Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper investigates the vulnerability of causal action verifiers, specifically CIVeX, to misspecification attacks on their committed action-state graphs, demonstrating that subtle graph corruptions can lead to a dramatic increase in harmful tool executions while maintaining internally valid certificates. The research reveals that omitting a single bidirected edge can increase false executions to 15.3% with 91% being harmful, and reversing an arrowhead can result in 48.9% false executions with zero correct ones. An additional attestation step, which tests certified executions against randomized samples, effectively detects these attacks, but does not fully restore beneficial action execution due to rejections by the verifier itself.
A single graph edge misspecification can transform a seemingly robust causal action verifier into a dangerous liability, executing harmful actions with internally valid but misleading certificates.
Causal action verifiers gate an agent's state-changing tool calls by checking whether each proposed intervention is identifiable against a committed action-state graph, and they issue a certificate that carries the identification argument and a one-sided lower confidence bound. One such verifier, CIVeX, reports zero false executions on a confounded tool-use benchmark. We red-team it by corrupting only the committed graph. Omitting a single bidirected edge takes it from zero false executions to 15.3% at the benchmark's published confounding strength, with 91% of its executions harmful and utility falling from +2.27 to +0.35. Reversing one arrowhead, so that a mediator is committed as a confounder, gives 48.9% false executions and no correct ones. Every one of these actions carries an internally valid certificate. An attestation step that tests each observationally certified execution against a bounded randomised sample detected both attacks, with 2 false alarms in 555 executions on a truthful graph; refusing what fails the test, or cannot be tested, gave zero false executions in every setting we measured. It does not restore beneficial execution: at the published strength 97.1% of beneficial actions are still never executed, because the same misspecification rejects them before attestation runs. Those rejections carry certificates too, and auditing them works, but its cost scales with the number of rejections rather than the number of executions. Recovering safety costs 127 experiments per 1,050 actions; recovering the lost value costs 614 more, at which point the audited verifier makes the honest graph's decisions on every instance and spends exactly its experiment budget. An audit that inspects only executions protects against wrongful action. Wrongful inaction has to be paid for separately.