PaperlayerView exact revision on arXiv

Source-linked AI summary

AUDITA: certified auditing and causal attribution of adverse outcomes in autonomous multi-agent systems

Zhixu Du, Yiran Chen

arXiv:2608.22160v1cs.AI

TL;DR

Adverse outcomes in autonomous multi-agent systems lack a defensible way to divide responsibility among agents and stakeholders from trustworthy evidence. Audita combines tamper-evident command records with certified graded causal attribution, cutting judge attribution error roughly threefold and recovering responsibility that single-culprit approaches miss.

  • Problem

    Existing audit methods cannot verify log authorship, order, or completeness and generally assign a single culprit despite shared, preempted, or omission-based responsibility.

  • Method

    Audita cryptographically verifies inter-agent commands and computes graded counterfactual responsibility over the resulting evidence.

  • Results

    Roughly threefold lower judge attribution error was achieved, while accident-structure benchmarks recovered planted responsibility and remained invariant under record forgery.

  • Takeaways & Limitations

    Audita provides evidence-backed, degree-based accountability for concrete adverse outcomes rather than treating responsibility as an argument over unverifiable logs.

  • Takeaways & Limitations

    The quantitative evaluation is simulated and does not yet demonstrate physical robots or production stacks.

Abstract

from arXiv · show

Physical automation is scaling toward fleets of embodied machines commanded by an AI brain. Early deployments already run factories and warehouses at production rates beyond any human line, and their adoption is accelerating. But when their joint decisions cause harm, everyone involved has reason to blame everyone else, the machine vendor, the algorithm provider, the factory operator, the insurer, and the regulator, and no method can divide the responsibility between them. Existing methods read logs whose origin they cannot verify and name a single culprit, misrepresenting outcomes that are overdetermined, preempted, or caused by an omission. We present \audita{}, an audit layer pairing a tamper-evident record of every inter-agent command with a certified, graded causal-attribution engine. We prove its verdict cannot be gamed: a rule-following agent can never be made to look guilty, an attempt to shift blame is itself caught and graded, and we establish the exact limit of what an evidence-based auditor can certify. On live language-model pipelines it reduces the standard judge baseline's responsibility error roughly threefold; on a benchmark of accident-grounded structures it recovers responsibility where single-culprit baselines fail, and stays invariant under forgery. \audita{} turns the question of who is to blame from an argument about logs into a calculation over evidence.

1. Introduction

Audita addresses the lack of defensible responsibility attribution in autonomous multi-agent systems by combining tamper-evident inter-agent records with certified causal analysis. It proves protections against fabricated culpability and evaluates them on language-model pipelines and accident-grounded structures.

  • Problem: Existing execution logs cannot defensibly establish authorship, order, or completeness when adverse outcomes create liability disputes.Operators, insurers, regulators, and vendors need to know which agents and commands bear how much responsibility, and which are demonstrably innocent.
  • Prior attribution methods: 53.5% agent-level and 14.2% step-level accuracy are the best judge-style results reported for the Who&When benchmark.The benchmark formalised failure attribution for multi-agent systems, while a taxonomy found substantial failure lies in inter-agent coordination rather than one model.
  • Contribution: Audita combines cryptographically checkable evidence with causal semantics for overdetermined, preempted, or omission-based harm.Every inter-agent message is signed, cites the messages it acts on, and is sealed into an append-only, Merkle-committed record.
  • Guarantees: Under a replayable stack, recorded channel, and sound key custody, Audita proves compliant principals cannot be made culpable by manufactured involvement.Each culpability finding is witnessed by the accused’s own certified conduct violating a declared duty.
  • Evaluation: Roughly threefold lower judge attribution error was achieved on live language-model multi-agent pipelines solving GSM8K.On physical incident structures grounded in public robot-accident records, Audita recovered planted responsibility exactly, refused blame on genuine accidents, and remained invariant under record forgery.

Results

Audita substantially improves graded responsibility attribution on live language-model failures and exactly recovers analytically grounded physical incident structures, including joint causation, overdetermination, and omissions. Its certified record remains invariant under forgery, while performance depends on counterfactual access and the registered duty standard.

  • Live multi-agent failures: 95–98% of adverse incidents are joint solver–aggregator incidents, and none has the monotone single-culprit structure assumed by the field’s metric.The counts are 56/57, 43/47, and 39/41 across three corpora under duty-aware graded ground truth.
  • Live multi-agent failures: 0.170 responsibility error reduces the judge baseline from 0.589, while Audita’s deployable breach standard reaches 0.159 without reading an answer key.The paired reduction is 0.418 with 95% CI [−0.445, −0.391] over 145 incidents; causal-only ablation reaches 0.408.
  • Physical incident structures: 0.000 responsibility error recovers every core physical incident structure exactly, including overdetermined accidents and omissions represented through absence variables.The result averages 300 draws per structure, whereas single-site scoring averages 0.433 and cannot represent redundancy or omissions.
  • Generalisation: 0.000 exact error on 74 held-out unexpected-startup incidents identifies the omitted pre-entry halt as the sole breach, despite every issued command being duty-compliant.This out-of-loop evaluation used the engine, oracle, and arms frozen at a recorded commit.
  • Record attacks: 0.000 error persists under forgery on the certified substrate, while unsigned-record forgeries reach 0.365 error and frame an innocent victim in 450/450 probes.Deleting certified evidence only widens the reported interval, retaining coverage 1.000, with error ≤0.122 and detection in 450/450 cells.
  • Ablations and standards: 0.667 error on redundancy and inert-twin structures follows duty-layer removal, while varying the duty standard preserves causal profiles but flips culpability in 69.8% of incidents.Live error rises from 0.170 to 0.408 without the duty layer; causal facts remain identical in 457/457 incidents.

Discussion

The discussion frames Audita as a combined evidentiary and causal system for post-incident accountability, while identifying tight limits on what record-confined auditing can certify. Its guarantees depend on replayable, recorded channels, and its current evaluation remains simulated, although the design targets regulatory and broader operational use.

  • Core design: Audita requires both tamper-evident evidence and certified causal semantics: either alone can be manipulated or collapse responsibility into a single culprit.The evidentiary substrate must be established before the incident and remain checkable by a hostile audience afterward.
  • Limits: The accountability frontier is tight: record attackers can widen uncertainty, valid-key insiders can cause harm, and completeness would require solving the audited task.The completeness barrier is formalized as Theorem 4.
  • Assumptions: Exact receipts require replayable deployments, while hosted non-deterministic models provide only statistical corroboration; recorded channels make exonerations complete only for certified evidence.Side-channel coordination remains invisible to the auditor.
  • Boundaries: The formalism covers discrete threshold incidents, not cumulative harms without such events, and its quantitative evidence is simulated rather than demonstrated on physical robots or production stacks.The structures are grounded in public accident reports, with analytically derived ground truth and re-executed-world scoring identified as needed for simulation validation.
  • Broader impact: Audita responds to EU AI Act recordkeeping by specifying records that are signed, cited, sealed, and causally analysable, with applications beyond factories.Proposed domains include logistics fleets, laboratory automation, service robots, and digital agent economies.

Methods

AUDITA models autonomous operations as signed, asynchronously interacting principals whose certified messages define an incident-specific causal record. Its verdict layer separates causal involvement from culpability, provides replay-checkable safeguards against false accusation and blame shifting, and states the limits of record-only certification.

  • Audit model: The system records signed messages from language-model planners, tool agents, robot controllers, and human supervisors through a replicated recorder, while modeling network and record attacks.Adversaries may read, delay, reorder, replay, drop, inject, equivocate, forge, or delete traffic; valid-key insider messages remain certified and attributable to their authors.
  • Incident construction: AUDITA defines an incident slice as the certified causal past of an outcome, closed under duties active during the relevant window.The same construction audits injuries, near-misses, and ruined batches, including both safety and quality outcomes.
  • Certified attribution: Every reported cause is replay-verified, so certified false positives are excluded on pinned stacks and bounded by α on hosted stacks; failure appears as abstention.Certification requires an intervention that reduces the certified risk by at least δ, exactly on a pinned stack and with confidence 1 − α plus reported action-match on a hosted stack.
  • Accountability guarantees: Theorems guarantee that compliant principals cannot be found culpable, blame-shift deviations become machine-checkable graded causes, and record edits cannot silently erase exonerating or inculpating evidence.Forged items remain outside the certified graph, while deletions can widen completion sets or produce author-attributed missing and suspect witnesses.
  • Certification limits: The completeness barrier states that no content-determined breach standard is both sound and complete when duty-compliant conduct can contain honest errors.Any standard that closes this gap must decide output correctness for the audited task, while influence outside the message bus remains invisible to a record-level auditor.

Extended Data

The extended data specifies AUDITA’s accountable-message record and two-layer causal-attribution engine, which jointly support gated candidate enumeration and replay certification. It also documents the benchmark and computational trade-offs of exact attribution.

  • Accountable message lifecycle: Each accountable message carries signed fields, including authored citations, a committed effect predicate, and pinned seed/model identifiers absent from standard observability logs.These fields are consumed by gating, grading, and replay; six bus stamps, including enforced citation and receipt, make uncited or dropped commands detectable.
  • Two-layer attribution engine: The attribution engine first exactly enumerates minimal cause sets and witness sets over the certified structural abstraction, then certifies proposals by seeded re-execution from recorded checkpoints.Responsibility is produced directly as ρ = 1/(|X*| + |W*|), with witnesses frozen at recorded values and models and simulators rolled forward from committed checkpoints.
  • Benchmark: The causal-attribution benchmark contains structures with planted graded ground truth, each probing a distinct attribution challenge.The complete generators and analytic oracle are provided in the Supplementary Information.
  • Exactness and computational cost: Responsibility error stays 0.000 at every tested incident width k, while wall-clock query time roughly doubles per added candidate.The facility register reports 393 B per signed message and 118 KB per complete incident.

S1. Notation and formal model

Audita models certified messages, omissions, and outcomes within an incident slice, then evaluates causal responsibility across all evidence-consistent completions. It reports an involvement interval and reserves culpability for principals shown to have both breached duties and caused the outcome.

  • Record and verification: Each message carries an author, payload, citation hashes, effect predicate, and signature; records add delivery receipts and per-epoch Merkle commitments for verification.Verification checks signatures and the integrity of cited and committed record items.
  • Slice model: The incident slice contains citation ancestry for outcome-linked actuation events, active-duty closures, certified message-presence variables, duty-absence variables, and the outcome.Unissued required messages are represented as first-class absence facts from the duty registry.
  • Attribution and completions: Audita computes each principal’s graded causal responsibility using a modified Halpern–Pearl test over models induced by admissible completions of missing evidence.Completions must remain consistent with verified receipts, commitments, and recorded actuation facts, including the adverse outcome.
  • Attribution and completions: The reported interval’s lower endpoint is the causal involvement every evidence-consistent reading must concede, while involvement alone does not establish culpability.A principal is culpable only when both breach and causation are established.

S2. Proofs

The proofs establish that Audita’s certified record and responsibility bounds resist forgery and deletion under explicit cryptographic and operational assumptions. They also formalize replay-certified causes, path-based exoneration, and correspondence between minimal causes and NESS causes in monotone models.

  • Assumptions: Under unforgeable signatures, collision-resistant hashing, sealed epochs, and key custody, certified messages cannot be newly forged or misattributed.Sealed-epoch deletion is detectable, while valid-key insider actions are attributed to the key holder.
  • Record integrity: Injecting unverifiable items leaves Gcert and M unchanged, while the suspect set grows by exactly the injected items.The injected items fail signature, citation, or inclusion-proof verification and therefore do not enter the certified graph.
  • Record integrity: Deleting items preserves every original admissible completion model-preservingly and may add completions, so missing evidence becomes detectable uncertainty rather than disappearance.Deleted certified items remain represented through committed hashes as missing nodes.
  • Responsibility monotonicity: For a fully certified principal, record edits cannot increase involvement: unverifiable injections leave the verdict unchanged, while deletions can only widen the reported interval.The widened upper end is explicitly labeled uncertainty from missing evidence, supporting an in-dubio-pro-reo interpretation.
  • Replay certification: Every reported cause is replay-verified: certified risk reduction is at least δ exactly on pinned stacks and with confidence 1 − α on hosted stacks.Certified false positives are excluded on pinned stacks and occur with probability at most α per reported cause on hosted ones.
  • Causal gating: A message lacking an intact verified production path to Y receives ρ = 0 and an exoneration note, regardless of its content.Only messages entering the gated slice model can belong to a cause set and receive attributable ρ-mass.
  • Causal semantics: In monotone slice models, minimal causes have empty witnesses and grade ρ = 1/|X*|, while minimal causes are exactly minimal transversals and variable membership equals NESS causation.This links the modified test to classical responsibility and identifies variables appearing in satisfied prime implicants.

S3. Guarantees against valid-key adversaries: groundedness, blame-shift accountability, and the completeness barrier

AUDITA’s guarantees remain grounded against valid-key coalitions: culpability requires the principal’s own certified breach, while blame-shifting conduct is itself causally certified. The framework also proves fundamental limits: record edits cannot silently exonerate a culprit, but no content-determined standard can be both sound and complete under honest fallibility.

  • Groundedness: Certified evidence about another principal enters a verdict only through causal mechanism or certified-input context; assertions never serve as testimony about the target’s conduct.If a principal’s authored items and input frontiers agree across certified records, its breach finding is unchanged by other principals’ assertions.
  • Groundedness: A valid-key coalition cannot make a duty-compliant principal culpable: any culpability finding must be witnessed by that principal’s own certified conduct or registered omission.This grounding holds even when record-edit attacks are applied.
  • Blame-shift accountability: A coalition that raises a compliant victim’s involvement bound above its declared-reference value has deviations that are an actual cause of the victim’s pivotality.A minimal deviation set paired with frozen witness deviations yields a machine-checkable certificate replayable across two runs.
  • Blame-shift accountability: Blame-shift certificates cannot generally localize a deviation to a production path from the victim’s messages to the outcome or make it an actual cause of the outcome itself.The theorem establishes accountability for raised pivotality, but explicitly rules out these stronger localization claims.
  • Completeness barrier: Under honest fallibility, no content-determined breach standard is both sound and complete; under template-uniform realizability, completeness is at least as hard as answer verification.A sound complete auditor restricted to certified records would decide whether any candidate answer is correct, creating the stated completeness barrier.
  • Record-edit accountability: A record edit that lowers a certified culprit’s responsibility below its original positive level must leave missing evidence crossing every forcing family, with authors and citers reported.Responsibility remains at least the original level on the modified record, so editing converts forced guilt into flagged uncertainty rather than certified innocence.

S4. Framing attacks as implemented, and what their success does not show

The facility attacks instantiate causal citation manipulation and are evaluated through exact counterfactual re-execution. Their results demonstrate implementation against theorem-derived attacks, while the reported success is explicitly limited by the experiment’s design and scope.

  • Implemented attacks: In the conditioning attack, a harmful speed command cites the victim’s compliant message, so suppressing that message silences the attacker’s certified production path.Citation is treated as an authored causal claim, making the citation itself create the certified production path.
  • Certification method: The certificate applies responsibility calculus to selector variables switching deviations between realised and reference conduct, with victim pivotality as the outcome event.Counterfactuals use exact world re-execution and citation-chain propagation, so suppressing a trigger silences conduct that cited it.
  • Limits of the result: Both attacks drive a compliant principal’s involvement bound to 1.0, but the attacks are theorem-derived rather than searched and the experiment reports only the successful half.The authors note that they designed the attacks, defence, and scoring, so the evaluation checks implementation against a prediction rather than searching for a favourable case.

S5. Scenario library, planted ground truth, and the analytic oracle

The scenario library instantiates causal families as typed-command facility incidents and computes planted ground truth with independent physics and analytic oracles. It distinguishes overdetermination, inert proposals, preemption, omission, delegation, attacks, and negative controls while grounding structures in public robot-accident records.

  • Scenario instantiation: Typed commands, deterministic 0.1 s kinematics, declared effect predicates, and facility semantics instantiate the abstract causal families for auditable replay.The facility register makes the abstract structures physically checkable against their command and actuator realizations.
  • Oracle construction: The physics oracle re-executes the world with candidate messages absent, while the analytic oracle independently derives grades through prime-implicant extraction and minimal-transversal enumeration.Neither oracle shares code with the engine under test, and no language model participates in physics-oracle computation.
  • Counterfactual semantics: Consumption-level interventions and registered supervisor duties define counterfactual message absence and omission variables without altering the sealed record or inventing obligations.The omission value comes from running the certified supervisor policy offline over recorded sensor reports and the registered duty specification.
  • Planted families: Named families encode distinct responsibility patterns: redundancy gives both planners ρ=1/2, inert twins exonerate an uncited proposal, preemption exonerates a halted hazard, omission separates causation from breach, and delegation grades every chain member.Delegation flags faithful relays as conduits and localizes the breach to the erroneous transformation at p1.
  • Accident grounding: 42 public robot-accident records are mapped to held-out register families, including unexpected startup, preemption and defeated protections, mixed conjunctive failures, and chain delegation.Unexpected startup contributes 7 cases, preemption and defeated protections 6, mixed conjunctive failures 6, and chain delegation 1.

S6. Canonical form and granularity invariance

AUDITA’s grading is invariant to how a principal chunks its own output. A canonical contraction merges same-author conjunctive message groups while preserving every principal’s grade on monotone slice models.

  • Granularity invariance: Re-chunking one principal’s output cannot change its responsibility because Eq. (2)’s per-principal maximum absorbs the principal’s own chunking.A size-s minimal cause using one of the principal’s chunks contributes grade 1/s regardless of sibling chunks.
  • Canonical contraction: Canonical contraction replaces same-author messages used only conjunctively by a single representative variable g.A conjunctive group is defined by invariance under permutation and replacement with one variable equal to the group conjunction.
  • Granularity invariance: On monotone slice models, canonical contraction leaves every principal’s grade unchanged: ρ_p(M) = ρ_p(M/g) for all p.The proof matches minimal causes before and after contraction while preserving their sizes and authorship.
  • Canonical contraction: Contraction additionally stabilizes other principals’ grades when their causes interact with a re-chunked group.It is applied before grading in all experiments, and the released test suite checks invariance on a re-chunked record.

S7. Record substrate and replay details

AUDITA uses layered storage and sealed commitments to preserve a shared, tamper-evident record, while replay stacks support either bit-exact or confidence-qualified certification. Divergent histories become cryptographic evidence of recorder misbehavior.

  • Storage tiers: The record uses hot append-only logs, warm content-addressed payload storage with sealed hashes, and cold sealed epochs with published Merkle roots.Encrypted or crypto-shredded payloads can preserve data protection without breaking the seal.
  • Equivocation: A single sealed sequence binds consumers to the same root, while divergent roots expose equivocation as cryptographic evidence of recorder misbehavior.The resulting evidence enters the suspect set.
  • Replay stacks and action-match: The pinned replay stack fixes weights, decoding, seeds, tool versions, and simulator build for bit-exact factual replay and deterministic interventional replay.The hosted stack instead reports Proposition 1’s confidence interval and an action-match score based on order-preserving alignment of recorded and replayed actuation events.

S8. Reproducibility

AUDITA provides a reproducible reference implementation organized into auditable components, with runner artifacts supporting regeneration and verification of reported results. Experiments use controlled stochastic seeds, deterministic simulation or replay, and a pinned software and hardware environment.

  • Implementation: The reference implementation is a Python package organized into record, engine, verdict, facility, corpus, baselines, and metrics modules.The modules cover accountable messages and Merkle sealing, certification, responsibility analysis, incident generation, live pipelines, baselines, and metrics.
  • Artifacts and verification: Each runner writes a JSON artifact containing configuration, per-incident outputs, and summary statistics.Scripts regenerate all main-text numbers, figures, and tables from these artifacts, while a verification script re-checks every reported quantity before submission.
  • Determinism and environment: Generation sweeps use seeds k∈{0, 1, 2}, while simulation is CPU-deterministic and open-weight planner replay uses seeded deterministic serving.Experiments ran on NVIDIA A100-SXM4-80GB GPUs under Python 3.11 and NumPy 2.4.

S9. Registered disclosures and measurement history

This section documents registered deviations, refuted predictions, measurement history, amended designs, and instrument defects, with registration dates recorded in the experiment log. Several predictions failed substantially, while design changes and defects were disclosed before or during experimentation.

  • Refuted predictions: 95–98% of 72B live-corpus incidents showed joint solver–aggregator causation, versus the predicted 28–42%.The measured share refuted the regime-decomposition prediction.
  • Refuted predictions: β= 0.000 under fair manipulation refuted the prediction that judge attributions would track message volume.Other refuted predictions included a paired difference spanning zero, upward brute-force repair curves, and Shapley errors of 0.833 on redundancy and 0.223 live.
  • Measurement history: The Llama-3.1-8B cell initially contained 13 scoreable incidents, with judge argmax culprit identification at 1.000 versus 0.615.Because post-result extension could constitute optional stopping, the enlarged cell’s reporting direction was fixed in advance without changing arms, metrics, or exclusion rules.
  • Amended designs: Two registered designs were amended: the second-family study changed from Llama-3.3-70B to a matched-scale Qwen2.5-7B versus Llama-3.1-8B contrast, and the benchmark changed from Who&When Pro to Who&When.The amendments addressed unservable capacity and unreleased benchmark data, respectively.
  • Instrument defects: Seven instrument defects were caught before publication, including omitted halt commands, tautological residuals, unfair speed repairs, and an unnameable silent duty-holder.After repair, full reruns of the principle-family and record-attack experiments reproduced every previously published mean exactly.

S10. Extended related work

The extended survey situates Audita across causal, legal, governance, distributed-systems, telemetry, attack, and accident-analysis literatures. It emphasizes that Audita’s novelty lies in composing established ingredients into a certified record and responsibility assessment.

  • Scope and positioning: Audita’s survey spans failure attribution, actual causality, graded responsibility, and manipulation-of-attribution work, while noting strategic-agent studies do not address adversarial framing.The adjacent literature includes incentive misalignment under uncertainty, but its agents do not attack others’ attributions.
  • Causation and accountability: Audita draws its verdict structure from NESS causation, legal causation theory, and distinctions between dependence and production, while addressing accountability gaps created by learning systems and many hands.Its volume-confound experiment tests whether human responsibility intuitions about contributor salience create a machine-analogue audit failure.
  • Evidence and auditability: PeerReview’s tamper-evident, witness-audited message logs provide the distributed-systems lineage for Audita’s guarantee that correct nodes can defend against false accusation.Theorem 1 generalizes that defense from protocol deviation to graded semantic responsibility.
  • Telemetry: Agent telemetry and tracing conventions capture operations but lack authenticated identity, completeness guarantees, and semantics that convert spans into responsibility.Audita extends these conventions with authored citations, committed effects, and pinned seeds.
  • Boundaries and contribution: Audita is positioned against robot attacks, systems-theoretic accident analysis, microservice root-cause methods, and agent-planning systems, preserving their roles while adding certified responsibility assessment.The paper presents its contribution as composing deeply rooted ingredients across these fields rather than introducing each ingredient independently.
Loading 2608.22160v1…