Finding Icebergs in Language-Model Workflow: Diagnosing Latent Structural Fragility with Stochastic Semantic Evidence Graphs

Matthew F. Dixon; Bertrand Nortier; Miquel Noguer i Alonso

cs.CLSep 3, 2026

Finding Icebergs in Language-Model Workflow: Diagnosing Latent Structural Fragility with Stochastic Semantic Evidence Graphs

Authors: Matthew F. Dixon, Bertrand Nortier, Miquel Noguer i Alonso

Organizations: BeliefLens · AI Finance Institute (AIFI) · University of Leicester · Cornell University

Abstract

AI-workflow governance cannot be reduced to checking the final answer: an apparently safe answer may rest on a fragile evidence path that ordinary evaluation cannot see, localize or govern. We call this hidden fragility a "structural iceberg": hallucinations and unsupported claims may form its visible tip, while consequential weakness remains submerged. Stochastic semantic evidence graphs (SSEGs) expose these icebergs by preserving workflow channels, propagating local uncertainty and identifying the hidden paths on which an apparently safe output depends. ALCE and RAGTruth show that visible failures at the tip -unsupported citations and hallucinated spans -rest on distinct submerged weaknesses and therefore require different interventions. Across retrieval, tool-use and controlled stress tests, SSEG localizes those weaknesses, supports targeted repair, produces no false automatic passes in 35,000 known-truth cases and reduces ToolSandbox review by 28.8% across 96 executions from two agent models. The same structural view carries into end-to-end governance: in a separately sealed 1,200-case FinGovBench study, adding SSEG to GPT-OSS-20B reduces unsafe releases from 452/660 to 8/660 while releasing all 540 safe cases and correctly distinguishing 592/600 matched workflow pairs. An unchanged-gate transfer to Qwen3-8B releases all 540 safe cases and none of 660 unsafe cases, whereas flat-UQ releases 520 unsafe cases. SSEG therefore moves governance below surface-level output checking, turning hidden evidence dependencies into auditable, path-specific decisions about intervention, revalidation and release.

Figures & tables

Panel of Figure 1 — Figure 1: The SSEG shown explicitly as a DAG. The observed inputs are $x=(Z_{U},Z_{E},Z_{O})$ . Equal-sized nodes represent observable components. An edge $p\to v$ records that output $Z_{p}$ is supplied to child $v$ . Retrieval node $R$ is the RAG component: it selects context from evidence input $E$ and returns the retained source set $Z_{R}=\bm{S}=(S_{1},\ldots,S_{J})$ , which is supplied to prompt node $P$ and preserved for evidence check $H$ . Thus $R$ denotes the retrieval operation, whereas $S_{j}$ denotes one retained source. The language-model component contains the autoregressive chain $t_{1}\to\cdots\to t_{m}$ , with conditional kernel $K_{j}(t_{j}\mid t_{<j},P)$ . Evidence check $H$ therefore receives both generated claim $C$ and its retained sources from $R$ . Direct source–token or tool–token edges are added only when declared traces or controlled interventions identify them; they are not inferred from attention alone. Here $Z_{T}$ is the candidate terminal action, $B_{T}^{+}$ is its robust propagated uncertainty bound and $\tau$ is the declared release tolerance. Expose applies the terminal check $B_{T}^{+}>\tau$ ; Localize path-ranks contributions $\rho_{vT}=\Gamma_{vT}b_{v}$ ; Route maps a leading node $v$ to its retained review artifact $\mathcal{R}(v)$ ; and Govern releases $Z_{T}$ or sends the affected path for human or automated review. After review or repair, the changed node and its recorded descendants are recomputed before the gate is applied again.

Stage	Study	Population	Endpoint and role
Expose	Controlled stress	35,000 known-truth cases	Bound coverage and false passes under graph misspecification.
Localize	MAGIC [ 44 ]	960 cases; 8,592 paths	Rank-1 localization of labelled conflict paths.
Route	ALCE; VitaminC [ 38 ; 39 ]	1,467 links; 688 revisions	Claim–source reliance and affected-path recall.
Govern	FinGovBench [ 47 ]	1,200 cases; 600 pairs	Safe recall, unsafe release and exact-pair accuracy.

Table 1: Main study design. Each benchmark tests one stage; endpoints are not pooled.

Model	Rule	Safe recall	Unsafe release	Exact pairs
GPT-OSS-20B	Model only	82.6%	452/660	20.5%
	Flat-UQ	1.1%	1/660	11.0%
	SSEG	100.0%	8/660	98.7%
Qwen3-8B	Model only	0.0%	0/660	10.0%
	Flat-UQ	96.9%	520/660	13.3%
	SSEG	100.0%	0/660	100.0%

Table 2: Sealed FinGovBench results on 1,200 cases (540 release-eligible; 660 requiring withholding). Exact-pair accuracy requires both members of a matched topology pair to be correct.

Stage	Iceberg question	Governance without SSEG	Governance with SSEG	Decision consequence
E [-1pt] X [-1pt] P [-1pt] O [-1pt] S [-1pt] E	Can hidden defects pass?	Nominal terminal gate false-passes 42.2% under combined stress.	100% observed bound coverage and zero false passes across 35,000 controlled cases.	A terminal pass is insufficient: widen the envelope or escalate when structural uncertainty is unresolved.
L [-1pt] O [-1pt] C [-1pt] A [-1pt] L [-1pt] I [-1pt] Z [-1pt] E	Can the conflict path be found?	Lexical rank-1 is 75.8%.	MAGIC rank-1 is 80.3–82.3% across five model families; all paired gains are positive.	Inspect the highest-contribution path first instead of searching every evidence path.
R [-1pt] O [-1pt] U [-1pt] T [-1pt] E	Which source should be reviewed?	HHEM-plus-lexical flat rank-1 is 58.7%; RAGAS is 61.3%.	ALCE rank-1 is 68.0%; on 688 VitaminC revisions, SSEG finds every affected claim path while reviewing 72.8% fewer claims than exhaustive NLI.	Route review to the named claim–source edge and revalidate its dependent claims.
G [-1pt] O [-1pt] V [-1pt] E [-1pt] R [-1pt] N	Can a closed-loop decision be released safely?	GPT-OSS alone releases 452/660 unsafe cases; flat-UQ releases almost nothing.	SSEG releases all 540 safe cases and withholds 652/660 unsafe cases with GPT-OSS; unchanged-gate Qwen transfer releases 540/540 safe and 0/660 unsafe.	Use the graph-aware gate for selective release; inspect residual cases as failures of local defect measurement.

Table 3: The main empirical argument. Each stage in the ELRG framework tests a different consequence of retaining dependency structure. Note that heterogeneous endpoints are not pooled.

Appendix figures & tables6 assets

Supplementary material from the paper’s appendix.

Appendix

Checkpoint	Immutable revision	Reported use
openai/gpt-oss-20b	6cee5e81ee83	FinGovBench, ALCE and complete-phrase audits
Qwen/Qwen3.5-9B	c20223623576	MAGIC and ALCE common-control scoring
Qwen/Qwen3-8B	b968826d9c46	FinGovBench cross-model transfer, phrase-equivalence and post-training studies
Mistral-7B-Instruct-v0.3	c170c708c41d	MAGIC, ALCE, RAGTruth and HotpotQA scoring
allenai/OLMo-2-1124-7B-Instruct	470b1fba1ae0	MAGIC and ALCE common-control scoring
unsloth/Meta-Llama-3.1-8B-Instruct	a2856192dd7c	MAGIC and ALCE common-control scoring

Appendix

Table 4: Open-weight model versions used in the experiments.

Figure 2: Frozen information-equivalence tests on three open-weight architectures. Bars show mean phrase-law distance and selected-phrase change rate; error bars are 95% configuration-bootstrap intervals and dashed lines are tolerances. Every relation fails at least one stability gate.

Figure 3: Evidence ladder. A: mean and maximum controlled discrepancies use 20% and 54% of the valid pathwise bound. B: the 120-date requalification set separates retrieval, presentation and interaction effects. C: a post-confirmatory descriptive audit uses a prespecified market-state reference distinct from the terminal-discrepancy endpoint. On the final 78 dates, SSEG and equal-information direct terminal drift both have zero reference errors at 50% coverage; SSEG retains the retrieval and presentation decomposition that terminal drift discards. The reference is an arithmetic benchmark derived from dated evidence, not a human judgment or future market outcome.

Question	Evaluation	Main result	Permitted conclusion
Propagation	35,000 known-truth stress cases	Robust envelope attained complete observed coverage and zero false passes under the tested misspecifications.	Conditional theorem verification, not field prevalence.
Workflow diagnosis	78 final financial dates; 312 executions	SSEG and direct terminal drift both admit zero reference errors at 50% coverage; SSEG retains typed path attribution.	Post-confirmatory diagnosis, not superior prediction or market correctness.
Conflict-path localization	960 untouched MAGIC cases; 8,592 candidate paths	Frozen graph–lexical ranking raises rank-1 localization from 75.8% to 80.3–82.3% across five model families.	Independently labelled localization and reduced ranked search.

Appendix

Table 5: The main evidence ladder. Each row answers a different part of the same governance claim; heterogeneous endpoints are not pooled.

Study	Population	Result and permitted interpretation
RCAEval	375 untouched incidents	82.1% top-one localization; tied with equal-telemetry flat rules, so no superiority claim.
SWE-rebench	1,614 issues; 216 unseen repositories	At 25% coverage, error falls from 4.0% to 2.4%; the interval touches zero.
Retrieval repair	7,500 controlled two-fault pipelines	Targeted repair restores affected descendants under injected faults; organic diagnosis is untested.
ToolSandbox	96 executions; two agent models	Retained paths reduce post-alarm review by 28.8%; trace-only SSEG does not beat the flat alarm.
Self-RAG	384 questions; 560 source interventions	Paths improve shortlisting and sensitivity detection; exact-hop localization needs paired edge contrasts.
RAGTruth and transfer	2,000 responses plus two holdouts	Modest word-level gain; summary-level and incomplete-law transfer gates fail.

Appendix

Table 6: Secondary evidence, retained for auditability but not pooled with the headline ladder.

Profile	Observable measurement	Claim limitation
Frontier black box	Generated text, returned top- $k$ alternatives and residual mass	Partial phrase law unless every declared alternative is exposed; no internal attribution.
Hosted open weight	Pinned endpoint and candidate or token log probabilities	Complete candidate law only when every complete phrase is scored under the same declared prefix.
Self-hosted instrumented	Full logits and candidate laws; optional hidden-state and routing summaries	Deeper diagnostics are available, but internal signals are not causal explanations without identification.

Appendix

Table 7: Capability-aware observation profiles.

LLM Safety Evaluation

Large language model safety evaluation measures harmful compliance, robustness, and safe utility across prompts, tools, and real-world tasks.

See all 258 papers

Structure Before Intelligence: Gating What Agentic Scientific Workflows Release
Oct 14, 2026Ashish Acharya, Aman Al Amin, Hong QinAgentic Workflows Runtime Enforcement for AI Agents
Department of Computer Science, Old Dominion University, Norfolk, Virginia, USA · Department of Computer Science, School of Data Science, Old Dominion University, Norfolk, Virginia, USA
SAGE: Governed Artifact Generation from Enterprise Guidelines
Sep 15, 2026Mohammadreza Sediqin, Shivali Dalmia, Sumukha Thoppanahalli +2LLM Hallucination Mitigation LLM Guardrails
Centific Research New York, USA · Centific Research Seattle, USA · Centific Research Washington, USA
LEDGER: Claim-to-Evidence Trace Graphs for Auditing LLM Agents
Aug 19, 2026Daehong Kim, Haichao Miao, Shusen LiuAI Agent Auditing Data Provenance
Carnegie Mellon University Pittsburgh, PA 15213 · Lawrence Livermore National Laboratory Livermore, CA 94550

Oct 14, 2026J/K move · Enter open · S save

Structure Before Intelligence: Gating What Agentic Scientific Workflows Release

Ashish Acharya, Aman Al Amin, Hong Qin

Department of Computer Science, Old Dominion University, Norfolk, Virginia, USA · Department of Computer Science, School of Data Science, Old Dominion University, Norfolk, Virginia, USA

Agentic Workflows Runtime Enforcement for AI Agents

Open paper AskPDF arXiv

An agentic scientific workflow can run to completion and still release wrong results: a silent numerical error, a stale input, or a defect in a shared upstream step can contaminate several outputs while a sibling branch stays correct. We treat trust in such results as a release decision. A harness around the workflow's directed acyclic graph (DAG) decides which outputs may be used: it enforces mandatory checks, contains failures to the affected branch, recomputes from tracked versions, adds validators, and releases a result only if a risk model estimates its probability of being invalid as low. Language-model agents work inside the harness, choosing corrective actions and reviewing releases, but cannot override it. On 60 held-out paired instances of two workflows with injected faults, we switched components on and off. Each supplied a different property. Containment and recovery raised the number of correct results. Validation supplied safety: fixed rules without validation released 37 invalid results, while validating every candidate released none. Risk estimation supplied efficiency, matching that safety with 31% fewer validators at somewhat lower yield, although better targeting than random validation was not shown. Lineage evidence helped on one workflow. The language model added no measurable benefit: whether invalid results escaped depended on the harness, not the model. This proof of concept points to a practical path: placing agents inside explicit release-control structure can keep released scientific results trustworthy, and it gives more capable agents a measurable baseline to improve on.

Abstract

LLM Safety Evaluation

Explore similar work

Structure Before Intelligence: Gating What Agentic Scientific Workflows Release

SAGE: Governed Artifact Generation from Enterprise Guidelines

LEDGER: Claim-to-Evidence Trace Graphs for Auditing LLM Agents