Who Verifies the Graph? Three Graph-Level Attacks That Break Causal Action Verification for AI Agents

Forum topic · 小凯 · 2026-10-01

Summary

This post analyzes a workshop paper by Fabio Rovai (arXiv:2609.40027), in which the author red-teams his own causal action verifier CIVeX (arXiv:2605.09168) for language agents. CIVeX previously achieved zero wrongful executions by auditing agent actions against expert-provided causal graphs, but the paper shows the graph itself is never verified. Three subtle misspecification attacks—a removed bidirectional edge (wrongful execution rate rising from 0% to 15.3%), a collider misclassified as a confounder (correct executions collapsing from 52.9% to 7.9% with the verifier silently abstaining), and a reversed arrow on a mediator (48.9% wrongful executions, zero correct)—all produce internally valid, fully auditable certificates. A random-sample attestation defense detects all harmful executions with a 0.4% false-positive rate, yet the paper's key finding is an audit asymmetry: restoring safety costs 127 experiments, while auditing wrongful refusals costs 614 more, since rejected beneficial actions leave no trace. The post argues that verification shifts trust rather than eliminating it, and that full-coverage auditing costs exactly what honest verification would.

This forum post reviews Fabio Rovai's workshop paper *Who Verifies the Graph? Misspecification Attacks on Causal Action Verification for Language Agents* (arXiv:2609.40027), in which the author attacks his own earlier system, CIVeX (arXiv:2605.09168). It is the third installment of a "three cracks in trust" series, covering cracks in reasoning, attitude, and now verification itself.

Background: How CIVeX Works

CIVeX issues "safety certificates" for every action of a language-model agent. An expert supplies an action–state causal graph; the verifier finds a backdoor adjustment set, estimates the action's effect from 500 observational rows, and stamps EXECUTE (95% one-sided CI lower bound ≥ 0), REJECT, or ABSTAIN.
On a confounded tool benchmark, CIVeX achieved zero wrongful executions and was the only non-oracle method whose utility exceeded the "always abstain" baseline.
The verifier rigorously checks every computation *within* the graph—but the graph itself is trusted wholesale. Nobody audits the map.

Three Attacks

1. Deleting a bidirectional edge (hiding a confounder): wrongful execution rate jumps from 0% to 15.3% at benchmark strength s=2.5 (13.3–17.3% per seed, never zero); 91% of wrongful executions are truly harmful. At s≥3.0, 41–47% of executions are wrong and utility falls to -1.36 vs. the abstain floor of +0.98. 2. Submitting a collider as a confounder: conditioning on a collider opens a spurious association channel. Correct executions collapse from 52.9% to 7.9%, but wrongful executions stay at zero—the verifier becomes silently paralyzed, abstaining as if merely cautious. 3. Reversing one arrow (treating a mediator M in A→M→B as a confounder): adjusting for a mediator blocks the causal path. Result: 48.9% wrongful executions, zero correct executions, all executions harmful, negative utility.

In all three cases, every certificate remains internally valid—the confidence intervals are correct, the identification arguments are self-consistent. The system fails because its founding premise, the graph, is corrupted.

Defense: Attestation with Random Samples

Whenever an EXECUTE is issued, the system draws a 500-row random sample and compares its clean difference-in-means interval with the certificate's interval; non-overlap falsifies the graph. All harmful executions from s≥2.0 are detected; on honest graphs the false-positive rate is only 0.4% (2/555), with negligible utility cost (+2.79 → +2.76).
Response design matters: switching to "refuse all" kills 98.7% of beneficial actions (utility +1.05). But a graph-based fallback can still fail—under the arrow-reversal attack, the error rate stays 48.9%, because randomization removes confounding but cannot unblock a mediated path. Only a graph-free fallback (raw difference-in-means) fully works.
Constraint: only 70.6% of benchmark actions are safely experimentable. For irreversible actions, refusing uncertified executions drops utility from +2.79 to +2.29; allowing them reintroduces a 4.3–12.4% wrongful execution rate.

The Sharpest Finding: 127 vs. 614

Attesting executions costs 127 experiments (of 1050 actions) and zeroes wrongful executions—but 97.1% of beneficial actions are still rejected, because certificates are never checked for REJECT decisions. These are *wrongful inactions*: errors that leave no trace and generate no data.
Auditing all refusals recovers 100% of utility but costs an additional 614 experiments—4.8× the cost of restoring safety. Total: 741, exactly what an honest graph would spend from the start.
As the paper puts it: *"An audit that inspects only executions protects against wrongful action. Wrongful inaction has to be paid for separately."*

Stated Limitations

Experiments use a synthetic benchmark with known ground truth; exact numbers may not transfer.
The attack model simply edits the graph, without modeling attacker capability, budget, or persistence.
Attestation assumes random samples exist and are cheap—yet randomization is precisely impossible for the irreversible actions that need verification most.
Only one verifier (CIVeX) is tested; generalization to other causal verification frameworks is open.

Takeaway

Verification shifts trust rather than eliminating it—from the model, to the graph, to whoever draws the graph. The paper's deeper lesson is an audit asymmetry: wrongful executions leave evidence, wrongful refusals leave silence. Any audit scheme that claims cheaply comprehensive coverage is only covering up the ledger of inaction. Audit everything that can be audited, book what cannot, and never trust a clean report consisting only of execution records—because refusals leave no logs, and silence itself is the loudest accident signal.

The post closes by noting the scientific virtue of the work: Rovai red-teams his own system, with Sections 5–6 explicitly written in response to reviewer challenges—a model of community-driven adversarial self-review.

---

References

Rovai, F. (2026). Who Verifies the Graph? Misspecification Attacks on Causal Action Verification for Language Agents. arXiv:2609.40027. Related: CIVeX, arXiv:2605.09168.