Counterfactual Sensitivity Is Not Repairability: Auditing Replay Probes for Video Evidence
Organizations: Department of Computer and Electrical Engineering, Texas A&M University at Qatar, Doha, Qatar · College of Science and Engineering, Hamad Bin Khalifa University, Doha, Qatar · Department of Computer and Electrical Engineering, Texas A&M University, College Station, TX, USA
Abstract
Tool-using video agents retrieve visual evidence before answering, but the final answer is not forced to depend on what was retrieved. The natural black box test is counterfactual: destroy the semantic content of the frames the agent retrieved and check whether the answer changes, against a matched sham that re-executes the identical pipeline on those same frames. We introduce CARVE, a black-box counterfactual probe that compares answer changes under matched SHAM and DESTROY replays. Across three independent k=3 runs on a frozen VideoExplorer-style agent, DESTROY changes the answer 29.3 percentage points more often than SHAM, yielding a large and reproducible aggregate effect. Question-level scores are less stable, and increasing the replay budget from k=3 to k=10 reduces ties but weakens the original zero-threshold routing policy. At k=3, CARVE selects 538 of 1,258 LVBench questions and improves accuracy by 3.26 points, with higher fallback yield than most matched random subsets. The score shows only a weak association with annotated temporal coverage, so CARVE is best understood as a routing signal rather than a direct grounding classifier. Our implementation is available at https://github.com/KurbanIntelligenceLab/CARVE.
Figures & tables
| Metric | Three-seed mean | Seed SD |
|---|---|---|
| Probe flip rates | ||
| SELF flip rate | ||
| SHAM flip rate | ||
| DESTROY flip rate | ||
| Estimated-effect distribution | ||
| Mean | ||
| Score by evidence coverage and correctness | ||||
| Gold cov. | Correct | Mean | 95% CI | |
| Yes | Yes | 275 | 0.453 | [0.403, 0.502] |
| No | Yes | 293 | 0.325 | [0.266, 0.387] |
| Yes | No | 245 | 0.191 | [0.136, 0.244] |
| No | No | 436 | 0.242 | [0.207, 0.278] |
| Association with evidence coverage | ||||
| Policy | Selected | Repairs | Harms | Yield per 100 |
|---|---|---|---|---|
| 166 | 33 | 19 | 8.43 | |
| 372 | 65 | 38 | 7.26 | |
| 538 | 98 | 57 | 7.62 | |
| Plain random | 538 | – | – | 5.09 |
| Video-balanced random | 538 | – | – | 5.28 |
| Evidence-matched random | 538 | – | – | 5.30 |
| Method | Acc. (%) | Tools | Tok. | Acc. | Repairs | Harms | 95% CI |
| LVBench ( ) | |||||||
| Vanilla | 32.2k | – | – | – | – | ||
| Judge-grnd. | 37.6k | [-0.40, +0.40] | |||||
| Look-more | 37.5k | [-0.92, +0.07] | |||||
| Self-consist. | 36.9k | [-3.58, -0.40] | |||||
| Random deferral | 35.8k | – | – | [+0.95, +3.42]* | |||
Appendix figures & tables6 assets
Supplementary material from the paper’s appendix.
Appendix
| Run pair | Pearson | Sign agreement | Trigger-set Jaccard |
|---|---|---|---|
| Run 1 vs. Run 2 | 0.586 | 0.617 | 0.198 |
| Run 1 vs. Run 3 | 0.548 | 0.617 | 0.237 |
| Run 2 vs. Run 3 | 0.547 | 0.601 | 0.205 |
| Budget | Distribution | Tie excess | |||
|---|---|---|---|---|---|
| LVBench | |||||
| Homogeneous prediction | 0.117 | 0.236 | 0.647 | – | |
| Observed ( Run 1 ) | 0.133 | 0.298 | 0.569 | +0.062 | |
| Homogeneous prediction | 0.056 | 0.071 | 0.874 | – | |
| Observed | 0.165 | 0.123 | 0.712 | +0.052 | |
| Change from to | +0.032 | 0.175 | +0.143 | 0.010 | |
| Replay budget | Stratum | (SHAM) | (DESTROY) | |
|---|---|---|---|---|
| Covered, correct | 275 | [0.181, 0.250] | [0.625, 0.710] | |
| Uncovered, correct | 293 | [0.241, 0.324] | [0.555, 0.658] | |
| Covered, incorrect | 245 | [0.376, 0.462] | [0.564, 0.657] | |
| Uncovered, incorrect | 436 | [0.391, 0.455] | [0.632, 0.700] | |
| Covered, correct | 276 | [0.182, 0.242] | [0.605, 0.683] | |
| Uncovered, correct | 294 | [0.248, 0.322] | [0.574, 0.660] |
| Metric | Confidence | |
|---|---|---|
| Accuracy at 100% coverage | 42.86% | 42.86% |
| Accuracy at 90% coverage | 44.18% | 43.47% |
| Accuracy at 70% coverage | 44.81% | 42.79% |
| Partial risk AUC, 70–100% | 0.558 | 0.567 |
| Full-range AURC | 0.544 | 0.521 |
| Source | Source gain | Transfer gain | Rule selected |
|---|---|---|---|
| (pp) | (pp) | (%) | |
| 7B | 96.8 | ||
| 32B | 93.2 |
| Method | Train-free | Black-box | Agentic | Primary signal |
|---|---|---|---|---|
| VER [ 4 ] | ✗ | ✗ | ✗ | Evidence-grounding reward |
| DeFacto [ 6 ] | ✗ | ✗ | ✗ | Counterfactual supervision |
| VideoSEAL [ 5 ] | ✗ | ✗ | ✓ | Temporal overlap and judge score |
| STEAR [ 11 ] | ✓ | ✗ | ✗ | Internal patch intervention |
| FACTOR [ 13 ] | ✓ | ✓ | ✗ | Attribute intervention |
| Self-consistency [ 14 ] | ✓ | ✓ | Optional | Answer agreement |
AI Agent Auditing
AI agent auditing examines agents’ actions, tool use, evidence, and outcomes to assess safety, compliance, reliability, and accountability.
See all 262 papers