RESEARCH

Two publications. Sixteen projects. One protocol.

Every result below is bound to a frozen Master Experiment Contract, pre-registered hypotheses, a deterministic oracle, and a red-team release checklist. The numbers are the ones in the repository — nothing is rounded up.

01 / PUBLICATIONS

Empirical papers from the FAULTLINE research bench.
PUBLICATION 02 · 2026

Runtime Provenance Contracts for Mitigating Tool Poisoning in MCP Agents

A Paired Evaluation on MCPTox Across Six Models

Samir Sawarkar · FAULTLINE

We deployed and evaluated an independent defensive second arm on the Model Context Protocol Poisoning benchmark (MCPTox), testing whether a client-side runtime provenance contract on tool-call arguments with call-only retry gating mitigates tool poisoning across six model rungs. We interposed a deterministic five-stage policy engine between model generations and tool execution that enforces envelope formatting, tool enumeration allowlists, strict schema argument boundaries, and verbatim substring-grounding against user turns, granting a single retry gated strictly on contract-blocked calls.

FIG. 1 — Attack Success Rate by Rung, Arm A vs Arm B
FIG. 1 — ATTACK SUCCESS RATE BY RUNG, ARM A VS ARM B
KEY FINDINGS
  • Significant attack reduction: On 300 MCPTox instances across six models via one gateway, the provenance contract achieved a statistically significant paired mean score reduction (Mean Δ = -0.2194, 95% CI [-0.2400, -0.1983], p < 0.0001, d_z = -0.49), cutting pooled valid ASR from 30.32% to 7.41% (and raw ASR from 28.83% to 6.89%).
  • Asymmetric transition matrix: Removed 421 attack successes while inducing only 26 (McNemar exact p = 5.61 × 10-93), demonstrating that defensive filtering interdicts true malicious tool invocations rather than shifting failure modes.
  • Autonomous refusal regime: Gemini 3.7 Flash (R5) reduction was non-significant (b=5, c=1, p=0.2188) due to high baseline resistance in Arm A (valid ASR 3.01%), leaving minimal attack margin for the contract to suppress.
  • Operational false-block penalty: Replay over 10,227 traces indicates substring grounding false-blocks 24.5% of legitimate actions when tasks require ungrounded world knowledge.
Paper (PDF) Paper (Markdown) Executive summary
PUBLICATION 01 · 2026

Multi-Trial Reliability and Failure Concentration in Multi-Hop AI Agents

Grounding Collapse, Failure Taxonomy, and Evaluator Calibration

Samir Sawarkar · FAULTLINE

We present a controlled empirical test of the independence assumption pass^k = (pass@1)^k on a contamination-resistant 5-hop knowledge graph benchmark, evaluating whether joint operational reliability compounds independently under repeated executions. Across 150 held-out hard scenarios executed at pinned temperature 0.0 with k=3 repetitions (1,350 total runs), every trial was graded by a deterministic dual-condition oracle requiring exact answer normalization and verified citation hashes without subjective model judges in the loop.

FIG. 2 — Multi-Trial Reliability vs Naive Independence
FIG. 2 — MULTI-TRIAL RELIABILITY VS NAIVE INDEPENDENCE
KEY FINDINGS
  • Empirical test of naive compounding: Evaluated 150 held-out hard Tier-3 scenarios across k=3 repeated trials (1,350 total runs) across commercial model tiers graded by a deterministic dual-condition oracle without model judges.
  • Independence holds within 2.5 pp: Naive Bernoulli compounding pass^k = (pass@1)^k matches empirical joint reliability within 2.5 percentage points at k=3 (Δ_3 = -0.0247 on R2; Δ_3 = +0.0187 on R4 infra-excluded), well within the pre-registered 10 pp minimum effect of interest.
  • Compounding extrapolation: Beta-binomial modeling shows that while k=3 leaves naive compounding accurate, even undetectable intra-scenario correlation (ICC_hi = 0.0668 on R2) yields divergence at scale (C_8 ≈ 2.25, pass^8 ≈ 0.057 vs naive 0.025).
  • Emergent failure taxonomy & calibration: Human axial coding of 200 execution traces revealed 5 structural failure modes beyond transport limits; automated LLM judge calibration falsified high-agreement expectations (κ ≥ 0.70 on only 2 of 5 core modes).
Paper (PDF) Paper (Markdown) Executive summary

02 / FINDINGS INTO ENGINEERING

Four architectural translations from empirical evidence.
Project P12 Failure Attribution: Retriever vs Generator
PROJECT P12

Failure Attribution: Retriever vs Generator

For this workload, when the agent fails it is almost always because the search never surfaced a chain document — a stronger model does not fix that (R4 pilot: 3 of 3 failures also retriever-owned).

Disclosure: The retriever evaluated here is a deterministic case-insensitive substring matcher over document titles and text, not a chunked dense-embedding RAG pipeline.

PROJECT P10

Calibrated Cheap-to-Frontier Cascade

On this workload the cheap model is on the frontier and escalating to the frontier model buys one extra pass in thirty at twice the cost — consistent with P12, where failures were retriever-owned.

Disclosure: R4 same-model gateway drift across runs and dates is disclosed without post-hoc rationalization: 0.24 pass rate in P10 (24/100) vs 0.15 in P6 as-run (67/450) vs 7/10 in P12 pilot.

Project P10 Calibrated Cascade Pareto Frontier
Project P11 Release Gate Evaluation
PROJECT P11

Release Gate: Bands, Not Thresholds

A model upgrade cannot be judged against a fixed point threshold because serving variance shifts same-model pass rates across runs; candidate models must clear an empirical tolerance band graded by a deterministic oracle judge on a pinned golden set.

Disclosure: Historical baseline pass rates for the exact same R2 model ranged across runs from 0.6000 to 0.8667, demonstrating that fixed thresholds penalize benign serving variance.

PROJECT P09

Red-Team Regression: Mention is Not Compromise

Models frequently mention or quote injected adversarial text (up to 75% in answer_hijack) while correctly resolving the ground truth entity (79% benign accuracy); requiring oracle task failure separates true compromise from surface quoting and prevents dramatic over-reporting of vulnerability.

Disclosure: Across 400 live runs, RuntimePolicy deterministically enforced a 0.0% ASR invariant on all four structural attack categories by intercepting calls at the execution boundary.

Project P09 Red-Team Regression

03 / PROJECT BOARD

15 experimental projects under Master Experiment Contract.
IDProjectFocusStatusSpend
P01 BaselineGrounded multi-hop agent evaluation baselineComplete$0.14
P02 OTel ExporterOpenTelemetry GenAI semantic conventions & spansComplete$0.00
P03 Grounding Zero-PointMulti-hop depth grounding decay across T1–T3Complete$1.43
P04 Failure TaxonomyHuman-in-the-loop trace coding (8 failure modes)Complete$0.00
P05 Evaluator CalibrationLLM judge calibration & Rogan-Gladen correctionComplete$0.04
P06 Multi-Trial Reliabilitypass^k independence testing & failure clustering (Pub 01)Complete$23.73
P07 Serving VarianceTemperature-0 serving nondeterminism across providersComplete$1.20
P08 MCP DefenseClient-side runtime provenance contract on MCPTox (Pub 02)Complete$3.55
P09 Red-Team RegressionDocument-text injection suite, 10 categories, two arms; regressions as strict xfailsComplete$0.63
P10 Calibrated CascadeCheap→frontier router on deterministic signals; Pareto frontierComplete$4.67
P11 Release GateTolerance-band gate: sha256 golden set, pinned oracle judge, live upgrade drillComplete$1.84
P12 Failure AttributionRetriever-vs-generator ablation with oracle retrieval (H8)Complete$1.93
P13 SLO IncidentMulti-window burn-rate SLO alerting & incident triageComplete$0.00
P15 ResilienceAdaptive circuit breakers & jittered backoff policiesComplete$0.00
P16 Runtime PolicyDeterministic call allowlists, path containment, token capsComplete$0.00

04 / HOW THE EVIDENCE IS PRODUCED

SHA-256 provenance and pre-registered protocol governance.

02 / ORACLE

Deterministic Dual Oracle

Grounded answer verification uses deterministic normalization and verified citation hashes against a frozen corpus (SHA256 84e6ff590704aa94d10912f8002716b14c7436080e1a3270b53f9385dc728efc, master seed 42). Zero subjective model judges in the primary evaluation loop.

03 / GOVERNANCE

Cost & Rate Ledgers

Pinned model pricing, per-project budget caps, and append-only ledgers (ledger.jsonl) recording timestamp, model rung, prompt/completion token counts, and exact USD cost per inference call across all runs.

05 / CITE

Citation Metadata Format (CITATION.cff).
Cite this research workbench.
CITATION.CFF
cff-version: 1.2.0
message: "If you use this software or benchmark, please cite it as below."
title: "FAULTLINE: Research Workbench for Agent Reliability and Tool-Poisoning Defense"
abstract: "A reproducible research workbench for evaluating autonomous AI agent reliability under multi-trial execution and defending against Model Context Protocol (MCP) tool poisoning."
authors:
  - family-names: "Sawarkar"
    given-names: "Samir"
date-released: 2026-09-18
repository-code: "https://github.com/Faultline-lab/faultline"
license: "MIT"
version: "0.32.0"
type: software
MACHINE-READABLE SPECIFICATION

FAULTLINE publications and experimental benchmark artifacts are licensed under MIT and indexed via Citation File Format (CFF v1.2.0).

View CITATION.cff Repository Root Security Policy