AgentProv: Auditing Agentic LLM API Providers via Tool-use Policy Probes

EMNLP 2026 · Main Conference

CISPA Helmholtz Center for Information Security

Abstract

Commercial LLM APIs advertise a specific foundation model, but the served backbone may be silently substituted, quantized, or wrapped, for example to save deployment costs. All existing audits decide backbone identity from the text-output channel, which is structurally fragile for agentic APIs because modern serving stacks (OpenAI, Anthropic, Gemini, Cloudflare Workers AI, LangGraph) discard text and expose only structured actions when the model calls a tool, and provider-injected system prompts can distort text distributions enough that text-channel tests falsely accuse honest providers of substituting the claimed model. We observe that recent agentic post-training internalizes tool-use directly into the weights, opening a new audit channel that the serving stack still exposes and that is largely invariant to deployment context. We introduce Agentic Provenance (AgentProv), the first action-based identity audit for agentic LLM APIs: AgentProv fingerprints a deployed model through its categorical tool-call distribution and decides identity via an MMD permutation test. AgentProv catches every substituted model (100% on 630 evaluated checkpoint pairs), while holding the false-positive rate under system-prompt injection at 7% (vs. 67% for MET and 53% for RUT). On third-party API endpoints, AgentProv’s disagreements with MET are consistent with an independent token-count side-channel that detects provider-injected system prompts.


Method

AgentProv's four stages: tool-choice probes, categorical action encoding, a fingerprint distance statistic, and a permutation-calibrated decision.
AgentProv compares the tool-selection behavior of a suspect API with an authoritative instance of the claimed model. Repeated probe responses form categorical fingerprints, which are compared using an MMD permutation test.

1 Tool-use policy probes

Both endpoints receive neutral requests with functionally equivalent tool options. Matched descriptions and randomized tool order reduce confounding effects. The primary evaluation uses 20 probe templates to measure preferences across different tool-use situations.

2 Action fingerprints

AgentProv records the selected tool as a categorical outcome and estimates its frequency over repeated queries. Responses without a tool call and malformed calls are recorded as separate outcomes. Combining these distributions across templates yields a behavioral fingerprint without requiring natural-language output or access to the suspect model’s weights.

3 Permutation-calibrated comparison

The audit compares fingerprints using maximum mean discrepancy (MMD). For the categorical kernel used here, the statistic is the squared distance between the empirical action-frequency vectors. A template-stratified permutation test calibrates the decision by pooling responses within each template, shuffling endpoint labels, and recomputing the statistic. Rejection indicates a discrepancy in the probed tool-selection behavior.


Experimental Results

Model substitution detection

AgentProv detects substitution on all 630 evaluated checkpoint pairs.

Robustness to hidden system prompts

In this control experiment, the model weights remain unchanged while the system prompt changes. Rejecting model identity is therefore a false positive. AgentProv produces fewer false positives than the comparison audits in the tested conditions.

Hidden-prompt control over five models and three prompt conditions, using 20 templates and 50 samples per template. Lower false-positive rates are better.
AuditFalse positivesRate
MET10 / 1567%
RUT8 / 1553%
Adapted LLMmap3 / 1520%
AgentProv1 / 157%

BibTeX

Accepted to the EMNLP 2026 main conference. The citation below points to the available arXiv version.

@misc{wang2026agentprov,
  title = {AgentProv: Auditing Agentic LLM API Providers via Tool-use Policy Probes},
  author = {Xun Wang and Bihe Zhao and Michael Backes and Franziska Boenisch and Adam Dziedzic},
  year = {2026},
  eprint = {2609.00052},
  archivePrefix = {arXiv},
  primaryClass = {cs.CR},
  url = {https://arxiv.org/abs/2609.00052}
}