We sent AI to refute our own conclusions, and they succeeded
In early 2026-08, we handed six headline conclusions about the pulse attack to independent agents, with one instruction only: "prove it wrong." The result: three refuted, two downgraded, and only two held up.
#Results
| Original conclusion | Verdict |
|---|---|
| Temporal structure barely affects total hits (1.81× spread across 15 cells) | Overstated |
| The blind spot matters far more than the attacker's parameter choice | Overstated |
| Beyond a blind spot of 0.5–0.75, pulsing does worse than sustained misbehavior | Refuted |
| Raising the audit rate cannot rescue cases with a blind spot | Refuted |
| Caught once = removed permanently | Overstated |
| At equal budget, crude strategies beat pulsing | Refuted |
Of the six, three were refuted and two downgraded. The two positive conclusions that were kept have both been written into our analysis disciplines as rules.
#Why it is so easy to get wrong
Because when we wrote the report, we subconsciously treated two related factors as orthogonal dimensions. Three sets of examples:
| What we thought | What it actually is |
|---|---|
| Temporal structure vs total hits | Total hits = exposure × efficiency, and the two cancel in opposite directions |
| Blind spot vs sampling rate | The three factors are terms in the same product |
| Timing vs misbehavior count | Our "equal budget" did not bind the budget |
The full breakdown of the first set
The second set: detection probability is a single product
The third set: equal budget has to check defected == BUDGET
#The hardest one to check: a conclusion held up by a degenerate endpoint
For "the blind spot matters far more than parameter choice," the re-verification agent found:
The blind spot and temporal structure have a strong interaction (two-factor decomposition η² = 0.264, 4 times the main effect of temporal structure), so the sentence pattern "the real variable is X" does not itself hold.
And the original numbers were held up almost entirely by one degenerate endpoint:
| After excluding blind = 1.0 | |
|---|---|
| Blind-spot effect for pulse | 8.9× → 3.28× |
| Blind-spot effect for patient | 54× → 5.68× |
If a gauge degenerates at an endpoint, the numbers it gives there look the best and carry the least information. This was later written up as the second analysis discipline.
#A bug in a statistics tool was caught
During re-verification we also caught a problem we did not expect: the normal-approximation branch of wilcoxon_signed_rank_exact applied the tie correction twice.
| n = 30, 20 positive, 10 negative | |
| The program said | p = 0.0288 (significant) |
| Exact value | p = 0.0987 (not significant) |
This was not the researcher's mistake; it was the tool's. But the danger is this — it quietly turns non-significant into significant.
Also caught in the same batch: the bootstrap CI used Python's built-in hash() as its seed, so the same data run in different processes gave two numbers, 53,478 and 1,628.
#Three positive conclusions that were kept
Re-verification is not only destructive. Two conclusions survived the attack, and they are stronger than the original six:
#1. Detection probability is a single product
P(caught) = (1 − blind spot β) × sampling rate p × audit accuracy
The three factors are on the same axis. This is not a finding; it is a rule — but it is one we learned separately from three different mistakes.
Measured support: at blind spot 0.5, audit rate 0.1 → 1.0 cut the attacker's total hits by 82% (Wilcoxon p = 5.5e-6); audit 0.5 → 1.0 exactly offsets a 50% blind spot (paired difference 0.03, p = 0.78).
#2. Interaction η² = 0.264
The blind spot × temporal structure interaction is 4 times the main effect of temporal structure. This directly refutes the sentence pattern "the blind spot is the only real variable."
#The cost of doing it this way
To be honest about it:
| What agent re-verification cost | One independent workflow per conclusion, rereading the raw JSONL |
| Can it be wrong | Yes. We keep the final say over its verdicts and don't accept them automatically |
| What it missed | Two conclusions have still not been re-verified (reaction lag, concentration of selective attacks) |
The last row matters: re-verification is not omniscient. The agents gave six verdicts, and two items we marked "Not re-verified" ourselves, because the re-verification agents didn't touch them either.
#Next
- The full version of the four analysis disciplines: Experimental methods and verdict values
- Verdicts for all claims: Evidence ledger

