Blindfold: Keeping the Audit Coin Secret from LLM Agents

arXiv:2610.37055v1 Announce Type: cross Abstract: Audit-based certification bounds the violation rate of an LLM agent by auditing a random fraction arepsilon of actions and reweighting the audited labels; its validity is meant to rest only on the defender's audit coin. We show that it also rests on a confidentiality property: the coin must not interfere with the agent's view before the action commits, at a time the agent chooses. We call this pre-commit noninterference (PNI) and measure its violation by D_{A}, the total-variation distance between the agent's views under the two coin values. PNI is necessary and sufficient for an unbiased certificate against adaptive agents, the worst-case bias is (1-arepsilon)D_{A}, and no procedure that sees only audited labels can pay less. Leakage composes across steps, a resource shared across episodes opens a channel of computable size, and raising the audit rate cannot restore validity. On a monitor we built, a silent audit changes no output but adds latency that tool timestamps expose, and the agent can enlarge it. A real LLM agent follows an injection that names a visible audit notice (generic, tool, and timing clauses have no effect); over that channel the plain certificate fails on measured labels and, by a post-hoc analysis, in a live run on a pre-registered schedule, while a silent audit restores it. A fresh coin per audited call closes the timing channel; padding only narrows it.

Related

• Colosseum: Auditing Collusion in Cooperative Multi-Agent Systems
• Does Splitting a Triage Decision Across Agents Hide Bias or Help Catch It? A Multi-Agent Simulation Study of LLM-Based Resource Allocation Under Audit Capacity Constraints
• Scores Alone Do Not Prove Discovery: The Discovery Certification Protocol for Auditing AI Research Agents
• ActGov: Governing LLM Agent Actions via Policy-Constrained Validation

Source: arXiv cs.AI | 2026-10-28