Silence Is Endorsement: Verification-Status Laundering in LLM Agent Pipelines
Yibo Hu at Illinois Institute of Technology identifies verification-status laundering, where an agent handoff keeps the claim that an action was authorised but drops the fact that the claim was never verified, and measures the effect on nine open-weight monitors and two hosted models.
Ask this paper
Removing the provenance framing flips monitors. With the action and the authorisation proposition held fixed, approval of risky actions rises from 5 to 60 percent on Llama-3.1-8B and from 9 to 98 percent on Qwen2.5-14B.
Ordinary pipeline components cause the loss. Summarizers frequently weaken verification status and memory compressors often remove it, so no attacker is required for the failure to occur.
The full pipeline reproduces it end to end. A proposer, summarizer, memory and monitor chain raises risky approval to 57 to 81 percent across three downstream monitors.
External benchmarks show the same pattern. WildGuard and ATBench, with independently authored harmful requests, confirm that unsupported authorisation claims raise approval.
Instructing the monitor is not a fix. Telling monitors to reject unverified authorisation leaves some models vulnerable and makes others reject legitimate requests; the authors argue provenance must be carried as structured state attached to the claim.
Abstract
Safety monitors in LLM agent systems often judge actions from summaries or stored handoffs, not from the original evidence. This creates a simple but dangerous failure mode: the handoff preserves the claim that an action is authorized while losing the fact that the claim was never verified. We call this verification-status laundering. Across nine open-weight monitors and two hosted models, the action and authorization proposition remain fixed while we remove the unverified provenance framing around the claim. This change raises approval for risky actions from $5\%$ to $60\%$ on Llama-3.1-8B and from $9\%$ to $98\%$ on Qwen2.5-14B, with similarly large shifts on both hosted models. The failure also emerges in ordinary agent pipelines. Summarizers frequently weaken the status, memory compressors often remove it, and a full proposer--summarizer--memory--monitor pipeline raises risky approval to $57$--$81\%$ across three downstream monitors. Experiments on WildGuard and ATBench show the same pattern on independently authored harmful and unsafe requests: unsupported authorization claims make approval substantially more likely. Explicitly instructing monitors to reject unverified authorization is not a reliable cross-model fix: some models remain vulnerable, while others reject legitimate requests. Agent systems should therefore carry authorization provenance as structured state attached to the claim throughout the pipeline.