Post-Audit Mirage: Identifiability Limits of Offline Agent Verification
The paper asks whether offline audits can reliably certify that an agent update will be safe once deployed. It formalizes the post-audit mirage by constructing matched safe and harmful lifecycles that expose byte-identical public evidence to the verifier while an isolated scorer records opposite deployment truth. The authors prove a non-identifiability theorem at this audit interface, instantiate it in an exact benchmark spanning authorization, scheduling, and shared-capacity environments, and propose a fail-closed monitor that uses fresh group-labelled harm outcomes to decide only when the evidence supports it. The core message is that correctness checks on fixed observations cannot substitute for missing deployment information.
The paper’s central argument—that offline observation equivalence prevents identification of deployment safety—is theoretically sound and carefully executed. Theorem 1 applies standard two-point indistinguishability to the audit interface, yielding the error-abstention tradeoff $\max\{P_{\mathrm{harm}}(A=\text{deploy}), P_{\mathrm{safe}}(A=\text{hold})\} \ge (1-r)/2$. The benchmark makes this boundary executable across three synthetic environment families, and the authors forthrightly limit scope: the benchmark constructs exact observation equivalence and does not estimate its production prevalence or monitor success. The monitor design is conservative and transparent about its assumptions, though its practical utility is sharply constrained by the difficulty sweep results.
The matched-world construction is rigorous and thoroughly verified. Across 272 safe-harmful pairs and 50 rounds per pair, the authors confirm that all 13,600 public inputs match byte for byte, protected truths reverse, and all nine offline procedures return identical paired sequences when given the same random draws. The IdentifiedRangeMonitor is a principled fail-closed method: it deploys only when every required group’s upper bound is safe, holds when any lower bound is harmful, and otherwise returns cannot determine or unsupported. The reproduction package is unusually complete, including independent JavaScript scorers, frozen synthetic records, and exact commands.
The central theorem is an application of standard results rather than a new theoretical advance, a limitation the authors acknowledge. Empirically, the evaluation is confined to synthetic environments with prespecified binary harm outcomes and fixed group structures. The controlled difficulty sweep shows that the monitor remains undecided in 14 of 18 inspected cells even after 20,000 attempted observations, suggesting limited practical traction for rare groups, small effect sizes, or incomplete retention. Additionally, the monitor cannot detect undeclared groups, missing-not-at-random outcomes, or target shifts, which substantially narrows its real-world applicability.
The evidence supports the identifiability claim without overreaching. The fixed-panel restoration shows zero false-safe lifecycles at 20,000 observations, but the authors explicitly caution that this is a descriptive result on a fixed synthetic panel, not a population error-rate estimate. Comparisons to related systems—SGM, PACE, SEA, SEAL, and SEA-Eval—are presented fairly as orthogonal lines of work; the authors note that their nine diagnostic rules are local abstractions and are not faithful reproductions of complete external systems. The distinction between pointwise Wilson intervals and anytime-valid confidence sequences is handled correctly.
Reproducibility is exemplary. The paper provides exact random seeds, monitoring thresholds, sample sizes, aggregation rules, and machine specifications, and it releases a complete open-source package. The only barrier to independent reproduction is the custom synthetic benchmark itself; there is no dependence on proprietary data, GPUs, or external model services. The authors even report a reference runtime on a specific CPU configuration and state that earlier exploratory runs are excluded.
Offline tests can fail to reveal whether an agent update will remain safe after deployment. We operationalize this post-audit mirage using matched safe and harmful lifecycles that expose identical verifier-visible evidence while an isolated scorer records opposite deployment truth. Our theorem applies standard observational-equivalence and indistinguishability ideas to this executable audit boundary and states the resulting error-abstention tradeoff. The Post-Audit Mirage benchmark makes that boundary executable across authorization, scheduling, and shared-capacity environments. IdentifiedRangeMonitor uses fresh group-labelled harm outcomes to return deploy, hold, cannot determine, or unsupported. Experiments show that monitoring can recover the missing distinction in favorable settings but may remain undecided for rare groups, small effects, or missing observations. Verifier-agent evaluation must therefore test both calculation validity and whether the available evidence supports the deployment decision.
Pick a starting point or write your own. Challenges run in the background, so you can keep reading while the AI investigates.
No challenges yet. Disagree with the review? Ask the AI to revisit a specific claim.