Elamur Research⌕
☰
home / papers / 2026 / Assertion-Conditioned Compliance: A Provenance-Aware Vulnerability in Multi-Turn Tool-Calling Agents

Assertion-Conditioned Compliance: A Provenance-Aware Vulnerability in Multi-Turn Tool-Calling Agents

Paper · 2026 · Daud Waqas, Aaryamaan Golthi, Erika Hayashida et al.

Summary

Tool-calling LLM agents are often judged by leaderboard accuracy. That score says little about how they behave when a conversation contains plausible but wrong information. The authors define Assertion-Conditioned Compliance (A-CC): an agent accepts a false claim and lets it change which functions it actually executes, not just what it says. They separate two sources of such claims. User-sourced assertions (USAs) test sycophancy toward mistaken users. Function-sourced assertions (FSAs) test deference to misleading tool feedback, such as stale hints from unmaintained tools.

Using the multi_turn_base split of BFCL, they inject synthetic assertions into specific turns. They then measure a compliance rate (CR) separately from final-state task success. Eleven current models usually followed the misleading assertions in roughly a fifth to two-fifths of cases, and BFCL success sometimes fell by more than 20 points. Compliance did not track accuracy loss closely, so agents can look successful while performing unneeded or risky operations.

For industry, this suggests running provenance-aware checks before deployment and treating user and tool channels as separately untrusted.

Key points

  • The benchmark is the BFCL multi_turn_base category: 200 stateful tasks modeled on real-world APIs, scored by the final environment state.
  • Gemini 2.5 Pro generated the USAs as single sentences in two tones (confident vs. hedged) and three modes (init, read-heavy, write-heavy). FSAs are inserted into tool responses.
  • Across 11 models, CR was typically 20–40%. The worst-case BFCL drop averaged 16.9 points per model.
  • Qwen3 14B (FC) was the most affected, falling 23.4 points from a 50.2% baseline. xLAM 2 32B (−20.3) and BitAgent Bounty 8B (−20.8) also dropped sharply. Watt Tool 70B and Qwen3 variants were especially swayed by FSAs.
  • Limitations: the assertions are synthetic, the study covers English only, it uses only BFCL APIs, and it proposes no defense methods.

Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.

 Institutions

🎓University of California, BerkeleyBerkeley · United States175 works · 227,440 citations🎓Monash UniversityMelbourne · Australia60 works · 54,866 citations

 Fields, topics and concepts

📚 Shelves 4The field of science this work belongs to (OpenAlex fields).Computer Science · 16,667 worksArtificial Intelligence · 16,194 worksArts and Humanities · 16,039 worksLanguage and Linguistics · 15,891 works

Cite

Cite as Daud Waqas, Aaryamaan Golthi, Erika Hayashida and Huanzhi Mao. 2026. Assertion-Conditioned Compliance: A Provenance-Aware Vulnerability in Multi-Turn Tool-Calling Agents. Proceedings of the 19th Conference of the European Chapter of the Association for Computational Linguistics (Volume 5: Industry Track).

The paper itself, not this page. BibTeX from the library's record of the work. DOI 10.18653/v1/2026.eacl-industry.47

@inproceedings{waqas2026assertion,
  title = {{Assertion-Conditioned Compliance: A Provenance-Aware Vulnerability in Multi-Turn Tool-Calling Agents}},
  author = {Daud Waqas, Aaryamaan Golthi, Erika Hayashida and Huanzhi Mao},
  booktitle = {Proceedings of the 19th Conference of the European Chapter of the Association for Computational Linguistics (Volume 5: Industry Track)},
  year = {2026},
  doi = {10.18653/v1/2026.eacl-industry.47},
  url = {https://doi.org/10.18653/v1/2026.eacl-industry.47}
}

References

18 references, 4 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

  1. BitAgent. 2025. Bitagent bounty 8b. https://huggingface.co/BitAgent/BitAgent-8B. Commit hash ca31a77. ↗
  2. Yi-Chang Chen, Po-Chun Hsu, Chan-Jan Hsu, and Da-shan Shiu. 2025. Enhancing function-calling capabilities in LLMs: Strategies for prompt formats, data integration, and multilingual translation. In Proceedings of the 2025 Conference of the Nations of the Americas Chapter of the Association for Comput… find
  3. Zhi-Yuan Chen, Shiqi Shen, Guangyao Shen, Gong Zhi, Xu Chen, and Yankai Lin. 2024. Towards tool use alignment of large language models. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pages 1382–1400, Miami, Florida, USA. Association for Computational Lingu… find
  4. Myra Cheng, Sunny Yu, Cinoo Lee, Pranav Khadpe, Lujain Ibrahim, and Dan Jurafsky. 2025. Elephant: Measuring and understanding social sycophancy in llms.
  5. Yiyang Feng, Yichen Wang, Shaobo Cui, Boi Faltings, Mina Lee, and Jiawei Zhou. 2025. Unraveling misinformation propagation in LLM reasoning. In Findings of the Association for Computational Linguistics: EMNLP 2025, pages 11683–11707, Suzhou, China. Association for Computational Linguistics. find
  6. Minghao Li, Yingxiu Zhao, Bowen Yu, Feifan Song, Hangyu Li, Haiyang Yu, Zhoujun Li, Fei Huang, and Yongbin Li. 2023. API-bank: A comprehensive benchmark for tool-augmented LLMs. In Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, pages 3102–3116, Singapore. Ass…
  7. Q. Vera Liao and Jennifer Wortman Vaughan. 2024. Ai Transparency in the Age of LLMs: A Human-Centered Research Roadmap. Harvard Data Science Review, (Special Issue 5). Https://hdsr.mitpress.mit.edu/pub/aelql9qy. find
  8. Joshua Liu, Aarav Jain, Soham Takuri, Srihan Vege, Aslihan Akalin, Kevin Zhu, Sean O’Brien, and Vasu Sharma. 2025a. Truth decay: Quantifying multi-turn sycophancy in language models. find
  9. Weiwen Liu, Xu Huang, Xingshan Zeng, Xinlong Hao, Shuai Yu, Dexun Li, Shuai Wang, Weinan Gan, Zhengying Liu, Yuanqing Yu, Zezhong Wang, Yuxian Wang, Wu Ning, Yutai Hou, Bin Wang, Chuhan Wu, Xinzhi Wang, Yong Liu, Yasheng Wang, Duyu Tang, Dandan Tu, Lifeng Shang, Xin Jiang, Ruiming Tang, Defu Lian, Q… find
  10. Siyuan Lu, Zechuan Wang, Hongxuan Zhang, Qintong Wu, Leilei Gan, Chenyi Zhuang, Jinjie Gu, and Tao Lin. 2025. Don’t just fine-tune the agent, tune the environment. find
  11. Huanzhi Mao, Fanjia Yan, Charlie Cheng-Jie Ji, Jason Huang, Vishnu Suresh, Yixin Huang, Xiaowen Yu, Joseph E. Gonzalez, and Shishir G. Patil. 2024. Bfcl v3 • multi-turn & multi-step function calling evaluation. find
  12. Shengqian Qin, Yakun Zhu, Linjie Mu, Shaoting Zhang, and Xiaofan Zhang. 2025. Meta-tool: Unleash open-world function calling capabilities of general-purpose large language models. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), page… find
  13. Changle Qu, Sunhao Dai, Xiaochi Wei, Hengyi Cai, Shuaiqiang Wang, Dawei Yin, Jun Xu, and Ji-Rong Wen. 2024. Tool learning with large language models: A survey.
  14. Ella Rabinovich and Ateret Anaby Tavor. 2025. On the robustness of agentic function calling. In Proceedings of the 5th Workshop on Trustworthy NLP (TrustNLP 2025), pages 298–304, Albuquerque, New Mexico. Association for Computational Linguistics. find
  15. Mrinank Sharma, Meg Tong, Tomasz Korbak, David Duvenaud, Amanda Askell, Samuel R. Bowman, Newton Cheng, Esin Durmus, Zac Hatfield-Dodds, Scott R. Johnston, Shauna Kravec, Timothy Maxwell, Sam McCandlish, Kamal Ndousse, Oliver Rausch, Nicholas Schiefer, Da Yan, Miranda Zhang, and Ethan Perez. 2025. T… — Towards Understanding Sycophancy in Language Models
  16. Zhiruo Wang, Zhoujun Cheng, Hao Zhu, Daniel Fried, and Graham Neubig. 2024. What are tools anyway? a survey from the language model perspective. watt ai. 2025. Watt tool 70b. https://huggingface.co/watt-ai/watt-tool-70B. Commit hash dbe1934. ↗
  17. Jerry Wei, Da Huang, Yifeng Lu, Denny Zhou, and Quoc V. Le. 2024. Simple synthetic data reduces sycophancy in large language models. find
  18. An Yang, Anfeng Li, Baosong Yang, Beichen Zhang, Binyuan Hui, Bo Zheng, Bowen Yu, Chang Gao, Chengen Huang, Chenxu Lv, Chujie Zheng, Dayiheng Liu, Fan Zhou, Fei Huang, Feng Hu, Hao Ge, Haoran Wei, Huan Lin, Jialong Tang, Jian Yang, Jianhong Tu, Jianwei Zhang, Jianxin Yang, Jiaxi Yang, Jing Zhou, Jin… find

Updated

↑ back to top

This page in Markdown → https://md.research.elamur.ai/free/en/papers/waqas-2026-assertion-conditioned-compliance-provenance-aware/