PaperlayerView exact revision on arXiv

Source-linked AI summary

Finding Icebergs in Language-Model Workflow: Diagnosing Latent Structural Fragility with Stochastic Semantic Evidence Graphs

Matthew F. Dixon, Bertrand Nortier, Miquel Noguer i Alonso

arXiv:2609.29703v2cs.CLcs.IRstat.ML

TL;DR

Ordinary output checks can miss weak evidence dependencies beneath an apparently acceptable answer. SSEG preserves workflow paths and propagates uncertainty to support path-specific review and release decisions; in end-to-end studies it withheld unsafe cases while releasing safe cases.

  • Problem

    Ordinary output checks do not show where a workflow weakness entered, what depended on it, or what must be revalidated, while related approaches do not by themselves preserve and qualify versioned workflow paths.

    Source: §1 · p. 1

  • Method

    SSEG represents observable workflow dependencies with local uncertainty and edgewise transmission bounds, then uses ELRG to expose, localize, route, and govern consequential paths.

    Source: §1 · p. 2, §2 · p. 4

  • Results

    Across end-to-end governance studies, SSEG released all 540 safe cases while withholding 652/660 unsafe GPT-OSS cases and none of 660 unsafe Qwen3-8B cases.

    Source: §4 · pp. 7–8

  • Takeaways & Limitations

    SSEG makes versioned evidence dependencies and responsible paths available for review, revalidation, and conditional release rather than relying only on terminal confidence.

    Source: §1 · p. 2

    End-to-end transfer requires a qualified observation interface: two tested models failed the pilot because their declared continuation events omitted substantial probability mass.

    Source: §4 · p. 8

Abstract

from arXiv · show

AI-workflow governance cannot be reduced to checking the final answer: an apparently safe answer may rest on a fragile evidence path that ordinary evaluation cannot see, localize or govern. We call this hidden fragility a "structural iceberg": hallucinations and unsupported claims may form its visible tip, while consequential weakness remains submerged. Stochastic semantic evidence graphs (SSEGs) expose these icebergs by preserving workflow channels, propagating local uncertainty and identifying the hidden paths on which an apparently safe output depends. ALCE and RAGTruth show that visible failures at the tip -unsupported citations and hallucinated spans -rest on distinct submerged weaknesses and therefore require different interventions. Across retrieval, tool-use and controlled stress tests, SSEG localizes those weaknesses, supports targeted repair, produces no false automatic passes in 35,000 known-truth cases and reduces ToolSandbox review by 28.8% across 96 executions from two agent models. The same structural view carries into end-to-end governance: in a separately sealed 1,200-case FinGovBench study, adding SSEG to GPT-OSS-20B reduces unsafe releases from 452/660 to 8/660 while releasing all 540 safe cases and correctly distinguishing 592/600 matched workflow pairs. An unchanged-gate transfer to Qwen3-8B releases all 540 safe cases and none of 660 unsafe cases, whereas flat-UQ releases 520 unsafe cases. SSEG therefore moves governance below surface-level output checking, turning hidden evidence dependencies into auditable, path-specific decisions about intervention, revalidation and release.

1 Introduction

Ordinary output checks can miss fragile dependencies beneath an acceptable answer, leaving unclear where weakness entered, what relied on it, and what needs revalidation. SSEG retains workflow paths and propagates uncertainty toward governed actions, enabling path-specific review and release decisions.

1 Introduction

  • Prior uncertainty, retrieval-quality, factual-support, and provenance approaches do not by themselves preserve versioned workflow paths, bound downstream effects, and identify components for revalidation.SSEG complements calibration, entailment, and task-specific controls rather than replacing them.Source: §1 · pp. 1–2
  • A stochastic semantic evidence graph retains meaning-bearing workflow objects, records which outputs feed later components, and attaches local uncertainty and edgewise transmission bounds.ELRG exposes hidden dependencies, ranks influential paths, routes alarms to retained artifacts, and governs action against declared tolerance.Source: §1 · p. 2
  • A terminal pass distinguishes robustness from monitor blindness only when local measurements detect the weakness, and SSEG is not a universal factuality classifier.Its release decisions remain conditional on qualified measurements and declared tolerances.Source: §1 · p. 2
  • Figure 1 traces observable workflow inputs through retrieval, prompt construction, token generation, evidence checking, and a candidate governed action.Its directed edges represent supplied data dependencies, not inferred reasoning steps.Source: §1 · p. 2, Figure 1 · p. 3
  • SSEG connects uncertainty measurement, evidence assessment, and provenance in a path-specific certificate that identifies what should be reviewed or revalidated.Its evaluation spans known-truth stress tests, retrieval and provenance benchmarks, tool-use workflows, and a sealed financial-governance study.Source: §1 · p. 2

2 Stochastic semantic evidence graphs

SSEG represents a workflow as a typed DAG whose recorded edges specify which outputs are supplied downstream. It preserves local uncertainty and provenance while adapting its observable measurements to the available interface.

2 Stochastic semantic evidence graphs

  • A stochastic semantic evidence graph is a typed DAG of observable workflow states, with each edge recording a parent output supplied to a child.The topology comes from a versioned trace contract, not outcome correlations; controlled edge changes and held-out residual checks challenge that contract.Source: §2 · pp. 3–4
  • Comparisons condition on a fixed, versioned workflow configuration that records retriever, prompt, evaluator, governance loss, and permitted actions.In the main experiments, “tool” means an observed evaluation component rather than a general interactive API.Source: §2 · p. 4
  • SSEG can use API-visible measurements; only logprob-enhanced or self-hosted profiles expose a token subgraph, and only self-hosting enables full-logit and hidden-state audits.Open weights are not required for graph propagation itself.Source: §2 · p. 4
  • Claim–source relations assign evaluator-induced probabilities to support, qualify, contradict, or insufficient labels, but these scores are not human ground-truth labels.A hard-label evaluator is recorded as a point mass without claiming additional relation uncertainty.Source: §2 · p. 4
  • SSEG keeps claim–source support distinct from structural reliance, because high semantic support alone does not establish that a claim depended on its source.It avoids multiplying scores from different sources because repeated or dependent passages need not be independent evidence.Source: §2 · p. 4

3 A conditional pathwise qualification bound

The section develops a conditional pathwise bound that carries local discrepancies through a workflow DAG to its terminal action. Its experiments test bound coverage under known defects and path localization on external benchmarks, then connect ranked contributions to review and release decisions.

3 A conditional pathwise qualification bound

  • Sensitivity tests reveal output changes under perturbations but do not bound their propagation to the final action or retain the responsible path.Channels perturb one part of the workflow while holding the versioned configuration fixed, locating where sensitivity enters.Source: §3 · pp. 4–5
  • A local discrepancy measures node mismatch, while an edge coefficient bounds how strongly a parent change can affect its child.The reference conditional law is an approved comparison baseline, not necessarily factual truth.Source: §3 · p. 5
  • The pathwise certificate bounds terminal discrepancy by summing local node discrepancies weighted by their downstream path influence.The inequality follows standard coupling and Dobrushin-style arguments; the contribution is connecting typed workflow interventions to local terms and conditional qualification.Source: §3 · p. 5
  • The 35,000 controlled DAG cases test deterministic coverage against realized discrepancy under seven injected misspecification scenarios, not a statistical prediction interval.External MAGIC and ALCE benchmarks test path localization against withheld conflict-path labels and human labels for citation support, respectively; they do not certify the theorem.Source: §3 · pp. 5–6
  • ELRG ranks nodes by their contribution to the terminal bound, routes review to the retained artifact, and requires recomputation of changed nodes and recorded descendants after repair.Missing telemetry forces review; the ranking is not a causal diagnosis, and a pass remains conditional on the declared graph, domain, model vintage, interventions, and tolerances.Source: §3 · p. 6

4 Evidence-path governance experiments

The experiments form an evidence ladder from controlled tests of uncertainty propagation through external path-localization and routing benchmarks to sealed end-to-end release decisions. Their endpoints are heterogeneous and are not pooled into a single leaderboard.

Experimental design

  • The flat ablation received the same local uncertainty measurements as SSEG but discarded directed adjacency, path identity, and descendant scope, isolating the value of graph topology.Held-out comparisons used frozen development choices and paired intervals resampled by the natural case, question, or topology group.Source: §4 · p. 6

Expose

  • Across 35,000 known-truth cases, the robust path envelope produced no false automatic pass, while the nominal terminal envelope false-passed 42.2% of combined-stress cases.The controlled test validates the conditional calculation under known local defects and topology errors, not their prevalence in deployment.Source: §4 · p. 7

Path-localize

  • On 960 held-out MAGIC cases, rank-1 accuracy rose from 75.8% to 80.3–82.3% across five models, with every case-paired gain interval excluding zero.This supports localization of labelled conflict paths, not identification of a uniquely causal triple.Source: §4 · p. 7

Route

  • Across five model families, unsupported ALCE links had 4.8–8.2 times weaker median source reliance than supported links, while 31.2–38.0% of supported links also triggered structural review.On 688 VitaminC revisions, affected-path recall was 688/688, with 72.8% fewer claims reviewed than exhaustive page review and the same NLI release decisions.Source: §4 · p. 7

Govern

  • All 540 safe cases were released; SSEG withheld 652/660 unsafe GPT-OSS cases and classified 592/600 matched topology pairs exactly.The unsafe-release rate was 1.21%, a 98.2% relative reduction from the model-alone rate of 68.5%; all 120 hard red-line cases were withheld.Source: §4 · p. 7, Table 2 · p. 8

Cross-model transfer

  • All 540 safe cases and none of 660 unsafe cases were released by unchanged-gate Qwen transfer; flat-UQ released 520/660 unsafe cases.The transfer used the existing confirmation population, not a second newly sealed population.Source: Table 2 · p. 8, §4 · p. 8

Limitations

  • Eight unsafe GPT-OSS releases involved confident local no-fault measurements; Qwen transfer also depended on a qualified observation interface, and Mistral-7B and OLMo-2 reported no end-to-end results after failing its pilot check.Propagation cannot recover a local defect the observation channel fails to measure; the declared continuation family must represent the model response law.Source: §4 · p. 8

Secondary evidence

  • ToolSandbox paths reduced post-alarm review by 28.8% across 96 executions, while Self-RAG path structure raised average precision from .283 to .538 on 560 interventions.RAGTruth showed modestly improved word-level hallucination localization, but summary-level and incomplete-law transfer gates failed; trace-only SSEG did not improve ToolSandbox detection over the flat contract alarm.Source: §4 · p. 8

I Z E

These results report evidence-path localization and governance comparisons across ALCE, FinGovBench, and related baselines.

Route

  • On 688 VitaminC revisions, SSEG found every affected claim path while reviewing 72.8% fewer claims than exhaustive NLI.ALCE rank-1 was 68.0%.Source: I Z E · p. 9

Comparators

  • HHEM-plus-lexical flat rank-1 was 58.7%, compared with 61.3% for RAGAS.Source: I Z E · p. 9

Govern

  • SSEG released all 540 safe cases and withheld 652/660 unsafe cases with GPT-OSS; unchanged-gate Qwen transfer released 540/540 safe and 0/660 unsafe.Source: I Z E · p. 9
  • GPT-OSS alone released 452/660 unsafe cases, while flat-UQ released almost nothing.Source: I Z E · p. 9

5 Conclusion

The conclusion is that terminal validity and path integrity are distinct but can be governed together. The evidence spans conditional propagation, path localization, source-specific routing, and sealed release decisions.

Conclusion

  • SSEG detects 98.8% of unsafe GPT-OSS cases without withholding a safe case, yet eight confident local no-fault measurements still pass.Under unchanged-gate Qwen transfer, it releases every safe case and no unsafe case, whereas flat-UQ releases 520 unsafe cases.Source: §5 · p. 9
  • The evidence ladder links known-truth propagation tests, MAGIC localization, ALCE and VitaminC routing, and sealed FinGovBench release decisions.Source: §5 · p. 9
  • The remaining dependencies are the quality of the local observation law and whether the declared continuation family captures it.Source: §5 · p. 9

Reproducibility statement

The reproducibility archive preserves artifacts for auditing the reported analyses and FinGovBench evaluation.

Archive contents

  • The archive includes frozen manifests, model revisions, prompts, complete-phrase records, analysis code, and machine-readable summaries.Source: Reproducibility statement · p. 10

FinGovBench records

  • FinGovBench records include the preregistration, separately sealed labels, 3,600 causal-logit laws, frozen release map, prediction freeze, final evaluation, and post-seal residual analysis.Source: Reproducibility statement · p. 10

Audit trail

  • A claim ledger maps headline results to artifacts and fields; reconstruction scripts are documented, and failed gates and invalidated pilots are retained.Source: Reproducibility statement · p. 10

AI use and ethics statement

This material pairs the paper’s ethics disclosure with reproducibility guidance and a specification of the SSEG workflow and expanded measurement and governance construction.

AI use and ethics statement

  • The authors report human review and responsibility for the analyses, and state that no universal safety or causal claim is made.Generative AI tools assisted with manuscript editing, experiment-code drafting, literature discovery, and formatting; AI-generated prose was not accepted as evidence or authorship.Source: AI use and ethics statement · p. 10

A Anonymous reproducibility archive

  • The archive separates offline paper reproduction, local open-weight measurement, and API-compatible observation, without treating different models or protocols as frozen paper evidence.Offline reproduction recomputes metrics from case-level records or frozen conditional laws, but does not repeat the earlier language-model acquisition stage.Source: A Anonymous reproducibility archive · p. 13

B.1 An implementable SSEG algorithm

  • An implementable SSEG requires an observable workflow graph, node measurement rules with controlled interventions, and a governance policy defining its domain, controls, tolerance, and permitted actions.Edges represent observed transfer of parent outputs to children, not correlation, attention, or narrative relevance; runtime propagation is O(|V| + |E|).Source: §B.1 · p. 14
  • Zero observed false acceptances across 39 material-discrepancy cases yielded a one-sided 95% Clopper–Pearson upper bound of 7.4%.With thresholds unchanged, acceptance ranged from 42.1% to 65.0% across four chronological blocks; the authors describe post-partition sensitivity checks as descriptive, not confirmatory.Source: §B.1 · p. 14

C Expanded measurement and governance construction

  • The expanded measurement construction retains phrase-event probabilities, uncaptured expressed mass, and a stability requirement under information-preserving context transformations.It also retains a compatible joint-law set because separate source marginals do not identify dependence.Source: C Expanded measurement and governance… · pp. 14–15
  • The source-preserving graph tracks retrieval, claim generation, evaluator relations, and governance through distinct conditional laws.Controlled channel contrasts change one recorded setting at a time; they are causal only when randomized or otherwise identified.Source: C Expanded measurement and governance… · p. 15

D Proof of the path certificate

The proof derives a pathwise terminal uncertainty certificate and its declared-graph extension; the sealed FinGovBench confirmation reports safe-release recovery alongside residual unsafe releases.

D Proof of the path certificate

  • The terminal path certificate weights each node’s local discrepancy by the sum of edge-influence products over directed paths to the terminal node.The proof constructs node couplings in topological order and uses the resulting recursive bound to derive the terminal Wasserstein bound.Source: D Proof of the path certificate · p. 16
  • For a declared supergraph, upper-bounding edge influences and adding uncertain paths can only increase the certificate; the comparison may fail outside the declared envelope.The envelope must contain the true graph and true local quantities.Source: D Proof of the path certificate · p. 16

E FinGovBench open-weight sealed confirmation

  • SSEG reduces the model-alone unsafe-release rate by 98.2% while recovering every safe release; eight unsafe releases remain.All 120 red-line cases are withheld, and the study does not meet its stringent criterion of zero observed unsafe releases.Source: E FinGovBench open-weight sealed… · p. 17
  • The residual unsafe releases reflect undermeasured local defect mass despite the graph representing the consequential path, distinguishing measurement failure from graph failure.The eight cases comprised four conflicting-evidence cases, two monitoring-drift cases, one evaluator-coupling case, and one calculation error.Source: E FinGovBench open-weight sealed… · p. 17

F Open-weight checkpoints and compute record

The section records the revisions and compute setup for open-weight measurements, including limits on reproducibility and throughput interpretation.

F Open-weight checkpoints and compute record

  • Table 4 identifies the open-weight checkpoints used; hosted runs without exposed weight revisions are limitation studies, not bitwise-reproducible self-hosted measurements.Revision prefixes denote immutable Hugging Face commits, with complete revisions retained in the run manifest.Source: Table 4 · p. 17, F Open-weight checkpoints and compute… · p. 17
  • The sealed FinGovBench collection used four AWS g5.xlarge workers with one 24 GiB NVIDIA A10G GPU each to measure 3,600 candidate laws.Reported per-shard measurement-loop times ranged from 791.8 to 862.5 seconds; these are execution records, not normalized throughput comparisons.Source: F Open-weight checkpoints and compute… · pp. 17–18
  • The unchanged-gate Qwen3-8B transfer measured 3,600 candidate-event observations for 1,200 cases in 1,117.4 seconds after model loading.A label-free 25-case qualification preceded evaluation; governance-rule timings exclude model inference, and the authors do not infer missing hardware details or cross-experiment speedups.Source: F Open-weight checkpoints and compute… · p. 18

G Additional experiments and limitation studies

These additional studies probe SSEG across path qualification, controlled stress, provenance, tool use, prompt stability and financial workflows, while delimiting what the evidence supports.

G Additional experiments and limitation studies

  • Across 35,000 known-truth stress cases, the robust envelope has 100% coverage and zero false passes in every scenario, while nominal false-pass rate reaches 42.2% under combined stress.With missing telemetry, robust automatic-action coverage falls to 4.9%; these controlled tests verify conditional coverage, not production-fault prevalence.Source: G Additional experiments and… · p. 19
  • On 23 final-date decisions that differed from the reference, SSEG ranks errors at AUROC .848 versus .827 for equal-information terminal drift.Both methods have zero reference errors at 50% coverage; SSEG retains retrieval and presentation decomposition, but this post-confirmatory comparison does not establish superior prediction.Source: G Additional experiments and… · pp. 19–20, Figure 3 · p. 19
  • On 384 questions, SSEG raises path-level AUROC from .783 to .827 and average precision from .331 to .392 versus the flat comparator.At a frozen 10% shortlist, precision rises from 36.3% to 43.6%, but rank-first accuracy falls from 52.8% to 47.5%; this does not improve answer accuracy or establish definitive path choice.Source: G Additional experiments and… · p. 20
  • On 560 untouched source interventions, SSEG raises average precision from .283 to .538 and AUROC from .562 to .766 versus terminal scoring.Precision in the highest-risk quartile rises from 25.7% to 53.6%, but exact-hop performance is null; second-hop defects often cause the largest response changes yet are localized infrequently.Source: G Additional experiments and… · p. 21
  • Across 560 interventions, paired-edge SSEG localizes 88.4%, versus 75.2% for paired-node contrasts and 38.6% for absolute local scoring.The 13.2-point gain over paired-node measurement is hypothesis-generating because the method was designed after inspecting the failed endpoint.Source: G Additional experiments and… · p. 21
  • With ToolSandbox’s validator supplying a local contract alarm, SSEG routes all 40 failed paths while reviewing 71.3% of intermediate nodes, 28.8% fewer than exhaustive inspection.This is post-alarm routing, not predictive detection; trace-only SSEG ties the flat contract monitor.Source: G Additional experiments and… · p. 21
  • On held-out ALCE links, source-specific decomposition raises rank-1 localization from 58.7% to 68.0%, while global AUROC remains statistically tied.Equivalent prompts also change selected phrases across tested models; every relation fails at least one stability gate, so certificates cannot be transferred across model versions without retesting.Source: G Additional experiments and… · pp. 18, 19, 22, Figure 2 · p. 18

H Additional claim limitations

I Condensed secondary evidence and audit limitations

This block catalogs secondary evidence for auditability rather than extending the confirmatory claim, and records ALCE protocol choices that bound source-reliance interpretation.

I Condensed secondary evidence and audit limitations

I.1 Continuation laws, provenance and ALCE protocol

  • Candidate phrases are teacher-forced under one recorded prefix, residual mass is retained, and low-mass cases abstain.Runtime provenance records source, span, time, hash, and downstream transfers, but does not infer training-data attribution; without identification, dependence is diagnostic rather than causal.Source: §I.1 · p. 22
  • ALCE evaluation uses question-disjoint development and evaluation links, length-matched label-blind controls, and question-clustered intervals; its result measures source reliance, not citation truth.Scored targets omit citation markers, repeated citations share weight, and the control map is frozen across five models.Source: §I.1 · pp. 22–23

J Observation profiles and claim limitations

The section distinguishes what different observation profiles expose from what can validly be inferred, and outlines the SSEG algorithm’s inputs, outputs, and operational boundaries.

J Observation profiles and claim limitations

  • Black-box services expose generated text and sometimes truncated top-k alternatives, while self-hosting permits full-logit, hidden-state, and routing diagnostics.Table 7 is labeled as a set of capability-aware observation profiles.Source: J Observation profiles and claim… · p. 23, Table 7 · p. 23
  • Additional observables refine the graph but do not provide causal explanations without identified interventions, and experiments claim no access to hidden beliefs or document-level training attribution.The stated transport boundary is the frozen graphs, models, and intervention families.Source: J Observation profiles and claim… · p. 23
  • The audit record tracks runtime source provenance separately from model-training provenance, which remains only partially observed when the base training corpus is undisclosed.Runtime source provenance can be verified through source identifiers, accessed spans, timestamps, and content hashes.Source: J Observation profiles and claim… · p. 23
  • Algorithm 1 takes an observable workflow, disjoint qualification records, a policy, and a versioned runtime trace, and returns a governance action with a reproducible SSEG certificate.The observable workflow comprises components, data transfers, and versions, not model weights.Source: J Observation profiles and claim… · p. 24
  • Missing telemetry, unqualified dependencies, version mismatches, or out-of-domain graphs trigger REVIEW with an unresolved certificate; repairing a node invalidates and reruns its descendants.Source: J Observation profiles and claim… · p. 24
  • Table 5 presents distinct evidence-ladder rows for different parts of the governance claim, with heterogeneous endpoints not pooled.Source: Table 5 · p. 25
Loading 2609.29703v2…