Decision Dependence Graph (DDG)

• Decision Dependence Graph (DDG) is a graph abstraction that represents how discrete decisions rely on artifacts, states, and prior choices.
• It employs both deterministic provenance via decision-valued maps and empirical, attention-based influences, facilitating reproducibility and audit trails.
• DDGs enhance security in LLM systems by detecting anomalous tool influences and supporting decision-level integrity through structured dependency analysis.

A Decision Dependence Graph (DDG) is a graph-based representation of how a discrete decision depends on underlying artifacts, states, or prior choices. In one formalization derived from a decision-valued map, a DDG is a graph whose nodes are snapshots, representations, engine runs, decisions, and policies, and whose edges encode the deterministic dependencies through which representational choices lead to discrete decision identities (Raitses, 11 Feb 2026). In an explicit formulation for LLM agents, DDG is a weighted, directed graph $\mathcal{G}=(\mathcal{V},\mathcal{E},w)$ in which vertices represent logical concepts and edges quantify attention-based dependencies for tool invocation decisions (Wang et al., 28 Aug 2025). These usages differ in ontology and construction, but both treat decision provenance as a graph object that can be audited, queried, and analyzed.

1. Scope and principal senses of the term

The term “Decision Dependence Graph” does not appear in “On Decision-Valued Maps and Representational Dependence,” but the paper’s formalism and the DecisionDB infrastructure can be used directly to define and construct such a graph (Raitses, 11 Feb 2026). By contrast, “MindGuard” introduces DDG explicitly as a decision-level provenance graph for LLM tool-calling under the Model Context Protocol (Wang et al., 28 Aug 2025).

Setting	Nodes or domain	Dependence relation
Decision-valued maps	snapshots, representations, runs, decisions, policies	$f(r)=\pi(E(r))$ and provenance edges
LLM tool-calling	user query, tools, prior results, invoked tool name, invocation arguments	weighted directed attention-based influence
Older graph-based lineages	players, statements, states, or layered DD states	functional, control, or state-transition dependence

A broader lineage also exists. In strategic games, a fixed dependency graph constrains which players’ payoffs may depend on which strategies, and functional dependence is expressed as $A \rhd B$ over Nash equilibria (Harjes et al., 2013). In program analysis, the control dependence graph is the $C$-edge subgraph of a program dependence graph and represents how decisions govern executability of statements (Ito, 2018). In discrete optimization, decision diagrams are directed acyclic graphs whose nodes are states summarizing past choices and whose arcs are feasible next decisions; the paper on unsplittable network flow explicitly notes that such DDs can be viewed as decision dependence graphs specialized to the problem class (Salemi et al., 2023).

This suggests that “DDG” is best understood not as a single canonical object but as a family of graph abstractions whose common purpose is to make decision dependence explicit.

2. Formal models of decision dependence

In the representational-dependence framework, the central object is the decision-valued map

$f \colon \mathcal{R} \to \mathcal{D},$

where $\mathcal{R}$ is a family of representations of a fixed snapshot $s$, and $\mathcal{D}$ is a set of discrete decision identities (Raitses, 11 Feb 2026). For each representation $r\in\mathcal{R}$, a fixed engine $E$ produces raw output $f(r)=\pi(E(r))$0, and an equivalence policy $f(r)=\pi(E(r))$1 reduces that output to a discrete identity

$f(r)=\pi(E(r))$2

so that

$f(r)=\pi(E(r))$3

The same paper defines a snapshot as “a frozen slice of external inputs over a declared time window” and a representation as “a deterministic encoding of $f(r)=\pi(E(r))$4, defined by explicit structural choices such as kernels, thresholds, weighting rules and aggregation policies.” Representation space may be parameterized by $f(r)=\pi(E(r))$5 with a factory mapping $f(r)=\pi(E(r))$6.

The structure of $f(r)=\pi(E(r))$7 induces persistence regions, boundaries, and fractures. Persistence regions are connected subsets of $f(r)=\pi(E(r))$8 over which $f(r)=\pi(E(r))$9 is constant; boundaries are loci where $A \rhd B$0 changes value; fractures are boundaries where a small change in representation parameters induces a discrete identity change. The same framework treats reuse as a mechanically checkable condition:

$A \rhd B$1

In MindGuard, DDG is formalized directly as

$A \rhd B$2

with

$A \rhd B$3

and

$A \rhd B$4

where $A \rhd B$5 is the user query vertex, $A \rhd B$6 contains one vertex per registered tool, $A \rhd B$7 contains vertices for execution results of previous tool calls, and $A \rhd B$8 contains the target vertices for the invoked tool name and invocation arguments (Wang et al., 28 Aug 2025). The graph is decomposed into a control-flow subgraph targeting $A \rhd B$9 and a data-flow subgraph targeting $C$0. Edge weights are derived from attention by Total Attention Energy,

$C$1

The two formalisms differ in epistemic status. The decision-valued-map framework is exact with respect to the declared arena $C$2; the attention-based DDG is an empirical influence model. This suggests two broad classes of DDG: one grounded in deterministic provenance and equivalence policy, the other grounded in signal extraction from an internal model mechanism.

3. Provenance, persistence, and DecisionDB

DecisionDB is designed to materialize and audit the decision-valued map (Raitses, 11 Feb 2026). Every core entity in the schema—snapshot, representation, engine run, decision, and the composite $C$3—has a content-addressed primary key. The construction is: payload (Python dict) $C$4 canonical JSON $C$5 SHA-256 digest, with identifiers of the form

$C$6

The paper gives the corresponding identifiers $C$7, $C$8, $C$9, $f \colon \mathcal{R} \to \mathcal{D},$0, and $f \colon \mathcal{R} \to \mathcal{D},$1, and defines the composite $f \colon \mathcal{R} \to \mathcal{D},$2 entry as

$f \colon \mathcal{R} \to \mathcal{D},$3

The paper describes this as the “materialized decision-valued map linking representations, runs and decisions.”

Deterministic replay verifies that the pipeline from raw output to decision identity is reproducible. Given a persisted decision record, replay loads the raw output artifact and policy spec, recomputes policy ID, payload hash, and decision ID, and verifies

$f \colon \mathcal{R} \to \mathcal{D},$4

Replay leaves the database unchanged. Matching identifiers certify that the dependence chain is deterministic and auditably reproducible.

On this basis, a DDG can be read as a dependency or provenance graph: snapshot $f \colon \mathcal{R} \to \mathcal{D},$5 representation, representation $f \colon \mathcal{R} \to \mathcal{D},$6 run, run $f \colon \mathcal{R} \to \mathcal{D},$7 decision, with optional policy nodes. The same framework also supports a graph on representation space itself. If adjacent representations are connected in a graph $f \colon \mathcal{R} \to \mathcal{D},$8, then a persistence region for decision $f \colon \mathcal{R} \to \mathcal{D},$9 is a connected component of the induced subgraph on $\mathcal{R}$0, while a boundary edge is any $\mathcal{R}$1 with $\mathcal{R}$2.

The routing demonstration in the paper gives a concrete instance. The arena uses a fixed snapshot consisting of a directed graph with 564 nodes and fixed edge attributes, a Dijkstra shortest-path solver with fixed configuration, and a fixed origin 85 and destination 50. Representation parameters are neighbor weight $\mathcal{R}$3 and second-order weight $\mathcal{R}$4, producing four graph encodings. Decision identity is defined by exact node sequence equality. The sweep shows that changing neighbor weight from $\mathcal{R}$5 to $\mathcal{R}$6 preserves Decision A with 16 nodes, whereas changing second-order weight from $\mathcal{R}$7 to $\mathcal{R}$8 changes the decision from A to B and the route length from 16 to 14 nodes. In the paper’s terms, the neighbor-weight axis exhibits a persistence region, while the second-order-weight axis exhibits a boundary and a fracture.

Operationally, this makes reuse a graph property. If two representation nodes map to the same decision node, reuse is admissible; if they are separated by a boundary, reuse requires renewed justification.

4. LLM decision-level security and attention-based DDGs

MindGuard introduces DDG in the context of Tool Poisoning Attacks against MCP-based LLM agents (Wang et al., 28 Aug 2025). The central claim is that the attack is in the reasoning rather than in the observable behavior of malicious tools: poisoned tools need not be executed, leaving no behavioral trace to monitor. The system therefore aims at decision-level security rather than behavior-level monitoring.

The graph is built by a Context Parser and a DDG Builder. Source vertices correspond to the user query, each tool’s description and arguments prompt, and previous execution results; target vertices correspond separately to the invoked tool name and the invoked arguments. The separation of $\mathcal{R}$9 and $s$0 is deliberate: tool choice reasoning produces subtle, distributed attention patterns, while argument values often involve direct copying with strong, localized attention. The DDG Builder combines layerwise attention by a Gaussian-weighted sum, removes attention sinks through a two-stage filter, partitions the filtered matrix by token spans, and assigns edge weights by Total Attention Energy.

Detection is based on anomalous influence from an uninvoked tool. The paper first states a threshold rule of the form

$s$1

and then introduces the Anomaly Influence Ratio

$s$2

An edge is anomalous if $s$3. The numerator is influence from an uninvoked tool; the denominator is the combined influence from the user query and the invoked tool’s own description. This relative normalization is used because absolute thresholds vary across heterogeneous MCP servers.

The same graph supports attribution. When an invocation is flagged as poisoned, the anomalous source is the uninvoked tool vertex with the highest AIR or the one exceeding threshold. The paper also maps classical program-analysis policies onto the DDG: control-flow integrity is checked on edges to the invoked tool name vertex, and data-flow integrity is checked on edges to sensitive argument vertices. The paper explicitly states that DDG can be viewed as an adaptation of the classical Program Dependence Graph, providing a basis for applying traditional security policies at the decision level.

Empirically, the abstract reports 94\%–99\% average precision in detecting poisoned invocations, 95\%–100\% attribution accuracy, processing times under one second, and no additional token cost. The detailed results report detection accuracy $s$4 of 89–99\% with average approximately 95\%, AP of 81–98\%, AUC of 90–99\%, and attribution accuracy $s$5 of 95–100\%. Ablations show substantial degradation without sink filtering, with one-stage filtering only, with sum aggregation instead of TAE, and with a unified output vertex.

The paper is explicit about limitations. Attention is treated as a practical signal for tracking tool invocation decisions, without requiring perfect causal interpretability. It also notes possible adaptive attacks that minimize attention activation, the need for access to internal attention maps, and the current focus on single-step tool decisions.

5. Lineages in games, program dependence, and decision diagrams

A game-theoretic lineage appears in the study of functional dependence in strategic games (Harjes et al., 2013). For a game over a dependency graph $s$6, the atomic formula $s$7 means that for all Nash equilibria $s$8,

$s$9

The graph constrains payoff functions by requiring that $\mathcal{D}$0 depend only on strategies in $\mathcal{D}$1. The logic consists of Reflexivity, Augmentation, Transitivity, and a graph-specific Contiguity axiom involving graph cuts and border sets $\mathcal{D}$2. Soundness and completeness show that this system captures exactly the functional dependency formulas valid over all games respecting the graph. In a DDG reading, the graph gives structural dependence, while $\mathcal{D}$3 expresses equilibrium-level decision determination.

A program-analysis lineage appears in the operational semantics of program dependence graphs (Ito, 2018). A PDG is a quintuple $\mathcal{D}$4 whose edge sets represent control dependence, loop-independent data dependence, loop-carried data dependence, and def-order dependence. The subgraph $\mathcal{D}$5 is the control dependence graph. Executability is determined by active control edges and satisfied incoming dependences; conditional nodes activate either true or false control edges. Deterministic PDGs are defined by three structural conditions ensuring unique final states of executions, and the paper proves that the operational semantics of control flow graphs is equivalent to that of deterministic PDGs. In this lineage, a DDG is essentially the control dependence layer of the PDG, equipped with a semantics of branch activation.

An optimization lineage appears in decision diagrams for unsplittable network flow (Salemi et al., 2023). A decision diagram $\mathcal{D}$6 is a directed acyclic graph with layered nodes, root and terminal, and arc labels representing variable values. For the stochastic unit train scheduling problem, the master problem is encoded in transformed variables $\mathcal{D}$7 rather than binary matching variables $\mathcal{D}$8, and the DD state records which outgoing-arc indices remain available. If a node has state $\mathcal{D}$9 and an outgoing arc label $r\in\mathcal{R}$0, the successor state is

$r\in\mathcal{R}$1

This directly encodes no-split/no-merge constraints as state-dependent admissibility of later decisions. The paper’s DD-BD framework couples this layered graph with Benders subproblems that generate cuts to refine the master DD, and computational experiments show a significant improvement in solution time of the DD framework compared with that of standard methods.

Taken together, these lineages situate DDG within a broader graph-of-dependence tradition: logical determination in equilibria, control dependence in programs, and state-dependent admissibility in layered decision graphs.

6. Limits, disambiguation, and research significance

The decision-valued-map framework has explicit scope conditions (Raitses, 11 Feb 2026). It requires an equivalence policy that reduces outputs to discrete identities, so continuous metrics are out of scope unless discretized. Each DDG is defined in a fixed arena: snapshot $r\in\mathcal{R}$2, engine $r\in\mathcal{R}$3, and query. The observed decision-valued map is evaluated only at declared points in representation space, so unsampled regions are unconstrained. The policy $r\in\mathcal{R}$4 determines what counts as the same decision, and different policies yield different DDGs. The current implementation is SQLite-based and tested with small representation families.

The attention-based DDG in MindGuard has a different limitation profile (Wang et al., 28 Aug 2025). Attention is not claimed to be a strict explanation; adaptive attacks that minimize attention activation remain a concern; deployment requires access to internal attention maps; and the present scope is MCP tool-calling with future work aimed at multi-turn attacks and alternative signals beyond attention.

A terminological ambiguity also matters. In algebraic graph theory, “DDG” commonly abbreviates “divisible design graph,” a $r\in\mathcal{R}$5-regular graph whose vertex set can be partitioned into $r\in\mathcal{R}$6 classes of size $r\in\mathcal{R}$7 such that two distinct vertices from the same class have exactly $r\in\mathcal{R}$8 common neighbors and two vertices from different classes have exactly $r\in\mathcal{R}$9 common neighbors (Panasenko et al., 2021). That usage belongs to symmetric divisible designs, Deza graphs, and algebraic combinatorics rather than decision provenance or decision-level security.

Across the decision-oriented usages, the durable idea is the same: a decision is not treated as an isolated output but as the endpoint of a structured dependence relation. Whether the dependence is exact and content-addressed, empirical and attention-weighted, logical over equilibria, semantic over program branches, or state-based in a layered DAG, the DDG serves to externalize decision provenance into a graph form that supports auditing, equivalence testing, boundary detection, or constrained optimization.