VacantAn accountability layer for AIGitHub

· Method · Overstated

We sent AI to refute our own conclusions, and they succeeded

In early 2026-08, we handed six headline conclusions about the pulse attack to independent agents, with one instruction only: "prove it wrong." The result: three refuted, two downgraded, and only two held up.

adversarial re-verificationself-correctionstatistics

#Results

Original conclusionVerdict
Temporal structure barely affects total hits (1.81× spread across 15 cells)Overstated
The blind spot matters far more than the attacker's parameter choiceOverstated
Beyond a blind spot of 0.5–0.75, pulsing does worse than sustained misbehaviorRefuted
Raising the audit rate cannot rescue cases with a blind spotRefuted
Caught once = removed permanentlyOverstated
At equal budget, crude strategies beat pulsingRefuted

Of the six, three were refuted and two downgraded. The two positive conclusions that were kept have both been written into our analysis disciplines as rules.

#Why it is so easy to get wrong

Because when we wrote the report, we subconsciously treated two related factors as orthogonal dimensions. Three sets of examples:

What we thoughtWhat it actually is
Temporal structure vs total hitsTotal hits = exposure × efficiency, and the two cancel in opposite directions
Blind spot vs sampling rateThe three factors are terms in the same product
Timing vs misbehavior countOur "equal budget" did not bind the budget

The full breakdown of the first set

The second set: detection probability is a single product

The third set: equal budget has to check defected == BUDGET

#The hardest one to check: a conclusion held up by a degenerate endpoint

For "the blind spot matters far more than parameter choice," the re-verification agent found:

The blind spot and temporal structure have a strong interaction (two-factor decomposition η² = 0.264, 4 times the main effect of temporal structure), so the sentence pattern "the real variable is X" does not itself hold.

And the original numbers were held up almost entirely by one degenerate endpoint:

After excluding blind = 1.0
Blind-spot effect for pulse8.9× → 3.28×
Blind-spot effect for patient54× → 5.68×

If a gauge degenerates at an endpoint, the numbers it gives there look the best and carry the least information. This was later written up as the second analysis discipline.

#A bug in a statistics tool was caught

During re-verification we also caught a problem we did not expect: the normal-approximation branch of wilcoxon_signed_rank_exact applied the tie correction twice.

n = 30, 20 positive, 10 negative
The program saidp = 0.0288 (significant)
Exact valuep = 0.0987 (not significant)

This was not the researcher's mistake; it was the tool's. But the danger is this — it quietly turns non-significant into significant.

Also caught in the same batch: the bootstrap CI used Python's built-in hash() as its seed, so the same data run in different processes gave two numbers, 53,478 and 1,628.

#Three positive conclusions that were kept

Re-verification is not only destructive. Two conclusions survived the attack, and they are stronger than the original six:

#1. Detection probability is a single product

P(caught) = (1 − blind spot β) × sampling rate p × audit accuracy

The three factors are on the same axis. This is not a finding; it is a rule — but it is one we learned separately from three different mistakes.

Measured support: at blind spot 0.5, audit rate 0.1 → 1.0 cut the attacker's total hits by 82% (Wilcoxon p = 5.5e-6); audit 0.5 → 1.0 exactly offsets a 50% blind spot (paired difference 0.03, p = 0.78).

#2. Interaction η² = 0.264

The blind spot × temporal structure interaction is 4 times the main effect of temporal structure. This directly refutes the sentence pattern "the blind spot is the only real variable."

#The cost of doing it this way

To be honest about it:

What agent re-verification costOne independent workflow per conclusion, rereading the raw JSONL
Can it be wrongYes. We keep the final say over its verdicts and don't accept them automatically
What it missedTwo conclusions have still not been re-verified (reaction lag, concentration of selective attacks)

The last row matters: re-verification is not omniscient. The agents gave six verdicts, and two items we marked "Not re-verified" ourselves, because the re-verification agents didn't touch them either.

#Next

Related

about 3 min read

Shih Hsin UniversityDepartment of Information and Communications, Shih Hsin UniversityVacant

Department of Information and Communications, Shih Hsin University · 2026 capstone project · on-site exhibition