BiCP: Reasoning-Prefix Deconfounding for Dual-Axis Counterfactual Probing and Operation-Risk Routing

Abstract Tool-using language-model agents can select the intended tool while executing an injected argument. Counterfactual guards also lose source sensitivity when they condition on reasoning that already encodes the injected decision. We present BiCP (bilateral counterfactual probing), an execution-time defense combining reasoning-prefix removal, complementary tool-name and complete-call probes, and operation-risk routing. Equal-token controls over 69 fixed proposals raise tool-name macro area under the receiver operating characteristic curve from 0.7164 to 1.0000. On these fixed proposals, a second model family (Mistral-7B-Instruct-v0.3) independently reproduces both prefix deconfounding (0.6509 to 1.0000) and five-domain source reversals (joint p = 0.03125). After independent calibration, progressive component ablations on 922 fixed replay cases reduce confirmed InjecAgent attacks from 83/682 to 0/682 and unsafe conditional executions from 33/240 to 0/240, while increasing benign task success from 66/120 to 78/120. All five malicious argument substitutions adopted by the original model are blocked. A paired prompt-contract comparison increases the unchanged policy's retention of verified legal protected calls from 30/47 to 43/47. Among 47 paired attack proposals, deterministic anchoring stops 40 unsupported substitutions, while both probe variants stop all seven observation-supported injected targets. Complete-call prefix slicing yields a 1.95-1.96-fold scoring-stage speedup on T4 graphics processing units; authorized discovery requires no additional model forwards. Together, these findings demonstrate that deconfounded dual-axis probing and deterministic evidence anchoring provide practical, complementary execution-time protection with a positive net security-utility gain.