{"id":"476c5005-2bd4-4575-a59e-413e43d15217","arxiv_id":"2606.18037","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":9,"one_line_summary":"ProvenanceGuard detects when a claim in an MCP-based agent answer is supported somewhere but attributed to the wrong source, with block F1 0.802 and perfect detection on 50 controlled swaps.","lead":"This paper introduces ProvenanceGuard, a verifier that checks whether an AI agent's claims are supported by the right source among the tools it used, not just by any evidence. On a small held-out medical-agent benchmark it blocks wrong attributions with F1 0.802 and catches all 50 deliberately injected source swaps.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Gold source labels for the held-out packet may not be truly independent: human review is not described, and the router's source accuracy (0.858) may reflect agreement with the LLM judge's relevance heuristic rather than true provenance. Re-annotation is needed.","rationale":"The central claim—that source attribution is an independent axis for factuality verification—requires trustworthy gold labels for source ownership. The paper's headline numbers (block F1 0.802, source accuracy 0.858) are computed against a held-out packet that is 'human-reviewed,' but the review protocol is opaque: no inter-annotator agreement, no disclosure of whether the reviewers saw the LLM's labels, and no statistics on how often human review changed a label. Given that the training/validation labels are purely LLM-assisted (Section VIII), the system's development decisions were made against a judge that may share semantic-similarity blind spots with the verifier's router. If the human review was deferential or shallow, the held-out gold is not an independent oracle, and the reported agreement between the router and the gold may reflect common heuristics rather than correct provenance. The 50-probe result does not rescue this: it tests only coarse family-level swaps with clean ground truth, and the paper itself reports exact source-plus-relation accuracy of only 0.229 on a harder benchmark. Therefore, an independent re-annotation of the held-out claims is the decisive experiment. If the numbers survive, the paper's condition should be lifted; if they do not, the central claim's empirical basis fails. The reader's weakest assumption identifies this same concern, so I agree. The verdict should remain CONDITIONAL pending this test.","tokens_in":21842,"tokens_out":9922,"duration_ms":96279,"concrete_test":"Independently re-annotate the 260 source-eligible held-out claims from the 40-trace packet. Two clinicians, blinded to the Gemma labels and to ProvenanceGuard outputs, receive each question, the final answer, and the full MCP tool outputs with source IDs; they independently label (a) the support verdict and (b) the correct source family/source ID for each claim. Compute pairwise Cohen's kappa and the agreement between the new consensus and the released held-out labels. Then recompute block F1 and source accuracy using the new consensus labels. If source accuracy drops by >0.1 or block F1 moves outside the reported bootstrap CI [0.664, 0.900], or if kappa between the old and new labels is <0.6, the reported numbers are not robust to label bias and the central claim lacks reliable empirical support.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The most load-bearing assumption is the gold standard for source attribution. The paper's Limitations (Section VIII) explicitly states that human verification covers only the 361 held-out labels; training/validation labels are LLM-assisted only (Sections IV-H, V-G). Moreover, the human review protocol is not described: no inter-annotator agreement, no evidence that reviewers were blinded to the LLM labels or given the complete raw tool outputs, and no report of how often reviewers changed the model's source annotations. Since the held-out evaluation is the primary evidence for the central claim, a 'human-reviewed' label set that largely reflects the LLM judge's source-relevance judgments would be partly self-confirming: the router (an embedding model) and the judge (Gemma) may share semantic-similarity notions, so high source accuracy (0.858) could indicate agreement with the judge's heuristic rather than correct provenance. The 50 conflation probes have clean ground truth, but they are single-swap, family-level (chart vs. literature) cases that the lexical alias matcher is designed to catch; they do not validate fine-grained source ownership, which the paper itself shows is difficult (source-plus-relation accuracy drops to 0.229 on the multi-source benchmark). Thus the central claim's empirical support rests on an unverified gold standard.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper introduces ProvenanceGuard, a source-aware factuality verifier for MCP-based LLM agents. It decomposes an agent answer into atomic claims, routes each claim to a specific MCP evidence source using embeddings, checks support with NLI plus a token-alignment and protected-value heuristic, calibrates the support decision with a random-forest model, and then compares the routed source against the source stated or implied in the answer. The system returns per-claim verdicts and an allow/block answer decision, with a RARR-style repair loop for blocked answers. Evaluation uses a frozen corpus of 281 captured medical-domain MCP traces; the primary held-out split is 40 traces / 361 human-reviewed claims, with reported block F1 0.802 and source accuracy 0.858 over 260 source-eligible claims. A harder multi-source benchmark yields block F1 0.846 but source-plus-relation accuracy 0.229, and 50 controlled single-swap conflation probes are all blocked and repaired. The paper argues that source attribution is an independent axis of factuality verification beyond pooled evidence support.","tokens_in":22159,"tokens_out":5669,"duration_ms":60478,"significance":"If the central claim holds, the paper addresses a real and underexplored failure mode: a claim can be supported by pooled evidence while being attributed to the wrong MCP tool output. The system's preservation of stable source IDs through routing and support checking is a sensible design, and the comparison with source-blind baselines (MiniCheck, RAGAS, AlignScore, SummaC-ZS) is appropriate. The paper is also commendably honest about limitations: it reports wide confidence intervals, acknowledges that human review covers only the held-out labels, separates the multi-source benchmark units, and does not overclaim the repair loop as an independent oracle. However, the load-bearing evidence for the source-attribution claim rests on (i) a gold standard whose human-review protocol is not described and whose training/validation labels are LLM-assisted only, and (ii) 50 conflation probes that are deliberately simple single-swap family-level cases. The multi-source benchmark, with source-plus-relation accuracy of only 0.229, further tempers the strength of the empirical support for exact source ownership. The contribution is therefore better characterized as a well-engineered demonstration","major_comments":[{"comment":"The gold standard for the headline source metrics is not shown to be independent of the verifier. Human review covers only the 361 held-out labels; training and validation labels are LLM-assisted, and the human protocol is unspecified: no inter-annotator agreement, no statement about blinding to model labels, no report of how often reviewers changed labels, and no evidence that reviewers saw complete raw tool outputs. If the two Gemma judge prompts share the same semantic-similarity notion as the MiniLM router and DeBERTa NLI, source accuracy 0.858 and block F1 0.802 could partly reflect agreement with the judge's relevance heuristic rather than true provenance. This is the primary evidence for the central claim. Please provide a detailed re-annotation protocol and/or an independent human gold set for at least a random sample, with agreement statistics and a list of label changes.","section":"Sections IV-H, V-G, VIII; Table XXI"},{"comment":"The 50/50 conflation result is the only direct evidence for cross-source conflation detection, but each probe is a single family-level swap (chart vs. literature) with no paraphrase, no adversarial hiding, and no near-source confound. The lexical alias matcher and routing are designed exactly for this contrast, so the exact binomial interval [0.93, 1.00] supports only the narrow claim that simple attribution swaps are blocked. The central novelty claim — that cross-source conflation is an independent failure mode a verifier can catch — would be much stronger with probes involving semantically close sources, paraphrased attribution spans, or multi-error traces. The conclusion should not rely on the 50/50 number as evidence beyond the simple-swap setting.","section":"Section V-F and Section VIII"},{"comment":"Repair-and-reverification success is scored by the same verifier that issued the block, so the abstract's statement that the loop 'resolves all blocked answers' demonstrates only pipeline consistency, not independent correctness. Table XIX shows 144 of 173 resolutions are terminal conservative fallbacks rather than substantive answer recoveries. The paper acknowledges this in the discussion, but the abstract and contribution list overstate the repair result. Please either measure repaired answers under independent human or LLM adjudication, or rephrase the claim as 'all blocked answers are converted to verifier-passing outputs, mostly by conservative fallback.'","section":"Sections III-H and V-E; Table XIX"}],"minor_comments":[{"comment":"The held-out block-F1 confidence interval [0.664, 0.900] is very wide, and the MiniCheck comparison in Table XVII is not statistically significant (one-sided p≈0.13). The text handles this adequately, but the abstract could state more explicitly that the support-F1 advantage over source-blind baselines is not the main evidence for the paper's contribution.","section":"Section V-A; Table III"},{"comment":"Decomposition is measured against a frozen reference extraction, not human gold, and the protected-value exact rate of 0.563 is low. This is acknowledged in the limitations, but it deserves a more prominent place in the answer-level repair discussion since protected-value errors can affect downstream attribution decisions.","section":"Section V-B; Table VIII"},{"comment":"The 2048-token ModernBERT diagnostic is a one-epoch, 100-group replacement checkpoint with raw source-plus-relation accuracy 0.090. Reporting it as a 'valid raw test point' is fine, but the row reads as if it were a substantive long-context result; consider moving this diagnostic clearly to an appendix or supplement.","section":"Section V-B; Table XIV"},{"comment":"The unit mismatch between 254 pairwise claim cases and 263 frozen extracted claims for the same 59 test questions is clearly stated, but the narrative occasionally refers to both as 'benchmark results.' Please ensure each table and sentence explicitly identifies which unit is being used.","section":"Section IV-C"},{"comment":"Minor typo: 'F ActScore' should likely be 'FactScore'. Also, the related-work discussion of ALCE is helpful and should be kept, but it could note more explicitly that ALCE's citation-level attribution is a passage-level task, not a tool-provenance task.","section":"Section II"}],"recommendation":"major_revision","confidential_remarks":"The paper is honest and well-structured, but the two main risks are the gold-standard independence and the simplicity of the conflation probes. I would ask the authors for a detailed human-review protocol or an independent re-annotation, and for harder conflation probes before considering acceptance. The artifact release and reproducibility statements are strengths and should be preserved."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Short version: this paper deserves a serious referee. It defines a real failure mode—cross-source conflation—and builds a concrete verifier that preserves MCP source IDs, which existing citation-style attribution work doesn't do. The authors are unusually candid about their own weaknesses; the limitations section reads like the referee report. But the headline numbers rest on a small, possibly self-confirming evaluation, and the strongest result (50/50 probes) is deliberately simple.\n\nWhat's new: the task formulation (support vs. source ownership as separate axes), the stable-source-ID routing pipeline, and the benchmark/probe set. The comparison to source-blind baselines is fair—they explicitly don't emit source IDs—and the paper doesn't oversell the F1 gap; MiniCheck is within noise. The multi-source benchmark showing source-plus-relation accuracy dropping to 0.229 is a nice, honest stress test.\n\nSoft spots, in order of importance. First, the gold labels. Human review covers only the 361 held-out claims, the protocol isn't described (no IAA, no blinding, no count of changes), and training/validation labels are LLM-assisted. If the judge's source-relevance notion shares blind spots with the router, the 0.858 source accuracy is partly circular. The paper acknowledges the LLM-assist nature but not the absence of a described human protocol. Second, the repair loop: 'resolved' means passes the same verifier that blocked it; the paper admits this. Fine for pipeline consistency, not for real-world correctness. Third, no public code or data release beyond promise, and no source-attribution-capable baseline—ALCE-style citation correctness is the obvious comparator. Fourth, the 50 probes are single-swap and family-level; the lexical alias matcher is designed to catch those. Not a flaw if read as a diagnostic, but not evidence for hard cases.\n\nThe citation pattern looks fine; related work is appropriately positioned. I don't see circular reasoning in the core detection results, since they're measured against adjudicated labels. The paper's central claim—that attribution is an independent axis—is supported in a bounded way.\n\nVerdict: conditional, leaning positive. For an editor: send to peer review. The work is a solid contribution to the LLM-agents evaluation subfield, and even if the numbers need independent confirmation, the task definition and benchmark will be useful. I'd cite it as related work. Reading group: maybe—depends on whether your group cares about agent evaluation methodology.","headline":"A well-scoped, honestly limited systems paper; the task formulation is the contribution, and the headline numbers need independent confirmation before being treated as established.","tokens_in":22663,"tokens_out":2381,"would_cite":true,"duration_ms":23941,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Source attribution is an independent axis of factuality for MCP-grounded agents: a supported claim can still be wrong if credited to the wrong evidence source.","keywords":["source attribution","factuality verification","cross-source conflation","MCP agents","provenance","claim decomposition","NLI support checking"],"falsifier":"Have clinicians annotate the training and validation claims from the same traces (or re-annotate the held-out 361) without seeing the system's verdicts; if source accuracy on this human-only gold set falls well below 0.858, or if the 50/50 conflation results do not survive paraphrased or multi-swap probes, the central claim would need qualification.","tokens_in":21690,"feed_emoji":"🔍","tokens_out":4745,"duration_ms":49844,"temperature":0.7,"pith_summary":"Tool-using AI agents that gather evidence through MCP servers (a standard way of connecting agents to external tools) often mix several sources into one answer. This paper claims that current factuality checks miss a specific failure: a claim can be supported by some piece of evidence while being attributed to the wrong source. It introduces ProvenanceGuard, which routes each atomic claim to the source that actually supports it, then checks whether the answer named that source; answers that conflate sources are blocked. On a held-out set of medical agent traces the verifier matches source-blind support checkers while also reporting claim-to-source attribution, and it catches all 50 deliberately injected attribution swaps. If this holds, factuality evaluation for tool-using agents needs a source-ownership axis, not just a pooled-support score.","feed_headline":"Verifiers must check a claim's source, not just its facts","feed_subtitle":"A new verifier routes each claim to its supporting evidence, then blocks answers that credit the wrong tool or record.","key_machinery":"The load-bearing mechanism is the separation of support from source ownership. The verifier preserves stable MCP tool IDs and source IDs, routes each claim to the highest-scoring evidence source via centroid cosine similarity, scores support with NLI plus a token-alignment proxy and protected-value checks, and then — only after the routed source is fixed — compares the claim's stated or implied attribution with that routed source. This two-step split turns cross-source conflation into a detectable verdict instead of an invisible failure. A random-forest calibration layer sets the conservative support threshold, and a fail-closed aggregation rule blocks an answer if any claim fails either sup","core_discovery":"The core discovery is that source attribution is a separate and measurable axis of factuality in MCP-grounded answers. A claim may be entailed by pooled evidence and still be wrong because the answer assigns it to the wrong tool output, patient record, literature source, or metadata source — the pattern the paper calls cross-source conflation. ProvenanceGuard makes this distinction operational by carrying stable source IDs through claim decomposition, source routing, NLI-based support checking with token-alignment and protected-value checks, and a calibrated support decision; only then does it compare stated attribution with the routed supporting source. The paper reports held-out block F1 0","pith_inferences":["Beyond the paper: if source attribution is a separate axis, evaluation suites for tool-using agents should include deliberately confused-source cases (e.g., a fact supported by the chart but attributed to literature) as a standard stress slice, not just incidental trace data.","Beyond the paper: the reported 50/50 conflation detections are on clean single-swap probes; a natural next test is multi-error, paraphrased, or adversarially hidden swaps, where precision is unknown.","Beyond the paper: because only held-out labels were human-reviewed, an independent clinician gold set over the training and validation claims would tell whether the calibration and source-accuracy numbers are stable or partly self-confirming."],"forward_implications":["Factuality evaluation for tool-using agents should report source ownership separately from pooled support; source-blind scores cannot detect cross-source conflation.","A verifier that preserves stable source IDs can match source-blind support performance (held-out block F1 0.802) while also emitting claim-to-source attribution.","Exact source ownership is substantially harder than support detection when candidate sources are semantically close: source-plus-relation accuracy drops to 0.229 on the harder multi-source benchmark.","Repair-and-reverify can turn every blocked answer into a verifier-passing answer, but in most full-trace cases the repair is a conservative fallback rather than a substantive rewrite."],"fun_headline_variants":["Source-attribution slips past fact-checkers","New verifier flags claims with wrong source credit","Factual claims can still be wrong if source is off","Source attribution is a separate axis of factuality","Checking facts isn't enough: tools need source checks"],"cache_read_input_tokens":2304,"weakest_assumption_plain":"The headline numbers rest on labels that are mostly LLM-assisted; only the held-out 361 labels got human review, so if the judge model and the verifier share the same blind spots about what counts as source support, the reported source accuracy could be self-confirming.","fun_headline_variants_meta":{"raw":{"variants":["Source-attribution slips past fact-checkers","New verifier flags claims with wrong source credit","Factual claims can still be wrong if source is off","Source attribution is a separate axis of factuality","Checking facts isn't enough: tools need source checks"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000204,"raw_usage":{"total_tokens":1295,"prompt_tokens":881,"completion_tokens":414,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":625,"completion_tokens_details":{"reasoning_tokens":355}},"tokens_in":625,"tokens_out":414,"duration_ms":4194,"temperature":1.0,"reasoning_tokens":355,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-02T11:00:00.055707+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Have clinicians annotate the training and validation claims from the same traces (or re-annotate the held-out 361) without seeing the system's verdicts; if source accuracy on this human-only gold set falls well below 0.858, or if the 50/50 conflation results do not survive paraphrased or multi-swap probes, the central claim would need qualification.","supporting_citations":[],"review_version":2}