Writing

What an adversarial audit of my own evaluation instrument found

2026-09-03

I built an evaluation instrument to answer one question: when two AI delegates deliberate across an enforced context boundary — each holding only its own institution's context — do they produce a synthesis neither could reach alone, and can that synthesis be graded against a sealed target without the target leaking into the run? The instrument has the parts a real evaluation needs: rubrics committed before any run, sealed targets, a split-context arm and a single-context ablation, a leakage review of the case contexts, and a provenance export of every turn.

Then I had it audited by a separate model that did not know who built it, and verified every finding in the code myself. It found six defects. Two matter more than the others.

The first is a control that does not do anything. The sandbox has a framing field that is supposed to steer the delegates; it writes to a place no delegate ever reads. Everything the interface said about that control was true of the interface and false of the system. The fix is not to wire the field up — doing that would leak the sealed target into the graded runs — but to add a sandbox-only field. A stated control that is not effective is worse than a missing one, because it is trusted.

The second is a self-grading recorder. The specification requires the grader to be a different model or instance from the delegates and the recorder. In the build, both grader calls run on the recorder, so it grades its own recognition of the synthesis. Nothing in the run output would tell you. The fix is a fourth agent slot; until it ships, no Q1 result from this build should be read as independent.

The other four are the kind of thing registers exist for: a sealed target in one case that contradicts its own reasoning chain; a provenance export that reports a leakage review as not done when it ran; a metadata string that overclaims what a phase flag does; and a required ablation arm that was never built. Two further issues the audit missed turned up in the same verification pass — an intervention index that drifts in the provenance after the first spawn, and the understated review record.

What changed: the six defects and three decisions are in a versioned register that travels with the artifact and says the review was model-run. The drafted description of the instrument was rewritten so that every claim states what was built, what was found, and what has not been run. Q1 has not been run; when it is, the readout — a position on a spectrum, not a pass — goes in the register either way.

The lesson is not that the instrument was bad. It is that in assurance work the audit is the deliverable. An instrument that has been through one and carries its defects in public is more useful to a governance program than a clean-run claim, because the program can see exactly what it would be trusting.

Earlier writing

An essay on adversarial analysis and strategic tension (2025) is being migrated to this site; it reads today as a statement of audit disposition.