BeTaL-GBI: Admission-Aware Benchmark Tuning and Full-Stack Verification of Geometric Belief Interfaces

Alvin Spivey; Yu Huang

Source-linked AI summary

BeTaL-GBI: Admission-Aware Benchmark Tuning and Full-Stack Verification of Geometric Belief Interfaces

Alvin Spivey, Yu Huang

arXiv:2608.21503v1Aug 21, 2026cs.SEcs.CRcs.LG

TL;DR

The study addresses verification systems that can reject malformed outputs while leaving their own numerical or semantic failures unexamined. It makes runtime admission depend on authoritative witness state and policy, then shows that repair makes interface behavior measurable while diagnostic and deployment boundaries remain explicit.

Problem
The study targets verification systems that may catch malformed model output without completing the verification loop on their own claims.
Method
GBI v2 represents runtime admission through authoritative grounding state W, versioned evidence, provenance ledgers, and declared policy P rather than a hidden benchmark answer key.
Results
Repair made malformed output measurable, while GBI v2’s policy design targets simultaneous refusal of severe contradictions and admission of clean records.
Takeaways & Limitations
The verification substrate is framed as self-auditing when it applies the same claim-checking discipline to its own architecture and runtime decisions.
Takeaways & Limitations
The latency result is CPU-only rather than an enclave measurement, and the evaluation demonstrates algebraic behavior rather than clinical correctness.

Abstract

from arXiv · show

A verification substrate is more credible when exposing errors in its own claims, not just model outputs. GBI-DCSE v3 falsified an architectural claim: the reported Fisher value epsilon ~ 0.066 satisfies the kappa^2 <= 10^4 budget only on the slice [epsilon, 3, 4, 5], while the full box [epsilon, 20]^4 requires epsilon ~ 0.326472. This erratum highlights whether an enterprise verification architecture can isolate interface failure, task competence, policy admissibility, and control integrity while keeping claims auditable. BoundaryBench v0.1 established the baseline: Qwen3-4B-Instruct-2507 completed 768 frozen executions, but 0% cleared the contract (369 failed parsing, 399 failed validation), limiting downstream selectivity metrics. This companion study evaluates three successive improvements. First, BeTaL-GBI v0.2 applies Benchmark Tuning with an LLM-in-the-loop over 2,218,750,380 grid points, separating format admission from conditional performance (rho_adm = N_admitted/N; rho_task = N_verified/N_admitted). Following schema repair, a model-free feedback search achieves a 2.87% mean held-out target gap, outperforming non-feedback baselines (13.61%, 11.46%). Second, GBI v2 swaps static keys for a reference-independent witness state W and policy P. Across 512 synthetic tasks, a 16-gate policy detects all 116 injected severe contradictions and accepts all 99 clean records (broad denominator: 4.27%). Hallucinator and evidence-forger surrogates are blocked with zero silent promotions. Third, GBI-DCSE v3 maps 99 claims to machine-readable evidence: 95 of 96 testable claims pass, with 148 standalone checks executed without failure. The harness exercises signed ledgers, PBFT quorums, and enclave forgery across 62 configurations. Under synthetic conditions, GBI-DCSE is a selective, policy-versioned, self-auditing test and routing substrate.

1 From fail-closed containment to self-auditing verification

The companion study extends fail-closed containment into self-auditing verification: it tests whether the substrate can expose falsified claims while separating interface failure from downstream verification. Its evidence remains bounded to synthetic evaluation and does not establish production, clinical, or frontier-model claims.

Design rule: The architecture treats model outputs as evidence rather than authority, with deterministic checks governing whether proposals may proceed.Checks cover identity, provenance, schema, temporal validity, dependencies, evidence, and policy.
Self-auditing verification: ϵ ≈0.066 satisfies the Fisher condition only on the stated slice, while the stronger box-wide criterion requires correcting the architectural claim.The verifier reproduced the slice value, evaluated the manuscript’s box-wide criterion, and retained the discrepancy as an ERRATUM.
Operational stakes: The evaluation uses illustrative, institution-specific healthcare boundary cases to show how W and P can govern EHR writes without making treatment recommendations.The examples ground abstract verification objects while remaining synthetic and non-clinical.
Baseline failure: 0% of 768 BoundaryBench v0.1 executions cleared the admissibility contract: 369 were parse rejects and 399 were schema rejects.The frozen experiment showed malformed or schema-invalid proposals did not silently become downstream actions, but zero coverage prevented selectivity claims.
Open questions: The zero-coverage result leaves task difficulty, selective risk, and untested architectural controls unresolved.A system that refuses everything can catch bad items vacuously while lacking operational utility; v0.1 did not test ledger, attestation, BFT, atomicity, receipts, or portability claims.
Study progression: The later evaluations are non-vacuous under declared synthetic populations, permitting eligible work, refusing severe contradictions, replaying decisions, and classifying unsupported or falsified claims.These results concern the verification substrate rather than frontier-model capability, because v0.2–v3 execute no language model.

2 Objects, notation, and evaluation boundary

The architecture separates candidate state, authoritative witness state, evaluation references, and versioned policy so runtime admission is independent of benchmark answer keys. Its evidence labels and executable predicates define what the synthetic evaluation can claim.

GBI/DCSE state: The enterprise state includes boundary algebra, semantic bundles, evidence registry, candidate state, witness state, ledger, and runtime policy.GBI v2 makes authoritative evidence and declared policy explicit as the basis for runtime admission.
Policy object: The policy instance is pinned by identifiers including policy ID, version, effective time, authority, and hash.Its operational components include actions, gates, thresholds, dependencies, human authority, quarantine, recovery, liveness, exceptions, and failover.
Operational grounding: In the healthcare examples, P determines whether missing or conflicting evidence requires review rather than commit, while clinical authority remains external to the mathematical object.GBI tests and executes an authorized institution’s policy rather than inventing clinical judgment.
Deployment predicate: The runtime predicate maps verified state to actions such as admission, quarantine, abstention, review, or rejection.The policy mapping must remain independent of benchmark answer keys to represent a plausible runtime gate.
Truth roles: W plus versioned P provide the runtime truth surrogate, while a synthetic generator/reference state measures agreement after gating.The two truths therefore serve different roles: admission control versus post-gate evaluation.
Reference independence: A shuffle test left all 512 gate verdicts unchanged after randomly permuting all 512 reference actions.Together with an abstract-syntax-tree probe, this shows the executable admission decision does not secretly use the answer key.
Evidence labels: The evidence register distinguishes reproduced, measured, synthetic, structural, proxy, out-of-scope, and erratum claims.These labels make the evidentiary status of each registered claim explicit and first-class in v3.
Evidence labels: An ERRATUM records an executable assertion that contradicts a numerical statement in the architecture manuscript.The labels become first-class in the v3 claim register.

3 BeTaL-GBI v0.2: benchmark tuning at an admission boundary

BeTaL-GBI v0.2 makes benchmark difficulty measurable only after admission is non-degenerate, separating interface admission from conditional task performance. After schema repair, it evaluates feedback-driven search and diagnostic controls across a large, versioned parameter space.

Admission-aware objective: BeTaL-GBI adds an admission-aware objective because task performance cannot be measured when structured outputs fail the format gate.The formulation distinguishes admission rate from task performance among admitted outputs, with an admission floor of 0.05.
Parameter space: 2,218,750,380 grid points define a nine-dial, inspectable, versioned environment, while the implemented search explores only a small path and local coordinate neighborhood.The dials cover eight BoundaryBench task families plus one global action-space distractor.
Evaluation design: The designer, target, and verifier remain separate, preventing proposed configurations from becoming ground truth and separating target competence from benchmark difficulty.The v0.2 artifact evaluates a deterministic feedback-coordinate controller and two non-feedback baselines without executing the BeTaL LLM designer.
Degenerate-gap result: 0% admission across five v0.1 probes reproduced the frozen boundary-floor split, with 369 parse rejects and 399 schema rejects across 768 executions.Each search attempt halted after one of ten budgeted iterations, selected no configuration, and reported task performance as undefined.
Search after format admission is restored: Feedback search has the best mean held-out gap across four target levels and is substantially better near the high-performance edge, although Best-of-N wins two individual cells.The artifact reports repeated proposals in at least one hard-level run, wasting part of the deterministic reference designer’s search budget.
Diagnostic controls: 2 local monotonicity violations across 24 consecutive dial steps were attributed to finite-sample variation, with monotonicity tested rather than imposed.At N = 256, the implementation did not silently force a monotone fit.

4 GBI v2: from refusal to selective external-validity gating

GBI v2 replaces vacuous refusal with witness- and policy-grounded admission, testing whether the gate can reject severe contradictions while admitting clean work. Its declared policy exposes strictness and denominator tradeoffs under synthetic adversaries and quarantine semantics.

4.1 Why v0.1 was insufficient as a positive substrate result: GBI v2 tests simultaneous refusal of syntactically valid severe contradictions and admission of clean, policy-compatible work.The hidden reference is used only after the runtime decision, while admission depends on witness state W and policy P.
4.2 Interface admission: A deterministic repair stage applies only declared syntactic transformations and refuses truncated or non-object outputs requiring invented semantic content.Sixty truncated payloads and seventy non-object answers remain unrepaired.
4.5 Adversarial containment: Zero silent promotions are observed against two distinct synthetic adversaries, supporting the implemented gate under the declared attack classes.The result does not establish protection against arbitrary hallucinations or adaptive attackers.
4.6 Clinical-style scorecard and denominator discipline: The selected strictness is 0.6, with five of five measurable targets met and one TEE-dependent target out of scope.The reported latency is CPU-only deterministic-check timing, not enclave measurement.
4.7 Strictness and the visible operating boundary: The broader false-conflict denominator gives 5/117 = 4.27%, while strictness 0.7 raises the clean-record rate to 18.18%, revealing a declared operating boundary.The narrow predeclared denominator reports 0.0%, and the strictness frontier is shown in Figure 3.

5 Mathematical validation and the discovered Fisher-bound erratum

The mathematical validation expands the original checks and discovers that the reported Fisher threshold is valid for a one-dimensional slice but not for the declared evidence box. The study records this as an erratum while preserving the underlying continuity claim.

5.1 Expanded mathematical validation: GBI v2 stress-tests a 64-element Boolean algebra over 65,536 randomized operations, checking eleven laws per operation with zero violations.The expanded suite also evaluates the declared Fisher corners and adversarial near-boundary probes.
5.1 Expanded mathematical validation: The mapping-cone implementation verifies all eight agreement patterns, the chain condition, symmetry, positive semidefiniteness, and basis-rotation invariance.Worst symmetry residual is 0, the minimum eigenvalue is approximately −5.39 × 10^-32, and energy rotation drift is approximately 1.11 × 10^-15.
5.2 The one-dimensional bound was not a box-wide guarantee: The reported ϵ ≈ 0.066 threshold is correct for the stated slice but does not satisfy the stronger corner-sweep requirement over [ϵ, 20]^4.At that value, the worst corner exceeds the declared condition-number budget by about 48 times.
5.2 The one-dimensional bound was not a box-wide guarantee: The corrected box-wide lower bound depends strongly on the ceiling and is used in the v2/v3 scorecard.The paper characterizes the issue as an erratum to a numerical implication, not a refutation of finite conditioning on compact evidence boxes.
5.3 Self-correction: The claim register preserves the original statement, records the corrected bound, and excludes the Fisher implication from the met count.This makes the failed assertion visible within the claim-to-evidence process.

6 GBI-DCSE v3: evaluating the full testable architecture

GBI-DCSE v3 converts the architecture into an executable claim register and evidence-verification harness. It reports high registered-claim coverage while explicitly separating reproduced values, verifier behavior, errata, and out-of-scope assertions.

6.1 Claim register and coverage: The v3 register maps 99 manuscript claims across Sections 1–12 and Appendices A–B to evidence classes, resolvers, criteria, and artifact evidence.Its distribution includes 16 REPRODUCED, 51 MEASURED, 5 MEASURED SYNTH., 22 STRUCTURAL, 1 PARTIAL PROXY, 3 OUT OF SCOPE, and 1 ERRATUM.
6.1 Claim register and coverage: Ninety-five of 96 testable registered claims meet their declared acceptance criteria, while three claims remain out of scope and one Fisher statement remains an erratum.The evidence classes are part of the evaluation design rather than an afterthought.
6.1 Claim register and coverage: The register integrity checks enforce unique identifiers, reconciled counts, explicit scope handling, and non-silent resolution of missing values.The only unmet testable claim is the Fisher-bound erratum.
6.2 Appendix A and previously untested GBI claims: The evaluator independently recomputes the numerical appendix, passing eleven self-check assertions and reproducing 21 published numerical values.Additional checks cover Fisher conditioning, perturbation response, entropy rows, truncation divergence, Boolean homomorphisms, and chart safety.
6.2 Appendix A and previously untested GBI claims: Exhaustive Boolean-homomorphism checks over 4,096 pairs produce zero violations, while a driven two-state system crosses category boundaries twice with entropy at least 0.665 nats.All four higher-dimensional chart safety checks are also exercised.
6.3 Evidentiary perimeter: The implemented evidence perimeter is bounded to synthetic, declared threat and integrity tests rather than arbitrary adaptive attacks or real-world institutional truth.The framework does not establish clinical safety, production readiness, institutional-policy correctness, or robustness to arbitrary adaptive attackers.

7 The DCSE systems layer

The DCSE systems layer verifies signed records, attestation, consensus, sparse certificates, transactions, receipts, and policy-bound claims through deterministic checks and fail-closed controls. Synthetic tests expose both successful verification and explicit limits on identity truth, hardware attestation, network operation, clinical correctness, and zero knowledge.

Ledger and attestation: Seven injected ledger fault classes are correctly detected and classified, while fallback triggers halt authoritative writes.Clean ledgers remain non-equivocating, and the clean fast path permits writes as a non-vacuity control.
Ledger and attestation: Equivocation is publicly checkable, but ledger consistency does not establish identity truth.A structurally valid ledger binding the wrong identity preserves the distinction between provenance and entity matching.
Ledger and attestation: Seven attestation failure cases deny the governed write path through distinguishable checks rather than a catch-all failure branch.The modeled cases include unlisted measurements, revoked platform keys, and downgraded TCB versions.
Transactions, receipts, and scope: The implementation does not include a hardware root of trust, hardware enclave measurement, clinical validation, or a zero-knowledge proof system.Measured timings are CPU-only proxies, and the proposed 2.5second attestation bootstrapping target remains out of scope.
Consensus and enclave verification: Across 62 PBFT-style configurations, safety and bounded progress hold, the write path halts below quorum, and an unsafe split appears at f + 1 Byzantine participants.The evaluation exhausts the modeled state space but is not a running BFT network and makes no latency or throughput claim.
Consensus and enclave verification: Spectral-moment checks reject an under-claimed kernel that residual checking alone accepts with a worst residual around 2.28 × 10^-15.An honest dense solver certificate is accepted and nine forgery classes are rejected, showing that the second certificate half is load-bearing.
Transactions, receipts, and scope: The synthetic implementation demonstrates atomic rejection, with no bad-bundle commit, byte-identical store digests, preserved unrelated records, structured errors, and audit recording.Independently scoped work can be quarantined before transaction construction while each transaction remains all-or-nothing.
Transactions, receipts, and scope: Fourteen of fourteen decisions are reproduced from replayable receipts, with tampering detected and policy and terminology versions pinned.Forbidden review-surface fields are absent, and model confidence is not carried as an authoritative review field.

8 Cross-domain portability: measured code reuse, not semantic equivalence

The cross-domain portability test reuses the systems layer while replacing domain-specific witness and policy objects. In a synthetic sensitive-infrastructure domain, this supports routing and triage behavior without establishing readiness for real operational domains.

Measured reuse: Eight systems modules are reused verbatim, while four domain-specific objects are replaced for the sensitive-infrastructure instantiation.The reused modules are crypto, ledger, attestation, consensus, enclave, transaction, receipts, and cone_certificate.
Measured reuse: No architectural change is required, providing evidence of implementation portability for the declared systems layer.This result concerns code and systems-layer reuse, not semantic equivalence across domains.
Synthetic triage: 512 synthetic records produce 175 release-verified, 54 historical-only, 157 rejected, 78 quarantined, 44 analyst-review, and 4 abstain actions.The population includes 265 severe contradiction cases, 175 clean records, and records requiring legitimate review or historical-only release.
Synthetic triage: The result supports a router/triage interpretation, but not readiness for classified, financial, clinical, or other real infrastructure.No real assets, operators, locations, telemetry, authoritative registries, or reviewed handling-caveat policies are present.

9 What changed from v0.1 to v3

The evaluation progression separates four questions rather than collapsing them into one headline score. From v0.1 through v3, each stage licenses a distinct view of interface admission, benchmark design, policy gating, or claim-to-evidence integrity.

Evaluation progression: The four stages answer different questions and should not be merged into one headline score.The progression is presented as a factorized evaluation rather than a single aggregate metric.
Evaluation progression: V0.1 measures the model-to-contract boundary, V0.2 the benchmark-design environment, V2 the reference-independent policy gate, and V3 the full architecture’s claim-to-evidence relationship.The paper identifies all four views as necessary for a mature evaluation program.

10 Threat model and residual exclusions

The threat model evaluates bounded adversarial and integrity failures across the verification substrate, while explicitly limiting claims to represented predicates, modeled trust roots, and non-adaptive attacks. Scope is treated as part of the evaluation contract rather than as an afterthought.

Threat model: The declared threat model covers malformed outputs, over-admission attempts, forged evidence, policy ablations, ledger and attestation faults, quorum failures, certificate forgeries, replay, tampering, and invalid atomic-transaction entries.These attacks define the evidentiary perimeter for the implemented verification substrate.
Residual exclusions: The adversaries are declared and non-adaptive, so they do not search for unknown policy gaps or exploit side channels.This bounds the adversarial setting used by the experiments.
Residual exclusions: The systems tests assume integrity of modeled roots including institutional authority, key provisioning, and hardware trust.These roots are represented in the model rather than supplied by deployed infrastructure.
Residual exclusions: The verifier can enforce only predicates represented in W, V, and P, leaving incomplete source systems or omitted policy semantics outside its guarantees.The reported synthetic results remain valid within these stated conditions.
Evaluation rationale: The benchmark factorizes interface admission, task-semantic correctness, evidence and policy admissibility, and systems integrity instead of treating them as one accuracy number.The sequence shows why zero admission, universal refusal, missing ablations, or non-adversarial certificate tests can make downstream conclusions uninformative.
Evaluation rationale: The benchmark’s value is reproducible diagnosis, allowing interventions such as expert labeling, retrieval changes, policy refinement, structured-output engineering, post-training, or systems repair.It does not predetermine which intervention or vendor is correct.
Evaluation rationale: A 99-row claim register distinguishes reproducible numbers, synthetic measurements, structural properties, proxies, missing experiments, and errors.This creates a practical bridge between paper prose and an engineering acceptance plan.

13 Discussion

The discussion treats self-falsification and non-vacuous evaluation as stronger evidence than aggregate pass rates alone. It also identifies remaining work needed to test frontier models, policy elicitation, and real deployment systems.

13.1 Self-falsification is an acceptance test, not a blemish: A failed claim can coexist with a successful verification process when the claim register preserves the contradiction as an ERRATUM.The stronger box-wide Fisher test contradicted a published implication, while the reporting machinery kept that negative result visible.
13.1 Self-falsification is an acceptance test, not a blemish: 95/96 testable claim criteria met and 148/148 verifier checks passing include correct detection and classification of the failed Fisher claim.The perfect check score therefore does not mean every registered assertion is true.
13.2 What is genuinely stronger than the first experiment: V2 makes positive and negative outcomes observable by adding clean controls, severe injections, policy ablations, runtime witnesses, and format-clearing adversaries.These additions address v0.1's inability to demonstrate selectivity when every model output was rejected.
13.3 Remaining uncertainties: The full-stack tests show coherent implementation under the declared synthetic model, while the claim register prevents unsupported components from borrowing credibility.Remaining work includes frontier-model evaluation, the intended LLM benchmark designer, expert policy elicitation, real systems integration, and prospective validation.
13.2 What is genuinely stronger than the first experiment: Zero silent promotions under the confident-hallucinator and evidence-forger surrogates indicates that distinct policy gates remain load-bearing.The two surrogates test admission-reaching invalid actions and corrupted evidence provenance in different ways.

14 Conclusion

The conclusion presents the study as a broader, executable verification substrate that distinguishes interface failure, refusal, optimization limits, and falsified claims. Its evidence remains bounded to declared synthetic conditions and explicitly excludes enterprise safety or arbitrary adaptive attackers.

14 Conclusion: A model can fail before semantic scoring, a verifier can refuse everything, and a paper can preserve an erratum instead of making the dashboard green.The strongest result is representing different failure types without collapsing them into one flattering score.
14 Conclusion: BeTaL-GBI v0.2, GBI v2, and GBI-DCSE v3 together add admissibility-aware search, witness-grounded policy, and a 99-claim executable register.The register meets criteria for 95 of 96 testable claims, leaves three claims out of scope, discovers one numerical erratum, and passes 148 checks.
14 Conclusion: 2,218,750,380 grid points define the BeTaL-GBI design space, whose dimensions cover identity normalization, anomalies, validation, temporal ambiguity, evidence, policy conflicts, and distractors.The search uses a monotone dial followed by local coordinate refinement rather than enumerating the full grid.
14 Conclusion: The policy uses declared witness evidence, policy version, validity, dependencies, identity state, and provenance rather than benchmark reference actions as deployment primitives.For injected records, stale reference actions can disagree with correct post-injection refusals, so witness-grounded verdicts and reference agreement are reported separately.
14 Conclusion: Three claims remain out of scope: zero-knowledge proofs, retrospective clinical playback, and hardware attestation bootstrapping.The study instead establishes finite certificate and blinded-commitment behavior, 14/14 synthetic receipt replay, and software-path proxy measurements.