Blindfold: keeping audit coins secret from LLM agents

The paper points out that audit-based certification providing an upper bound on the violation rate of LLM agents also relies on a confidentiality property, namely that the audit coin must not affect the agent's view before an action is submitted, which the authors call pre-submission non-interference (PNI). The paper proves that PNI is both necessary and sufficient for unbiased certificates for adaptive agents, with worst-case bias (1-ε)D_A; leakage accumulates across steps, resources shared across turns open a channel whose size can be computed, and increasing the audit rate cannot restore validity. On the monitor the authors built, silent auditing does not change the output, but the added latency is exposed by tool timestamps and can be amplified by the agent; in experiments, a real LLM agent complied with an injection that mentioned a visible audit notice, and through this channel ordinary certificates failed on the measured labels, and post-hoc analysis showed that they also failed in one live run conducted according to a pre-registered schedule, whereas silent auditing restored the certificates. Using a fresh coin for each audited call can close this timing channel, and padding can only narrow it.