PACEGuard: Minimum Evidence-Cut Auditing for Polluted-Evidence Fragility in LLM SOC Agents

Abstract

LLM-assisted SOC agents can base verdicts and high-impact actions on polluted or weak-lineage evidence. We frame this dependence as a graph intervention problem. PACEGuard wraps an LLM SOC reasoner with MECI, which searches for the lowest-cost structurally valid evidence cut that changes a verdict, citation set, or action. The resulting empirical fragility score routes cheap-to-flip cases to sanitization or review, while respecting source boundaries, lineage, temporal order, semantic retrieval, and independent corroboration. We separate a formal property for an additive bounded-influence model from the measured black-box score.

On a fixed-seed benchmark with 2,400 clean cases and 12,000 polluted variants, PACEGuard lowers attack success rate (ASR) to 4.35% under 20% pollution and 10% missing-source stress, versus 9.32% for the strongest runtime re-execution baseline. Under a matched 38.87% review budget, post-review ASR is 2.54% versus 5.19%. Unseen-template and LANL deterministic-profile replays preserve the advantage. In a 400-case LANL replay on each of two provider-returned LLMs, PACEGuard has no observed ASR or poisoned-citation events among 200 polluted cases per model (0/200; 95% one-sided exact upper bound 1.49%), with 0-0.75% review. Parameter and seed/temperature sweeps show the same observed zero-event outcome; these are finite-suite measurements, not evidence of zero deployment risk.

Equal contribution: Zhaoxuan Zhang and Yuankun Zhang contributed equally to this work and share first authorship.

Corresponding author: Zhaoxuan Zhang (zhangzhaoxuan@mail.ncut.edu.cn).

All authors are affiliated with North China University of Technology, Beijing, China.