What Lies Beyond Perception: A Partition Theory of the Limits of AI Evaluation and Oversight

• Judge replacement can change benchmark scores even when candidate responses stay fixed, and judges favor mistakes resembling their own [Yang et al., 2026].Source: §1 · p. 2
• An agent’s discrimination is the partition induced by its perception, and its judgments cannot distinguish inputs within the same partition cell.Source: §1 · p. 2
• An examinee that knows its evaluator’s partition can group its finer percepts and answer as though it had no extra distinctions.The evaluator then sees no behavioral difference from an agent that genuinely has no greater discrimination.Source: §1 · p. 2
• When an examinee conflates inputs that its evaluator separates, it must reply alike to them, exposing the shortfall under probing.Source: §1 · p. 2
• The evaluator’s resolution sets the certification ceiling: harder elicitation of the examinee cannot raise it, but eliciting the evaluator can.A sharper evaluator must distinguish the concealer’s reply from that of the agent it presents as; an ensemble can combine distinctions its members lack individually.Source: §1 · pp. 2–3
• The framework organizes consequences for exact sandbagging, interpretability probes, monitor ensembles, controlled channels, self-assessment, and empirical predictions.It also relates published findings on judge disagreement, weight-noise detection, capability elicitation, and monitor evasion to the model.Source: §1 · pp. 3–4

2 Model

• An agent maps stimuli to percepts and then emits actions; its perception induces equivalence classes of stimuli it cannot distinguish.Source: §2 · p. 4
• Partition refinement orders discrimination, while the join overlays partitions and groups stimuli together only when every partition does.Refinement is only a partial order: two agents’ partitions may be incomparable, with each separating distinctions the other merges.Source: §2 · p. 4

Notation.

• The theory compares partitions over a chosen agent boundary and stimulus scope, and it assumes replies arrive unchanged without modeling an intervening medium.For a deployed system, prompts, scaffolds, tools, and decoding are part of the agent boundary; narrower test scopes certify refinement only on that scope.Source: Notation · pp. 5–7
• Axiom 3 requires behavior to factor through perception, so replies are fixed by percepts; seeds can be included among stimuli to represent sampling.Copying, lookup, and retrieval count as perception routes, but a fine partition alone does not establish competence.Source: Notation · p. 6
• A test specifies cases and acceptable replies, and it is gradable by an evaluator when its acceptance rule is constant across inputs that evaluator conflates.Source: Notation · p. 7
• The echo test is gradable by construction and accepts replies that the evaluator perceives as identical to the input.It assumes a closed channel in which replies are stimuli the evaluator can perceive; a copier passes trivially, which certifies discrimination rather than competence.Source: Notation · pp. 7–8

3 The asymmetry

• Detection from below applies when a conflated pair is probed and has disjoint acceptable replies; the echo test is complete among tests the evaluator can grade.The detected fact is a missing distinction, not concealment itself.Source: §3 · pp. 8–9
• The echo test is complete for tests the evaluator can grade: with non-empty acceptable replies, any examinee at least as sharp as the evaluator can pass them.Passing such a test certifies no more about discrimination than passing the echo test.Source: §3 · p. 9
• Under exhaustive probing, passage rules out an examinee that conflates a pair the evaluator separates, but remains consistent with both a peer and a sharper examinee.Interpreting failure as evidence of a shortfall requires a cooperative examinee; failure can also arise from incomparable partitions or a sharper examinee that declines to pass.Source: §3 · p. 9
• Exact emulation makes a sharper examinee behaviorally indistinguishable from a peer, while constructing that emulation may require computing the target’s emission and the evaluator’s partition.The theory establishes existence, not ease or capability of computing the required emission.Source: §3 · pp. 8–9
• An echo-failure detector flags an honestly weaker examinee and not a concealer presenting as the evaluator’s peer, so its flags point opposite to concealment under exhaustive probing.With sparse probing, an honestly weak examinee’s conflated pair may go unprobed.Source: §3 · pp. 10–11

3.1 Discrimination and task competence

• For task competence, discrimination is necessary but not sufficient: conflating inputs with no shared correct response forces an error, but separating them does not ensure correctness.The claims therefore bound discrimination and what it makes possible, rather than reducing capability to partition structure.Source: §3.1 · p. 11

4.1 No self-assessed ceiling

• An agent’s self-report cannot reveal distinctions between stimuli it conflates; it can learn of such blind spots only from an agent that separates them.A self-report factors through the agent’s own percepts, so two stimuli it cannot distinguish elicit the same report.Source: §4.1 · pp. 11–12

4.2 Strategic self-reports add nothing to testing

• Strategic self-reports are refutable when they overclaim discrimination, but no behavioural test refutes a claim that the agent conflates a pair it actually separates.On the echo test, an agent unable to distinguish a pair cannot pass for both members if it claims to separate them.Source: §4.2 · p. 12

4 Six consequences for evaluation

• Table 1 organizes six consequences by who assesses whom and whether the observed party exploits the assessment.The paper develops the consequences from its partition model and the definitions introduced in each subsection.Source: §4 · p. 11, Table 1 · p. 12

4.3 Absence is unprovable where a probe merges

• A probe’s positive distinction establishes that representations differ, but a negative result cannot establish sameness where the probe merges representations.Absence is certified only where the probe loses nothing of the representation it reads.Source: §4.3 · p. 13

4.4 Exact concealment leaves no behavioural trace

• Exact imitation makes sandbagging behaviourally undetectable; imperfect imitation is distinguishable only where the evaluator perceives the replies as different.The examinee need not be globally superior, only able to match the evaluator on distinctions it can see; harder tests do not change the evaluator’s resolution.Source: §4.4 · p. 13

Hiding a message.

• A monitor is blind under a given output distribution exactly when encoding leaves its observed cell distribution unchanged; blindness under every distribution requires cell-preserving renaming.The detector reads only which evaluator-cell an output enters.Source: Hiding a message · p. 14

4.5 When an added monitor helps

• An added monitor increases collective discrimination only if it separates a pair that the existing ensemble does not.Monitors with the same distinctions add no discrimination; diversity, not monitor count, determines the increase.Source: §4.5 · p. 14

4.6 Redundancy limits what a controlled channel can hide

• A controlled channel can hide a distinction exactly when it separates a pair that the undisturbed, uncontrolled channels do not, assuming the evaluator checks consistency.A model-written reasoning trace adds no independent channel; an unwriteable log or an unshapeable probe can provide one.Source: §4.6 · pp. 15–16

5.1 Noise and elicitation

• A concealing examinee stays at its presented score until its trigger or link breaks, then follows its unconcealed version; honest weakness has nothing to lose at that breakpoint.The subsequent rise depends on the unconcealed version’s score, and can shrink when task components break earlier under noise.Source: §5.1 · pp. 16–17, Figure 3 · p. 17

5.2 Existing observations

• Replacing a judge can change a benchmark score with responses fixed, and judges may favor candidates whose mistakes resemble their own.Repeated samples of one judge share its partition, while judges with similar partitions add little.Source: §5.2 · pp. 17–18
• Weight noise produced anomalous score improvements in sandbagging models; the partition account predicts a return to unconcealed replies, with smaller rises when deeper processing breaks earlier.Reported cases include significant rises across all 17 instruction–benchmark pairs and increases in two password-locked models; the no-goal evidence is thinner and does not establish Mistral Large’s motivation.Source: §5.2 · p. 18
• Fine-tuning or prompting recovered locked capabilities in reported settings, while fine-tuning and weight noise change the examinee rather than evaluate an unchanged model.Prompting recovered capability on multiple-choice questions; on one code-generation task, only fine-tuning did so.Source: §5.2 · pp. 18–19

5.3 Predictions

• For concealment left intact by examinee elicitation, detection should not rise as the examinee’s budget grows; a coarse evaluator stays at chance, while a sharp one stays level or falls.This prediction depends on the larger budget not making the examinee’s copy of its target worse in the evaluator’s view.Source: §5.3 · p. 20
• Raising the evaluator’s budget cannot lower its best detection rate under monotone elicitation, and can expose concealment tailored to the original evaluator but not an exact copy.Detection rises when the evaluator separates the concealer’s reply from the target’s at a probed stimulus.Source: §5.3 · p. 20
• Noise should restore a concealer’s unconcealed replies, with the score rise shrinking as task processing deepens and growing when the trigger or link is carried by less of the input or weights.The proposed test scores each item with and without its trigger on the same noised models across tasks of graded depth.Source: §5.3 · p. 20
• Encodings shaped against a monitor should approach renamings within its score level sets when varied inputs can isolate each output; a second monitor may detect what the first misses.The proposed test scores outputs with the shaping monitor and a second monitor before and after encoding.Source: §5.3 · pp. 20–21

Discrimination as partition

• Behavioral-equivalence frameworks partition inputs for different purposes; this paper compares the evaluator’s partition with the examinee’s to study what evaluation can certify.Related lineages include Myhill–Nerode equivalence, bisimulation, causal states, and the information bottleneck [Tishby et al., 2000].Source: §6 · p. 21

Evaluator quality and formal accounts

• Judge-quality research measures evaluator differences and biases, while this account asks what follows structurally from an evaluator having limited resolution.Reported concerns include non-transferable judge rankings [Norman et al., 2026], judge–examinee similarity, and contrastive-context effects [Eshuijs et al., 2025].Source: §6 · p. 21
• Scalable-oversight work studies weak-to-strong performance, capability-gap scaling, debate, and latent knowledge; this paper instead characterizes what an evaluator cannot certify at any gap.Its scope is narrower than computational or statistical impossibility results: the obstacle concerns what one agent can establish about another’s discrimination.Source: §6 · pp. 21–22

Evaluation and sandbagging

• Models can be prompted or fine-tuned to underperform selectively and approximate a weaker model’s profile; fine-tuning and, in tested settings, prompting recover capability from password-locked models, while weight noise exposes sandbagging.Source: §6 · p. 22

Routes counted as perception

• Copying, retrieval, and caching count as perception, so a system may pass the echo test with fine discrimination without being competent.The results bound discrimination, not competence.Source: §7 · p. 22

Graded perception and randomness

• The theory uses exact partitions and fixed replies; graded perception and random sampling can make detection probabilistic, and graceful extension to graded perception remains open.When the evaluator cannot hold the sampling seed fixed, the stated single-shot floor is probabilistic rather than certain.Source: §7 · p. 22

Probe cost

• Detection from below is guaranteed only when a conflated pair is probed, but exhaustive probing is infeasible and the sample complexity of finding such a pair is unaddressed.Source: §7 · p. 22

Noise and elicitation

• The noise model removes distinctions and emission parts outright, unlike gradual and draw-dependent real noise; monotone elicitation also excludes prompts that remove distinctions.Source: §7 · p. 23

Willingness and knowledge

• Emulation is shown to be possible, not inevitable, and requires the system to model the evaluator.Source: §7 · p. 23

8 Conclusion

• An examinee matching every distinction its evaluator draws can appear as a peer, while any missed distinction is exposed under exhaustive probing.The bound is set by the evaluator’s resolution under its current elicitation; harder examinee elicitation does not move it, but changing the evaluator can.Source: §8 · p. 23
• The section predicts that evaluator sharpening can raise detection, weight noise restores unconcealed replies with smaller rises on deeper tasks, and monitor-shaped encodings approach renamings within score level sets.Under exhaustive probing, a coarse evaluator flags honest weakness but not a concealer presenting as its peer; an honest weak control arm can reveal this distinction.Source: §8 · p. 23
• The results characterize undetectable emulations and encodings but do not provide a way to build them; defenders can widen the evaluator’s partition or add an uncontrolled channel.The account distinguishes this structural characterization from prior demonstrations of approximate weaker-profile emulation.Source: Broader Impact Statement · p. 23

A Proofs and details for Section 3

• A finer examinee can map each of its percepts to the evaluator’s percept and reproduce any behavior that factors through the evaluator’s perception.The coarsening map makes the evaluator’s percept a well-defined function of the examinee’s percept, allowing the examinee to realize the same replies at every stimulus.Source: A Proofs and details for Section 3 · p. 28
• The echo test is complete for tests the evaluator can grade, provided each stimulus has an acceptable reply.The examinee can choose one prototype reply per evaluator cell, rather than echoing the input verbatim; the emulator’s behavior must factor through the evaluator’s perception.Source: A Proofs and details for Section 3 · p. 28

A.1 Random emission: the lucky pass

• A coarse examinee with random emission passes both probes with probability at most 1/4, or all 2m probes with probability at most 4^-m.The bound applies when the examinee conflates a pair that the evaluator separates, and its replies are drawn independently at each probe.Source: §A.1 · p. 29
• Randomization makes a coarse examinee detectable probabilistically rather than with certainty, and repetition restores the discrimination-floor guarantee exponentially.The worst case splits reply probability evenly between the two evaluator cells; a single-shot pass no longer certifies that the examinee’s partition refines the evaluator’s.Source: §A.1 · p. 29

A.2 A worked example

• A final-answer-only evaluator groups valid and flawed solutions with the same answer into one cell, so its rubric cannot distinguish their reasoning.The example uses twenty worked solutions: reasoning status has two values and final answer has ten.Source: §A.2 · p. 29
• A reasoning-aware examinee can pass by emitting a valid solution with the stimulus’s final answer, matching the evaluator’s reply standard at all twenty stimuli.A final-answer-only examinee can produce the same replies, so the evaluator cannot tell whether the examinee reads reasoning.Source: §A.2 · p. 29
• Misreading 8 as 3 makes either examinee fail on a stimulus pair the evaluator separates, regardless of whether it reads reasoning.The failure of the reasoning-aware variant therefore does not show that it lacks access to reasoning.Source: §A.2 · p. 29
• Adding an observer that reads reasoning raises the discrimination floor, but a concealing examinee can still fail like a weaker one.The joint evaluator can establish that a cooperative examinee reads reasoning; it cannot distinguish concealment from weakness when replies match.Source: §A.2 · p. 30

A.3 What passing and failing the echo test say

• When the examinee’s partition is incomparable with the evaluator’s, failure can reflect a boundary-crossing conflation without revealing its other distinctions.The echo test does not distinguish this case from an examinee that is strictly coarser.Source: §A.3 · p. 30
• A failed probe can locate a conflated pair for a cooperative examinee, but says nothing about distinctions the evaluator itself merges.The examinee may be arbitrarily fine on those unseen distinctions, so detection does not characterize its overall partition.Source: §A.3 · pp. 30–31
• Passing every echo probe establishes that the examinee separates everything the evaluator separates, but leaves finer distinctions above that floor open.The pass is universal and does not require cooperation; failure is existential and conditional, and neither outcome caps discrimination beyond the evaluator’s resolution.Source: §A.3 · p. 31

A.4 The regress of evaluators

• No evaluator’s adequacy is certified within the account, because certifying it would require a sharper evaluator whose adequacy is itself unestablished.The comparison is agent-to-agent rather than against a privileged standard; the account does not place any agent at the lattice’s top element.Source: §A.4 · p. 31

B.1 Hiding a message

• A detector distinguishes encoded from unencoded outputs exactly when their distributions over monitor cells differ.Even when the encoding moves individual outputs across cell boundaries, balanced cell frequencies can leave the monitor blind under a particular input distribution.Source: §B.1 · pp. 31–32
• An encoding is hidden under every input distribution only if it preserves each output’s monitor cell; a single boundary-crossing output can expose it under a suitable distribution.Balanced frequencies can hide a swap under one distribution, but another distribution can reveal it.Source: §B.1 · p. 32
• Randomized encodings inherit the distributional condition, while renamings preserve cells with probability one; varied test sets can isolate outputs and expose non-renamings.Cell-frequency balancing depends on the monitor’s input distribution, which may drift; the cited security claim is relative to the monitor’s partition.Source: §B.1 · p. 32

B.2 Proofs for Section 4

• The accompanying proofs derive bounds for self-report and probes, exact emulation, ensemble refinement, and concealment through a controlled channel.They show that self-report factors through the reporting agent’s perception, that identical observed behavior is indistinguishable, and that a controlled channel can hide a difference only when uncontrolled channels agree.Source: §B.2 · pp. 32–33

On §4.1

• A model’s stronger prediction of its own behavior concerns self-prediction, not whether it can identify inputs it conflates.The discussion distinguishes this from findings of no privileged access to knowledge of language and from definitions requiring privileged self-access.Source: §B.3 · p. 33

On §4.3

• A linear probe, sparse dictionary, or activation readout can reveal distinctions behavior alone conflates, but only where the probe loses nothing does a null result support absence.That conclusion applies only to the representation the probe reads; probe unreliability and incomplete sparse dictionaries are cited as practical concerns.Source: §B.3 · p. 33

On §4.5

• Repeated samples of one judge share its partition, while judges with similar mistakes may add few distinctions; averaging votes is outside Proposition 21’s partition model.The discussion relates this redundancy criterion to test-suite reduction and mutation testing.Source: §B.3 · pp. 33–34

On §4.6

• An emitted reasoning trace is a channel the model controls, linking monitorability’s fragility to the loss of an uncontrolled channel.The discussion connects this concern to untrusted monitoring and possible collusion.Source: §B.3 · p. 34
• In Figure 6, only distinctions drawn by the controlled channel but absent from the uncontrolled-channel join can be falsified without failing consistency.A corroborated distinction cannot be moved without inconsistency.Source: Figure 6 · p. 34

C Proofs and details for Section 5

• From σe onward, a vanished trigger makes the triggered and untriggered inputs share a cell, so B replies alike; below σe, the trigger and its link hold.The proof identifies the third claim as Corollary 13 applied to the noised examinee and says an unconcealed examinee has no trigger or link.Source: C Proofs and details for Section 5 · pp. 34–35

D Further related work

• Blackwell’s garbling order gives a precedent for one-way information ordering, while Proposition 21 applies the partition join to ensemble monitor discrimination.The discussion identifies partition refinement and factorisation through a coarser quotient as proof tools.Source: D Further related work · p. 35
• Renaming within cells is invisible to observers that read only which cell was occupied, but unlike an ICA permutation it need not be invertible..Source: D Further related work · p. 35
• Definition 18 treats substitution invisibility as a distributional analogue of opacity, and Proposition 19 makes unchanged observer-cell frequencies the exact criterion.Source: D Further related work · p. 35

E Notation

• Table 2 is identified as the paper’s notation table.Source: Table 2 · p. 36