AgentProv: Auditing Agentic LLM API Providers via Tool-use Policy Probes

Xun Wang; Bihe Zhao; Michael Backes; Franziska Boenisch; Adam Dziedzic

Source-linked AI summary

AgentProv: Auditing Agentic LLM API Providers via Tool-use Policy Probes

Xun Wang, Bihe Zhao, Michael Backes, Franziska Boenisch, Adam Dziedzic

arXiv:2609.00052v1Aug 30, 2026cs.CRcs.CLcs.LG

TL;DR

Commercial LLM APIs may silently substitute the advertised backbone, while text-based identity audits are fragile when agentic serving exposes structured actions or injects system prompts. AgentProv audits categorical tool-call policies with an MMD test, detecting all evaluated substitutions and reducing prompt-injection false positives relative to MET and RUT. Its scope requires an authoritative reference and provides evidence from behavior rather than a complete certificate of the underlying backbone.

Problem
Existing API audits rely on natural-language completions, but agentic serving may expose only structured actions and provider prompts can shift text distributions.
Method
AgentProv compares categorical tool-selection distributions from a suspect endpoint and authoritative reference using an MMD equality test.
Results
100% of 630 evaluated checkpoint pairs were rejected when substituted, while system-prompt-injection false positives were 7% versus 67% for MET and 53% for RUT.
Takeaways & Limitations
AgentProv provides a practical, lightweight identity signal for agentic APIs, including action-only serving stacks, and is more robust than text-channel baselines to tested deployment changes.
Takeaways & Limitations
AgentProv requires an authoritative reference and cannot prove the underlying backbone without model-weight access, so it supplies behavioral evidence rather than a complete identity certificate.

Abstract

from arXiv · show

Commercial LLM APIs advertise a specific foundation model, but the served backbone may be silently substituted, quantized, or wrapped, for example to save deployment costs. All existing audits decide backbone identity from the text-output channel, which is structurally fragile for agentic APIs because modern serving stacks (OpenAI, Anthropic, Gemini, Cloudflare Workers AI, LangGraph) discard text and expose only structured actions when the model calls a tool, and provider-injected system prompts can distort text distributions enough that text-channel tests falsely accuse honest providers of substituting the claimed model. We observe that recent agentic post-training internalizes tool-use directly into the weights, opening a new audit channel that the serving stack still exposes and that is largely invariant to deployment context. We introduce Agentic Provenance (AgentProv), the first action-based identity audit for agentic LLM APIs: AgentProv fingerprints a deployed model through its categorical tool-call distribution and decides identity via an MMD permutation test. AgentProv catches every substituted model (100% on 630 evaluated checkpoint pairs), while holding the false-positive rate under system-prompt injection at 7% (vs. 67% for MET and 53% for RUT). On third-party API endpoints, AgentProv's disagreements with MET are consistent with an independent token-count side-channel that detects provider-injected system prompts.

1 Introduction

Commercial LLM APIs can silently serve backbones different from their advertised models, while text-channel audits are fragile for agentic APIs. AgentProv instead audits model identity through tool-call behavior, using an MMD test and achieving complete substitution detection with lower prompt-injection false positives.

Motivation: Agentic API endpoints may serve quantized, distilled, wrapped, or otherwise substituted backbones despite advertising a specific foundation model.Prior audits and surveys report identity discrepancies across commercial endpoints, motivating direct auditing of deployed models.
Motivation: Text-channel audits are structurally vulnerable because agentic serving stacks may expose only structured tool actions, while provider system prompts shift surface text.These changes can make honest providers appear to serve substituted models.
Motivation: Tool-use behavior remains exposed when text is stripped and is comparatively robust to small prompt-level deployment changes.Recent post-training embeds tool-use behavior in model weights, making tool-call policy a persistent behavioral signature.
Approach: AgentProv fingerprints a deployed model through categorical tool-call distributions and decides identity with an MMD test.It compares tool choices from a suspect endpoint and trusted reference across probe situations, including action-only serving settings.
Results: 100% of 630 evaluated checkpoint pairs were correctly rejected when models were substituted, while prompt-injection false positives were 7% versus 67% for MET and 53% for RUT.The result supports action-based auditing as more robust than the cited text-channel baselines under the tested injection conditions.

2 Background

Prior black-box audits identify or verify LLMs using natural-language completions, internal reasoning, or modified agentic surfaces. AgentProv builds on evidence that tool-use policies are learned in model weights and vary reproducibly across models, while targeting passive equality verification on unmodified deployments.

Existing audits: MET and RUT test completion distributions, while LLMmap and related methods identify backbones from known candidate sets using black-box outputs.These approaches rely on natural-language completions or other output channels that may be unavailable or unstable for agentic APIs.
Existing audits: CoTSRF relies on chain-of-thought contrast, which is inapplicable to commercial agentic platforms that expose tool-call traces while concealing internal reasoning.The cited background reports that 82.8% of such platforms conceal internal reasoning.
Related agentic methods: AGENTWM injects user-specific biases into action sequences for ownership claims, whereas AgentProv addresses passive equality verification without modifying the deployment.The methods therefore target different auditing goals and threat models.
Background: Agentic behavior is trained directly into model weights, and benchmarks report substantial per-model variation on identical function-call inputs.Different training data and recipes produce stable, reproducible policy differences that can support identity auditing.

3 Method

AgentProv audits whether an endpoint matches a claimed model by comparing categorical tool-selection policies across functionally equivalent probes. It combines one-hot action fingerprints with an MMD-based permutation test, while preserving interpretability through per-template diagnostics.

Problem formulation: AgentProv compares suspect and reference endpoints through their tool-selection distributions when functionally equivalent tools are offered.The framework produces a binary accept/reject decision at a controlled false-positive rate and supports local references for open-weight models or official APIs for closed-source models.
Probe design: The probe uses K = 20 templates spanning general tools and MCP servers, with equivalent alternatives, neutral requests, randomized order, and matched descriptions.These controls target position bias, detail-driven selection, and domain priming while probing tool-selection preferences associated with model lineage and tool-use fine-tuning.
Action representation: Each returned action is classified into a template-specific option, with no-tool and malformed-call responses retained as separate outcomes even when natural-language text is unavailable.Because classification uses the API’s returned tool invocation, the action channel remains deterministic in text-free responses.
Fingerprint and kernel: AgentProv encodes actions over the joint template-option alphabet and uses a characteristic delta kernel, making distributional differences detectable with sufficient samples.The empirical fingerprint is the column mean of one-hot action rows, representing the empirical distribution over tool selections within each template.
Test statistic: The squared MMD statistic measures the policy gap and reduces to squared L2 distance between fingerprints under the delta kernel.The statistic aggregates evidence across templates while the block-diagonal representation supports a per-template interpretability breakdown.
Calibration and decision rule: Permutation testing pools and relabels the 2N observations within each template, repeats the procedure B = 1,000 times, and rejects at α = 0.05 above the null quantile.Exchangeability controls Type-I error regardless of N, K, or option-set sizes; per-template contributions identify influential scenarios without changing aggregate Type-I control.

4 Evaluation

AgentProv reliably separates model identities across local checkpoints and closed-source models while remaining comparatively robust to deployment-context changes that destabilize text-channel audits. Its action-based decisions also reveal family structure, post-training drift, and differences among third-party endpoints.

Model identity: 100% of the 630 distinct-checkpoint pairs were rejected by AgentProv, matching MET and RUT on identity discrimination.On 36 same-model self-pairs, AgentProv and MET never falsely rejected, while RUT falsely rejected 2 models.
Model identity: All 9/9 OpenAI self-comparisons, 36/36 distinct OpenAI pairs, and 324/324 OpenAI-to-local comparisons were correctly separated.These results extend the controlled identity findings to closed-source models accessed through the official API.
Model structure: Within-family action distributions cluster more tightly for most model families, while Hermes endpoints remain closer to their own bases than to Hermes siblings.Seven of eight multi-member families have cross/intra ratios of 1.8–3.0×; Hermes has a ratio of 0.8×.
Model structure: Qwen3-Think lies approximately 14× farther from other Qwen3 checkpoints than those checkpoints lie from one another.The result indicates a substantial action-policy shift associated with reasoning-mode post-training.
Hidden prompts: 7% of hidden-prompt control cases were false positives for AgentProv, versus 67% for MET and 53% for RUT.AgentProv rejected 0/5 models under empty and short conditions and 1/5 under the long condition; the single long-prompt rejection involved Gemma-3-1B.
Hidden prompts: A single whitespace already caused MET to flip on 3/5 models, showing that text-channel vulnerability appears without crafted adversarial prompts.The long condition approximated provider-style deployment prompts, and the same false-positive pattern appeared on real third-party endpoints.
API verification: Among nine OpenRouter endpoints, AgentProv accepted 7, compared with 1 for MET and 2 for RUT.The pattern was consistent with sensitivity to action-distribution changes but relative insensitivity to hidden prompts and template variants; interpretations remained correlational without serving ground truth.
Efficiency: At K = 20 and N = 50, AgentProv reached 100% rejection on distinct checkpoints, while Type-I error was 0/36 in every grid cell except K=10, N=10.Increasing either templates or samples generally improved rejection, and the two budget effects composed.

5 Conclusion

AgentProv audits agentic LLM APIs by comparing tool-selection behavior rather than natural-language completions. Across evaluated models, it distinguishes genuine model changes and remains robust to tested deployment-context changes, including action-only serving stacks.

AgentProv compares categorical tool-selection behavior instead of natural-language completions to audit agentic LLM APIs.The resulting distribution reflects post-training and learned parameters as a practical identity signal.
AgentProv distinguishes genuine model changes while remaining more robust than text-channel baselines to the deployment-context changes tested.The method is designed for practical auditing, including action-only serving stacks.

Limitations

AgentProv provides evidence from probed tool-selection behavior rather than a complete identity certificate, and its applicability depends on trusted reference access.

AgentProv is inapplicable to fully closed models without a trusted reference channel.It also cannot prove the underlying backbone without access to model weights.
Third-party API cross-checks do not establish ground truth about serving configuration because providers do not disclose backbone identity or system-prompt content.The analysis uses an independent token-count side-channel as corroboration.

Ethical Considerations

AgentProv is intended to support transparency and accountability in commercial LLM deployments while requiring cautious interpretation of statistically significant rejections.

A rejection at α = 0.05 indicates a significant difference in tool-selection behavior, not proof of model substitution or provider misconduct.Serving configuration can also affect tool-selection behavior.
Auditors should interpret results alongside serving configurations, per-template analyses, and corroborating side-channels.The paper also advises respecting endpoint terms of service and rate limits.

A.1 Method Details

AgentProv deterministically converts structured tool-call outputs into categorical action labels, while mandatory controls reduce position, description, and domain-priming confounds.

Structured tool-call names are mapped to per-template option labels, with direct answers and unparseable calls retained as _no_call and _malformed.Both labels remain part of every option set and are never silently discarded.
Tool order is randomized per sample with a deterministic seed to eliminate first-listed bias.This control is applied to every template.
Tool descriptions are length-matched and structurally parallel to prevent detail-driven selection.The design targets a controlled comparison among alternatives.
Neutral recipients and tool-agnostic task wording reduce domain priming during probing.The prompts avoid wording that names a specific tool domain.

A.2 Probe Examples and Template Sourcing

The probe templates cover complementary general-tool and MCP-server domains, using functionally equivalent operations with provider-realistic naming.

General tools cover everyday operations across 15 task categories, with names drawn from provider documentation and public benchmarks.
MCP-server templates present equivalent operations through different server families, such as calendar tools with distinct naming conventions.

A.4 Full Pairwise Heatmap

The AgentProv evaluation combines tool-selection probes, pairwise MMD testing, endpoint token-count checks, and robustness experiments to audit model identity and deployment-context changes. It separates checkpoint identities reliably while revealing limits under aggressive quantization and detecting hidden provider-injected content.

Full Pairwise Heatmap: All 630 distinct-checkpoint pairs reject at α = 0.05, while darker diagonal blocks reveal same-family and shared-lineage clustering in the MMD2 matrix.The matrix covers 36 models using K = 20 templates and N = 50 samples per template.
Full Pairwise Heatmap: Endpoints are classified by token-count drift and call-to-call variance as no_drift, constant positive or negative offsets, or variable behavior.For each prompt, d_p is the API-reported count minus the local bare count, and v_p is the call-to-call variance.
Full Pairwise Heatmap: Nine endpoints show constant positive token offsets, led by Llama-3.2-3B-Instruct (+25), while Llama-Guard-4-12B has a variable positive mean offset.The side-channel compares provider-reported prompt_tokens with the canonical bare chat-template count and interprets persistent positive offsets as added hidden content.
Full Pairwise Heatmap: AgentProv accepts all 9/9 matching OpenRouter routes, but controlled checks reject all 36/36 distinct OpenAI pairs and 324/324 OpenAI–local-checkpoint pairs.The OpenAI official endpoint is used as the trusted reference; OpenRouter agreement remains supporting rather than definitive because its serving configuration is unobservable.
Full Pairwise Heatmap: AgentProv has no false positives under the tested safety-policy and agent-wrapper prompts, whereas 4-bit quantization is mixed and model-dependent.At 4 bits, AgentProv accepts Qwen2.5-7B but rejects Llama-3.1-8B; at 8 bits, all three methods accept both tested deployments.
Full Pairwise Heatmap: The protocol uses temperature 0.7, shuffled tool schemas, K = 20 templates, N = 50 samples per template, and categorical action buckets including _no_call and _malformed.The comparison methods use different protocols: MET uses Wikipedia continuation prompts, while RUT requires reference log-probabilities and WildChat-1M prompts.