Research

Published research from KEMSafe’s founding team and academic collaborators

Certified Multi‑Source Integrity for Structured Agent Actions

When can an AI agent safely execute a structured action, such as paying an invoice, from evidence an adversary may have corrupted? The paper answers exactly, and gives the certifier that meets the bound.

Proceedings of the Fourth UK AI Conference 2026. Proceedings of Machine Learning Research, volume 348, pages 134 to 147. Nottingham, 29 and 30 September 2026.

Read on PMLR PDF arXiv 2609.34245 Code and data UK AI Conference 2026

First page of Certified Multi-Source Integrity for Structured Agent Actions

The authors

Anmol Pandey
University of Warwick
Aditya Jain
University of Warwick
Liang Chen
University of Hertfordshire
Carsten Maple
University of Warwick
Christo Panchev
University of Warwick

Authors in the order printed on the paper, with the affiliations printed on it.

Agents assemble actions from evidence an attacker can touch.

A payment has a payee, an amount and an account, each read from documents and tool outputs that come from different parties. Indirect prompt injection can make the model itself extract the values an attacker chose.

The paper characterizes when such an action can be executed safely under a stated corruption budget, and gives the maximally live certifier: it admits each field only under the rule its evidence structure supports.

1 Untrusted evidence

2 Isolated extraction

3 Per-field certification

4 Decision

Trust boundary

Purchase order

From the buyer

Invoice

From the seller, tampered

Payee confirmation

From the bank

Sanctions feed

From the authority

One model call

payeeAgreement or threshold

Counted across independent origins: all agree, or at most k dissent

amountReconciliation

Within the authorised order, plus tolerance

accountTrusted anchor

Matches the payee name at the bank and is on the onboarding allowlist

Execute(a)

Only if every field is admitted

otherwise

Abstain (⊥)

Nothing executes

1. Untrusted evidence
- Purchase orderbuyer
- Invoiceseller, tampered
- Payee confirmationbank
- Sanctions feedauthority
2. Isolated extraction
Each source is read on its own, one model call per source.
3. Per-field certification
- payeeAgreement or threshold
  Counted across independent origins: all agree, or at most k dissent
- amountReconciliation
  Within the authorised order, plus tolerance
- accountTrusted anchor
  Matches the payee name at the bank and is on the onboarding allowlist
4. Decision
Execute(a) only if every field is admitted, otherwise Abstain (⊥).

The certifier as an admission gate, redrawn from figure 1 of the paper. An adversary within budget k corrupts at most k control domains, here the tampered invoice. Corroboration is counted over corruption-distinct domains, not over documents.

Theorem 1

Safe execution is exactlysingleton feasibility.

A certifier that never executes a wrong action, under any corruption within budget, may execute an action exactly when it is the only action consistent with the evidence. When more than one action fits, every safe certifier must abstain.

The proof is an indistinguishability argument: two feasible actions yield one observation from two allowed worlds, so committing to either is wrong in the other. Section 2 and appendix A.

One feasible action

It is the truth in every allowed world.

Execute

Two feasible actions

The observation cannot tell the worlds apart.

Abstain

How many origins does a value need?

More than twice as many as an adversary might control. With N independent origins in agreement and up to k of them corrupted, the rule certifies a value only when N is greater than 2k. One corrupted origin needs three in agreement, two need five, three need seven.

Below that line it abstains rather than guess. In the paper’s evaluation, no configuration with at least one honest origin ever certified a wrong value.

Outcome of the certifier rule under an adversary controlling k independent origins, for N agreeing origins. Certified only when N is greater than 2k. Adapted from table 4 of the paper.
Budget	N equals	N equals	N equals	N equals	N equals	N equals	N equals
k equals	Some configuration forces a safe abstention	Certified under every adversarial configuration	Certified under every adversarial configuration	Certified under every adversarial configuration	Certified under every adversarial configuration	Certified under every adversarial configuration	Certified under every adversarial configuration
k equals	No more origins than the budget	Some configuration forces a safe abstention	Some configuration forces a safe abstention	Certified under every adversarial configuration	Certified under every adversarial configuration	Certified under every adversarial configuration	Certified under every adversarial configuration
k equals	No more origins than the budget	No more origins than the budget	Some configuration forces a safe abstention	Some configuration forces a safe abstention	Some configuration forces a safe abstention	Certified under every adversarial configuration	Certified under every adversarial configuration

Certified under every adversarial configurationSome configuration forces a safe abstentionNo more origins than the budget

Section 4, table 4, including the case where the corrupted origins coordinate.

Three witnesses.Two origins.

Sources that agree make an action look well supported. When two of them share an upstream origin, one compromise can forge both, so the paper counts corruption-distinct control domains, not documents.

3apparent witnesses

Adapted from Pandey et al. (2026), section 4 and figure 2. The build provenance is produced by GitHub Actions and the back-reference is GitHub repository content, so a single repository compromise can forge both. The paper counts corruption-distinct control domains, not attestations.

Genuine corroboration is rarer than it looks. Measured on software supply chains and sanctions designations, using upper-bound proxies.

450 npm packages

16.4%

appear to carry three independent witnesses

once the shared GitHub origin is counted

Section 4, figure 2

300 PyPI packages

32.3%

appear to carry three independent witnesses

once the shared GitHub origin is counted

Section 4, figure 2

70,966 sanctioned entities

74.6%

rest on a single control domain

~15%

carry three or more

Section 4, table 2. Both are upper bounds.

A realistic injection fooled four of five models. The certifier admitted no unsafe action.

Claude Opus 4.8
Followed the injection0%Naive agent acted on it0%Certifier admitted it0%
GPT-5.5
Followed the injection100%Naive agent acted on it72%Certifier admitted it0%
Gemini 3.1 Pro
Followed the injection100%Naive agent acted on it100%Certifier admitted it0%
Gemini 3.5 Flash
Followed the injection100%Naive agent acted on it98%Certifier admitted it0%
Claude Haiku 4.5
Followed the injection100%Naive agent acted on it100%Certifier admitted it0%

Results for five models in a real agent loop, 80 episodes each, with one of five sources corrupted by an embedded injection
Model	Followed the injection	Naive agent acted on it	Certifier admitted it
Claude Opus 4.8	0%	0%	0%
GPT-5.5	100%	72%	0%
Gemini 3.1 Pro	100%	100%	0%
Gemini 3.5 Flash	100%	98%	0%
Claude Haiku 4.5	100%	100%	0%

Section 5, table 1. Each model ran 80 episodes in a real agent loop, with one of five sources corrupted by an embedded injection. The action at stake was a payment.

Every mechanism is load-bearing. Remove one and exactly one attack family succeeds.

Payment-field mechanisms

Configuration	One source	Mule account	Amount splice	Omission
Full certifier	0%	0%	0%	0%
No join key	0%	0%	100%	0%
No account policy	0%	100%	0%	0%
No mandatory source	0%	0%	0%	100%

Counting mechanisms

Configuration	Single corruption	Laundering	Sybil
Full certifier	0%	0%	0%
No atomic claims	0%	100%	0%
No authentication	0%	0%	100%

Section 3, table 3. Attacker success rates under a single corrupted class; for counting, the rate at which an unsafe value is certified.

Read it, run it, cite it.

The paper is open access on PMLR. The code and data are on GitHub.

Read on PMLR Code and data

These are research measurements on public data and a controlled evaluation harness, not KEMSafe product metrics. The paper informs how KEMSafe treats evidence. It does not certify KEMSafe’s product or its architecture.

pandey26a.bib

@InProceedings{pmlr-v348-pandey26a,
  title     = {Certified Multi-Source Integrity for Structured Agent Actions},
  author    = {Pandey, Anmol and Jain, Aditya and Chen, Liang and Maple, Carsten and Panchev, Christo},
  booktitle = {Proceedings of the Fourth UK AI Conference 2026},
  pages     = {134--147},
  year      = {2026},
  editor    = {Benford, Alistair and Büyükateş, Baturalp and Cabrera, Christian and Kiden, Sarah and Salili-James, Arianna and Zakka, Vincent and Zhou, Feng},
  volume    = {348},
  series    = {Proceedings of Machine Learning Research},
  month     = {29--30 Sep},
  publisher = {PMLR},
  pdf       = {https://raw.githubusercontent.com/mlresearch/v348/main/assets/pandey26a/pandey26a.pdf},
  url       = {https://proceedings.mlr.press/v348/pandey26a.html}
}