PaperlayerView exact revision on arXiv

Source-linked AI summary

More Rejective, Not More Discriminative: The Unit of Verification in Pre-Execution LLM Oversight

Yuchen Han, Cheng Yan, Wuyang Zhang

arXiv:2608.23941v1cs.AI

TL;DR

Pre-execution oversight must choose how many planned actions each verifier call reviews, but existing evidence cannot isolate that unit from confounding trajectory factors or measure its clean-side cost. The paper introduces matched twin prefixes and paired informedness evaluation, finding that longer windows increase rejection rather than discrimination, while no tested label-blind policy consistently beats a calibrated fixed short unit.

  • Problem

    The effect of the verification unit on fallible monitors is unmeasured, although over-blocking can forfeit usefulness and pressure deployers to disable oversight.

  • Method

    The twin-prefix framework pairs each injected, environment-accepted error with a clean twin and evaluates both across five nested lengths using catch minus false rejection.

  • Results

    Informedness peaks at L∈{1, 2} for all six judges in both domains, while longer windows make zero-shot monitors more rejective, not more discriminative.

  • Takeaways & Limitations

    Safety cases should state the verification unit and co-report the clean series; no tested label-blind policy consistently beats a calibrated fixed short unit.

  • Takeaways & Limitations

    The study covers a zero-shot panel, two tool-agent domains, L≤8, and single non-adaptive injected writes; retail gold-clean prefixes are limited to n=31.

Abstract

from arXiv · show

Pre-execution oversight is core to trusted monitoring in AI control: a fallible LLM monitor vets planned actions before irreversible execution. Over-blocking forfeits usefulness and pressures deployers to disable it. Every protocol must fix a unit of verification: how many actions one call reviews. Existing designs take the unit as given; its effect on fallible monitors is unmeasured. Natural traces cannot isolate it: review length co-varies with error type and position. Catch alone misleads: rejecting everything catches everything. Measuring this needs boundary variation alone and a matched clean control. We introduce the twin-prefix framework, which supplies both. Each gold plan yields a prefix with one injected, environment-accepted error and a clean twin differing in one write. Judging each pair at five nested lengths ties verdict changes to the unit alone. Discrimination is scored by pre-registered informedness, catch minus false rejection. Longer review raises catch; false rejection climbs in lockstep. Informedness peaks at one or two actions for all six judges in both domains: longer windows make zero-shot monitors more rejective, not more discriminative. Replaying withheld observations traces the failure largely to observation deprivation. Safety cases should state the unit and co-report the clean series. Our framework is the first controlled, pre-registered instrument for this choice and never reads catch alone. Our calibrated short unit recovers up to 0.95 informedness over eight-action review, and no tested label-blind policy consistently beats it.

1 Introduction

The paper isolates the unit of verification with matched bad and clean prefixes, showing that longer reviews increase rejection without improving discrimination. It therefore treats informedness, not catch alone, as the relevant deployment measure.

  • Motivation: The unit of verification—how many planned actions one call reads—remains unmeasured despite determining fallible-monitor behavior.Natural trajectories confound review length with task difficulty, error type, and error position, while whole-trajectory scoring lacks a matched clean prefix.
  • Method: The twin-prefix framework varies only five nested review lengths while holding error type and position fixed and pairing each bad prefix with a clean twin.Each pair differs at one anchor write, so verdict changes can be attributed to the reviewed unit.
  • Results: Informedness peaks at L∈{1, 2} for all six judges in both domains, while longer windows make zero-shot monitors more rejective, not more discriminative.The primary informedness falls from 0.602 to 0.035 as review length increases, with observation deprivation identified as a major driver.
  • Implications: No tested label-blind policy consistently beats a calibrated fixed short unit, so safety cases should state the unit and co-report the clean series.The framework makes usefulness loss visible by requiring false rejection alongside catch.

2 Related Work

Related work places this study within research on fallible supervision and AI control, where trusted monitoring must balance safety against usefulness and supervision cost.

  • Oversight and AI control: Prior work studies fallible supervision, scalable oversight, trusted monitoring, resampling, control safety cases, chain-of-thought monitoring, and the cost of supervision.The paper positions its per-call unit choice within AI-control work that prices supervision and protocol-level control tax.

3 The Twin-Prefix Framework

The framework constructs matched bad and clean prefixes, evaluates them with paired stateless verifier calls across nested lengths, and scores discrimination as catch minus false rejection. It also separates review-cost savings from informedness loss and permits cost-sensitive unit selection.

  • Cost and discrimination: C(L) = F + L · i models a fixed per-call overhead plus per-item verifier-token cost, so average cost per reviewed step falls as L increases.The per-step cost is F/L + i.
  • Cost and discrimination: J(L) = catch(L) −FR(L) measures bad-from-clean discrimination by subtracting matched clean false rejection from bad-prefix catch.J=0 is chance level and J=1 perfect separation; a reject-everything verifier can have catch = 1 but J = 0.
  • Twin construction: Five nested windows L ∈{1, 2, 3, 5, 8} end at the same anchor slot, where a clean gold write or one injected error forms the final twin difference.The construction shares goal, executed context, and final-slot position while varying the reviewed prefix.
  • Twin construction: The schematic pairs independently judged bad and clean inputs so every catch value has a corresponding false-rejection value.The anchor slot closes all five windows; increasing L also withholds observations from in-window steps.
  • Corpus design: The construction uses accepted injected writes stratified into cross-customer, wrong-argument, and unrequested-extra-write errors with a registered 20/50/30% mixture.The corpus also balances near and far argument distance at 50/50.
  • Paired co-evaluation: Two independent stateless calls judge each twin separately, while a score-mode pass evaluates verbalized error probabilities for threshold-free ranking and operating-point analysis.The frozen instruction forbids rejecting for missing observations and requires a named fault for rejection.
  • Paired co-evaluation: The clean series is a mandatory co-report, and pre-registration freezes the direction-agnostic outcome map before measurement.This prevents selecting the reported contrast after observing whether performance rises, decays, or remains flat.
  • Unit selection: Unit selection can trade amortized overhead against informedness loss using a deployment-set shadow value λ, with safety-co-primary selection reducing to arg maxL J(L).Unequal miss and false-rejection costs can instead be represented by Uw(L) = catch(L) −w · FR(L).

4 Experiments

Across both domains and all judges, informedness peaks at one or two reviewed actions, while longer windows increase false rejection alongside catch. Observation replay removes much of the retail increase, and no tested label-blind policy consistently surpasses a calibrated fixed short unit.

  • Experimental Setup: Every judge peaks at L=1 or L=2 across both Retail and AppWorld.
  • RQ1: Longer Windows Buy Rejection, Not Discrimination: 0.602 → 0.035: primary informedness collapses from L=2 to L=8 as catch and false rejection rise together.Catch increases from 0.765 to 0.970, while gold-clean false rejection increases from 0.419 to 0.935.
  • RQ1: Longer Windows Buy Rejection, Not Discrimination: Retail ranking decays sharply from L=2 to L=8, and per-length recalibration does not rescue the long window.AppWorld is mixed: ranking decay appears for the smallest verifier, while larger and closed judges show no detected change.
  • RQ2: Where Long Windows Fail: At L=8, a position-4 error is caught at 0.237 versus 1.000 at position 8, making the headline long-window result position-optimistic.The position-marginal informedness never exceeds 0.093 at measured long lengths.
  • RQ2: Where Long Windows Fail: 0.035 → 0.490: providing withheld observations largely restores retail informedness at L=8, while the optimal unit remains L=2.Retail false rejection changes from 0.419 → 0.935 with withheld observations to 0.419 → 0.290 when observations are provided.
  • RQ4: A Short Unit Is Rarely Beaten: The calibrated fixed short unit matches or exceeds tested label-blind alternatives in five of six open-weight cells, with one router improvement of +0.105.The retail 70B oracle reaches 0.903 versus fixed-L∗ 0.602, leaving 0.302 headroom.

5 Limitations

The study’s scope is constrained to injected, non-adaptive writes, two tool-agent domains, units up to L≤8, and a zero-shot verifier panel. Retail gold-clean prefixes are limited to n=31, making small false-rejection gaps underpowered.

  • The evidence covers injected single non-adaptive writes, two tool-agent domains, L≤8, and no second-family process-reward model.
  • Retail gold-clean prefixes cap at n=31, so small false-rejection gaps and the peak location are statistically underpowered.

6 Conclusion

The paper concludes that longer review windows make zero-shot monitors more rejective rather than more discriminative, largely because withheld observations impair verification. It recommends stating the verification unit and co-reporting clean-prefix rejection.

  • Across six judges and two domains, longer review made zero-shot monitors more rejective, not more discriminative.
  • The twin-prefix framework varies only the verification unit and never reports catch without the matched clean series.
  • Observation deprivation largely explains the longer-window failure, while short-only training does not repair it.
  • No tested label-blind policy consistently beats a calibrated fixed short unit.
  • Safety cases should state the verification unit and co-report the clean series because increased catch can reduce usefulness through false rejection.

D Position Sweep (Full Grid)

The position sweep shows that catch is highest at the window’s end and falls toward the interior, especially for weaker verifiers. Position-marginal informedness is poor at long windows, including strongly negative values for the 14B and 72B.

  • Catch falls from the window’s end toward its interior on every verifier and both long lengths, with the steepest decline for the weakest verifier.
  • At AppWorld L=8, the 14B catches a position-1 error at 0.000 versus 1.000 at the last step.
  • At L=8, position-marginal informedness is −0.001 for 70B, −0.367 for 14B, and −0.100 for 72B.
  • At L=5, position-marginal informedness is 0.093 for 70B, −0.419 for 14B, and −0.181 for 72B.

E Rejection-Rationale Taxonomy (Detail)

The rejection-rationale analysis finds a consistent shift as windows grow: verifiers move from concrete, often hallucinated mismatches toward refusals based on unavailable evidence. A paired example shows this drift within the same clean item.

  • As windows grow, rejection mass shifts from concrete, often hallucinated argument mismatches toward unverifiable evidence claims.
  • For the same clean item, the 70B changes from a hallucinated goal violation at L=2 to unavailable evidence at L=5.
  • Nine of 31 clean items satisfy the registered short-ARG and long-EVID/OBS rejection-flip criterion.
  • Registered short-versus-long informedness contrasts exclude zero under both item-level and task-cluster resampling in all six open-weight cells.
  • The closed-weight panel targets complete, length-balanced verdict availability, with five cells fully complete and one disclosed exception.

J Oracle Bound, Router, and Verdict Pooling

Pooling verdicts across review lengths does not improve discrimination and can sharply worsen it, despite higher query cost. Fixed short units therefore outperform broad label-blind pooling, while a router offers only one disclosed exception.

  • The any-reject union attains J ≤0.105 in every cell, with J exactly 0 in four cells.
  • AppWorld follows the same broad shape as retail: catch rises or saturates with L while clean false rejection climbs.
  • The majority vote across five lengths is uniformly worse than fixed L∗, with ∆J from −0.118 to −0.400 despite 5× query cost.
  • Pooling scores across lengths does not separate from the best test-tuned fixed L in any cell while paying 2.2–6.3× the query cost.
  • The per-tool router is statistically indistinguishable from fixed L∗ in five of six cells and beats it only for AppWorld 14B by +0.105 [+0.024, +0.188].

K Asymmetric Error Weighting

The utility analysis shows that short verification units remain optimal whenever false rejection carries a sufficient relative cost, while long-window optima arise only when rejecting outright is nearly as valuable.

  • K Asymmetric Error Weighting: For every cell, a false-rejection cost of at least 0.41 relative to a missed error preserves a short optimum.Below each cell’s threshold, the nominal utility optimum can move to longer windows.
  • K Asymmetric Error Weighting: Below the per-cell threshold, the best long window exceeds verifier-free always-reject by at most 0.03 in five cells and 0.08 in AppWorld 70B.AppWorld 70B is the mildest case, because its long windows do not saturate to blanket rejection.
  • K Asymmetric Error Weighting: Longer windows move every cell toward the reject-everything corner, while only retail 70B and 14B first move toward the ideal corner from L=1 to L=2.These two retail cells are the interior-peak cells.

L Natural-Error Probes

Natural-error probes support the direction of the controlled curve, but sequentially executed trajectories cannot provide a clean long-window catch curve because later steps depend on observations unavailable before execution.

  • L Natural-Error Probes: Registered deterministic harvesting found catch@window-3 − catch@window-1 = +0.097, with 95% CI [−0.032, +0.258].This structural-ceiling harvest used paired n=31 across divergent drafts produced at temperature 0.
  • L Natural-Error Probes: Rendering sequential natural-error trajectories as unexecuted review batches causes 83–100% of windows at L ≥3 to trigger the NEED-OBSERVATION barrier rule.Those long-window verdicts measure barrier handling rather than error detection.
  • L Natural-Error Probes: Splicing a weaker executor’s first divergent write into controlled windows collapses anchor grounding from 43/43 at L=1 to 1/18 at L=8.The failure occurs when the window de-executes preceding gold steps.

M Observation Deprivation: Intervention and Structural Audit

Intervention and audit results indicate that long-window false rejection is driven largely by withheld observational content rather than review length or token volume alone, while three-way deferral reframes much of the rejection as abstention.

  • M Observation Deprivation: Intervention and Structural Audit: Retail false-rejection slope changes from +0.516 [0.323, 0.710] to −0.129 [−0.323, +0.065] when observations are provided, with paired slope difference 0.645 [0.484, 0.806].The registered deprivation-dominant branch removes a 1.25 share of the baseline slope; AppWorld shows a mixed branch, falling from 0.495 [0.420, 0.570] to 0.305 [0.230, 0.380].
  • M Observation Deprivation: Intervention and Structural Audit: Within fully groundable retail-70B items, FR(8)−FR(2) = +0.833 and J difference = −0.557, showing the long-window climb persists without parameter-level grounding failures.AppWorld-70B likewise has ∆FR +0.258 and ∆J −0.169 within G(8).
  • N Inert-Padding Token Controls: Restoring the L=8 token deficit leaves clean FR at 0.935 → 0.968, whereas restoring real observations collapses FR to 0.290.The contrast supports observational content, not token volume, as the relevant intervention.
  • O A Three-Way ACCEPT/REJECT/DEFER Probe: In the three-way probe, retail clean-side DEFER rises from 0.000 at L=1 to 0.613 at L=8, while decided coverage falls to 0.387.At L=8, 93 of 95 retail deferrals carry NEED_OBSERVATION.
  • P Clean False Rejection: Intervals and the Draft-Clean Bound: Gold-clean rates are upper bounds and draft-clean rates lower bounds for deployment-facing false rejection, so both clean populations are reported.The two retail bounds are bracketed at L≤3 and for the primary verifier at all five lengths.

Q Label-Validity Audit: Environment Census and Model Panel

The label-validity audit found that injected bad writes were environment-accepted and state-divergent, while an independent blind model panel produced an empty registered dispute set.

  • Q Label-Validity Audit: Environment Census and Model Panel: Retail accepted 200/200 injected bad writes, each immediately state-divergent from its gold twin; AppWorld accepted 188/188 evaluable writes, all persisting to terminal-state divergence.AppWorld had two unevaluable items because the gold anchor write returned HTTP 422 during replay.
  • Q Label-Validity Audit: Environment Census and Model Panel: The blind panel evaluated 150 bad-clean pairs across registered severity and position strata using GPT-5.6 and Claude Opus 4.8.The annotators answered four registered questions while blinded to kind-revealing fields.
  • Q Label-Validity Audit: Environment Census and Model Panel: The registered dispute set was empty, so the exclusion-stability rerun changed no cell, while harsher single-veto exclusions moved no rate by more than 0.024.The audit therefore preserved the published results under the registered exclusion rule.

R Balanced Reweighting, Matched Twins, and Cost-Constant Sensitivity

Multiple reanalyses preserve the reported short-window preference, while cost-sensitive ordering remains largely stable across tested parameter settings.

  • Five of six J(L) argmax results remain unchanged under both anchor-balanced and task-balanced reweighting.The sixth AppWorld/14B anchor-balanced result shifts from 1 to 2 within its disclosed tie band, with |∆J| < 0.009.
  • Matched-twin averaging reproduces the anchor-balanced curves, and within-anchor conditional AUC reproduces the global-pool pattern in all six score cells.For primary L=2, the anchor-bootstrap estimate is 0.605 with CI [0.470, 0.737].
  • 0 flips in 31×3 leave-one-anchor-out deletions change any peak contrast’s sign or selected J(L) maximum across the retail verifiers.Tukey jackknife SEs of the selected J values are 0.069, 0.079, and 0.068.
  • The largest single-deletion change in any retail FR(L) cell is 0.033, with influence dispersed across contexts and lengths.The 70B L=8 level remains within [0.933, 0.967] around 0.935 after deletion.
  • 25 of 27 cost-grid points preserve the L-ordering, with both reversals being adjacent L=2/L=8 swaps favoring the short unit.The tested grid varies F, i, and N over the registered parameter ranges; common rescaling does not affect the ordering.

S Same-Backbone Domain-Trained Monitor

The same-backbone trained-monitor analyses distinguish short-only generalization from seen-length supervision and continue to favor short verification units under the registered decision rule.

  • Same-Backbone Domain-Trained Monitor: The trained control preserves the pretrained causal-LM readout while applying LoRA to attention projections and training on matched bad/clean twin pairs.The backbone is bf16 Qwen2.5-14B-Instruct; LoRA uses rank 16, alpha 32, and dropout 0.05.
  • Same-Backbone Domain-Trained Monitor: All-length supervision repairs the short-only monitor’s collapse within the seen length support, whereas short-only training does not transfer to long windows.Figure A6 compares J(L) for the zero-shot, short-only, and all-length monitors with 95% bootstrap confidence bands.
  • Same-Backbone Domain-Trained Monitor: J(2) −J(8) = 0.043 [−0.064, 0.162] for the all-length ensemble, showing a much flatter curve when L=8 is inside supervised support.The corresponding AUC contrast is 0.013 [−0.024, 0.043], while all-minus-short at L=8 is +0.585 in J.
  • Same-Backbone Domain-Trained Monitor: The registered cost-aware rule selects L∗=2 for zero-shot 14B, L∗=1 for short-only training, and L∗=1 at the all-length point optimum.For all-length, J(1)=0.690 versus J(8)=0.625; only a flat-curve reading can make amortized cost favor the longest seen length.
  • Same-Backbone Domain-Trained Monitor: At L=8, short-only training reaches 1.000 but has gold-clean FR .935, compared with .290 for all-length training.The short-only result is therefore accompanied by near-blanket rejection rather than balanced discrimination.
  • Same-Backbone Domain-Trained Monitor: Calibration selected no unit longer than two actions across all six cells and both protocols.Retail 70B/14B always chose L=2; retail 72B and the AppWorld cells chose L=1 or L=2, and no fold selected L ∈{3, 5, 8}.
  • Same-Backbone Domain-Trained Monitor: The randomized-offset reading assumes one hidden random offset per episode and one audit per step, so chosen-position attacks are evaluated through expected catch.Overlapping or sliding windows and errors split across short windows are outside the tested mitigation claim.
  • Same-Backbone Domain-Trained Monitor: The worst-case one-action bound is positive in all six cells, ranging from 0.043 to 0.445, while the eight-action bound is negative in all six.The registered retail contrast Jworst(5) −Jworst(8) makes no claim because all three task-cluster intervals contain zero.

V Deployable Observation Substitutes: Predicted and Inert Arms

Observation-substitute experiments test whether deployable predictions can reproduce the benefits of withheld observations without introducing additional false acceptances, alongside independent reasoning-effort controls.

  • Predicted and Inert Arms: The deployable observation-substitute analysis uses a four-arm design on frozen retail judgments, including baseline, inert, predicted, and oracle conditions.The co-located executor predicts observations that have not yet been generated by the deployment window.
  • Predicted and Inert Arms: At L=8, the predicted arm’s repair fraction is 0.104 [−0.152, 0.324], identical in point estimate to the inert control’s 0.104 [0.000, 0.274].The long-window movement is therefore not attributable to observation content in this comparison.
  • Predicted and Inert Arms: At L=5, the predicted arm recovers 0.559 of the oracle effect [0.184, 1.070], while the inert control is null at −0.037 [−0.185, 0.082].The L=8 denominator Joracle −Jbase is 0.455 [0.333,...].
  • Predicted and Inert Arms: At L=8, predicted and inert arms both increase FR by 0.484 relative to L=1, whereas the oracle changes FR by −0.129.The predicted arm does not depress catch: 0.985 versus baseline 0.970, while oracle catch is 0.780.
  • Predicted and Inert Arms: The predictor reproduced 6.5% of oracle content tokens unreachable from its own context, indicating partial memorization of the public benchmark.The passage states that an unmemorized environment would do no better.
  • Predicted and Inert Arms: The frozen retail substitute analysis is bounded by missing-not-at-random availability, discarded unread rows, and added context and availability gates.The rerun required a pre-flight context check and per-arm availability of at least 0.99.
  • Predicted and Inert Arms: The effort controls use different vendors, model families, and knobs, so their results are not pooled.They are intended as independent controls for whether length decay reflects available deliberation.
  • Predicted and Inert Arms: For Qwen3-32B, thinking-ON decays more across length, with mode×length interaction −0.471 [−0.648, −0.273] under the cluster interval.Thinking-ON has higher short-window J, including 0.721 versus 0.289 at L=2.

X Compositional Two-Step Errors

The evaluation constructs and tests compositional two-step error pairs across domains, while quantifying how review length affects discrimination, cost, and deployment-oriented utility. Results favor short units, but several analyses are bounded by zero-shot prompting, limited retail clean anchors, and test-tuned policies.

  • Corpus construction: 100 of 100 emitted items had individually harmful second-step errors, so the corpus evaluates the weaker compositional form rather than harmless second errors.Zero admitted pairs contained an individually harmless second error because the injected write replaced the anchor’s gold write.
  • Frozen evaluation: The short unit wins across every span stratum, with maxL≤3 exceeding maxL≥5 by 0.450 overall in informedness.The reported differences are +0.500 for spans 1 and 2, and +0.417 for span 4.
  • Policy refinements: A two-stage cascade improves over its fixed short-unit baseline in only two of six cells, with gains of +0.040 and +0.048 at 12–23% extra clean-side cost.The cascade remains below the best fixed policy in the AppWorld 70B cell, and elsewhere its gain is not separable from zero.
  • Forward-drafted histories: On drafted histories, informedness peaks at L=2: J is 0.387, 0.458, 0.211, 0.133, and 0.077 for L=1, 2, 3, 5, and 8.Catch rises from 0.774 to 1.000 while clean false rejection rises from 0.387 to 0.923.
  • Forward-drafted histories: The primary drafted-history L=1→2 contrast is inconclusive at +0.042, while the between-arm double difference cannot be evaluated because only 13 of 31 anchors survive at L=8.Across the full grid, the drafted arm’s L=1→8 rise is +0.536 versus +0.516 for the frozen arm on the same anchors.
  • Scope and limitations: The retail clean series is structurally limited to 31 gold-clean anchors, and the study’s observation replay is unavailable in deployment while predicted observations repair almost none of oracle recovery at L=8.The replay is therefore treated as evidence for a major driver, not the only mechanism; public availability of the derived measurements is assessed as partial.
Loading 2608.23941v1…