cs.LOJul 22, 2026

Operational Identity: A Finite Audit of Declared and Implemented Rules of Sameness

Authors: Denise M. Case

Abstract

A record system declares when two records refer to the same entity, occurrence, scope, or rule. Its disclosed implementation mechanisms induce a corresponding operational identity relation. The declared and implemented relations may diverge systematically without producing a provenance gap or detectable contradiction. A system can apply, consistently and with every record individually correct, a rule of sameness that no artifact declares. This paper formalizes that implemented relation. A declared identity regime partitions a finite record domain into co-reference classes; a disclosed mechanism, through its typed identity-relevant outcomes, induces an operational identity partition of the same domain. The audit compares these partitions in the refinement lattice. A mechanism is faithful when the declared partition refines the operational partition, so no declared class is split. A divergence witness is a pair the declaration merges and the mechanism separates; such witnesses are decidable by pair enumeration. When an imported sibling basis also splits a declared class, local comparison with its partition yields sibling-aligned, sub-sibling, super-sibling, or sibling-incomparable divergence. This result reports only the relationship; it does not identify the basis carried by the mechanism. Global equality of the operational and sibling partitions is defined separately as regime substitution and does not follow from sibling alignment. A version field incremented on every textual edit inhabits the sub-sibling case by splitting declared classes more finely than either imported basis. The audit is three-valued and relative to the disclosed artifacts, evaluated surfaces, and identified uses; each boundary has a finite refuting witness. A passing verdict is non-monotone because extending the transformation history can merge declared classes and create a witness among records already examined.

Explore similar work

CardsList
Sep 14, 2026cs.LG

Interpolation Is Not Invariance: Pair Count Is Not Coverage in Transformation Audits

Counting equivalent pairs is a common way to report transformation-audit coverage, but it can substantially overstate the constraints imposed by an audit: pairs generated from the same semantic object are correlated, and complete orbit graphs contain algebraically redundant edges. We therefore distinguish four complementary quantities---edge count mm, effective contrast rank ss, population support rank rr, and graph spectral gap ηη---and characterize their roles in audit coverage and deployment reliability. Under a rank-rr Gaussian contrast model, a population-invariant calibrated reader exists exactly when the anchor has a component in ker⁡T\ker T. When an audit has rank s<rs < r, its unobserved risk is R⋆/UR^\star/U, with U∼Beta⁡((r−s)/2,s/2)U \sim \operatorname{Beta}((r-s)/2,s/2); when s≥rs \ge r, exact calibrated interpolation is infeasible. The same distinction appears in orbit topology: a spanning tree imposes the same exact-null constraints as a complete graph, while a sharp graph Poincare inequality propagates edge-level drift to an entire orbit at a cost proportional to 1/η1/η. Cyclic audits can additionally yield zero pair-level leave-one-out error without holding out any semantic object. To address these failures, we derive exact block-Woodbury leave-one-orbit-out updates and introduce a source-disjoint deployment gate over finitely many candidate readers. The gate retains the original reader unless uncertainty bounds certify lower drift within a prescribed clean-utility budget. etc..
Mohammed Ahnouch, Lotfi Elaachak
Algorithm AuditingOptimal Ergodic Coverage
AskPDF
Apr 17, 2026cs.CY

High-Risk AI Systems and the Problem of Identity in the European AI Act

The EU Artificial Intelligence Act (AIA) establishes a lifecycle governance regime for high-risk AI systems built around ex-ante conformity assessment, post-market monitoring, and re-assessment upon "substantial modification." These obligations presuppose AI identity judgments: regulators and providers must decide when an updated system remains the same system over time. In this work, we show how this logic is clarified by the function+ framework of artifact identity, which individuates AI systems by their intended function together with context-sensitive criteria of appropriate functioning, captured as "AI trustworthiness." We further argue that the AIA does not provide an internal, auditable criterion for synchronic identity--when two AI systems at a given time should count as the same for regulatory purposes--and instead largely defers such sameness determinations to sectoral or harmonization instruments. function+ supplies a synchronic identity test anchored in intended function and trustworthiness profiles and levels, making synchronic identity decisions inspectable in governance settings such as procurement, liability, and market surveillance. Our contribution is a conceptual and auditing lens: we provide a correspondence map between AIA lifecycle obligations and function+ identity components, and we make the synchronic case operationally legible via a minimal decision flow for audit and dispute contexts. We conclude with two implementation-facing recommendations: (1) more precise, testable reporting of intended purpose, and (2) standardized, auditable trustworthiness reporting that supports comparability over time and across deployments.
Andrea Ferrario
Responsible Artificial IntelligenceArtificial Intelligence RiskArtificial Intelligence SystemsIdentityImplicit Identity
AskPDF
Jun 27, 2026cs.LG

Statistically Indistinguishable, Operationally Distinct: A Formal Barrier for Tabular Foundation Models

Tabular foundation models cannot reason about data produced by running systems without access to the rules that govern them. We make this statement falsifiable. The \emph{Operational Turing Test} (OTT) constructs pairs of legal and rule-violating database states whose 11- and 22-way column-value marginals match to a total variation of <0.02<0.02; Le~Cam's lemma then bounds any values-only classifier at ≥0.49\geq0.49 Bayes error. Three values-only baselines (XGBoost, TabICL, TabPFN) hit the bound exactly (accuracy 0.500.50, pre-registered two one-sided tests (TOST) p<0.002p<0.002), raw row-level access does not help, exposing relational value consistency closes most of the gap, and only a classifier fed by seven executable rule-derived audits reaches 1.001.00 classification accuracy. In three matched 100100-state frontier large-language-model (LLM) runs, models given the schema, trigger source, rule tables, and state files classify at most 2/502/50 legal states as LEGAL; GPT-5.5 accepts 0/500/50 legal states even with higher reasoning effort and a Structured Query Language (SQL) executor. The access-ladder pattern also appears on a second schema with structurally distinct rule families (banking ledger: cross-row balance, cumulative aggregate). The barrier is identifiability, not capacity: scale, data, and richer features cannot cross it without operational grounding.
Tassilo Klein, Johannes Hoffart
Tabular Foundation ModelsCounter Turing TestViolationIndistinguishabilityBarriers
AskPDF