REVIEW 3 major objections 5 minor 29 references
ProvenanceGuard: Source-Aware Factuality Verification for MCP-Based LLM Agents
T0 review · 3 major / 5 minor · reviewed 2026-08-02 · deepseek-v4-flash
Pith's one-line read Source attribution is an independent axis of factuality for MCP-grounded agents: a supported claim can still be wrong if credited to the wrong evidence source.
desk verdict A well-scoped, honestly limited systems paper; the task formulation is the contribution, and the headline numbers need independent confirmation before being treated as established. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The load-bearing mechanism is the separation of support from source ownership. The verifier preserves stable MCP tool IDs and source IDs, routes each claim to the highest-scoring evidence source via centroid cosine similarity, scores support with NLI plus a token-alignment proxy and protected-value checks, and then — only after the routed source is fixed — compares the claim's stated or implied attribution with that routed source. This two-step split turns cross-source conflation into a detectable verdict instead of an invisible failure. A random-forest calibration layer sets the conservative support threshold, and a fail-closed aggregation rule blocks an answer if any claim fails either sup
What would settle it
Have clinicians annotate the training and validation claims from the same traces (or re-annotate the held-out 361) without seeing the system's verdicts; if source accuracy on this human-only gold set falls well below 0.858, or if the 50/50 conflation results do not survive paraphrased or multi-swap probes, the central claim would need qualification.
Extended reading notes
Core claim
The core discovery is that source attribution is a separate and measurable axis of factuality in MCP-grounded answers. A claim may be entailed by pooled evidence and still be wrong because the answer assigns it to the wrong tool output, patient record, literature source, or metadata source — the pattern the paper calls cross-source conflation. ProvenanceGuard makes this distinction operational by carrying stable source IDs through claim decomposition, source routing, NLI-based support checking with token-alignment and protected-value checks, and a calibrated support decision; only then does it compare stated attribution with the routed supporting source. The paper reports held-out block F1 0
Load-bearing premise
The headline numbers rest on labels that are mostly LLM-assisted; only the held-out 361 labels got human review, so if the judge model and the verifier share the same blind spots about what counts as source support, the reported source accuracy could be self-confirming.
Editorial extensions
If this is right
- Factuality evaluation for tool-using agents should report source ownership separately from pooled support; source-blind scores cannot detect cross-source conflation.
- A verifier that preserves stable source IDs can match source-blind support performance (held-out block F1 0.802) while also emitting claim-to-source attribution.
- Exact source ownership is substantially harder than support detection when candidate sources are semantically close: source-plus-relation accuracy drops to 0.229 on the harder multi-source benchmark.
- Repair-and-reverify can turn every blocked answer into a verifier-passing answer, but in most full-trace cases the repair is a conservative fallback rather than a substantive rewrite.
Reading between the lines
- Beyond the paper: if source attribution is a separate axis, evaluation suites for tool-using agents should include deliberately confused-source cases (e.g., a fact supported by the chart but attributed to literature) as a standard stress slice, not just incidental trace data.
- Beyond the paper: the reported 50/50 conflation detections are on clean single-swap probes; a natural next test is multi-error, paraphrased, or adversarially hidden swaps, where precision is unknown.
- Beyond the paper: because only held-out labels were human-reviewed, an independent clinician gold set over the training and validation claims would tell whether the calibration and source-accuracy numbers are stable or partly self-confirming.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper introduces ProvenanceGuard, a source-aware factuality verifier for MCP-based LLM agents. It decomposes an agent answer into atomic claims, routes each claim to a specific MCP evidence source using embeddings, checks support with NLI plus a token-alignment and protected-value heuristic, calibrates the support decision with a random-forest model, and then compares the routed source against the source stated or implied in the answer. The system returns per-claim verdicts and an allow/block answer decision, with a RARR-style repair loop for blocked answers. Evaluation uses a frozen corpus of 281 captured medical-domain MCP traces; the primary held-out split is 40 traces / 361 human-reviewed claims, with reported block F1 0.802 and source accuracy 0.858 over 260 source-eligible claims. A harder multi-source benchmark yields block F1 0.846 but source-plus-relation accuracy 0.229, and 50 controlled single-swap conflation probes are all blocked and repaired. The paper argues that source attribution is an independent axis of factuality verification beyond pooled evidence support.
Significance. If the central claim holds, the paper addresses a real and underexplored failure mode: a claim can be supported by pooled evidence while being attributed to the wrong MCP tool output. The system's preservation of stable source IDs through routing and support checking is a sensible design, and the comparison with source-blind baselines (MiniCheck, RAGAS, AlignScore, SummaC-ZS) is appropriate. The paper is also commendably honest about limitations: it reports wide confidence intervals, acknowledges that human review covers only the held-out labels, separates the multi-source benchmark units, and does not overclaim the repair loop as an independent oracle. However, the load-bearing evidence for the source-attribution claim rests on (i) a gold standard whose human-review protocol is not described and whose training/validation labels are LLM-assisted only, and (ii) 50 conflation probes that are deliberately simple single-swap family-level cases. The multi-source benchmark, with source-plus-relation accuracy of only 0.229, further tempers the strength of the empirical support for exact source ownership. The contribution is therefore better characterized as a well-engineered demonstration
major comments (3)
- [Sections IV-H, V-G, VIII; Table XXI] The gold standard for the headline source metrics is not shown to be independent of the verifier. Human review covers only the 361 held-out labels; training and validation labels are LLM-assisted, and the human protocol is unspecified: no inter-annotator agreement, no statement about blinding to model labels, no report of how often reviewers changed labels, and no evidence that reviewers saw complete raw tool outputs. If the two Gemma judge prompts share the same semantic-similarity notion as the MiniLM router and DeBERTa NLI, source accuracy 0.858 and block F1 0.802 could partly reflect agreement with the judge's relevance heuristic rather than true provenance. This is the primary evidence for the central claim. Please provide a detailed re-annotation protocol and/or an independent human gold set for at least a random sample, with agreement statistics and a list of label changes.
- [Section V-F and Section VIII] The 50/50 conflation result is the only direct evidence for cross-source conflation detection, but each probe is a single family-level swap (chart vs. literature) with no paraphrase, no adversarial hiding, and no near-source confound. The lexical alias matcher and routing are designed exactly for this contrast, so the exact binomial interval [0.93, 1.00] supports only the narrow claim that simple attribution swaps are blocked. The central novelty claim — that cross-source conflation is an independent failure mode a verifier can catch — would be much stronger with probes involving semantically close sources, paraphrased attribution spans, or multi-error traces. The conclusion should not rely on the 50/50 number as evidence beyond the simple-swap setting.
- [Sections III-H and V-E; Table XIX] Repair-and-reverification success is scored by the same verifier that issued the block, so the abstract's statement that the loop 'resolves all blocked answers' demonstrates only pipeline consistency, not independent correctness. Table XIX shows 144 of 173 resolutions are terminal conservative fallbacks rather than substantive answer recoveries. The paper acknowledges this in the discussion, but the abstract and contribution list overstate the repair result. Please either measure repaired answers under independent human or LLM adjudication, or rephrase the claim as 'all blocked answers are converted to verifier-passing outputs, mostly by conservative fallback.'
minor comments (5)
- [Section V-A; Table III] The held-out block-F1 confidence interval [0.664, 0.900] is very wide, and the MiniCheck comparison in Table XVII is not statistically significant (one-sided p≈0.13). The text handles this adequately, but the abstract could state more explicitly that the support-F1 advantage over source-blind baselines is not the main evidence for the paper's contribution.
- [Section V-B; Table VIII] Decomposition is measured against a frozen reference extraction, not human gold, and the protected-value exact rate of 0.563 is low. This is acknowledged in the limitations, but it deserves a more prominent place in the answer-level repair discussion since protected-value errors can affect downstream attribution decisions.
- [Section V-B; Table XIV] The 2048-token ModernBERT diagnostic is a one-epoch, 100-group replacement checkpoint with raw source-plus-relation accuracy 0.090. Reporting it as a 'valid raw test point' is fine, but the row reads as if it were a substantive long-context result; consider moving this diagnostic clearly to an appendix or supplement.
- [Section IV-C] The unit mismatch between 254 pairwise claim cases and 263 frozen extracted claims for the same 59 test questions is clearly stated, but the narrative occasionally refers to both as 'benchmark results.' Please ensure each table and sentence explicitly identifies which unit is being used.
- [Section II] Minor typo: 'F ActScore' should likely be 'FactScore'. Also, the related-work discussion of ALCE is helpful and should be kept, but it could note more explicitly that ALCE's citation-level attribution is a passage-level task, not a tool-provenance task.
Circularity Check
Repair-and-reverify success reduces to the same verifier's own verdict; terminal fallback makes 'all resolved' near-tautological. The central held-out support/source metrics remain independent.
-
self definitional
[Section III-H (Repair and Reverification); Section V-E (RQ4); Table XIX]
"The RARR-style repair loop is therefore not treated as a separate oracle; it is a repair mechanism whose output must satisfy the same attribution-sensitive checks that blocked the original answer. ... The limitation is that repair success is measured against the same verifier that triggered the block. ... The repair loop resolves all 173 blocked answers, and all 173 revised outputs pass the same Router+NLI verifier."
A blocked answer counts as 'resolved' exactly when the same ProvenanceGuard verifier passes the revised output, and the loop is allowed to terminate by replacing remaining content with a conservative non-claim response. Because the verifier treats generic safety boilerplate as non-evidence-bearing, the terminal fallback path (144 of 173 resolutions in Table XIX) passes by construction. Thus 'repair resolves all blocked answers' is not a prediction about external correctness; it is an artifact of defining success as the verifier's own verdict. The paper concedes this is 'not independent proof,' but the headline repair/resolution numbers still reduce to the verifier's self-judgment rather than to an external gold standard.
full rationale
The core derivation is not circular. The claim-level support and source-attribution numbers are measured on a held-out packet with human-reviewed labels (Section IV-H, Table XXI), the router's 0.858 source accuracy is a Top-1 cosine ranking compared against those labels, and the source-blind baselines are external systems never used to train or calibrate ProvenanceGuard. I found no self-citation chain, no imported uniqueness theorem, and no fitted parameter renamed as a prediction. The main circular element is the repair-and-reverify evaluation: 'resolved' is defined as passing the same verifier that produced the block, and the terminal fallback rule makes passing near-guaranteed. The paper explicitly acknowledges this limitation ('repair success is measured against the same verifier that triggered the block... not independent proof'), so it is a transparently disclosed partial circularity rather than a hidden one. The 50 conflation probes are controlled diagnostics whose ground truth matches the system's own attribution rule; I did not count this as a separate circular step because the probes still require routing and NLI to succeed, but their evidentiary weight is limited. Overall: the central claim that source attribution is an independent axis has independent support from the held-out source-accuracy and multi-source benchmark; the repair claims are partly self-confirming, warranting a score of 4 rather than 0.
Assumptions & free parameters
free parameters (9)
- support threshold =
0.65
- alignment threshold tau =
0.35 of maximum claim-token attention score
- minimum supported-token ratio =
0.70
- lexical rescue thresholds =
0.55 (with protected values); 0.85 (otherwise)
- NLI pair budget =
512 tokens (previously 256)
- random forest hyperparameters =
400 trees, depth 5, min leaf 8, balanced class weights, seed 20260607
- max extracted claims M =
20
- source embedding model =
all-MiniLM-L6-v2
- NLI checkpoint =
MoritzLaurer/DeBERTa-v3-base-mnli-fever-anli
assumptions (6)
- domain assumption MCP trace objects carry stable source IDs and complete raw tool outputs; if no source ID, tool name fallback suffices.
- domain assumption The cosine-similarity centroid router ranks the true supporting source first often enough; routing errors cascade to all downstream verdicts.
- domain assumption The NLI model and attention-token alignment proxy measure support for the routed source.
- domain assumption The LLM-assisted adjudication labels (Gemma 4 E4B judge prompts) and 361 human-reviewed labels are valid gold.
- ad hoc to paper Passing the same verifier after repair is evidence of resolution.
- domain assumption Fail-closed blocking (block if any claim fails) is the right evaluation policy.
Cite this review
Pith. "Pith review of ProvenanceGuard: Source-Aware Factuality Verification for MCP-Based LLM Agents." pith.science (2026). https://pith.science/paper/ZESHNARJ
@misc{pith2026260618037,
author = {Pith},
title = {Pith review of: ProvenanceGuard: Source-Aware Factuality Verification for MCP-Based LLM Agents},
year = {2026},
howpublished = {\url{https://pith.science/paper/ZESHNARJ}},
note = {Machine review of arXiv:2606.18037}
}
read the original abstract
Tool-using LLM agents increasingly use the Model Context Protocol (MCP) to answer from heterogeneous evidence sources, including search, APIs, databases, clinical records, and formulary tools. Standard factuality metrics usually test whether an answer is supported by pooled evidence, missing a provenance-sensitive failure mode: a claim may be supported somewhere while being attributed to the wrong source. We call this cross-source conflation. We introduce ProvenanceGuard, a source-aware verifier for MCP-grounded answers. It consumes captured MCP traces with stable tool IDs, source IDs, and raw outputs; decomposes answers into atomic claims; routes claims to source-specific evidence; checks support with NLI and a token-alignment proxy; compares stated attribution with the routed source; and returns per-claim verdicts plus an answer-level allow/block decision. Blocked answers can be repaired with retrieval-augmented answer revision and re-verified. We evaluate on 281 medical-domain MCP-agent traces. A 266-trace adjudicated subset yields 2,325 LLM-assisted claim labels split by trace; 361 held-out labels are human-verified. On the 40-trace held-out split, ProvenanceGuard achieves block F1 0.802 and source accuracy 0.858 over 260 source-eligible claims, outperforming source-blind baselines that do not emit claim-to-source IDs. On a harder multi-source benchmark it reaches block F1 0.846, while source-plus-relation accuracy drops to 0.229, showing that exact source ownership remains difficult with semantically close sources. Repair-and-reverify resolves all blocked answers in the full trace set, often via conservative fallback. In 50 controlled clinical conflation probes, ProvenanceGuard detects all injected attribution swaps with no retained wrong attribution. These results show that source attribution is an independent axis for factuality verification in MCP-based agents.
Figures
Reference graph
Works this paper leans on
-
[1]
S. Min, K. Krishna, X. Lyu, M. Lewis, W.-t. Yih, P. W. Koh, M. Iyyer, L. Zettlemoyer, and H. Hajishirzi, inPro- ceedings of the 2023 Conference on Empirical Methods in 17 System Claims Block P Block R Block F1 Verdict acc. Verdict macro F1 ProvenanceGuard (ours) 361 0.673 0.993 0.802 0.812 0.406 MiniCheck 361 0.655 0.971 0.783 0.792 0.396 RAGAS Faithfulne...
2023
-
[2]
We introduceProvenanceGuard, a calibrated source-aware Router+NLI verifier that decomposes answers into claims, preserves stable MCP tool IDs and source IDs from raw tool outputs, routes claims to source-specific evidence, and detects cross-source conflation
-
[3]
We report a frozen captured medical-domain agent benchmark built from 281 captured MCP-agent traces, a 266-trace claim subset with 2,325 LLM- assisted labels, and a 40-trace held-out packet with complete MCP tool outputs and human-expert- reviewed labels
-
[4]
We compareProvenanceGuardagainst MiniCheck, RAGAS Faithfulness, AlignScore, and SummaC-ZS on the same held-out claim packet, while separately evaluating RARR-style repair on full captured traces and targeted source-conflation probes. The central claim is limited to source-attribution factu- ality in MCP-grounded answers; we do not claim to solve open-doma...
-
[5]
Y. Song, Y. Kim, and M. Iyyer, inFindings of the Asso- ciation for Computational Linguistics: EMNLP(2024)
2024
-
[6]
Goyal and G
T. Goyal and G. Durrett, inFindings of the Association for Computational Linguistics: EMNLP 2020(2020)
2020
-
[7]
L. Tang, P. Laban, and G. Durrett, inProceedings of the 2024 Conference on Empirical Methods in Natural Lan- guage Processing(Association for Computational Lin- guistics, Miami, Florida, USA, 2024) pp. 8818–8847
2024
- [8]
Show all 29 references
-
[9]
Y. Zha, Y. Yang, R. Li, and Z. Hu, inProceedings of the 61st Annual Meeting of the Association for Compu- tational Linguistics(Association for Computational Lin- guistics, Toronto, Canada, 2023) pp. 11328–11348
2023
-
[10]
evaluates whether LLM-generated citations point to the correct supporting passage, which is the closest existing task to source attribution. However, ALCE operates at the passage or chunk level within a single retrieved set, whereas MCP traces expose stable tool- level source ...
-
[11]
Bohnet, V
B. Bohnet, V. Q. Tran, P. Verga, R. Aharoni, D. Andor, L. B. Soares, M. Ciaramita, J. Eisenstein, K. Ganchev, J. Herzig, K. Hui, T. Kwiatkowski, J. Ma, J. Ni, L. Sestorain Saralegui, T. Schuster, W. W. Cohen, M. Collins, D. Das, D. Metzler, S. Petrov, and K. Web- ster, Attribu...
2022 arXiv
-
[12]
Cattan, P
A. Cattan, P. Roit, S. Zhang, D. Wan, R. Aharoni, I. Szpektor, M. Bansal, and I. Dagan, Transactions of the Association for Computational Linguistics (2026)
2026
-
[13]
Harary, E
S. Harary, E. Hirsch, A. Slobodkin, D. Wan, M. Bansal, and I. Dagan, PrefixNLI: Detecting factual inconsisten- cies as soon as they arise (2025), arXiv:2511.01359
2025
-
[14]
S. Es, J. James, L. Espinosa-Anke, and S. Schockaert, inProceedings of the 18th Conference of the European Chapter of the Association for Computational Linguis- tics: System Demonstrations(Association for Computa- tional Linguistics, St. Julian’s, Malta, 2024) pp. 150–158
2024
-
[15]
T. Gao, H. Yen, J. Yu, and D. Chen, inProceedings of the 2023 Conference on Empirical Methods in Natural Language Processing (EMNLP)(Association for Compu- tational Linguistics, Singapore, 2023) pp. 10355–10377
2023
-
[16]
D. Wan, E. Hirsch, E. Stengel-Eskin, I. Dagan, and M. Bansal, GenerationPrograms: Fine-grained attribu- tion with executable programs (2025), arXiv:2506.14580
2025 arXiv
-
[17]
X. Yue, B. Wang, Z. Chen, K. Zhang, Y. Su, and H. Sun, inFindings of the Association for Computational Lin- guistics: EMNLP 2023(Association for Computational Linguistics, Singapore, 2023) pp. 4615–4635
2023
-
[18]
Rashkin, V
H. Rashkin, V. Nikolaev, M. Lamm, L. Aroyo, M. Collins, D. Das, S. Petrov, G. S. Tomar, I. Turc, and D. Reitter, Computational Linguistics49, 777 (2023)
2023
-
[19]
Honovich, R
O. Honovich, R. Aharoni, J. Herzig, H. Taitelbaum, D. Kukliansy, V. Cohen, T. Scialom, I. Szpektor, A. Has- sidim, and Y. Matias, inProceedings of the 2022 Confer- ence of the North American Chapter of the Association 18 for Computational Linguistics: Human Language Tech- nolo...
2022
-
[20]
takes a generated passage, researches evidence, and revises unsupported claims while preserving the original style and structure. In our setting, RARR-style repair is evaluated after source-aware blocking: the verifier rejects an answer, repair attempts to produce a source-gro...
-
[21]
Hirsch, A
E. Hirsch, A. Slobodkin, D. Wan, E. Stengel-Eskin, M. Bansal, and I. Dagan, inProceedings of the 63rd An- nual Meeting of the Association for Computational Lin- guistics(2025) pp. 15355–15370
2025
-
[22]
J. Gao, J. Zhou, Q. Sun, R. Huang, and S. Yoo, Atomic information flow: A network flow model for tool attribu- tions in RAG systems (2026), arXiv:2602.04912
2026
-
[23]
Zhang, Z
Q. Zhang, Z. Xiang, Y. Xiao, L. Wang, J. Li, X. Wang, and J. Su, inProceedings of the 63rd Annual Meeting of the Association for Computational Linguistics(2025)
2025
-
[24]
Filice, E
S. Filice, E. Haramaty, G. Horowitz, Z. Karnin, L. Lewin- Eytan, and A. Shtoff, inProceedings of the 14th Interna- tional Joint Conference on Natural Language Processing and the 4th Conference of the Asia-Pacific Chapter of the Association for Computational Linguistics(2025) p...
2025
-
[25]
L. Gao, Z. Dai, P. Pasupat, A. Chen, A. T. Chaganty, Y. Fan, V. Y. Zhao, N. Lao, H. Lee, D.-C. Juan, and K. Guu, inProceedings of the 61st Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)(Association for Computational Linguis- tics, Toron...
2023
-
[26]
P. Roit, J. Ferret, L. Shani, R. Aharoni, G. Cideron, R. Dadashi, M. Geist, S. Girgin, L. Hussenot, O. Keller, N. Momchev, S. Ramos Garea, P. Stanczyk, N. Vieillard, O. Bachem, G. Elidan, A. Hassidim, O. Pietquin, and I. Szpektor, inProceedings of the 61st Annual Meeting of th...
2023
-
[27]
Kry´ sci´ nski, B
W. Kry´ sci´ nski, B. McCann, C. Xiong, and R. Socher, in Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP)(Association for Computational Linguistics, 2020) pp. 9332–9346
2020
-
[28]
I. Poey, J. Liu, and Q. Zhong, inProceedings of the 2025 Conference on Empirical Methods in Natural Language Processing: Industry Track(2025) pp. 1057–1071
2025
-
[29]
question_id
ThoughtProof, Reasoning verification capability — veri- fying ai output correctness through MCP, MCP GitHub Discussion #2574 (2026). 19 Appendix A: Illustrative Escaped JSON Schema F ragments { "question_id": "clin-real-v2-shuf-003", "user_question": "Summarize beta blockers i...
2026
Reviewed August 2, 2026 · model on record in the stance chip above.
Discussion (0). Continue with ORCID to comment.