ASSERT: A Measurement Pipeline for GenAI Audits

Riccardo Fogliato; Abhinav Palia; Xiawei Wang; Emily Sheng; Chad Atalla; Jean Garcia-Gathright; Nicholas Pangakis; Sharman Tan

cs.CLAug 14, 2026

ASSERT: A Measurement Pipeline for GenAI Audits

Authors: Riccardo Fogliato, Abhinav Palia, Xiawei Wang, Emily Sheng, Chad Atalla, Jean Garcia-Gathright, Nicholas Pangakis, Sharman Tan, +6 more

Organizations: Microsoft

Abstract

Audits of generative AI (GenAI) systems often summarize behavior as a reported rate: how often the audited system complies with policy. Researchers and stakeholders use that rate to compare systems, track regressions, and gate deployment. A reported rate reflects both the system under audit and the measurement choices behind it, so a change in the rate can leave it unclear whether the system or those choices moved. We introduce ASSERT, a specification-driven measurement pipeline for GenAI audits that ties each reported rate to a written specification of the measurement choices used to produce it. ASSERT helps draft a behavioral rubric and test cases, then runs the audit against a GenAI system and returns a reported rate. In a case study on conversational deception, we observe that the reported rate moves substantially with the dialogue setup, the simulated user, the judge, and the evidence bar for non-compliance. These measurement choices substantially change the reported rate and can reorder GenAI system rankings. Because each reported rate is tied to an explicit specification, differences across audits are easier to attribute and interpret.

Figures & tables

Figure 1: ASSERT turns a broad concern into an inspectable measurement pipeline. Researchers define what counts as the behavior, write scoring rules, build test cases, run multi-turn interactions with the GenAI system, score the transcripts, and aggregate the scores into a reported rate. The lower panels walk through one illustrative deception example.

Panel of Figure 2 — Figure 2: ASSERT measurement specification.

Figure 3: Specification curve for the deception multiverse analysis. Specification curve for deception with the evaluated GenAI system fixed to GPT-5.5 ( OpenAI, 2026 ) . Each point is one tested combination of interaction condition, simulated user, judge, and evidentiary standard. Circles are the Grok-4.3 simulated user and triangles the GPT-5.5 simulated user; colors denote judges. Vertical lines show 90% Wilson confidence intervals. The dashed line marks the baseline reported rate, and the bottom strip records each specification’s choices. The shaded band marks the 81–83% range across five fresh judge calls on the baseline transcripts; it is not an uncertainty interval.

	Judge
Evaluated GenAI system	GPT-5.5	Opus-4.7	Grok-4.3
GPT-5.5	82	80	95
Opus-4.7	64	97	99
Grok-4.3	50	67	97

Table 1: Reported rate (%) for deception by evaluated GenAI system and judge (

N{=}120

transcripts per system; Grok-4.3 simulated user).

Appendix figures & tables1 asset

Supplementary material from the paper’s appendix.

Appendix

Figure 5: Reported rates across concepts. Reported rates for four safety concepts (columns) under varied measurement choices. Within each panel the rows are, top to bottom: rerunning the fixed baseline specification (fixed-specification stochastic variation), substituting the judge, changing the transcript-level scoring rule from flagging any violated applicable criterion to flagging only when a majority of applicable criteria are violated, and reporting the rate separately for each level of one concept-specific elicitation factor. Each dot is the reported rate at one level of that row’s factor; the bar spans the min–max range as that factor varies, with the other choices held at the baseline specification (dashed line). Rerunning a fixed specification changes the rate by only a few points. In most concepts at least one reasonable alternative changes it more, and which alternative dominates differs across concepts; ISA is the exception, changing little on the plotted axes.

Explore similar work

Governance-as-Code: Translating EU AI Act Technical Requirements into Executable Compliance Pipelines for Generative AI Systems
Sep 17, 2026Rudrendu Kumar Paul, Sourav NandyAlgorithmic Auditing AI Governance
Boston University, Boston, MA, USA
The Compliance Gap: Why AI Systems Promise to Follow Process Instructions but Don't
May 3, 2026Kwan Soo ShinAI Agent Benchmarks LLM Honesty
PolymathMinds AI Lab
AuditBench: Evaluating Alignment Auditing Techniques on Models with Hidden Behaviors
Feb 26, 2026Abhay Sheshadri, Aidan Ewart, Elias Kempf +8Benchmark Auditing AI Agent Evaluation
Anthropic Fellows Program · Anthropic

Sep 17, 2026J/K move · Enter open · S save

Governance-as-Code: Translating EU AI Act Technical Requirements into Executable Compliance Pipelines for Generative AI Systems

Rudrendu Kumar Paul, Sourav Nandy

Boston University, Boston, MA, USA

Algorithmic Auditing AI Governance

Open paper AskPDF arXiv

The EU AI Act (Regulation 2024/1689) imposes technical obligations on high-risk AI providers, yet Articles 8-15 were drafted for predictive AI and leave seven technical gaps when applied to generative systems, spanning non-deterministic data governance, training-data provenance, continuous conformity, human oversight, open-ended robustness, emergent risk, and generative fairness. We deliver Governance-as-Code (GaC), a framework of 43 machine-checkable acceptance criteria across six compliance modules that run in a CI/CD pipeline and emit Article-indexed audit evidence, and we show the actual Rego policy code rather than merely describing it. Our central commitment is that the Act's open-textured standards ("appropriate levels," "possible biases") become declared, auditable numbers: robustness thresholds are derived from the provider's documented baseline and a state-of-the-art floor, and framing bias is collapsed into eight measurable proxies tested by counterfactual demographic probing. We also correct who owes what, since under Article 25 and Chapter V a downstream deployer relies on the upstream provider's Article 53 training-data summary and documents only the layers it controls, so GaC verifies that summary rather than demanding per-sample documentation the deployer never had. We validate on two enterprise deployments, a high-risk advisory chatbot and a limited-risk content generator, benchmarking against a manual expert audit rather than documentation artifacts that were never designed to enforce compliance. GaC reproduces all of the manual audit's findings, including three penalty-triggering violations, while cutting audit labor by roughly 75%.

Abstract

Explore similar work

Governance-as-Code: Translating EU AI Act Technical Requirements into Executable Compliance Pipelines for Generative AI Systems

The Compliance Gap: Why AI Systems Promise to Follow Process Instructions but Don't

AuditBench: Evaluating Alignment Auditing Techniques on Models with Hidden Behaviors