A reasoning model asked whether a causal effect is recoverable from observational data can fail in two ways: it refuses an identifiable query or answers a nonidentifiable one. The latter is more consequential, as no observational data can validate the claimed formula. Measuring this failure requires queries that are provably non-identifiable, which prior evaluations lack, and grading that accepts correct formulas in any equivalent form, which string matching cannot provide. We build CERTID, a formal identification pipeline that addresses both limitations. CERTID uses the sound and complete causal identification algorithm ID to certify whether an effect is identifiable from a given graph and query, and verifies returned formulas against structural causal models whose interventional distributions are known exactly. CERTID further develops theoretical results to mitigate structural leakage, repair non-identifiable queries, and establish grading guarantees. We evaluate three frontier reasoning models (Gemini Flash, Gemini Pro, and GPT5.5) on 1,200 certified instances spanning 4 to 50 vertices. Accuracy proves a poor proxy for soundness: on identical instances, the false-claim rate on non-identifiable queries varies by seventeen-fold across models. We also find that models decide identifiability with 97-100% accuracy on graphs generated after the strongest model's training snapshot. Instances, the certification procedure, the verifier, and per-instance records are available at https://anonymous.4open.science/r/certid-D718.
Figures & tables
Benchmark
Ground truth
Unanswerable instances
Grading
cladder ( Jin et al., 2023 )
oracle-computed
—
string
noisycausal ( Xu and Fu, 2026 )
SCM-computed
—
string
qrdata ( Liu et al., 2024 )
data-computed
—
string
causalbench ( Wang, 2024 )
annotated
—
string
econcausal ( Lee et al., 2026 )
curated
underspecified
string
abstentionbench ( Kirichenko et al., 2026 )
annotated
annotated
string
Table 1: How ground truth and grading are established in causal reasoning benchmarks. In prior methods, every query is answerable when groundtruth is provided or unanswerable determined by human judgment. CertID is the only benchmark without ground truth or human judgment.
Figure 1: (a) an error current evaluations cannot catch, (b) the two computations that let us catch it, and (c) what the resulting measurement separates.
Figure 2: How CertID ’s one instance moves through the evaluation. (1) An instance is drawn from a family defined in Section 3.1 and certified by id (Definition 3 ). (2) The system sees the graph and query but not the label, and its reply is parsed into a response (Section 4.2 ). (3) The verdict is compared with the label (Definition 5 ); for a correct claim, the estimand is also verified on sampled SCMs (Section 4.3 ). The dashed row follows the confounded graph of Figure 1 (a): the system returns an estimand for a non-identifiable query, a false claim that no observational data can expose.
Model
Scored
Acc.
Id. rate
Ans. rate
False-claim rate
FLASH
600/600
0.983
0.500
0.513
0.030
PRO
589/600
0.978
0.506
0.511
0.028
GPT-5.5
600/600
0.998
0.500
0.498
0.000
Accuracy
False-claim
Model
Rand. fam.
Pub. fam.
Rand. fam.
Pub. fam.
FLASH
0.981
0.992
0.033
0.017
Table 2: Verdict performance on the main pool: 600 instances, balanced between identifiable and non-identifiable queries. Random-family graphs sweep ∣V∣∈{5,7,9,11,13} .
Figure 3: Accuracy and false-claim rate against graph size, three frontier models on identical instances and identical prompts. (a) Accuracy separates the models by about ten points and declines gently. (b) The false-claim rate separates them by a factor of 17 pooled.
Appendix figures & tables14 assets
Supplementary material from the paper’s appendix.
Appendix
Symbol
Meaning
Introduced
graphs and models
G
acyclic directed mixed graph over V
Sec. 2
V
observed variables of G
Sec. 2
X,Y
disjoint treatment and outcome sets
Sec. 2
B(G)
bi-directed edges of G
Sec. 2
An(Y)
ancestors of Y
Sec. 2
Appendix
Table 3: Symbols used in the paper, with the section in which each is introduced.
Feature
Definition
AUC
directed degree sum
d(u)+d(v)
0.574
directed degree min
min{d(u),d(v)}
0.534
directed degree max
max{d(u),d(v)}
0.580
bi-directed degree sum
b(u)+b(v)
0.442
bi-directed degree min
min{b(u),b(v)}
0.410
bi-directed degree max
max{b(u),b(v)}
0.480
Appendix
Table 4: The thirteen structural features, and their single-feature AUC on our construction (927 edges). Values outside [0.45,0.55] are in bold.
uniform injection
our construction
common parents
0.266
0.472
directed degree min
0.321
0.534
bi-directed degree sum
0.299
0.442
bi-directed degree min
0.258
0.410
directed distance
0.585
0.637
pooled classifier
0.825
0.652
Appendix
Table 5: AUC under uniform injection and under our construction. Rows are single-feature AUCs; the last row is the held-out pooled classifier.
main pool
scale grid
flash
2,421
4,114
pro
8,070
17,144
gpt-5.5
2,994
5,733
Appendix
Table 6: Mean reasoning tokens per reply.
Network
Domain
Source
Nodes
Edges
asia
lung-disease diagnosis
Lauritzen and Spiegelhalter [1988]
8
8
child
congenital heart disease
Spiegelhalter [1992]
20
25
insurance
car-insurance risk
Binder et al. [1997]
27
52
alarm
patient monitoring
Beinlich et al. [1989]
37
46
hepar2
liver-disorder diagnosis
Onisko [2003]
70
123
Appendix
Table 7: The five networks behind the published family (Definition 7 ).
total
verdict line
estimand block
whole-text scan
false claims
flash
main
9
9
0
0
flash
scale
51
51
0
0
pro
main
8
4
2
2
pro
scale
22
16
6
0
gpt-5.5
main
0
0
0
0
Appendix
Table 8: How each verdict was read, by model, pool and label. Counts are of responses; the shipped metrics reproduce exactly from them.
pro
as shipped
truncated excluded
main-pool accuracy
0.9779 (589 scored)
0.9811 (583 scored)
main-pool false claims
8/291 = 0.0275
6/287 = 0.0209
scale-grid accuracy
0.9415
0.9430
scale-grid false claims
22/298 = 0.0738
21/297 = 0.0707
false claims at n=50
6/49 = 0.1224
5/48 = 0.1042
Appendix
Table 9: pro under the shipped treatment and with truncated responses excluded. flash and gpt-5.5 are unaffected, having none.
Scorer
published
scrambled
novel domains
Random
0.4953
0.4953
0.5342
Embedding similarity
0.5047
0.4115
0.5590
Structural (no names)
0.8210
0.8210
0.7487
0.5B
0.4405
0.4770
0.4529
1.5B
0.3586
0.4929
0.5363
3B
0.5181
0.4427
0.5100
Appendix
Table 10: Small open-weights models on the edge-classification task, against name-blind and lexical baselines. Values come from the uniform-injection construction of Appendix E ; the structural baseline is 0.821 under the original features and 0.825 under the permutation-invariant features of Table 4 .Values come from the superseded construction of Appendix E . Comparisons are valid within a column only : the published and scrambled columns are scored on the same 2,775 edge instances, the novel column on a separate set of 731, and none of these are comparable to the frontier-model results elsewhere in this paper. The 1.5B model discriminates in the wrong direction; scrambling variable names returns it to chance, so the inversion is name-driven.
flash
pro
gpt-5.5
n
Acc.
False-claim
Acc.
False-claim
Acc.
False-claim
10
0.940
0.12
0.960
0.02
1.000
0.00
15
0.960
0.06
0.960
0.04
1.000
0.00
20
0.890
0.20
0.960
0.06
0.990
0.02
30
0.840
0.28
0.940
0.10
1.000
0.00
40
0.920
0.16
0.919
0.10
1.000
0.00
Appendix
Table 11: Verdict accuracy against graph size.
Model
Condition
Budget
Parse err.
Validity
Min. ∣ valid
Exact F
Recall
flash
one-shot
8,192
0.007
0.9295
0.9675
0.8993
—
flash
asked-for-all
32,768
0.003
0.9264
0.9928
0.9197
0.9066
flash
oracle
8,192
0.053
1.0000
1.0000
1.0000
—
pro
one-shot
32,768
0.010
0.9697
0.9826
0.9529
—
pro
asked-for-all
32,768
0.030
0.9485
0.9746
0.9244
0.8704
pro
oracle
8,192
0.380
excluded: parse failure on 38% of instances
Appendix
Table 12: Repair and enumeration on the main pool.
n
Valid
Min. ∣ valid
Oracle valid
Oracle min.
F coverage
mean ∣F∣
10
0.880
0.9545
1.000
1.000
1.00
3.28
15
0.860
0.9535
1.000
1.000
1.00
3.73
20
0.860
0.8837
1.000
1.000
0.88
2.30
30
0.880
0.7500
1.000
1.000
0.10
1.40
40
0.920
0.8696
1.000
1.000
0.02
1.00
50
0.980
0.8163
1.000
1.000
0.00
—
Appendix
Table 13: Repair against graph size ( flash ).
Figure 4: A certified instance, its frontier, and an invalid repair. Dashed edges are unobserved common causes.
z1
z2
z3
y
truth
library
difference
0
0
0
0
0.068800
0.066377
−0.002423
0
0
0
1
0.087453
0.089876
+0.002423
0
0
1
0
0.073608
0.066449
−0.007159
0
0
1
1
0.083090
0.090249
+0.007159
0
1
0
0
0.028730
0.028270
−0.000460
0
1
0
1
0.039616
0.040076
+0.000460
Appendix
Table 14: P(z1,z2,z3,y∣do(x=1)) under one seeded SCM. Ground truth by exact enumeration; the published estimand matches it to 5.6×10−17 throughout and is omitted. Deviations cancel within each (z1,z2,z3) block.
Figure 5: Our encoding of Figure 1 of Robins et al. [2000] . At is zidovudine treatment at time t , Lt the measured risk factors, Y the outcome, and Ut the unmeasured risk factors (dashed, latent). (a) Projecting out U0 and U1 confounds every pair of observed variables, so the joint effect and both single effects are non-identifiable. (b) The authors’ assumption removes the three red edges, from unmeasured risk factors into treatments; only L0 , L1 and Y stay confounded, and all three effects become identifiable. (c) For the effect of A1 in (a), two minimal restoring sets have the same size and opposite meaning, so cardinality cannot choose between them. Two edges we could not read from the scan, A0→Y and L0→U1 , change neither projection and are omitted.