with source identifiers, offsets, hashes, quotes, and a domain-separated execution commitment. A deterministic integrity verifier reconstructs these bindings before semantic or task labels are joined. We separate this integrity plane from a pluggable support plane, so structural validity is not used as a proxy for entailment. The contract exposes seven independently testable properties: claim-emission binding, source binding, ordered-execution binding, oracle separation, persisted-object replay, execution-rerun consistency, and version/access binding. Across 1,280 cross-object attacks, the joint contract detects 1,275 substitutions (0.9961). Removing a targeted property reduces its attack-detection rate to 0.0156-0.0625. On an independently adjudicated 384-pair split, the conflict-aware support guard reaches F1 0.8865 and false acceptance 0.0729; on unseen failure families, these rates are 0.8679 and 0.0938.
Key facts. No citing papers in the map yet (data through 13 Oct 2026). Builds on 22 of its 38 references that are in the map. First posted on arXiv 29 Sep 2026.
Builds on
22 of 38 references.
References · 22
- 2022ReAct: Synergizing Reasoning and Acting in Language Modelscited by 8,502
- 2023Reflexion: Language Agents with Verbal Reinforcement Learningcited by 4,156
- 2023Toolformer: Language Models Can Teach Themselves to Use Toolscited by 4,117
- 2023Let's Verify Step by Stepcited by 3,672
- 2023Self-Refine: Iterative Refinement with Self-Feedbackcited by 3,367
- 2023WebArena: A Realistic Web Environment for Building Autonomous Agentscited by 1,953
- 2023ToolLLM: Facilitating Large Language Models to Master 16000+ Real-world APIscited by 1,904
- 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,417
- 2024τ-bench: A Benchmark for Tool-Agent-User Interaction in Real-World Domainscited by 1,335
- 2023FActScore: Fine-grained Atomic Evaluation of Factual Precision in Long Form Text Generationcited by 1,268
- 2023AgentBench: Evaluating LLMs as Agentscited by 1,242
- 2023Mind2Web: Towards a Generalist Agent for the Webcited by 1,222
10 more
- 2024OSWorld: Benchmarking Multimodal Agents for Open-Ended Tasks in Real Computer Environmentscited by 1,154
- 2023Enabling Large Language Models to Generate Text with Citationscited by 588
- 2023API-Bank: A Comprehensive Benchmark for Tool-Augmented LLMscited by 583
- 2023Ragas: Automated Evaluation of Retrieval Augmented Generationcited by 413
- 2024ProcessBench: Identifying Process Errors in Mathematical Reasoningcited by 280
- 2023RAGTruth: A Hallucination Corpus for Developing Trustworthy Retrieval-Augmented Language Modelscited by 278
- 2024ToolSandbox: A Stateful, Conversational, Interactive Evaluation Benchmark for LLM Tool Use Capabilitiescited by 276
- 2023ARES: An Automated Evaluation Framework for Retrieval-Augmented Generation Systemscited by 260
- 2024Atomic Fact Decomposition Helps Attributed Question Answeringcited by 21
- 2026GenProve: Learning to Generate Text with Fine-Grained Provenancecited by 2
Built on by
Not cited yet.