arXiv cs.AI· Guanxing Chen, Sining Zhang, Haohuai He, Qiujie Lv, Yu-An Huang, Zhi-An Huang·· 3 小时前AI 评分46
ProbeID：验证注册表漂移下 LLM Agent 的 MCP 工具身份
ProbeID: Verifying MCP Tool Identity for LLM Agents under Registry Drift
AI 导读
arXiv 论文提出 ProbeID，通过比较候选实现对 schema-valid 探针的规范化响应与可信准入参考来验证 LLM Agent 的 MCP 工具身份，歧义时弃权。
正文 · 原文
Abstract:Agents select tools by copyable descriptions, which cannot establish which implementation runs. ProbeID compares canonicalized responses to schema-valid probes with a trusted admission reference and abstains on ambiguity, so a squatter must copy probe-observable behavior. With the gold present, independent probes and a fixed margin, standard concentration arguments give a shared probe budget logarithmic in the candidate count and bound the joint probability of a wrong decision. On cached MCP-IdentityDrift cases, strict choice reaches \(0.956\) hit@1 while description routers fall near chance, but simpler exact comparisons tie it, MMD better tolerates heavy value noise, and a 32B behavioral judge is similarly accurate at higher cost. Random probes from agent banks and a prospective held-out study of 38 tools test theory-set thresholds. On the agent banks, equality refuses every reachable replacement from 64 probes and the bounded distance from 512, and sharper post hoc gates halve both. Two tools whose drift no bank probe reaches always pass. In an MCP-Bench agent, verification cuts tainted tasks from 15 to 9 of 16 at unchanged task success. Over eleven weeks, 7 of 59 real tools changed responses despite version pins. Verification depends on reference integrity, probe coverage, and response noise.
| Subjects: | Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI) |
| Cite as: | arXiv:2610.33633 [cs.CR] |
| (or arXiv:2610.33633v1 [cs.CR] for this version) | |
| https://doi.org/10.48550/arXiv.2610.33633 arXiv-issued DOI via DataCite (pending registration) |
Submission history
From: Guanxing Chen [view email]
[v1]
Sat, 24 Oct 2026 12:26:13 UTC (517 KB)
来源：arXiv cs.AI · arxiv.org