Abstract
Commercial LLM APIs advertise a specific foundation model, but the served backbone may be silently substituted, quantized, or wrapped, for example to save deployment costs. All existing audits decide backbone identity from the text-output channel, which is structurally fragile for agentic APIs because modern serving stacks (OpenAI, Anthropic, Gemini, Cloudflare Workers AI, LangGraph) discard text and expose only structured actions when the model calls a tool, and provider-injected system prompts can distort text distributions enough that text-channel tests falsely accuse honest providers of substituting the claimed model. We observe that recent agentic post-training internalizes tool-use directly into the weights, opening a new audit channel that the serving stack still exposes and that is largely invariant to deployment context. We introduce Agentic Provenance (AgentProv), the first action-based identity audit for agentic LLM APIs: AgentProv fingerprints a deployed model through its categorical tool-call distribution and decides identity via an MMD permutation test. AgentProv catches every substituted model (100% on 630 evaluated checkpoint pairs), while holding the false-positive rate under system-prompt injection at 7% (vs. 67% for MET and 53% for RUT). On third-party API endpoints, AgentProv’s disagreements with MET are consistent with an independent token-count side-channel that detects provider-injected system prompts.
Method
1 Tool-use policy probes
Both endpoints receive neutral requests with functionally equivalent tool options. Matched descriptions and randomized tool order reduce confounding effects. The primary evaluation uses 20 probe templates to measure preferences across different tool-use situations.
2 Action fingerprints
AgentProv records the selected tool as a categorical outcome and estimates its frequency over repeated queries. Responses without a tool call and malformed calls are recorded as separate outcomes. Combining these distributions across templates yields a behavioral fingerprint without requiring natural-language output or access to the suspect model’s weights.
3 Permutation-calibrated comparison
The audit compares fingerprints using maximum mean discrepancy (MMD). For the categorical kernel used here, the statistic is the squared distance between the empirical action-frequency vectors. A template-stratified permutation test calibrates the decision by pooling responses within each template, shuffling endpoint labels, and recomputing the statistic. Rejection indicates a discrepancy in the probed tool-selection behavior.
Experimental Results
Model substitution detection
AgentProv detects substitution on all 630 evaluated checkpoint pairs.
Robustness to hidden system prompts
In this control experiment, the model weights remain unchanged while the system prompt changes. Rejecting model identity is therefore a false positive. AgentProv produces fewer false positives than the comparison audits in the tested conditions.
| Audit | False positives | Rate |
|---|---|---|
| MET | 10 / 15 | 67% |
| RUT | 8 / 15 | 53% |
| Adapted LLMmap | 3 / 15 | 20% |
| AgentProv | 1 / 15 | 7% |
BibTeX
Accepted to the EMNLP 2026 main conference. The citation below points to the available arXiv version.
@misc{wang2026agentprov,
title = {AgentProv: Auditing Agentic LLM API Providers via Tool-use Policy Probes},
author = {Xun Wang and Bihe Zhao and Michael Backes and Franziska Boenisch and Adam Dziedzic},
year = {2026},
eprint = {2609.00052},
archivePrefix = {arXiv},
primaryClass = {cs.CR},
url = {https://arxiv.org/abs/2609.00052}
}