Wei Zhu, Meiyun Zuo and Huiping Sun submitted Blindfold: Keeping the Audit Coin Secret from LLM Agents to arXiv on 27 October 2026. The authors argue that audit-based certification of large language model (LLM) agents depends on keeping the random audit decision hidden until the agent commits its action.[1]
The scheme audits a random fraction ε of actions and reweights the audited labels to estimate violations. The authors call the required confidentiality property pre-commit noninterference (PNI): the audit decision must not affect what the agent can observe before commitment. Their abstract claims PNI is necessary and sufficient for an unbiased certificate against adaptive agents. It gives worst-case bias as (1−ε)D_A, where D_A is the total-variation distance between the agent’s observable views under the two audit decisions.[1]
The abstract reports that a silent audit in the authors’ monitor changes no output but adds latency visible through tool timestamps, which the agent can amplify. Separately, it describes a real LLM agent following an injection that names a visible audit notice. The authors report certificate failure on measured labels and in a post-hoc analysis of a live run on a pre-registered schedule; silent auditing restores the certificate in that experiment. They also claim that a fresh coin per audited call closes the timing channel, while padding only narrows it.[1]
[1]: Blindfold: Keeping the Audit Coin Secret from LLM Agents, arXiv, 27 October 2026.
Sources
Check or correct this page
Verification record
The digest below shows whether the text you are reading matches the published source. It does not show that the reporting is correct. The build computes it from this page's Markdown source and lists it in the site manifest.
13fc7944161ca09089bf45540cf2f68bcb34d501cf906a3d0589ecc8d4cbd1e2
