Prompt injection and copied sources: check independence

Checking several sources helps an AI agent only when their agreement represents independent evidence. Trace who controls each record and where its decisive facts originated. Copies, summaries and separate documents from one compromised authority can all repeat the same error.

For prompt-injection protection, this adds a question to source provenance: how many independent failures would be needed to change the proposed action? A list of different URLs leaves that question unanswered.

Trace agreement to its origin

In Certified Multi-Source Integrity for Structured Agent Actions, Anmol Pandey and colleagues study agents that assemble consequential actions from documents and tool outputs. Their September 2026 preprint focuses on fields such as payee identity, amount and destination account.

The paper groups evidence by the control domains whose compromise could change it. A control domain means an independently controlled authority or system in the threat model. Two records can share an upstream publisher, builder or other dependency even when they arrive through different services.

Consider a fictional purchasing task. An internal summary and a supplier directory both copy a supplier's original notice. Three documents agree, but their agreement depends on that notice. Recording their shared origin helps the reviewer understand the evidence available for a decision.

Count independent control, including original records

Removing duplicate copies addresses only part of the counting problem. One compromised authority might issue several distinct original records, each with its own document identifier. Counting those identifiers as independent votes would still give that authority disproportionate influence.

The proposed design therefore binds records to authenticated control domains and counts a domain once for each claim. It also models dependencies between domains. Establishing those bindings and dependencies is a prerequisite for the guarantee, with an operational owner needed to maintain them.

For an evaluation, ask who supplies the dependency map, how its accuracy is checked and what happens when provenance is unknown. The paper recommends treating unknown origins as a shared unknown domain. That conservative treatment reduces the evidence available to authorise an action.

Give each field an appropriate rule

Agreement suits a fact that several independent sources can genuinely attest. Other fields need different checks. The paper distinguishes a corroborated identity from an amount reconciled against an authorised ceiling and an account checked against trusted records.

Before reading untrusted material, its system also fixes the intended operation, transaction identity, required sources, destination constraints and policy version. Those choices prevent a document from quietly selecting a different transaction for an otherwise consistent set of fields.

This is useful when reviewing agent workflows: identify what the user already authorised, what the agent may discover and which system can approve the final action. Our tool-security guide covers the surrounding permission boundaries.

Read the research guarantee with its assumptions

The authors distinguish returning the correct value despite corruption from safely abstaining when evidence is insufficient. Abstention preserves the security boundary while leaving work unresolved. Their field-by-field implementation can abstain more often than the paper's ideal joint decision rule.

The guarantee assumes authentic source identities, trusted anchors, a trusted transaction identifier and sound extraction from unaffected evidence. A shared model, prompt, provider or parser can introduce correlated errors across sources. Reading each document separately leaves that common dependency in place.

The real-data analysis also makes the scarcity of corroboration visible. Among 70,966 sanctions entities, 14.9% had three or more mapped control domains. Among 450 npm packages, none retained three distinct witnesses after accounting for shared origin. These are author-reported upper-bound proxies for independence, with incomplete dependency information.

They describe those datasets and their mapping choices. They do not establish the same proportions for an enterprise's invoices or knowledge base. The controlled experiments are research evidence; Promptective has not independently reproduced them or verified a production deployment of the design.

Turn the distinction into a review exercise

Use a fictional task and harmless records in an isolated environment. Prepare a genuinely independent corroborating record, a copied record and several original records from the same fictional authority. Agree the expected evidence count before running the agent.

Check whether changing the number of copies changes the decision. Then remove a mandatory source, introduce a disagreement and change the transaction identifier. The review should expose missing evidence and mismatched transactions clearly while retaining a usable route for an authorised human decision.

Keep separate results for the proposed action, the gate's decision, any executed effect and useful-task completion. Retain the fixture and dependency-map versions without collecting production documents. A safe abstention and a completed authorised task are both informative outcomes.

Source independence deserves a named place in the evidence record. It helps teams judge what corroboration can support and where additional trusted information is still needed.

Map your agent decision boundaries with Promptective.