The Audit Join Is Still a Hypothesis

The table replayed; the experiment did not

A recent forensic audit of a radiology vision-language benchmark recovered a result table almost exactly—and then withdrew the study’s main conclusions. The released artifact contained 300 nominal API calls and 297 nonempty responses.[1] But 60 Claude calls labeled A/B were executed with prompt C.[1] The table was computationally replayable; the intended experiment was not what the files recorded. Once the investigators reconstructed the prompt-to-response mapping, they withdrew claims about prompt effects, model performance, model ranking, and clinical interpretation.[1]

This is the distinction that motivates a local decision record. The object to preserve is not merely the final answer, score, or table row. It is one consequential decision at the grain at which a later reviewer may need to agree, disagree, or declare the evidence insufficient. That decision can be a label assigned to a prompt span.[2] It can be an answer tied to a page region.[5] It can be a scientific claim paired with its cited evidence.[4] It can be a subgroup result classified for evidential strength.[6] Or it can be a benchmark issue judged against a patch and test.[3]

The missing object is an audit join:

`local decision -> exact evidence -> generating activity -> versioned artifacts -> adjudication status`

The word join is literal: it binds records a reviewer would otherwise have to chase separately. Each component is useful on its own, but audit questions usually cross their boundaries. Which evidence supported this decision? Which run produced it? Which prompt, model, parser, dataset split, or code revision did that run use? What happened when someone reviewed the result? The join makes those questions answerable without treating a polished output as its own explanation.

This is a synthesis across the cited studies, not a tested universal architecture. The evidence shows recurring failure modes that the join would expose. It does not show that the join is necessary or sufficient for reproducibility, that every AI system needs the same record structure, or that provenance by itself produces accountability.

The audit atom is typed and domain-specific

An audit begins by choosing its atom: the smallest reviewable decision that still corresponds to the claim being made. That choice is substantive.

In system-prompt auditing, the relevant span may be a sentence or instruction classified against a behavioral standard.[2]

In software-engineering benchmarks, the decision may be whether a pull request actually resolves the paired issue, with the patch and tests serving distinct evidential roles.[3]

In scientific verification, the atom is a claim–evidence pair rather than a document-level label.[4]

In visual question answering, it is an answer plus the region offered as evidence.[5]

In clinical fairness reporting, it is a subgroup result plus a status such as sufficient, imprecise, or insufficient.[6]

Those atoms should be typed because their evidence contracts differ. A test can demonstrate that a patch changes behavior, but it is not interchangeable with the issue’s problem statement. A bounding region can localize relevant content, but it does not prove that the content caused a model’s answer. A confidence interval can support an evidential status, but it does not establish clinical validity. If all of these are stored as an untyped `source` field, the audit trail preserves links while losing their meaning.

The W3C PROV data model supplies a useful substrate. It represents entities, activities, and agents, along with relations such as usage, generation, derivation, attribution, and association. It also allows domain-specific provenance to be translated into a shared model.[7] On that substrate, the decision is an entity. An inference or review activity generates it from evidence, and a human or machine agent is associated with the activity.

PROV does not, however, choose the audit atom or decide truth. Its bundles are named sets of provenance descriptions; the standard does not require claim-level granularity, define domain evidence contracts, or determine whether an adjudication is correct.[7] The audit join is our proposed application profile on top of that substrate. In practice, a reviewer should be able to resolve five questions from the record: what was decided, what evidence bore on it, which activity produced it, which versions governed it, and what status the decision reached. If any answer is missing, the record is operationally incomplete.

Compound decisions can need compound scores

Aggregate accuracy often collapses the very relationship an auditor needs to inspect. System Prompt Auditing evaluates 1,459 prompts across 21 language models against 26 user-intent standards and 14 misuse-prevention standards.[8] Its results separate classification accuracy from exact-match ratio, where the stricter measure requires the entire set of applicable standards to be correct. On intent prompts, `gemini-2.5-flash` scored 90.1% accuracy but 11.5% exact match.[8] On prevention prompts, `gpt-5.2` scored 83.2% accuracy but 18.9% exact match.[8] High per-label accuracy did not imply that complete prompt-level decisions were usually correct.

SciClaimEval exposes the same structural issue in another domain. Its pair accuracy counts a scientific example as correct only when both the supported and refuted entries are classified correctly. The reported Subtask 1 validation-set baseline results list `o4-mini` at 82.3% ordinary accuracy and 68.2% pair accuracy; `Llama-3.2-11B-Vision` appears at 54.8% ordinary accuracy and 10.8% pair accuracy.[9] These model results should not be compared numerically with the prompt-auditing results: the tasks, labels, samples, and metrics differ. Their shared lesson is narrower. When the unit of consequence is compound, a component-wise average can conceal broken local records.

An audit join makes the denominator inspectable. For each prompt, it can retain the exact span, the set of applicable standards, each predicted label, the scoring rule, the model and prompt version, and any later adjudication. For each scientific example, it can retain the claim, the two evidence items, both decisions, the pairing identifier, and the pair-level outcome. That supports questions an aggregate cannot answer: Are errors concentrated in one standard? Does one side of a scientific pair fail more often? Did a template or parser revision change only a subset of records?

These benchmarks support a narrow design rule: preserve the local structure required by the strictest decision-level metric you care about. They do not establish a universal threshold at which an aggregate becomes misleading, nor do they estimate how prevalent hidden local failures are outside their evaluated datasets. And even a compound score says only that the record failed; diagnosis requires asking which evidence relation broke.

Citation is not support, relevance, or influence

That diagnosis requires at least four separate questions about evidence. Citation asks whether a source was named. Support asks whether its content warrants the answer or claim. Relevance asks whether the highlighted passage or region addresses the decision. Influence asks whether changing or removing that evidence would change the system’s behavior. These properties can correlate, but no one of them entails the others.

CiteVQA makes this separation visible at the answer–region level. The benchmark contains 1,897 questions over 711 PDFs and uses a joint metric that requires both the answer and its evidence attribution to be correct.[5] Its analysis shows that a system can produce the right answer while pointing to the wrong region.[5] A claim-level record would keep the answer judgment and the attribution judgment distinct, then join both to the same question and document version.

ProvenAI reports a different gap: 53.53% answer accuracy and 71.55% citation fidelity in its evaluated setting.[10] It also proposes leave-one-resource-out answer changes as a proxy for evidence influence. That proxy is informative but one-sided. Under near-deterministic decoding, removing evidence may alter probabilities without changing the final string, so a zero observed answer change does not prove zero influence.[10] The local record should therefore name the intervention, the decoding configuration, and the response comparison rule rather than storing an unqualified `used=true` flag.

White Box Evidence Packages tests whether rich traces protect against deceptive evidence. Across 60 policy cases, the study generated 600 audit reports under 10 evidence interfaces using `Qwen 2.5 7B`.[11] In 39 of the 60 cases with shuffled-evidence controls, reports were rated at least 4 for both correctness and evidence misuse; only three reports warned that the evidence was weak, and one of those identified an internal tool issue.[11] This is evidence about an LLM auditor/report workflow, not evidence that human auditors would be fooled at the same rate. It nevertheless shows why a plausible conclusion and a detailed trace should be scored separately.

Localization itself can also be produced rather than observed. A coordinate-free attribution pipeline evaluated six open vision-language models and found that its language-based interface improved evidence recall relative to model-generated coordinates and roughly halved hallucination.[12] But the interface combines model quotations with a layout parser and multimodal retriever. Its returned region is a pipeline output, not automatically a faithful causal rationale of the base model.[12]

Finally, evidence checking can be selective. On DeepSciVerify’s 91-example SCitance test set, a later verification phase corrected 13 earlier decisions while flipping seven previously correct ones; 61 examples exited before the most expensive phase. The resulting gain was 4.5 Micro-F1 points.[4] The result is a trade-off, not a mandate to process every item more deeply. This supports recording escalation paths and intermediate statuses, not assuming that indiscriminate full-text processing is always better.

Those failures belong in separate fields: source identity, quoted or localized evidence, support judgment, relevance judgment, influence test, and adjudication status. The studies do not show that any currently reported attribution metric recovers a model’s true causal reasoning. Even a well-typed evidence edge, however, can still point to the wrong version of an artifact.

Versions and schemas are part of the claim

That upstream identity problem is easy to miss. A local record can be internally meticulous and still join to the wrong artifact. Dataset names, task labels, prompt labels, and metric names need resolvable identities, not just readable strings.

MuSciClaims illustrates ordinary version drift. An early artifact describes a cell-only collection of 918 data points.[13] The later MUSCICLAIMS conference version reports 1,515 data points spanning physics, chemistry, and biology.[14] Neither number is meaningful without its version and scope. A table that records only `dataset=MuSciClaims` turns a citable fact into an ambiguous one.

The radiology audit shows a more damaging identity failure. The released output label said one prompt; the actual request payload contained another.[1] A record that stores a human-readable condition label but not the prompt bytes, request identifier, response identifier, and code revision can faithfully reproduce the wrong grouping. Content hashes or immutable artifact identifiers would not prevent the original error, but they would make the discrepancy locally testable.

KAISEN shows why configuration identity matters even when the computation is deterministic. In its synthetic evaluation over 16 disease tasks and 15 social-determinant axes, its mechanism checks were correct in all 144 controlled cases.[15] Yet none of 48 deliberately misspecified proxy configurations triggered a failure signal.[15] That result does not invalidate the framework; it bounds what the test established. Reproducible execution under a bad specification is still reproducibly misspecified.

Recording those identities extends the minimum version surface beyond `model_version`. The system must bind the decision to its input dataset and split, prompt or policy text, model and decoding configuration, and code and dependency environment. It must also identify the parser or retrieval index, metric definition, schema version, and any transformation between them. PROV can express that one activity used and generated particular entities.[7] The domain schema must still say which entities are mandatory for the claim under audit.

Schema identity therefore belongs in provenance rather than background documentation. But these cases do not demonstrate that hashing every artifact prevents semantic mislabeling, detects a bad task definition, or guarantees that a later environment can execute the artifact. Even a technically complete record leaves the human and institutional question open.

What the join buys—and what it does not

The join's immediate promise is diagnosability. When a conclusion is challenged, it lets a reviewer isolate whether the disagreement concerns evidence, execution, version, metric, or adjudication. A clinical subgroup result can carry a status instead of being forced into pass/fail. In one retrospective Alzheimer’s-disease fairness analysis, subgroup comparisons with fewer than 20 observations—including Asian–White and Black–Male comparisons—were classified as insufficient; the authors also used statuses such as imprecise and equivalence.[6] Those classifications depend on study-specific rules, and the small-sample floor was a chosen convention rather than a validated clinical threshold.[6]

The join can also make uncertainty and dissent durable. PaperTrail’s within-subject study with 26 researchers found lower reported trust in an interface that exposed claim–evidence provenance, but no difference in measured reliance behavior.[16]

The appropriate inference is not that provenance reduces trust in general. It is that visibility can change user experience and judgment while imposing interface costs—and that those effects need their own records.

Access remains a precondition for particular audit questions. An auditability framework organized around claims, evidence, and means of validation distinguishes public documentation or APIs from deeper access to code, weights, data, and logs. Its Moodle case study found limited auditability where documentation, monitoring, or test data were missing.[17] A beautifully normalized local schema cannot reconstruct artifacts an auditor is not allowed to inspect.

Nor is the audit join the only route to reproducible work. TRIPOD+AI provides a 27-item reporting checklist for clinical prediction-model studies, plus a 13-item checklist for abstracts.[18]

Separately, a large real-world-evidence project reproduced 150 studies using the same healthcare databases; the median relative effect was 1.0, with an interquartile range of 0.9–1.1 and a full range of 0.3–2.1.[19] That project demonstrates substantial study-level replay without a first-class claim store, while also documenting unresolved assumptions and incomplete reporting.[19]

So the strongest defensible claim is modest: a typed audit join can make local failures easier to locate, compare, and adjudicate. The cited evidence does not show that it causes better institutional decisions, eliminates first-party bias, captures unlogged human judgment, or makes an auditor independent. It does not establish whether its storage and review costs outweigh its benefits in any particular deployment.

A decisive test would compare otherwise identical audit workflows with and without first-class local decision joins. Auditors would receive the same claims, artifacts, access rights, and time budget. Outcomes would include detection of seeded evidence, version, and scoring faults; time to diagnosis; inter-auditor agreement; false accusations of error; and the quality of final adjudications. Until such a test exists, the audit join should be treated as a concrete, testable design hypothesis—not a synonym for accountability.