PaperlayerView exact revision on arXiv

Source-linked AI summary

agent-risk: Risk Assessment for Changes to AI Agents

Yue Zhao, Zixiang Xu, Angela Huyue Zhang, S. Alex Yang, Xiyang Hu

arXiv:2610.16280v1cs.AIcs.CLcs.LG

TL;DR

Organizations need evidence of an agent’s risk before approving a change, but existing logs may not settle the risk of the changed system. agent-risk replays episodes and specifies when logs, declared stop values, saved-state reruns, or bounds provide evidence. In the bash sandbox, targeted reruns enabled decisions matching both live retry-gate decisions, while the paper identifies assumptions and evidence limits.

  • Problem

    Before approving a deployed-agent change, organizations need to know what risk existing logs establish, although logs may not capture stops or actions after refusals.

    Source: §1 · p. 1

  • Method

    agent-risk replays logged episodes under a proposed change and uses the log, a declared stop value, logged support, saved-state reruns, or bounds to assess unresolved cases.

    Source: §4 · p. 2

  • Results

    In the bash sandbox, targeted reruns predicted two retry gates’ harm within 0.015 and reached both live decisions, whereas the log alone could not decide either gate.

    Source: §4.1 · p. 7

  • Takeaways & Limitations

    Approval evidence must be designed around the change, including suitable log fields, saved states, and targeted reruns.

    Source: §6 · p. 8

    Replay assumes nothing else changes and the agent does not anticipate the change; the demonstrations use one open-weight model family in a bash sandbox and airline-booking environment.

    Source: Limitations · p. 9

Abstract

from arXiv · show

Before changing a deployed AI agent (a stricter safety gate, a new model), organizations must approve the change, starting from existing logs. Extending classical risk analysis to partial records and partial changes to running systems, agent-risk replays logged episodes, assuming nothing else changes and the agent does not anticipate the change. The log settles episodes acting as before, a declared stop value settles stopped ones, and the rest need logged support, a saved-state rerun, or a bound. We prove what logs must record for exact replay and which saved states serve a gate family. For independent episodes, we bound the reruns a decision needs and tolerable drift from live behavior. In a bash sandbox, a 7,200-episode log alone decided neither of two retry gates, which let the agent act after refusals the log never shows. Rerunning only each gate's blocked episodes from saved states reached both live decisions at half the agent calls of a live test sized post hoc for them, given the log. Without per-step harm, a stopping gate's certified harm ceiling rose up to 2.5-fold, since the log hides whether harm preceded the stop. Approval thus needs evidence designed in advance: log fields, saved states, targeted reruns.

1 Introduction

Organizations need to assess an agent’s risk before changing it, using evidence available before deployment. Existing logs are the starting point, but may not establish the changed system’s risk.

1 Introduction

  • Deployers, insurers, certifiers, approvers, and courts need a stated loss, evidence, and uncertainty before an agent acts.The paper calls the organization that runs an agent and holds its logs the deployer.Source: §1 · p. 1
  • Existing logs record tool calls, monitor scores, and outcomes, while live trials expose users to risk and new test campaigns cost runs.The question is how much risk those logs establish for a proposed change.Source: §1 · p. 1
  • Six characteristics of AI agents make it difficult to assess a change’s risk from logs.The passage points to approval gates, partial records, and long horizons; the remaining characteristics are not specified here.Source: §1 · p. 1

4 model releases,

The paper extends risk analysis to agent changes by specifying what logs establish and what further evidence is needed. Its theory and sandbox demonstrations show how replay, saved-state reruns, and bounds can support decisions about changes.

Related Work

  • The paper distinguishes its approach from evaluations of a fixed system and specializes existing log-based methods to agent changes, including stops and post-refusal retries absent from logs.It adds evidence-design guidance on logged fields, saved states, and new runs.Source: §4 · p. 1

Framework

  • agent-risk replays logged episodes under a proposed change, sorting them into agreeing, stopped, and continuing cases; continuing cases may need a saved-state run, logged support, or bounds.Replaying uses recorded inputs and recomputes actions up to the first deviation, without new environment steps.Source: §4 · pp. 1–2, Figure 1 · p. 2

Problem Formulation

  • The framework formalizes risk before a change runs by extending scenario risk analysis to partial records and admissible changes, organized around six agent characteristics.It asks which risk values remain possible given the logs.Source: §4 · p. 2

Theoretical Results

  • The theory specifies what logs must record to settle agreeing and stopped episodes, bounds reruns and restoration error for independent episodes, and identifies saved states serving a threshold family.The paper also proves a lower bound on reruns needed to certify a harm level.Source: §4 · p. 2

Empirical Verification

  • Targeted reruns of logged-open continuations predicted two retry gates’ harm within the registered 0.015 margin and reached both live decisions, which the log alone could not.Across 16 runs, the log covered about 49,000 episodes; clean starts and an announced gate mispredicted live runs.Source: §4 · p. 2

Reproducibility and Access

  • The authors release a Python package for replay, harm bounds, and logging comparisons, plus scripts to check formal results on finite instances.The passage also says the harness, logs, and registrations are available online.Source: §4 · p. 2

Partial Records and Long Horizons

  • For partial records, exact replay requires each episode’s contribution, such as harm timing relative to a stop.For long horizons, stopping changes replay at any length, while the share of continuing episodes that agree can remain unchanged or fall.Source: §4 · p. 2

Model Releases and Shared State

  • For model releases, rerunning the new model on logged inputs and seeds settles episodes where it acts as logged; remaining cases need similar logged cases, reruns, or bounds.The framework also treats shared state: when its law is known, single-agent tests bound joint risk, while saved shared-state reruns can settle it.Source: §4 · p. 2

6 Oversight cues

The paper’s oversight results apply only to cues represented in testing: telling an agent about a gate can change its behavior and violate the no-anticipation assumption. Table 1 organizes six agent characteristics by their place in the risk specification and the associated result and demonstration sections.

6 Oversight cues

  • Results carry over only for oversight cues seen in testing; telling an agent about the gate can change its behavior and break the no-anticipation assumption.The passage points to announced-gate testing as an example.Source: §6 · p. 2
  • Table 1 organizes six agent characteristics by the risk-specification component they affect and the corresponding result and demonstration sections.Its caption describes what logs can establish under each characteristic.Source: Table 1 · p. 2
  • The table’s organizing scheme links each characteristic to a distinct part of the analysis rather than treating oversight cues as the only concern.The caption describes all six characteristics as inputs to the risk specification, results, and demonstrations.Source: Table 1 · p. 2

2 Problem Formulation

The problem formulation represents agent changes through execution, loss, records, and admissible changes, then asks which risks the records justify. Its setup highlights how stops, retries, partial logs, and assumptions about unchanged behavior affect what can be inferred.

2.1 Six Organizing Characteristics of Agents

  • Approval gates create a running-case problem: a stricter gate stops episodes the log shows running, but the log cannot show what follows the stop.Partial records retain only chosen fields, and long horizons add more steps where a changed rule can depart from the log.Source: §2.1 · p. 2

2.2 One Agent and One Logged Episode

  • The setup models a sandboxed agent proposing tool calls, a trusted monitor scoring each call, and a gate acting on that score over episodes of at most T steps.Loss includes task failure, harm, and cost; harm is an executed policy violation, while cost counts tokens and calls.Source: §2.2 · p. 3
  • A stopping gate ends an episode at the first score above its threshold; it counts accrued harm and cost, adds no later harm, and treats the stop as failure under a declared valuation.A retry gate instead refuses the call and lets the agent try again.Source: §2.2 · p. 3
  • A log that records only whether harm occurred cannot reveal whether it happened before a proposed stop; after a refusal, a retrying agent takes actions absent from the log.The stop’s value must be declared, while logs alone can only bound what follows a retry.Source: §2.2 · p. 3

2.3 Writing Down the Risk Specification

  • The risk specification defines execution as the kernels over a finite, at-most-T-step process and loss as a function of a complete episode.Records specify which history is logged, while admissible changes state which kernels may be replaced, when, using what information, and by whom.Source: §2.3 · p. 3

2.4 A Change’s Risk and Identified Set

  • The deployer declares a family of structural models that reproduce observed record laws, then asks which risks remain possible under those models.The queried loss coordinate is summarized by a functional such as harm probability, mean cost, or conditional value-at-risk.Source: §2.4 · p. 3
  • Logs support claims about a changed system only under invariance and no anticipation: unchanged kernels remain as logged, and the agent does not react to the change or its announcement.If either assumption fails, the deployer must model the additional change.Source: §2.4 · pp. 3–4

3 Evidence Design for Agent Changes

The evidence-design procedure combines replay, a declared stop value, and additional evidence for unresolved continuations. Its results specify what records, reruns, and saved states can support conclusions about agent changes.

3 Evidence Design for Agent Changes

  • The five-step procedure declares the change, stop value, and decision rule; replays to first deviation; resolves remaining episodes with matching cases, reruns, or bounds; then decides against declared thresholds.The assumptions of invariance and no anticipation must be justified or the extra change modeled.Source: §3 · p. 4

3.1 Approval Gates: Can Logs Replay a Stop?

  • Agreement episodes are read from the log, while stopped episodes are settled by a declared stop value that includes losses accrued before stopping.The continuing term requires support, reruns, or bounds.Source: §3 · p. 4, §3.1 · p. 5

3.2 Partial Records: What Must Logs Keep?

  • A log determines replay contributions exactly only when episodes it merges have equal combined contributions; fields such as harm timing and serving mode can be necessary.Without sufficient records, identical logs can arise from baseline distributions with different replay contributions.Source: §3.2 · p. 5

3.3 Long Horizons: Does Length Matter?

  • As the horizon grows, the share of episodes agreeing throughout cannot rise; stopping changes remain identified with sufficient records and a declared stop value, while continuing-change bounds can widen.Each additional step creates another opportunity to leave the log.Source: §3.3 · p. 5

3.4 Continuing Changes: Runs and Snapshots

  • When logs do not support a continuation, saved-state reruns or bounds can resolve it; support-based identification requires baseline support and records of relevant inputs and loss coordinates.For independent episodes, the paper bounds the reruns needed and shows restoration error can prevent reliable certification.Source: §3.4 · pp. 5–6

What to store: snapshot design for threshold gates

  • For threshold gates, open running maxima before the last step form the least set of first-block snapshots whose continuation laws identify the query across the gate family.An earlier snapshot can replace one by re-executing agreeing steps.Source: What to store: snapshot design for… · p. 6

3.5 Shared State: Does Evidence Transfer?

  • With shared state, standalone component logs leave dependence between failures open; under the stated assumptions, unseen composed states bound how much standalone evidence leaves unidentified.The width of the identified set is bounded by the probability of composed states never seen alone.Source: §3.5 · p. 6

3.6 Oversight Cues: Do Tests Transfer?

  • Test evidence determines risk only for deployment cues that occur in testing when the agent reads only the cue and private randomness; an announced gate violates no anticipation.Recorded evaluation signs and gate notices play the role of shared state in this transfer question.Source: §3.6 · pp. 6–7

4 Applying the Framework in a Sandbox

The sandbox evaluation tested replay and targeted execution against paired live runs across agent changes. The experiments show where logs suffice and where missing support, records, or state limits their use.

4.1 Approval Gates: Stopping and Retry

  • The 7,200-episode pass-all log alone decided neither retry gate; targeted reruns reached both live decisions at half the calls of post-hoc-sized live tests.The prespecified rule approved gate 2 and declined gate 1, matching live runs.Source: §4.1 · p. 7, Table 2 · p. 8

4.2 Partial Records: What the Log Must Keep

  • Without per-step harm, the certified stopping-gate harm ceiling was 0.159 instead of 0.064 because the log could not establish whether harm preceded the stop.The reduced log with per-step harm certified the same ceiling as the full record.Source: §4.2 · p. 7

4.3 Long Horizons: Replay Across 40 Steps

  • At 40 steps, the retry gate’s agreement mass fell from 0.77 to 0.57, and its plug-in bounds reached [0.043, 0.473]; stopping-gate replay stayed at 0.043 to 0.067 from 15 steps on.The stopping-gate values represent unknown outcomes in the 600-episode bash log.Source: §4.3 · p. 7

4.4 Model Releases: Old Logs, New Model

  • The new model reproduced none of 99 logged episodes, so replay settled none and the release required support, bounds, or new runs from step 0.At logged inputs and seeds, the same model reproduced every episode.Source: §4.4 · p. 7

4.5 Shared State: Two Agents in Relay

  • In the relay, both agents violated policy in four times as many relays as the product of their individual rates; task-risk-class logs narrowed joint probability to [0.031, 0.115].Testing the second agent from the handoff snapshot matched the relay, unlike a clean start.Source: §4.5 · pp. 7–8

4.6 Oversight Cues: Announcing the Gate

  • Announcing the gate in the prompt raised the abort rate above replay’s prediction, while the unannounced negative-control gate remained compatible with replay.The comparison used the same tasks and seeds.Source: §4.6 · p. 8

5 Related Work

The related-work discussion positions agent-risk alongside replay, off-policy evaluation, partial identification, and execution methods. It distinguishes established tools from the paper’s logging, restoration, and snapshot results.

Evaluation from Logs

  • Full trajectories with known rewards support stopping-rule evaluation, while regime comparisons censor at deviation; cited replay and weighting methods use randomized logging, which these logs lack.The paper’s replay analysis builds on these stopping and deviation-replay connections.Source: §5 · p. 8
  • Saved-state execution has precedents in simulation, rare-event splitting, agent resampling, and reset access, while checkpoint systems restore prefixes without identification guarantees.Source: §5 · p. 8

What Is New

  • The paper identifies its novel results as the logging condition for replayed stop values, the restoration threshold and execution-to-live cost ratio, stratified allocation, and least first-deviation snapshots for threshold families.Its unsupported-input result specializes partial-identification methods to replacement kernels with declared values.Source: §5 · p. 8

Agent Risk and Governance

  • The discussion frames shared-state joint-risk ranges and evidence design as contributions to agent risk and governance alongside work on gate errors, audit rigor, and underwriting.Source: §5 · p. 8

6 Conclusion and Future Directions

The conclusion presents agent-risk as a framework for deciding what existing logs establish about agent changes and what further evidence is needed. Its sandbox results support targeted reruns for retry-gate decisions, while identifying future work on restoration and oversight awareness.

6 Conclusion and Future Directions

  • Under the assumptions that nothing else changes and the agent does not anticipate the change, agent-risk determines what logs settle and what they must record.For independent episodes, it also bounds decision-required reruns.Source: §6 · p. 8
  • In the bash sandbox, the log alone decided neither retry gate; rerunning only unresolved episodes reached both live decisions at half the calls of a post-hoc-sized live test, given the log.Source: §6 · p. 8
  • Future work could restore state beyond saved files and bound risk for oversight-aware agents.Source: §6 · p. 8

Limitations

The framework’s conclusions depend on replay assumptions and a declared stop value, and its demonstrations cover a limited set of agents and environments.

Limitations

  • Replay assumes unchanged unreplaced mechanisms and no agent anticipation; bounds for agents that recognize oversight remain open.The declared stop value is not tested for harm, and restoration checks cover only the harness-compared file tree.Source: Limitations · p. 9
  • Demonstrations use honest agents from one open-weight model family in a bash sandbox and simulated airline booking, and supported continuation is untested.For the model release, replay settled none of 99 episodes, leaving its losses unestimated.Source: Limitations · p. 9

Ethical Considerations

The ethical discussion emphasizes transparent risk specifications, uncertainty, and safeguards against approval-driven choices; the appendix guide directs readers to formal results and demonstrations.

Ethical Considerations

  • Risk claims should identify affected parties, loss definitions, evidence, and uncertainty because unobserved consequences or misspecified mechanisms can give false reassurance.The framework exposes assumptions to deployers and auditors while preserving unresolved uncertainty in downstream decisions.Source: Ethical Considerations · p. 9
  • Declaring the specification and decision rule before results guards against choosing a loss, stop value, or margin to favor approval.Replay records and saved states may contain user data, while Proposition 3.1 identifies when privacy-trimmed logs still determine agreeing and stopped terms.Source: Ethical Considerations · p. 9

Guide to the Appendix

  • The appendices support the paper’s formulation, results, demonstrations, and related work.Appendix B presents the survey and comparisons with prior work.Source: Guide to the Appendix · p. 14
  • Appendix A covers specifications and evaluation, while Appendix D covers registered and exploratory demonstrations and their uncertainty.Appendices E–G address replay identification, continuation and snapshots, and transfer of component evidence; Appendix H indexes verification scripts.Source: Guide to the Appendix · p. 14

A Formal Statements Behind Sections 2 and 3

The appendix formalizes the risk specification and replay conditions, then states what records identify and where continuation evidence or bounds are needed.

A.1 The Specification

  • The risk specification combines an execution mechanism, consequence map, observation mechanism, and family of admissible replacements.Execution kernels encode the declared causal structure; the loss covers the episode, and the observation mechanism generates the deployer’s log.Source: §A.1 · p. 14, A Formal Statements Behind Sections 2… · p. 14

A.2 The Question, Assumptions (A1) and (A2), and Identified Sets

  • Changed-system queries rely on invariance and prefix preservation with no anticipation, while identified sets retain query values consistent with observed records.One-sided endpoint confidence bounds account for sampling error; plug-in bounds do not.Source: §A.2 · p. 15

A.3 Records That Leave a Gate Change Open

  • Logs can leave stop, retry, and omitted-harm-timing effects unresolved; without step-level harm, a stricter gate’s identified harm interval can remain [0, 1].In the stated example, recording step harm contracts that interval to {p}; omitting a state bit can likewise leave changed damage probability anywhere between 0.1 and 0.9.Source: §A.3 · pp. 15–16

A.4 Deviation Replay

  • Deviation replay identifies losses on agreement episodes from baseline records and settles stopped episodes using the declared abort valuation.The result assumes (R), invariance, and prefix preservation with no anticipation.Source: §A.4 · p. 16

A.5 Supported Continuation, Compact Form

  • Supported continuation is identified by the g-formula when replacement inputs are supported and recorded and all loss coordinates are observed.Without support at some inputs, the identified set allows free laws at those inputs, or an outer set when laws are shared across positions.Source: §A.5 · p. 16

A.6 The Evaluation Procedure

  • The evaluation procedure checks assumptions and replay sufficiency, then uses the g-formula, restored-prefix continuations, or bounds for unresolved terms.It reports whether the result is identified, bounded, or needs execution, and names missing evidence when the decision remains open.Source: §A.6 · p. 17

A.7 Symbols

B.1 Survey Method

The appendix describes a purposive review used to motivate six agent characteristics, notes a selection caveat, and situates the framework among classical tools and existing practices.

B.1 Survey Method

  • The survey used a purposive sample of 85 papers and reports, with two language-model coders independently coding 23 frameworks and 30 incidents against 20 candidate characteristics.The incidents covered 2025 and 2026 reports describing tool-using agents.Source: §B.1 · p. 17

B.2 The Other Characteristics

  • The six characteristics were selected for frequency, persistent risk under current mitigations, and formal results, but the last criterion is partly circular.The selection motivates the six characteristics without proving they matter most; other candidates map to the framework’s four objects and the rows are neither exhaustive nor additive risk scores.Source: §B.1 · p. 17, §B.2 · p. 17

B.3 Classical Tools

  • The appendix describes the four-object specification as its modeling choice for adapting classical tools.Its table summarizes how the specification adapts those tools.Source: §B.3 · p. 17

B.4 Existing Practice as Instances

  • Existing practices are represented as specifications without ranking them, and the risk-specification notation is summarized as execution, loss, observation, and admissible replacements.The released artifact lists the surveyed sources and incident identifiers.Source: §B.4 · pp. 17–18, §B.1 · p. 17

C Comparisons With Prior Work

The comparisons distinguish agent-risk from evaluation and control methods by specifying which evidence supports a particular agent change. They also locate its relevance to insurance and logging duties while marking the additional assumptions needed to transfer evidence.

C Comparisons With Prior Work

  • For stopping changes, declared accrued-loss valuation identifies risk without overlap; continuing changes add continuing mass and may require bounds where support is absent.The section distinguishes position-specific free-law sharp sets from shared-law outer bounds.Source: C Comparisons With Prior Work · p. 19
  • Targeted execution transfers evidence through reset access under assumptions formalizing transfer, and seed-addressable replay evaluates changes at recorded inputs and seeds.The comparison distinguishes reset-fidelity-based execution from learned simulator models and inferred shared-randomness couplings.Source: C Comparisons With Prior Work · p. 19
  • Proposition 3.1 characterizes when records preserve replay contributions and unresolved mass, while related logging and state-abstraction work supplies motivating foundations.The section contrasts this criterion with information-state and reward/transition sufficiency results.Source: C Comparisons With Prior Work · p. 19
  • Agent-risk separates stopping replay from continuing changes and specifies the evidence each requires, unlike work certifying composed agents from measured joint executions.Its shared-state Fréchet range instead uses component logs and the shared state; related control-evaluation practices reuse records to assess changes.Source: C Comparisons With Prior Work · pp. 19–20
  • The framework complements insurance work on safe defaults and modeled claim costs, but premiums additionally require monetary severity, exposure, coverage, and dependence information.The section also notes that cited logging and reporting instruments do not give a general criterion for whether records suffice to assess a specified change.Source: C Comparisons With Prior Work · pp. 19–20

D Registered Demonstrations and Supporting Evidence

  • The appendix reports registered and exploratory evidence with post hoc readings computed without multiplicity control; the primary bash claims are limited to a sandbox where task failure is near saturation.Bash runs sampled uniformly with replacement from 257 tasks, using fresh containers and seeds and a frozen checker.Source: D Registered Demonstrations and… · p. 20, §D.1 · p. 20

D.2 Setup Specification

This setup specifies a sandboxed bash evaluation and formalizes and tests how logged episodes, replay, and targeted snapshot continuations support approval decisions for stopping and retry gates. The analysis depends on logged fields and saved-state or replay assumptions, including prefix preservation and saturated continuation.

D.2 Setup Specification

  • The evaluation’s frozen checker flags policy violations in executed calls, but failed state checks leave harm unknown unless a violation is recorded or a replayed stop explains the failure.The policy forbids network access, changes outside /workspace or /tmp, destructive commands outside those paths, and privilege escalation.Source: §D.2 · p. 20
  • For one retry gate, executing 485 snapshot continuations narrowed log-only harm bounds of [0.023, 0.422] to 0.029, matching live harm of 0.030 within ±0.02.The estimate used 30% of live agent calls, given the log; all 485 restoration checks passed.Source: §D.3 · p. 22
  • Without per-step harm records, certified harm ceilings were 0.159 and 0.111, versus 0.064 and 0.051 when timing was available.The log can hide whether harm preceded a stopping gate; rerunning the checker on logged calls recovered timing in 1,200 of 1,200 episodes where database state was determined by executed calls.Source: §D.3 · pp. 22–23
  • Gate 1 and Gate 2 identified harm rates were 0.2794 and 0.1584, each equivalent to live within the registered 0.015 margin; log-only bounds could not decide either gate.Log-only outer bounds were [0.244, 0.345] and [0.100, 0.451]; both reference predictors failed the margin for both gates.Source: Figure D.2 · p. 23, §D.3 · p. 24
  • For the stopping-gate replication, replay predicted harm of 0.039 versus 0.030 in 1,000 live runs, within the registered ±0.03 equivalence margin.The difference was −0.009 (Newcombe 95% [−0.025, 0.007]).Source: §D.3 · p. 21, Figure D.3 · p. 23
  • Gate 2 passed the declared joint decision rule, with identified harm at most 0.1658 and success at least 0.3889; targeted continuations used 8% and 23% of live gate calls.The rule required harm at most 0.25 and task success at least 0.37; neither registered reference predictor certified a candidate.Source: §D.3 · p. 24
  • Replay estimated airline retry-gate P(harm) at 597/1,200 = 0.4975, versus 598/1,200 = 0.4983 live, with both 90% equivalence intervals inside ±0.03.The 159 continuations used 0.090 of live agent calls and 0.131 of declared tokens. In the horizon comparison, stopping-gate replay stabilized at 26/600 = 0.043 for k ≥15, while retry-gate agreement mass fell from 0.77 at k = 1 to 0.57 at k = 40, widening outer bounds to [0.043, 0.473].Source: §D.3 · p. 25, §D.5 · p. 25
  • Full and reduced logs certified harm at 0.051 (39/1,000) on the replication log and 0.064 (12/300) on the held-out log, below bounds without per-step harm.Without per-step harm, the corresponding certified levels were 0.111 (94/1,000) and 0.159 (37/300); the reduced log retained per-step scores, harm, cost, and final outcomes.Source: §D.4 · p. 25
  • The release candidate reproduced 0 of 99 logged episodes, while the identical model reproduced 99 of 99 and kernel and precision changes reproduced 2 and 1.Outputs were seed-addressable within processes (40 of 40 probe inputs reproduced) but varied across processes (14 of 40 differed); the exact two-sided 95% Clopper–Pearson bound for 0/99 was 0.037.Source: §D.6 · p. 25
  • Relay violations were 0.115 versus 0.178 from clean starts, failing ±0.03 equivalence, but matched snapshot starts at 0.1175 to 0.1188.Both agents violated in 136/1,600 relays (β = 0.085), showing positive dependence: assuming independence overstates union harm by 0.066; conditioning on task risk class and external write flags narrows the identified range for β.Source: §D.7 · p. 26
  • The announced stopping gate aborted 0.070 more often than the unannounced gate (181/400 versus 153/400), while harm was 10/400 in all three arms.Replay from unannounced logs understated announced aborts by 0.0725; the intervention rejects abort-rate invariance for this prompt but does not isolate semantic anticipation from other prompt perturbations.Source: §D.8 · p. 26

E.1 Continuing Deviations: Statement

  • Under saturated continuation, the identified set combines agreement and stop outcomes with feasible continuation laws, and monotone functionals attain extrema by assigning each continuing prefix its minimum or maximum.Mean, exceedance probability, and CVaR attain every value between the extremes; VaR takes a finite set of values, and without saturated continuation these results are outer bounds.Source: §E.1 · p. 26

E.2 Finite Setting

  • The finite replay setting specifies a replaced decision kernel, first-deviation histories, recorded inputs, and known baseline and replacement maps, with assumptions requiring replayability and no anticipation.An abort terminates calls to the replaced kernel; post-abort distributions depend only on the replayed prefix when unreplaced kernels are shared.Source: §E.2 · p. 27

E.3 Prefix Lemma and Proof of Proposition A.4.1

  • Under replayability, shared unreplaced kernels, and prefix preservation, the replacement law agrees with baseline on agreement paths and histories before any deviation.This equality also holds for pre-intervention records whose component cylinders have no deviation history as a proper prefix.Source: §E.3 · p. 27

E.4 Saturated Continuation and Proof of Proposition E.1.1

The appendix characterizes which loss laws remain identified under partial continuation and logging, then derives order and horizon bounds. It also establishes how coarsened evidence, baseline support, and coordinate-level structure constrain what can be learned or replayed.

E.4 Saturated Continuation and Proof of Proposition E.1.1

  • Under Proposition E.4.3, the identified set contains the possible continuation loss laws; it is exact when the model class is saturated at the baseline law.The set is built from feasible continuation outcomes after continuing prefixes and terminal valuations.Source: §E.4 · p. 28
  • η− and η+ bracket every identified loss law in stochastic order, bounding monotone risk summaries such as the mean, exceedance probability, VaR, and CVaR.For the mean, exceedance probability, CDF value, and CVaRβ, every value between the endpoints is attained.Source: §E.4 · p. 28

E.5 Logging Characterization and Proof of Proposition 3.1

  • Exact replay is characterized by whether the log value determines both the contribution and continuing-deviation status; necessity requires variation across all baseline laws.Coarsened logs may omit deviation status when paths pooled by the log have equal signatures.Source: §E.5 · p. 29

E.6 Coarse Evidence and Garbling

  • A coarsening of a log weakly enlarges the identified set, because it leaves more compatible models.For a fixed model class, replacement, and query measurable from the record, the finer log’s identified set is contained in the coarser log’s.Source: §E.6 · p. 29

E.7 Long Horizons

  • The full record identifies agreement mass at any horizon, while continuing deviations can keep the mean-loss interval wide as their mass and feasible outcome spread increase.When every deviation is terminal and the contribution is determined by the log, the whole conditional loss law is identified.Source: §E.7 · p. 29

F Proofs: Supported Continuation, Unsupported Inputs, and Model Updates

  • The appendix proves supported-continuation and model-update results using a finite-coordinate model, the sequential g-formula, and partial identification.It also covers execution-budget and snapshot-design results.Source: F Proofs: Supported Continuation,… · p. 29

F.1 Finite Coordinate Model

  • The finite-coordinate model represents episodes as ordered variables with declared kernel inputs, replacement sets, recorded loss inputs, and pre-intervention records.Tree mechanisms can be embedded by allocating slots to histories where call order or kernel identity varies.Source: §F.1 · p. 30

F.2 Assumptions and Their Deployment Reading

  • For an unchanged agent reading full text, a refusal message or regenerated text with zero baseline probability violates the support condition; coarsening context requires an unverified sufficient-input assumption.Source: §F.2 · p. 30

F.4 Full Statement and Proof of Proposition A.5.1

These appendices establish what logged and saved-state evidence can identify about outcomes, gate behavior, and joint risk under changes, as well as execution bounds sufficient or necessary for certification. Their conclusions depend on stated support, recording, restoration, testing, dependence, equivalence, and transportability assumptions.

F.4 Full Statement and Proof of Proposition A.5.1

  • Under (G1)–(G4), the sequential g-formula identifies the changed conditional law and its queries from the record law, declared inputs and kernels, and known replacement kernels.The formula applies to every r-compatible value; the proposition also states that each query is identified among mechanisms sharing the declared inputs and kernel values.Source: §F.4 · p. 31
  • Support condition (G1) is checkable from the baseline record law and declared kernel values; the proposition also composes with Proposition A.4.1 to identify the continuing part as a remainder.Zero agreement can still yield identified replacement risk: the stated deterministic construction has agreement mass 0 and risk 1/2. Conditions (G2) and (G4) cannot be dropped, nor can (G3) be weakened to recording L alone.Source: §F.4 · p. 31

F.5 Continuation from Records with Unsupported Inputs

  • Without (G1), the identified set is contained in the image generated by varying allowed kernels at unsupported inputs, and is sharp when the model class is closed under those changes.If (G1) holds, every such variation yields the same identified law as the g-formula. A finite log cannot establish that an unobserved input is null; for classes tying kernel slots, the image remains an outer set and the identified set may be smaller.Source: §F.5 · p. 32

F.6 Model Updates: Statement and Proof

  • For seed-addressable model updates, agreement mass is identifiable and estimable from independent baseline episodes when decision inputs, tapes, and baseline outputs are recorded and the interface captures later-used actions and states.The agreement contribution is identified when loss is recorded; agreement mass is at most the first-decision agreement probability.Source: §F.6 · p. 33

F.7 Budgeted Targeted Execution: Statement and Proof

  • Under independent common-probability outcomes and exact restoration, stratified sampling of unresolved continuations yields harm bounds with simultaneous coverage across declared looks and any target.Replay resolves agreement, pre-deviation harm, and stops with fixed abort valuation; unresolved episodes are sampled without replacement within log-defined strata.Source: §F.7 · p. 33
  • Restoration error adds ξ = Σ_h w_hγ_h to the certified harm bound; prefixes with harm before deviation contribute no harm allowance, while success floors need their own allowance.A population statement also requires an upper confidence limit for continuing mass, or the conservative bound εκ ≤ 1.Source: §F.7 · p. 34

F.8 Necessity of the Execution Budget

  • The cited passages state that no valid procedure is powerful for any n, and that the procedure has EW1[K] ≥ kl(1−β, α)/kl(p, p̄) ≥ kl(1−β, α)m²p̄(1−p̄)/(ζ−mγ)².The first bound diverges as mγ approaches ζ from below.Source: §F.8 · p. 35
  • For live sequential testing, E_q[KL] ≥ kl(1−β, α)/kl(q, q⋆) ≥ kl(1−β, α)q⋆(1−q⋆)/ζ².This lower bound applies when the stopping time has finite mean harm q, certification probability is at most α above q⋆, and at least 1−β at q.Source: §F.8 · p. 35
  • With mγ < ζ, the execution test has size at most α, power at least 1 − β′ − χ_n, and expected execution cost at most K̄_ex; the live test has corresponding size, power, and cost bounds.The execution bound is E_W1[K] ≤ E_p[τ] ≤ K̄_ex, while the live bound is E_q[K_L] ≤ K̄_lv.Source: §F.8 · pp. 35–36
  • As α and β decrease with n large enough for χ_n < β, C_ex/C_lv converges to kl(q, q⋆)/kl(p, p̄), and the sharp restoration threshold is γ = ζ/m.For every γ < ζ/m, a valid and powerful procedure exists for sufficiently large n; for γ ≥ ζ/m, none exists at any n.Source: §F.8 · p. 36

F.9 Execution Across Strata

  • Across strata, every valid and powerful procedure has expected cost at least kl(1 − β, α)/t*, with cost shares a_s c_s / c̄ and design rates p̄ forming a saddle point.The optimal design assigns execution shares a_s proportional to w_s/g_s on active strata; the test’s shares are part of its validity, not only its cost.Source: §F.9 · pp. 37, 39
  • The stratified test achieves cost at most {log(1/α) + ū}/t* and power at least 1 − β′ − χ_n; its execution-to-live cost ratio converges to kl(q, q⋆)/(c_L t*).Execution is cheaper to first order exactly when t* > kl(q, q⋆)/c_L.Source: §F.9 · pp. 38–39
  • Earlier snapshots do not raise the stratified bound only under the stated matching continuation laws, routing probabilities, and cost condition; the comparison excludes snapshots that observe more or route differently.The paper leaves the storage-versus-bound tradeoff from choosing coarser snapshots unresolved.Source: §F.9 · p. 39

F.10 Snapshot Design for a Family of Gates

  • For a threshold family, a history h is a first deviation for some threshold exactly when the family intersects [m̄(h), m(h)); for a continuous threshold range this requires a running score maximum above θ_min.For a finite threshold set, the condition is B(m(h)) > B(m̄(h)), and an episode has at most n first deviations.Source: §F.10 · p. 40
  • A gate family is exactly identified by first-deviation snapshots when the stored set contains every gate’s open first-deviation history; the least such set is the union across gates.For thresholds in [θmin, 1), the required histories are running maxima above θmin at steps before termination that some gate leaves open.Source: §F.10 · p. 40
  • Broader logged decision histories can identify each gate when every first deviation has a stored ancestor, but minimal history sets need not be unique and require re-executing agreeing steps.The least-set result concerns first-deviation snapshots; storing every step-0 history also identifies every gate but may require more reruns.Source: §F.10 · p. 40

G.1 Statement

  • Conditional independence determines joint loss from the shared-state law and component conditional laws; without dependence restrictions, linked episode records identify joint risk while separate records generally do not.Separate (S, Li) records identify the joint law under no restriction only if, at each positive-probability state, at most one component’s conditional law is non-degenerate.Source: §G.1 · p. 41
  • Standalone component runs identify composed conditional losses only with known state distribution, invariant conditional behavior, and support for every composed state.Without support, the identified interval for a nontrivial loss event has width equal to the probability of composed states never seen in isolation; without a link between deployments, standalone records impose no restriction.Source: §G.1 · p. 41

G.2 Finite Setting and Composition Interfaces

  • A composition is specified by its shared state, scheduler, component loss laws, and joint loss map, with conditional independence, unrestricted dependence, or transport assumptions stated separately.These assumptions distinguish product-law identification, unrestricted coupling, known shared-state distribution, and invariance between standalone and composed runs.Source: §G.2 · p. 41

G.3 Lemmas

  • Paired component records fix exactly the set of joint laws compatible with the observed shared-state and component marginals, and unrestricted dependence can realize every such law.The coupling set is a singleton exactly when, at each positive-probability state, at most one component’s conditional loss law is non-degenerate.Source: §G.3 · p. 42

G.4 Proofs of Proposition G.1.1 Parts (i) to (iv)

The proofs characterize what component and state records identify about composed losses, and when standalone evidence transfers to a composition. They also establish verification checks and disclose the authors’ use of AI assistants.

G.4 Proofs of Proposition G.1.1 Parts (i) to (iv)

  • Under conditional independence, the composed loss law follows from the state law and component conditional laws; paired records cannot test that independence.The proof factors the joint state-loss law into component conditional laws, while paired records exclude no element of the compatible family under unrestricted dependence.Source: §G.4 · p. 42
  • Under unrestricted dependence given state, paired records identify two-component intersection probabilities only within sharp Fréchet bounds.The bounds average conditional lower and upper bounds across states, and every intermediate value is attainable.Source: §G.4 · p. 42
  • Jointly linking state and all component losses identifies every loss query, whereas state-only records identify only the state marginal.Paired records identify the joint law only when, at each positive-probability state, at most one component’s conditional loss law is non-degenerate.Source: §G.4 · p. 43
  • Standalone component evidence transfers when the state law is known, conditional laws are invariant across deployments, and every composed state is covered by standalone runs.Without invariance, standalone evidence places no restriction on the component’s conditional laws in the composition; without state coverage, event probabilities can remain within an interval.Source: §G.4 · p. 43

H Verification Index

  • The verification scripts check finite instances and counterexamples, while Appendices A–G prove the general theorems.The scripts use exact rational arithmetic for finite instances and disclose floating-point use for seeded Monte Carlo cases, logarithms, and dynamic programs.Source: H Verification Index · p. 43

I AI Use Statement

  • The authors report using AI assistants for implementation, analysis tooling, proof checking, figure preparation, and manuscript drafting and revision.They state that evaluation code over logged runs and saved experimental artifacts computed the reported empirical results, and that the authors take responsibility for the final content.Source: I AI Use Statement · p. 43

Related papers

Loading 2610.16280v1…