Hugging Face blog describes ProvenanceGuard checks for source attribution

The authors’ source-attribution problem

A claim can have supporting evidence and still name the wrong source. In a Hugging Face Blog post, the authors introduce ProvenanceGuard to address that problem in agents using the Model Context Protocol. They describe cross-source conflation as a failure in which evidence supports a statement somewhere, but the answer attributes it elsewhere. Their proposed check examines that connection between a claim and its attributed source.

According to the authors, ProvenanceGuard reads a captured record of an agent’s tool activity, including outputs and source identifiers, without retraining the agent. It separates the answer into claims, selects a relevant source, evaluates support and checks whether the attribution matches. The process produces a source verdict for each claim and a decision to allow or block the answer as a whole.

Reported testing and unresolved errors

The authors report testing against expert judgments on answers held apart from the system’s development data. Their account includes both a claim that passed despite experts judging it unsuitable to pass and supported claims that the system held for review or repair. Those reported errors mean a positive automated verdict cannot be treated as factual certification or as evidence that a human approved the answer.

In a controlled attribution test, the authors say they changed the named sources while keeping the supporting evidence intact, and the system detected every swap. They also acknowledge continuing difficulty distinguishing similar sources. Their discussion separates detecting a deliberately introduced attribution error from selecting the correct source when several candidates appear plausible; success on the former does not settle the latter.

What the paper adds to the results

Version 3 of the authors’ arXiv preprint, dated August 27, 2026, reports a held-out evaluation of 361 claims from 40 medical-agent traces. The verifier blocked 138 of the 139 claims that should have been blocked, but also blocked 67 of 222 supported claims. A review queue can therefore contain both real errors and supported answers.

In the harder multi-source test, exact-source accuracy was 50.3%; requiring both the source and its relation to match reduced accuracy to 22.9%. These are different metrics. In the full-trace repair experiment, 144 of 173 blocked answers ended in fallback text. Passing the verifier after repair is not proof that a useful, complete answer was recovered. The authors limit the evidence to the studied stack; we have not reproduced it.

Try the distinction with a fictional example

Imagine two fictional workshop notices: the blue notice lists 20 seats and the green notice lists 30. An answer that assigns 30 seats to the blue workshop contains a number found in the evidence, but attaches it to the wrong event. Keeping the two source labels visible makes the mistake easier to locate.

For your own reading, isolate one claim, open its named source and check that the supporting passage refers to the same subject, date and conditions. Record uncertainty if it does not. This is a reading exercise created by The Illustral, not a benchmark result or a demonstration of ProvenanceGuard.

Update history and evidence limits

Updated October 13, 2026 (UTC), following source review on the same date. Added the authors’ versioned technical paper, evaluation denominators and a fictional attribution exercise. The original announcement is a Multiverse Computing team post hosted on Hugging Face; hosting is not independent verification by Hugging Face. This article does not establish performance or safety in another deployment. The original publication date is retained.