Auditable Early Stopping for Agentic Routing: Ledger-Verified Run-Wise Certificates under Local DP

Shivam Akhauri

Keywords: LLM tool-use routing, perturb-and-MAP, best-first (A*) search, certified inference, local differential privacy, graph search on DAGs, large language models, auditing and reproducibility

TL;DR: We prove when a tool-use router can safely stop—and log a ledger so anyone can replay and verify the run.

Abstract:

\begin{abstract}
We study early stopping for best-first routing in tool-use agents under local differential privacy (LDP), with an auditable, validator-replayable ledger. Our key idea is a \emph{run-wise certificate}: we couple each node's key to the \emph{same} exponential race that realizes leaf perturbations, so the standard halting rule---stop when $\max_{v\in\mathcal{F}}\Key(v)\le B^{\ast}$, where $B^{\ast}$ is the incumbent realized leaf value---soundly certifies the realized run. We provide two certified modes on context-indexed prefix--DAGs whose children partition the leaf set. \emph{Exact} mode (known counts) implements lazy offset propagation with winner reuse; \emph{Surrogate} mode (upper bounds only) disables winner reuse and uses a parent-anchored surrogate race; keys are conservative online and can be tightened ex post by a validator via $\kappa=\log(N/\Nub)$. A small compiler enforces the partition property, and an admissible, race-independent $M_\tau$ keeps keys sound. A replayable ledger records uniforms, counts, and tie handling; privacy follows from post-processing. Experiments on synthetic graphs and a small real tool-use pipeline show tight stopping, deterministic replay, and low overhead.
\end{abstract}

Primary Area: other topics in machine learning (i.e., none of the above)

Submission Number: 5207