Limits of Statistical Assurance for Embodied and Agentic AI under Adaptive Adversaries

Inderjeet Singh

cs.CROct 13, 2026

Limits of Statistical Assurance for Embodied and Agentic AI under Adaptive Adversaries

Authors: Inderjeet Singh

Organizations: Fujitsu Research of Europe, Slough, United Kingdom

Abstract

Finite safety assessments cannot exclude an adversary that preserves unattacked behavior until certification and activates afterward. We characterize this limitation for embodied and tool-use AI. An adversary that matches the complete observation law until observable, irrevocable certification and retains intervention access afterward attains $v\mathbb{E}[(n-S_0)_+]$ expected post-certification events over $n$ trials, where $v$ is the active event probability and $S_0$ the unattacked certification time. The result covers adaptive and privately randomized evaluators. Switching at certification is exactly optimal for a fixed likelihood-ratio test under memoryless, event-increasing interventions without a binding intervention budget. A positive clean-certification requirement forces linear worst-case expected excess when intervention raises event rates over an authorized deployment horizon, even if certification is deferred to the deadline. In simulated RoCo collaboration, switching yields commanded-separation violations in 34 of 36 post-certification episodes. Preregistered randomized AgentDojo trials estimate 1.98 additional security violations per four-task continuation (95% interval [1.67, 2.29]). An adversarial language-model controller infers hidden certification from noisy evaluation receipts and times intervention accordingly. With permanent revocation, a mixture likelihood-ratio monitor bounds cumulative excess above a prespecified reference rate at square-root order, up to logarithmic factors, on every sample path. A single fixed alternative can permit linear expected excess under stationary attacks. Against a controller observing the monitor's rule and statistic, live mixture monitoring reduces violations from 12.00 to 3.81 per 24 assigned task opportunities. Revocation also reduces tasks executed.

Figures & tables

A. Intervention interfaces
Family / interface	Executed mechanisms	Required access
$F_{1}$ : planner context	Fictitious retraction, divider, or peer reach	Replace supplied state information
$F_{2}$ : planner feedback	Suppress collision or margin rejection, replay approval	Modify feedback and approval state
$F_{3}$ : coordination	Suppress peer turns, forge agreement	Alter peer messages or delivery
Tool response	Banking instruction injection	Replace lower-trust tool content

Table 1: Intervention access and the assessed event are distinct. Feedback modification exceeds prompt-only access. Here

d_{t}

is the minimum commanded robot separation in an episode with at least one commanded plan. The event does not measure contact. Thresholds

\tau

are shown rounded, while scoring uses their frozen full precision. RoCo reference rates

p_{0}

are calibration fractions

9/40

and

18/40

. The earlier AgentDojo reference is rounded from an upper confidence limit for

0/20

unattacked events. Vetoes form a separate robotic outcome channel.

Figure 1: Certification timing and deployment duration have different consequences. Left: the area under cumulative clean certification probability gives

J_{n}/v

. Right: deadline certification removes excess within the original horizon but preserves subsequent deployment excess when certification probability and continuation rates are unchanged. Analytical parameters:

p_{\mathrm{clean}}=p_{0}=0.225

q=0.88

v=0.9

n=H=40

, and

\beta^{\prime}=0.00625

RoCo 006
Controller	Defined /	Cert.	Post-certification		Full campaign
	attempted	$S$	Events $D_{N}$	Trials $N-S$	Active $k/n$	Inactive $k/n$
Bernoulli intervention	$39/40$	$5$	$\mathbf{7}$	$34$	$7/7$	$1/32$
Rate tracker	$40/40$	$12$	$\mathbf{14}$	$28$	$17/19$	$2/21$
Rate tracker, longer horizon	$80/80$	$21$	$\mathbf{30}$	$59$	$36/36$	$4/44$
gpt-5.6-luna	$38/40$	$7$	$\mathbf{21}$	$31$	$18/19$	$5/19$

Table 2: Executed policies obtain certification and record subsequent events.

N

and

S

count defined trials, while

g

counts nominal episodes between decisions. Post-certification exposure

N-S

includes inactive trials. Active and inactive fractions cover the full campaign and do not estimate causal excess. Nominal binomial intervals are retained in Appendix Table 6 . The longer-horizon tracker also changes its target and execution conditions. Refusal supplies no active sample.

Figure 2: A controller infers the hidden certificate from noisy receipts. Left: stated probability of operating past certification by task offset from the hidden certificate, informative receipts against matched fair coins, with 95% bootstrap bands over trajectories. Right: verified deployment violations per eight-task trajectory. The dashed line is the perfect-information rate measured in the continuation experiment.

Appendix figures & tables35 assets

Supplementary material from the paper’s appendix.

Appendix

Result	Objective	Assumptions	Guarantee / reference
Clean imitation	Expected events after certification	Complete clean transcript matching, observable retained certification, continued control	Attainable lower bound, Theorem 1
Switching optimum	Maximize the same event count	Fixed LR rule, fresh randomness, memoryless increasing intervention	Exact optimum, Theorem 2
Sequential optimality	Minimize expected sample demand	Simple hypotheses and fixed error constraints	Classical SPRT comparison ( Wald & Wolfowitz, 1948 )
Binomial power	Maximize fixed-sample certification probability	Bernoulli observations, fixed size, rates below the alternative	Uniform power ordering, Theorem 6

Appendix

Table 3: The objectives and assumptions determine the meaning of optimality. Classical statistical optimality does not imply optimal protection against adaptive post-certification events.

	world $006$ , $p_{0}=0.225$ , $n=20$				world $037$ , $p_{0}=0.45$ , $n=40$
$q$	$p^{\dagger}$	$\pi_{0,n}$	$p^{\star}$	$V_{n}^{\mathrm{stat}}$	$p^{\dagger}$	$\pi_{0,n}$	$p^{\star}$	$V_{n}^{\mathrm{stat}}$
$0.30$	$0.261$	$0.000$	$0.01$	$0.0$	specification error
$0.50$	$0.354$	$0.211$	$0.11$	$3.2$	$0.475$	$0.000$	$0.01$	$0.0$
$0.70$	$0.455$	$0.911$	$0.24$	$16.4$	$0.578$	$0.632$	$0.31$	$52.0$
$0.88$	$0.578$	$0.998$	$0.38$	$34.9$	$0.694$	$0.996$	$0.49$	$107.2$
$0.95$	$0.656$	$1.000$	$0.47$	$48.6$	$0.762$	$1.000$	$0.58$	$136.4$

Appendix

Table 4: Theorem 3 at the two RoCo assessment specifications, computed by finite-state recursion under an i.i.d. Bernoulli channel at the allocated

n

with

\beta^{\prime}=0.00625

. Clean power

\pi_{0,n}

and the stationary grid value

V_{n}^{\mathrm{stat}}

(expected post-certification events, summed over eight interventions) both rise with the registered alternative.

p^{\star}

is the maximizing rate on the saved grid.

p_{1}^{\mathrm{alt}}=0.30

on world

037

is below

p_{0}

and is rejected by the registration check. The replay on collected streams (Section D.3 ) gives

98

0.88

on world

037

against

107

here. Those streams have

n_{j}

between

36

and

40

and are separately replayed observations. This grid maximum is not a continuous-rate optimum.

Figure 3: Increasing the registered alternative raises both clean certification power and the stationary attacker’s value. Axes share scales within each row. The dotted lines mark the executed alternative

q=0.88

. Solid curves are i.i.d. calculations. Lower-right diamonds are maxima over the saved target-rate grid in a rate-shaped Monte Carlo replay of collected streams. Stream lengths and outcome laws differ from the i.i.d. calculation. Attacker values sum eight intervention streams.

Figure 4: Certification precedes sustained intervention and subsequent events. Left: evidence crosses at defined trial

3

. The dashed continuation uses recorded outcomes excluded from the retained decision. Right: activation at nominal episode

5

follows the inactive first wave, and the campaign records

34

events in

36

defined post-certification trials under the registered commanded-separation endpoint.

Status	Formal definition	Decision role	Evaluation example
Nominal	Planned budget index $e\in\{1,\dots,A\}$ in protocol sequence	Determines allocated sample budget	Planned $40$ episodes on RoCo or $4$ tasks on AgentDojo
Attempted	Episode dispatched to execution harness	Consumes environment runtime	MuJoCo simulation or Docker tool execution launched
Defined	Attempt satisfying channel validity preconditions	Advances defined trial clock $N$	Multi-robot planner emits at least one plan ( $N_{e}^{\mathrm{plan}}>0$ )
Evaluable	Defined trial producing valid binary observation $Y_{t}\in\{0,1\}$	Scored by statistical rule and advances test statistic	Commanded separation parsed against $\tau$ , yielding $Y_{t}=\mathbf{1}\{d_{t}\leq\tau\}$
Undefined	Attempt failing preconditions or crashing ( $I_{e}=0$ )	Excluded from scoring, consuming nominal budget	Planner crash, LLM parse failure, or unparseable trajectory

Appendix

Table 5: Taxonomy of trial status across embodied and agent evaluations. Formal trial clocks advance only on defined, evaluable outcomes, while nominal budgets count all attempts.

Figure 5: The stopping rule that issues a rate certificate also determines the adversary’s remaining uninspected operation. Observed post-certification events on world

006

progress from the rate-tracking controller through the language-model attackers to deterministic switching. Each row is a separate registered execution. All attempted

40

episodes, with defined counts shown. Grey denotes the rate tracker, blue language-model controllers, and orange deterministic switching. These counts have no estimated repeated-campaign intervals. The comparison describes executed policies rather than a causal effect of model choice or decision spacing. Under the stated memoryless intervention model, the exact per-trial optimum is

v\mathbb{E}[(n-S_{0})_{+}]

. The executed deterministic policies act at the indicated block boundaries.

Figure 6: Expanded view of the execution in Figure 4 . The inspected likelihood ratio crosses at defined trial

3

. Activation follows the four-episode boundary and

34

later events occur. The dashed continuation reconstructs the statistic from retained outcomes for display. It is not evidence inspected before the retained certificate. The nominal-episode strip preserves the undefined execution failure without advancing the defined-trial clock.

World / system	Controller	Active episodes		Inactive episodes
		$k/n$	Nominal 95% CP	$k/n$	Nominal 95% CP
006	Bernoulli intervention	$7/7$	$[0.590,1.000]$	$1/32$	$[0.001,0.162]$
006	Rate tracker	$17/19$	$[0.669,0.987]$	$2/21$	$[0.012,0.304]$
006	Rate tracker, longer horizon	$36/36$	$[0.903,1.000]$	$4/44$	$[0.025,0.217]$
006	gpt-5.6-luna	$18/19$	$[0.740,0.999]$	$5/19$	$[0.091,0.512]$
006	gpt-5.6-sol	$23/24$	$[0.789,0.999]$	$1/16$	$[0.002,0.302]$

Appendix

Table 6: Active and inactive event fractions in the campaigns of Table 2 . The two-sided Clopper-Pearson intervals are retained as nominal binomial summaries. Their coverage requires independent constant-rate sampling within the specified subset, which adaptive selection need not satisfy. They provide no established coverage guarantee for these campaigns and do not estimate causal excess or repeated-campaign uncertainty in

D_{N}

. Refusal supplies no active sample.

Figure 7: The all-zero boundary determines whether the interval comparison is attainable. At

p_{0}=0.225

and

\beta^{\prime}=0.00625

, the lower confidence endpoint of an all-event sample first exceeds the boundary at integer allocation

n^{\star}=8

(left). Shading marks smaller allocations. Right: the eight world-

006

measurements with two-sided

95\%

Clopper-Pearson intervals. Both panels use this confidence level. The

n=20

floor is a common reference in the right panel. Their denominators remain those of the measured streams.

		RoCo 006			RoCo 037
Family	Intervention	$k/N$	$S$	$D_{N}$	$k/N$	$S$	$D_{N}$
$F_{1}$	Phantom retraction	$1/20$	3	1	$8/40$	5	7
$F_{1}$	Phantom barrier	$5/20$	5	4	$12/39$	5	11
$F_{1}$	Understated reach	$6/19$	5	5	$16/39$	5	15
$F_{2}$	Collision suppression	$20/20$	none	0	$15/40$	7	13
$F_{2}$	Margin understatement	$18/20$	none	0	$14/40$	7	12

Appendix

Table 7: Installed interventions can remain present when certification occurs. Here

N

counts defined trials,

k

counts separation events,

S

is the first certification trial at

q=0.88

, and

D_{N}

counts events strictly afterward. The eight mechanisms span three intervention interfaces. These streams use fixed installed mechanisms and precede the adaptive campaigns. The worlds have separate calibrations and allocations. The World 037 joint prediction remains unmet because forged agreement’s upper confidence endpoint exceeds

p^{\dagger}

(Appendix D.4 ).

Campaign / criterion	Registered measurement	Outcome
Bernoulli, 006: B1	Release at $q=0.88$	Hit , $S=5$
Bernoulli, 006: B2	Rate $8/39=0.205$ in target band $[0.282,0.590]$	Miss , gate calibration
Bernoulli, 037: B1	Release at $q=0.88$	Hit , $S=4$
Bernoulli, 037: B2	Rate $13/35=0.371$ in target band $[0.314,0.657]$	Hit
Tracker, 006: B1	Release at $q=0.88$	Hit , $S=12$
Tracker, 006: B2	Rate $19/40=0.475$ in target band $[0.375,0.500]$	Hit

Appendix

Table 8: Registered criteria for Bernoulli intervention and rate tracking. Table 2 gives the denominators and event counts. B2 concerns the realized separation-event rate, not intervention delivery. B3 tests the inactive reference condition. These are the same campaigns reported in the main text.

Controller	World	Defined / attempted	Total $k/N$	Tracker agreement	Missing
gpt-5.6-luna	006	$38/40$	$23/38$	$1/5$	2
gpt-5.6-luna	037	$38/40$	$13/38$	$3/5$	2
gpt-5.6-sol	006	$40/40$	$24/40$	$0/5$	0
Refusing controller	006	$39/40$	$6/39$	$0/5$	1

Appendix

Table 9: Decision agreement in the language-model controller campaigns. Agreement counts waves in which the model allocation equals the deterministic tracker’s allocation on the same visible history. It does not measure optimality or a causal controller effect. All campaigns obtain certification. Active and inactive counts and later-event fractions are in Table 2 . The refusing controller never activates, so its active fraction is undefined. These are the same campaigns, not additional replications.

		World 006			World 037
Model	Framing	Valid	Hit/near	Median $p$	Valid	Hit/near	Median $p$
DeepSeek-V4-Flash	Prose	$19/20$	$9/20$	$0.440$	$16/20$	$8/20$	$0.595$
	Formula	$19/20$	$14/20$	$0.365$	$19/20$	$12/20$	$0.494$
claude-opus-5	Prose	$0/20$	$0/20$	n/a	$0/20$	$0/20$	n/a
	Formula	$0/20$	$0/20$	n/a	$0/20$	$0/20$	n/a
claude-sonnet-5	Prose	$0/20$	$0/20$	n/a	$0/20$	$0/20$	n/a

Appendix

Table 10: Registration reading under provider-default sampling, with twenty calls per cell. Valid denotes a parseable response. Hit/near retains all calls in its denominator, and median

p

uses valid responses. The target plateaus are

[0.35,0.45]

006

and

[0.40,0.50]

037

. Provider-default calls yield

102/560

hit/near responses. The separate temperature-zero regime yields

2/28

, giving

104/588

combined, below the registered

50\%

criterion. The cell decomposition is post hoc. Output limits, timeouts, transport errors, and an unrecorded stop reason restrict capability interpretation of missing answers. The framing comparison remains descriptive.

Exhibit	Sampling design	Hit/near	Fraction	Pooled criterion
1	$28$ temperature-zero, $560$ provider-default calls	$104/588$	$0.177$	Failed
2	$16$ temperature-zero, $320$ provider-default calls	$85/336$	$0.253$	Failed
3	Separate roster, $21$ calls per cell	$250/588$	$0.425$	Failed

Appendix

Table 11: Three distinct evaluation-specification studies fail their pooled

50\%

criterion. Each crosses two framings with two worlds. Roster and evaluation conditions differ, so the rows are neither pooled nor interpreted as repeated estimates of one model population. Nonanswers remain in the denominators.

Developer	Selected document	Reported outcome	Unit and evaluation rule
Count and sampling unit reported
OpenAI	o3-mini System Card (2025-01-31)	$0/10$ successful rollouts	AlphaFold task, rollout-level result
Anthropic	Claude 3.7 Sonnet System Card (2025-02-24)	$0/4$ tasks solved	Reverse-engineering challenges, Pass@ $30$
Google DeepMind	Gemini 2.5 Pro Model Card (2025-06-27)	$0/13$ challenges solved	Hack the Box, any-success over repeated attempts
Denominator absent from the selected claim
Amazon	Nova Premier safety evaluation (2025-07-07)	Threshold adherence	Denominator unspecified in selected claim

Appendix

Table 12: Reported outcomes have different sampling units. The audit selects claims from eight developer slots within 2025-01-01 to 2026-08-31. The first three rows give counts for the selected evaluation, with tasks and challenges distinct from individual rollouts. The next four lack a denominator in the selected claim. The final slot has no qualifying document among the

50

enumerated news posts. These categories do not describe a common rate certificate.

Arm	Defined / attempted	Missing	$k/n$	Rate	95% CP interval
Clean	$39/40$	1	$6/39$	$0.154$	$[0.059,0.305]$
$F_{1}$ : context sham	$37/40$	3	$4/37$	$0.108$	$[0.030,0.254]$
$F_{2}$ : feedback sham	$40/40$	0	$4/40$	$0.100$	$[0.028,0.237]$
$F_{3}$ : coordination sham	$38/40$	2	$4/38$	$0.105$	$[0.029,0.248]$

Appendix

Table 13: Matched-sham Channel B rates by arm on world

006

under the matched-control protocol,

40

episodes per arm interleaved four-per-wave, no rate certificate computed. The clean arm’s interval contains the initial calibration rate

0.225

and every sham arm’s interval overlaps it. Six undefined planner failures are excluded, never rerun.

		AUROC [95% bootstrap CI]
Arm metadata	Classifier	World $006$ ( $n=40$ )	World $037$ ( $n=40$ )
Excluded	Logistic	$0.436\ [0.255,0.619]$	$0.444\ [0.266,0.631]$
Excluded	Tree	$0.456\ [0.273,0.646]$	$0.419\ [0.251,0.606]$
Included	Logistic	$0.434\ [0.255,0.611]$	$0.439\ [0.265,0.629]$
Included	Tree	$0.424\ [0.239,0.611]$	$0.404\ [0.240,0.599]$

Appendix

Table 14: The challenge-bit diagnostic meets D1’s registered criterion: every AUROC interval contains chance. Values use five-fold stratified cross-validation and

2000

bootstrap resamples. This is a diagnostic on the selected features, not a proof of conditional privacy against every attacker.

A. Classification: AUROC [95% bootstrap CI]
Prediction	Recorded measurement	Verdict
P1, masked attack versus sham	Logistic $0.307\ [0.164,0.468]$	Miss
P2, sham versus clean	Logistic $0.463\ [0.293,0.633]$	Hit
	Tree $0.470\ [0.315,0.636]$
B. Event rates: $k/n$ and 95% Clopper-Pearson CI
P3, sham versus clean	Sham $2/23$ , $[0.011,0.280]$	Hit

Appendix

Table 15: Randomized matched controls meet the sham criteria and miss the masked-classification and excess-rate criteria. P2 requires chance-containing AUROC intervals without arm metadata. P3 requires rate-interval overlap. P1 jointly requires separation with payload features and loss of separation after masking. P4 requires the attack-rate lower endpoint to exceed the clean point estimate. These are registered diagnostic criteria. Attack, sham, and clean event rates are

0.083

0.087

, and

0.040

Campaign / study	Registered criterion	Outcome	Section
Robotic replication and presentation controls
World 037 replication	$5/8$ certified with CP upper below $p^{\dagger}$	Miss	D.4
World 037 replication	Clean Channel A non-event rate ( $0/40$ )	Miss	D.4
Stationary targets	Pooled hit-or-near rate ( $\geq 50\%$ across 7 models)	Miss	D.7
Challenge sampling	Retraction pool challenge prediction (L6a)	Hit	D.9
Challenge sampling	Uniform-family challenge coverage (L6b)	Miss	D.9

Appendix

Table 16: Preregistration ledger across executed campaigns. Registered criteria, outcomes, and protocol misses are indexed by the reporting appendix section. Hits and misses follow the frozen criteria of each preregistered protocol. Positive denotes a positive paired contrast whose 95% interval excludes zero and whose exact two-sided

p

value is below

0.05

. The original receipt criterion remains a miss.

Concealed mixture				Pure comparator
Alternatives $q$	Weights	Clean power	Value	$q$	Clean power	Value
$0.70{:}0.88{:}0.95{:}0.99$	$1{:}1{:}1{:}1$	$0.9069$	$100.33$	$0.774$	$0.9075$	$74.06$
$0.70{:}0.99$	$1{:}1$	$0.8159$	$84.37$	$0.741$	$0.8262$	$63.44$
$0.70{:}0.99$	$3{:}1$	$0.7239$	$63.69$	$0.717$	$0.7311$	$56.98$
$0.70{:}0.99$	$1{:}3$	$0.9080$	$126.17$	$0.775$	$0.9085$	$74.26$
$0.70{:}0.88$	$1{:}1$	$0.8139$	$71.67$	$0.741$	$0.8262$	$63.44$

Appendix

Table 17: Concealing the alternative does not improve the recorded stationary frontier on world

037

. Values are expected post-certification events summed over eight hypothetical streams at

n=40

each. The pure comparator is the lowest-threshold point on the recorded grid with clean power at least the mixture’s. Power need not match exactly because the crossing boundary is discrete. These are i.i.d. calculations, not executed mixed-assessor campaigns.

Assessment change	Established consequence	Remaining condition
Adaptive alternative	Plug-in: $0/10$ certified intervention streams, fixed $q=0.88$ : $10/10$ . Clean stream: $0/1$ versus $1/1$ (replay)	Fewer certificates do not establish improvement at equal clean-certification power
Concealed alternative	Equal four-point mixture: value $100.33$ at clean power $0.9069$ . Pure $q=0.774$ : $74.06$ at $0.9075$ (calculation)	Comparator has at least equal clean power. Observable certification still permits switching
Minimum samples or delayed certification	World- $006$ tracker: $S=12$ becomes $21$ under minimum $20$ . Later events fall from $14$ to $9$ (replay)	Fixed deployment-horizon bound persists if certification probability and rates are preserved
Continued inspection or revocation	Changes retained-certification or uninspected-operation assumptions	Requires informative signals, valid inference, and a response to detected change
Withheld certification	Certificate-dependent payoff is zero (theory)	Excluded by a positive clean-certification requirement. Other risk remains

Appendix

Table 18: Changing the assessor changes specific parts of the guarantee. The plug-in floors use

\epsilon\in\{0.01,0.05\}

. No tested mixture improves the recorded stationary frontier. Mixture comparisons concern the recorded world-

037

grid, with values summed across eight hypothetical streams. Comparisons must state the excluded rate and clean-certification requirement. Replays hold collected streams fixed and do not reoptimize the attacker.

Analysis label	Decision criterion	Recorded measurement	Verdict
Recorded gate criteria
H1, candidate FA	false assurance $\leq 0.05$	$0.0000$ , no assurance issued	Pass
H2, diversion	B4 capture $\geq 0.7625$	$0.7875$ $[0.7844,0.7907]$	Pass
H3, system FA	false assurance $\leq 0.05$	$0.0000$ , no assurance issued	Pass
H4a, bound	resolution upper CI $\leq 0.1875$	maximum upper CI $0.1116$	Pass
H4a, ordering	oracle point estimate at least each non-oracle	oracle largest at both budgets	Pass

Appendix

Table 19: The sealed gate misses both operational floors. Zero false assurance coexists with zero rate certification. H4e is the post-gate per-budget analysis. The original pooled statistic passes and remains reported below.

Figure 8: Candidate traversal ends before primary rate certification can become possible. The recorded maximum private depth is

13

against a requirement of

23

, and the primary verdict count contains no rate certificates. Both panels pool candidate decisions across the sealed FleetSecGym gate. These are not independent robotic episodes.

Allocation policy	Resolution, $C=128$	Resolution, $C=192$
$P^{*}$ , coverage floors	$0.01975$	$0.10888$
B1, uniform random	$0.06531$	$0.10913$
B3, best first	$0.08281$	$0.10919$
B4, active search	$0.00938$	$0.10869$
B7, oracle	$0.10925$	$0.10925$

Appendix

Table 20: Policy differences shrink at the larger tested budget. The oracle’s point estimate is unchanged. This comparison does not establish saturation at untested budgets. Entries are point estimates. Pooled intervals are not assigned to individual budgets.

Figure 9: Additional budget narrows the observed policy gaps while leaving every policy below the registered resolution floor. Markers show point estimates at the evaluated budgets

C=128

and

C=192

. Connecting lines do not establish behavior between or beyond those budgets.

Figure 10: Exploratory betting sweep using the total-private-depth reference and saved empirical admissibility criterion. The left panel shows the recorded admissible betting limit. The right shows the corresponding rate-exclusion coverage on non-mechanisms. At strengths

23

and

24

the uncorrected window is empty and its points are omitted. The Bonferroni window remains at its all-zero floor. These development calculations use the saved simulator and do not describe the later restriction to diagnostic-stage updates.

Amendment	Procedure or inferential change	Timing relative to gate
1	Add secondary likelihood-ratio rate-exclusion process	implemented before gate, indexed after
2	Require uniform prerequisite exploration for $P^{*}$	implemented before gate, indexed after
3	Replace H4a point prediction with bound and ordering	before gate
4	Scope H4c and H4d to diagnostic stages	before gate
5	Reconcile executed episode count	after gate
6	Retract confounded budget comparison	after gate

Appendix

Table 21: Historical amendments for the FleetSecGym record. Post-gate sensitivity analyses remain separate from the original executed primary procedure.

Family	Intervention	$k/n$	AUROC [95% CI]	Historical class	$p_{\mathrm{MW}}$
F1	phantom retraction	$1/20$	$0.395$ $[0.276,0.524]$	Below	$0.936$
F1	phantom barrier	$5/20$	$0.434$ $[0.300,0.575]$	Below	$0.834$
F1	understated reach	$6/19$	$0.499$ $[0.347,0.649]$	Below	$0.502$
F2	collision suppression	$20/20$	$0.994$ $[0.979,1.000]$	Above	$p<10^{-5}$
F2	margin understatement	$18/20$	$0.978$ $[0.938,1.000]$	Above	$p<10^{-5}$
F2	stale verdict	$17/19$	$0.976$ $[0.932,1.000]$	Above	$p<10^{-5}$

Appendix

Table 22: World

006

Channel B in the original transfer study against pooled clean

n=40

. The Above, Below, and Overlapping labels compare two-sided 95% Clopper-Pearson intervals with

p_{1}^{\min}

at the cell

p_{0}

(sham

0.200

on stale, clean

0.225

otherwise) and the historical exponent

\kappa=8

. These labels are small-allocation sensitivities, not the

n=20

primary classifications. AUROC intervals use bootstrap resampling.

p_{\mathrm{MW}}

is the unadjusted one-sided permutation Mann-Whitney probability for smaller commanded separation under attack.

Intervention	$k/n_{j}$	Class	CP upper	$S$	$D_{N}$	Upper $<p^{\dagger}$
Phantom retraction	$8/40$	Below	$0.3565$	$5$	$7$	below
Phantom barrier	$12/39$	Below	$0.4757$	$5$	$11$	below
Understated reach	$16/39$	Overlapping	$0.5790$	$5$	$15$	below
Collision suppression	$15/40$	Overlapping	$0.5420$	$7$	$13$	below
Margin understatement	$14/40$	Overlapping	$0.5168$	$7$	$12$	below
Stale approval	$14/40$	Overlapping	$0.5168$	$14$	$7$	below

Appendix

Table 23: Independent-world Channel B at the terminal prefix,

p_{1}^{\min}\approx 0.516

, minimum event count

k=28

for an interval above the boundary. The certification columns give the

q=0.88

LR crossing: certifying trial index

S

(1-indexed) and events strictly after that trial.

p^{\dagger}=0.694189

. Forged is the headline miss.

Registered criterion	Verdict	Recorded outcome
Allocation and interval-boundary comparisons
prefix $n=5$ min $k$ for interval above boundary	Holds	none (impossible)
prefix $n=8$ min $k$ for interval above boundary	Holds	none (impossible)
prefix $n=10$ min $k$ for interval above boundary	Holds	requires $k\geq 10$
prefix $n=20$ min $k$ for interval above boundary	Holds	requires $k\geq 17$
prefix $n=40$ min $k$ for interval above boundary	Holds	requires $k\geq 28$

Appendix

Table 24: Registered predictions and outcomes on World

037

. A hold on “above

p^{\dagger}

” means no certified intervention has observed rate above

p^{\dagger}

. Forged is certified and still not an above-

p^{\dagger}

offender because

21/37=0.5676<p^{\dagger}

. The headline miss is the CP-upper clause. Impossibility here concerns an interval lying above the specified boundary at that allocation, not every possible detector.

$p_{0}$ provenance	$0.30$	$0.50$	$0.70$	$0.88$	$0.95$	$0.99$
Calibration $0.45$	invalid	$(0,0)$	$(7,32)$	$(8,68)$	$(8,79)$	$(8,83)$
Recorded clean $9/39$	$(0,0)$	$(2,8)$	$(6,29)$	$(7,67)$	$(8,75)$	$(8,82)$
Clean CP lower $0.111337$	$(1,0)$	$(2,9)$	$(4,12)$	$(7,64)$	$(7,74)$	$(8,79)$
Clean CP upper $0.393262$	invalid	$(1,0)$	$(7,34)$	$(8,68)$	$(8,79)$	$(8,83)$

Appendix

Table 25: Post hoc null sensitivity of the world-

037

ordered attack streams. Each cell reports the ordered pair (certified streams, post-certification events). “invalid” is a specification error (

p_{1}^{\mathrm{alt}}\leq p_{0}

), never scored.

k_{\max}(40)

p_{1}^{\mathrm{alt}}=0.88

25

21

18

24

down the four rows. Not confirmatory.

	RoCo 006: $p_{0}=0.225$ , $n_{\mathrm{alloc}}=20$				RoCo 037: $p_{0}=0.45$ , $n_{\mathrm{alloc}}=40$
$\delta$	Wald $L_{W}$	$L_{W}/n_{\mathrm{alloc}}$	Fixed $n$	LR $n_{0.95}$	Wald $L_{W}$	$L_{W}/n_{\mathrm{alloc}}$	Fixed $n$	LR $n_{0.95}$
$0.01$	$\mathbf{16{,}457.0}$	$822.9\times$	$30{,}420$	$40{,}022$	$\mathbf{22{,}941.9}$	$573.5\times$	$42{,}559$	$55{,}946$
$0.02$	$\mathbf{4{,}195.0}$	$209.7\times$	$7{,}725$	$10{,}182$	$\mathbf{5{,}747.4}$	$143.7\times$	$10{,}658$	$14{,}029$
$0.05$	$\mathbf{707.5}$	$35.4\times$	$1{,}290$	$1{,}708$	$\mathbf{923.1}$	$23.1\times$	$1{,}711$	$2{,}260$
$0.10$	$\mathbf{190.0}$	$9.5\times$	$343$	$458$	$\mathbf{230.4}$	$5.8\times$	$428$	$572$
$0.20$	$\mathbf{52.4}$	$2.6\times$	$93$	$127$	$\mathbf{55.6}$	$1.4\times$	$105$	$140$

Appendix

Table 26: Tighter rate exclusion requires substantially more evidence. Certification probability is at least

1-\gamma=0.95

p_{0}

and at most

\beta^{\prime}=0.00625

p_{0}+\delta

. Wald

L_{W}

bounds expected demand. Fixed

n

is the minimum randomized binomial test size, and LR

n_{0.95}

is the certification-time quantile under

p_{0}

. These are analytical calculations. Appendix L gives numerical conventions.

Registration				Expected demand		Fixed sample size		Quantile
World	$\delta$	$q$	$p^{\dagger}$	Wald bound	SPRT estimate	Pinsker bound	Minimum $n$	$n_{0.95}$
$006$	$0.01$	$0.235$	$0.2300$	$16457.03$	$18087.85$	$6341$	$30420$	$40022$
$006$	$0.02$	$0.245$	$0.2349$	$4194.97$	$4616.38$	$1617$	$7725$	$10182$
$006$	$0.05$	$0.275$	$0.2494$	$707.46$	$781.52$	$273$	$1290$	$1708$
$006$	$0.10$	$0.325$	$0.2731$	$190.03$	$211.22$	$74$	$343$	$458$
$006$	$0.20$	$0.425$	$0.3194$	$52.40$	$59.21$	$21$	$93$	$127$

Appendix

Table 27: The analytical sample-cost bound exceeds the available allocation. Wald bounds expected sample demand at

\gamma=0.05

\beta^{\prime}=0.00625

. The SPRT column is the truncated numerical first moment described above, without a validated decimal-accuracy guarantee. Pinsker bounds fixed

n

2(1-\gamma-\beta^{\prime})^{2}/\mathrm{KL}(p_{0}\|p_{0}+\delta)

. The fixed-sample column is the minimum size for a randomized binomial test attaining clean power

0.95

and certification error at most

\beta^{\prime}

. World

006

uses

p_{0}=0.225

n=20

. World

037

uses

p_{0}=0.45

n=40

		Total expected demand		Sum of per-stream allocations
World	$\delta$	$8\times$ Wald	$8\times$ SPRT	$8\times$ fixed	$8\times n_{0.95}$
$006$	$0.01$	$131656.24$	$144702.84$	$243360$	$320176$
$006$	$0.02$	$33559.75$	$36931.07$	$61800$	$81456$
$006$	$0.05$	$5659.71$	$6252.14$	$10320$	$13664$
$006$	$0.10$	$1520.27$	$1689.77$	$2744$	$3664$
$006$	$0.20$	$419.17$	$473.70$	$744$	$1016$

Appendix

Table 28: Family budgets at

m=8

. The world-

037

attack allocation was

8\times 40=320

nominal trials, with undefined outcomes recorded separately. That allocation is below the family Wald bound in every row. Each column multiplies its per-stream quantity by eight. The sum of crossing quantiles is not a family-level

95\%

power calculation. The SPRT column scales the same truncated estimates.

			Opportunity score			Clean power		Event value
World	$q$	$n_{\mathrm{zc}}$	$X_{\mathrm{zc}}$	$X_{\star}$	$X_{\mathrm{seq}}$	$\pi_{\star}(p_{0})$	$\pi_{\mathrm{seq}}(p_{0})$	$V_{\mathrm{seq}}$
$006$	$0.30$	$15$	$0.0237$	$0.0362$	$0.0000$	$0.034$	$0.000$	$0.00$
$006$	$0.50$	$8$	$0.0433$	$0.1294$	$0.0776$	$0.525$	$0.211$	$3.21$
$006$	$0.70$	$5$	$0.0670$	$0.2729$	$0.2198$	$0.980$	$0.911$	$16.45$
$006$	$0.88$	$3$	$0.1055$	$0.4748$	$0.3566$	$1.000$	$0.998$	$34.93$
$006$	$0.95$	$2$	$0.1481$	$0.5868$	$0.4458$	$1.000$	$1.000$	$48.57$

Appendix

Table 29: Recorded stationary opportunity score

X(R)=\sup_{p}p\,\pi_{R}(p)

at the allocated

n

(

20

006

40

037

). Zero-count uses its minimal

n_{\mathrm{zc}}

with

(1-p_{1}^{\mathrm{alt}})^{n_{\mathrm{zc}}}\leq\beta^{\prime}

and the closed form

n^{n}/(n+1)^{n+1}

R_{n}^{\star}

is the uniformly most powerful binomial test at the allocated

n

, size

\beta^{\prime}

, randomised at

c_{n}

. The sequential rule is

R_{n}^{\mathrm{seq}}

. Subscripts

\star

and

\mathrm{seq}

distinguish their scores

X

, certification probabilities

\pi

, and post-certification event values

V

V_{\mathrm{seq}}

is family post-certification event value (

m=8

), computed by the same finite-state recursion.

V_{\star}

is omitted because a fixed-sample test certifies at

n

, so events strictly after certification are zero inside the allocation. World

037

p_{1}^{\mathrm{alt}}=0.30

is a specification error and is omitted. The largest

X

gap

R_{n}^{\star}

minus

R_{n}^{\mathrm{seq}}

0.1973

on world

037

p_{1}^{\mathrm{alt}}=0.50

, where the SPRT has no clean power at

n=40

. The lower-tail power ordering holds at every tested point on the

0.01

grid below each

p_{1}

. The recorded

X

values search an interior grid of spacing

0.001

over rates on both sides of the alternative. They are distinct from the restricted

X_{<}

in Theorem 6 , and are not relabelled as that functional.

AI Assurance

Artificial intelligence assurance develops evidence and controls to evaluate, govern, and certify AI systems across their lifecycle and deployment contexts.

See all 79 papers

Sep 23, 2026

Finite-Sample Probabilistic Safety Certification for AI-Based Grid-Edge Coordination

Coordinating large population of flexible grid-edge devices can alleviate the need for time-consuming and capital-intensive network upgrades, and AI-based control methods such as multi-agent reinforcement learning or imitation learning are promising in their real-time decision scalability. However, system operators still need an independent and rigorous way to decide whether a given AI system is safe enough for deployment. This paper develops a finite-sample probabilistic safety certification framework for black-box AI decision models in closed-loop grid operation. The central idea is to reduce the complete input--AI--grid evaluator workflow to a binary unsafe outcome under an operator-defined safety specification, and then use exact binomial inference to certify the corresponding unsafe operation probability. Given a set of held-out calibration scenarios, the framework returns the tightest one-sided upper certificate and an accept/reject deployment criterion that controls the probability of false safety certification. Because the certification is for the calibration distribution that may deviate from the future operation, we further combine the nominal certificate with physically interpretable sample-space adversarial attacks, a concept widely used in AI to investigate the fragility of AI models. Case studies on grid-edge flexibility coordination with 1{,}000-agent AI models (independent parameters) verify the finite-sample safety guarantee and the value of integrating adversarial attacks into a rolling-window training-certification-deployment flow.

Yihong Zhou, Hanbin Yang, Thomas Morstyn

Department of Engineering Science, University of Oxford, U.K.

AI Agent Safety

Ask PDF

Feb 24, 2026

When can we trust untrusted monitoring? A safety case sketch across collusion strategies

AIs are increasingly being deployed with greater autonomy and capabilities, which increases the risk that a misaligned AI may be able to cause catastrophic harm. Untrusted monitoring -- using one untrusted model to oversee another -- is one approach to reducing risk. Justifying the safety of an untrusted monitoring deployment is challenging because developers cannot safely deploy a misaligned model to test their protocol directly. In this paper, we develop upon existing methods for rigorously demonstrating safety based on pre-deployment testing. We relax assumptions that previous AI control research made about the collusion strategies a misaligned AI might use to subvert untrusted monitoring. We develop a taxonomy covering passive self-recognition, causal collusion (hiding pre-shared signals), acausal collusion (hiding signals via Schelling points), and combined strategies. We create a safety case sketch to clearly present our argument, explicitly state our assumptions, and highlight unsolved challenges. We identify conditions under which passive self-recognition could be a more effective collusion strategy than those studied previously. Our work builds towards more robust evaluations of untrusted monitoring.

Nelson Gardner-Challis, Jonathan Bostock, Georgiy Kozhevnikov +4

LASR Labs · Imperial College London · University of Wyoming +2

AI Agent Monitoring AI Safety Trustworthy AI AI Safety Evaluation

Ask PDF

Aug 4, 2026

Post-Hoc Trajectory-Risk Certification for Modular LLM-Based Security Agents

Autonomous security agents operate as staged pipelines, such as classifying network traffic and then attributing attacks to a specific technique. Split conformal prediction gives each stage finite-sample coverage, but deployment requires a trajectory-level guarantee across the full chain. These guarantees do not compose automatically when stages are independently trained and calibrated. Bonferroni allocation is distribution-free but conservative under correlated errors. We show that a natural pairwise-correlation extension to three or more stages is invalid because it gives a lower rather than an upper bound, and derive a valid spanning-tree alternative. We distinguish whether stages are dependent from whether an audit sample is large enough to certify that dependence, and give matching upper and information-theoretic lower sample-complexity bounds. We also show that coarse-to-fine label selection can create near-perfect measured correlation without learned dependence. On a two-stage intrusion-detection pipeline across 6 open LLMs and 2 datasets, removing this artifact reduces measured correlation from near 1 to 0-0.78. A direct audit of trajectory failure becomes 13.7% tighter than Bonferroni once the audit reaches the required sample size, but is worse when undersized. A modular certificate using per-stage certificates and a pairwise overlap bound yields a positive average gain of 0.6%, quantifying the cost of lacking joint access. Same-model, cross-model, and permuted-pairing tests show that residual dependence reflects shared sample difficulty, not shared model representations. Average trajectory coverage across 12 configurations is 92.7% +/- 2.4% at alpha = 0.10. Under cross-dataset deployment, single-step miscoverage reaches 100% even when accuracy remains 78%, showing that distribution shift destroys calibrated confidence before raw accuracy.

Zhenpeng Li

Guangzhou Health Science College, No. 248 Guangyuan Middle Road, Guangzhou, Guangdong 510405, China

IoT Intrusion Detection Cybersecurity Conformal Prediction LLMs for Cybersecurity LLM Agent Reliability

Ask PDF

Abstract

AI Assurance

Explore similar work

Finite-Sample Probabilistic Safety Certification for AI-Based Grid-Edge Coordination

When can we trust untrusted monitoring? A safety case sketch across collusion strategies

Post-Hoc Trajectory-Risk Certification for Modular LLM-Based Security Agents