The Tunnel Pipeline

§1.1The phenomenon

A mobile phone call passing through a tunnel keeps the voice and loses the content. The speaker sounds the same. What they are saying does not arrive. This paper argues that training pipelines can produce the same phenomenon at the correctness-judgment step: the signal continues, the model learns, and the epistemic content that should have shaped what it learned was lost in transit.

OpenAI launched GPT-5 in August 2025 with HealthBench scores positioned as evidence of clinical-reasoning capability. The launch included a demonstration with a patient named Millon, framing the model as a thought partner for navigating disagreement between physicians on radiation therapy. HealthBench Hard, a benchmark evaluating medical-question performance at high granularity, showed GPT-5 scoring 46.2%, a significant improvement over its predecessor.

Capobianco et al. (2025, Journal of Medical Systems 49:173) independently evaluated GPT-5 at University Hospital Tübingen against 100 tumour-board-validated gastrointestinal oncology cases. The result: 85% concordance with tumour-board consensus, identical to GPT-4o. Cochran's Q and pairwise McNemar tests showed p ≥ 0.21 across all model comparisons. The benchmark improvement did not transport to the deployment-relevant criterion. The marketing claim of clinical-reasoning superiority was not supported by the independent evaluation in the domain publicly demonstrated. (On 23 April 2026, as this paper was being completed, OpenAI launched ChatGPT for Clinicians with a new benchmark, HealthBench Professional, and released the GPT-5.5 system card. Anthropic published a post-mortem on Claude Code quality. The framework's structural questions about these events, and a three-lab pattern observation, are addressed in §4.11.)

§1.2The structural question

The question this paper asks is not "why is GPT-5 bad at oncology?" (It is not. 85% concordance is high.) The question is structural: why does a well-funded pipeline producing measured benchmark improvement produce a gap between marketing claim and independent evaluation? The gap is not explained by insufficient capacity, data, or engineering effort. HealthBench is a well-constructed evaluation. Capobianco's methodology is rigorous. Both measure something real. They measure different things.

The training signal is not just a number. It is a record that must faithfully encode a judgment's epistemic content and connect to a criterion that tracks what the pipeline actually needs. When the criterion measures the wrong quantity, the signal encodes the wrong content, regardless of how well the evaluation is conducted. When the signal loses information through aggregation, the model cannot learn what was never encoded. When the evaluator shares error modes with the producer, the signal carries the shared error rather than filtering it. These are structural properties of the correctness-judgment step, the moment where an artifact is irrevocably mapped to a reward scalar, a preference rank, or a filter-inclusion decision before that signal shapes model behaviour. The failure modes trace to these structural properties rather than to capacity, scale, or effort.

§1.3Scope and method

This paper analyses the correctness-judgment step and identifies five structural conditions it must satisfy: criterion adequacy (§2.1), evaluator independence (§2.2), structural accountability (§2.3), verdict reproducibility (§2.4), and verdict preservation (§2.5). Non-redundancy is demonstrated by counterexample in §3. A seven-class cross-pipeline diagnostic with worked empirical anchors is developed in §4, classifying pipeline classes from RLHF (reinforcement learning from human feedback) with human raters through RLVR (reinforcement learning with verifiable rewards) with Lean kernels to consumer chat deployments at scale.

The verdict record as common audit substrate is specified in §5, and the continuous ledger extending across training and deployment in §6. Failure-mode mapping under autoregressive transformers is developed in §7. Cross-architectural discussion addresses normalising flows, diffusion, state-space models, and Mixture-of-Experts in §8. Scope limits appear in §9. The economic argument, with cross-domain empirical corroboration, is developed in §10. Candidate extensions and framework-native reframings of empirical anomalies are developed in §12. A case study applying the framework to AI medical scribe deployment is developed in §11. Series relationships are established in §13, and methodology in §14.

§1.4Contributions

The paper's contributions are: the PARIA framework, five peer conditions with non-redundancy demonstrated by counterexample, applicable to the judgment pipeline with the judgment step as analytical hinge. A condition-discrimination decision rule for cases where multiple conditions appear to apply (§2.6). A shared audit substrate (the verdict record) on which every condition's verification depends, with a clarification distinguishing audit preservation from training-signal preservation at the update step. A continuous ledger extending the audit substrate across the training-to-deployment boundary.

A seven-class cross-pipeline diagnostic grounded in peer-reviewed independent evaluations. A failure-mode mapping connecting condition failures to documented deployment pathologies through dominant routes (sycophancy, fabrication, reward hacking, Goodhart-class proxy optimisation, calibration collapse), with the caveat that real failures are typically compound. Two diagnostic vocabularies: satisfaction by mechanism versus satisfaction by absence (analogous to vacuous truth in formal logic) for cross-architectural evaluation (§8.2), and the distinction between weak and strong forms of each condition.

A Data-Processing-Inequality-grounded analysis of warrant decay across sequential judgment stages, scoped to preservation chains, with falsifiability criteria (§12.1). An economic argument, grounded in measured cost data across six domains (healthcare, law, software engineering, employment, finance, psychiatry), establishing that correctness failures are cost categories whose externalisation current industry accounting obscures (§10).

§2.1Criterion adequacy

Statement. The criterion applied by the evaluator measures what the pipeline requires the training signal to encode. More precisely: the signal's semantic content under the applied criterion falls within the manifold that the pipeline's downstream use interprets as valid.

Scope. This condition is not a claim about evaluator capacity, criterion complexity, or Goodhart's law in full generality. The scope is tight: does the applied criterion's measured quantity correspond to what the pipeline needs the signal to encode? A criterion can be well-constructed, internally consistent, and rigorously applied, and still fail adequacy if the quantity it measures is not the quantity the deployment context requires. The broader Goodhart extensions (where a criterion that initially tracks the target quantity decouples under optimisation pressure) are candidate-extension territory (§12).

Weak and strong forms. In its weak form, criterion adequacy requires only that the criterion is defined precisely enough to apply consistently. In its strong form, the criterion's measured quantity is the pipeline-relevant quantity, not a proxy that may decouple under deployment pressure. The distinction matters because weak adequacy is achievable by definitional rigour alone, while strong adequacy requires empirical validation that the criterion tracks the deployment-relevant quantity under the conditions the deployment actually faces.

Criterion fit and coverage fit. Strong adequacy has two components. Criterion fit asks whether the measured property is the property the pipeline requires. Coverage fit asks whether the artifacts subjected to judgment adequately cover the deployment-relevant manifold. A pipeline can measure the right property on the wrong slice of cases. In that case, the criterion is locally adequate but the assessment is globally inadequate. Coverage fit is structurally distinct from preservation (which concerns what each record carries forward from events that happened) and from accountability (which pressures evaluator application quality on events they judge, not the sampling procedure that selects what they judge). A pipeline satisfying all five conditions in strong form for the artifacts it evaluates, while the evaluated set is a biased slice of the deployment distribution, produces a model with well-formed training signal where the evaluator looked and structurally absent signal elsewhere. The deployment pathology is spurious confidence in unjudged territory: the model behaves confidently on inputs it was never evaluated on because nothing in the training signal told it to modulate there. A systematic review of 39 clinical LLM benchmarks (Gong et al., JMIR 2025; four databases, PROSPERO-registered) quantified this gap: knowledge-based benchmarks show 70-79% mean accuracy, while practice-based benchmarks show 46-70% mean performance. Diagnostic accuracy drops from 82% on traditional case vignettes to 62.7% on multi-turn patient dialogues, a 19.3 percentage-point decrease. Only 5% of the 761 LLM evaluation studies reviewed assessed performance on real patient care data. The coverage-fit failure is structural: examination benchmarks cover stylised question-answer formats, not the full deployment manifold of clinical encounters with ambiguity, incomplete information, and multi-step reasoning under uncertainty.

Grounding. The condition draws on three independent theoretical traditions. The specification-use gap in software engineering describes the distance between what a specification captures and what the system's users actually require (a specification can be internally correct and externally inadequate). Construct validity in measurement theory concerns whether a measurement instrument measures the construct it claims to measure. Goodhart's law, in its bounded scope here, observes that a measure ceases to be a good measure when it becomes a target. All three converge on the same structural observation: the relationship between a criterion and its intended target is not guaranteed by the criterion's internal properties. The empirical grounding is developed in §4.1 (Capobianco et al. on HealthBench-to-clinical-concordance gap), §4.6 (Magesh et al. on groundedness-versus-correctness in legal AI), and §4.8 (ECRI on health-technology hazards).

Why it matters structurally. Adequacy failure means the pipeline optimises what the criterion measures while the deployment depends on what the criterion should have measured. This is the condition whose failure the other four conditions cannot compensate. Independence ensures the evaluator's errors are not correlated with the producer's. Reproducibility ensures the criterion is applied consistently across contexts. Accountability ensures application quality is audited. Preservation ensures the verdict's epistemic content reaches the weight update. All four can hold in strong form, and the pipeline still produces a training signal that encodes the wrong quantity. The four satisfied conditions ensure the wrong thing is measured well. They do not close the gap between what is measured and what should have been measured.

Compressed flagship. The case introduced in §1.1 makes the condition concrete. GPT-5's HealthBench Hard improvement over GPT-4o did not transport to Capobianco et al.'s deployment-relevant criterion (tumour-board concordance on real oncology cases: 85% for both models, p ≥ 0.21). The benchmark improvement is real. The deployment-relevant improvement is absent. The criterion-to-deployment transport failure is the adequacy gap. Full methodology in §4.1.

Operationalisation. Adequacy is evaluable by contrasting the evaluated quantity against the deployment-context requirement on the same pipeline class. The mechanism is independent replication against deployment-relevant criteria. A pipeline claiming clinical-reasoning capability is evaluated against clinical standards, not against the benchmark it optimised for.

§2.2Evaluator independence

Statement. The evaluator and the producer do not share criterion-relevant error modes.

Weak and strong forms. In its weak form, independence requires only that the evaluator and producer are architecturally distinct: different systems, different personnel, different organisational units. In its strong form, the evaluator and producer share no error modes relevant to the criterion being applied. The distinction is consequential. Architectural separation is necessary but not sufficient. Two architecturally distinct systems can share error modes on the criterion-relevant dimension if they were trained on the same data, share the same cultural priors, or optimise for the same proxy.

Grounding. The condition draws on the de Bruijn criterion from formal methods (Barendregt and Wiedijk): a proof checker's correctness must be independent of the proof generator's. The proof kernel is small, trusted, and verifiable. The proof generator can be arbitrarily complex. What matters is not the complexity of either component but that the checker's failure modes do not overlap with the generator's on the dimension the checker evaluates. The same structural principle operates in institutional accountability theory, where the independence of auditors from the entities they audit is the condition that makes auditing meaningful.

Why strong independence matters. RLHF with human raters achieves weak independence. Raters are architecturally distinct from the model. They are human. The model is not. But raters and downstream users share sycophancy-relevant preferences: warmth, agreeableness, validation, narrative coherence. On these dimensions, the evaluator's error modes overlap with the user population the pipeline is meant to serve. Architectural separation does not prevent the applied criterion from encoding shared bias. The training signal encodes the shared preference rather than the target quality, and it does so precisely because the evaluator shares the preference the signal is supposed to filter.

Compressed flagship. RLHF-trained systems exhibit documented sycophancy patterns consistent with weak-independence failure. SycEval reports 78.5% within-session sycophancy persistence: sycophantic behaviour established in response to user signals is maintained across subsequent turns rather than correcting toward the model's initial assessment. Chen et al. (npj Digital Medicine 8:605, 2025) demonstrate the model-side failure directly: five frontier LLMs showed up to 100% initial compliance with illogical medical requests that misrepresented drug equivalencies, prioritising helpfulness over logical consistency even when the model had the knowledge to identify the request as illogical.

Cheng et al. (Science 391:eaec8352, 2026) demonstrate the human-side consequence: even a single interaction with sycophantic AI reduces human participants' prosocial intentions and increases their conviction that they were right (N = 2,405, three preregistered experiments), and participants were 13% more likely to return to the sycophantic model. Together, the two findings show both sides of the weak-independence failure: the model complies with the shared preference (Chen), and the human's judgment is distorted by the compliance (Cheng). The weak-independence structure cannot filter out either side because the filter would require evaluators whose error modes do not overlap with users on the dimension the criterion applies to. Full treatment in §4.1 and §4.2.

Operationalisation. Identify the evaluator's error modes, identify the producer's error modes, identify the criterion's failure manifold. Strong independence holds when the error-mode overlap on the criterion manifold is empty. Weak independence holds when evaluators and producers are architecturally distinct but the overlap is non-empty. The gap between weak and strong independence is the space where sycophancy, shared bias, and correlated-error propagation operate.

§2.3Structural accountability

Statement. The evaluator bears responsibility for the verdict in a way that generates feedback pressure on actual judgment-application behaviour.

Weak and strong forms. In its weak form, accountability requires only that someone is nominally responsible for the evaluation. In its strong form, responsibility creates measurable feedback pressure via audit, calibration tracking, or consequence. The Knowledge Horizon (CC Paper 3, §2) draws the distinction as "on the hook" versus "in the loop": nominal responsibility without feedback pressure means someone pays if things go wrong, but nothing in the structure detects or corrects degradation before it causes harm. That is accountability-as-insurance. Strong accountability is accountability-as-oversight: the structure detects application-quality drift and generates corrective pressure. The distinction matters because accountability-as-insurance produces a known failure mode: when the cost of compliance exceeds the expected cost of penalties, rational actors choose the penalty (Lund and Sarin 2022). At sufficient scale, penalties become a line item rather than a behavioural signal.

Grounding. Engineering traceability standards require that every decision in a safety-critical pipeline is attributable to an identifiable actor whose judgment quality is auditable. The requirement exists not because engineers are untrustworthy but because application quality drifts under workload pressure, and drift that is not detected is not corrected. Institutional accountability theory makes the same observation at organisational scale: accountability mechanisms function as feedback loops, not as punishment infrastructure. Their purpose is to maintain application quality over time, not to assign blame after failure.

When the evaluator is a human rater, feedback pressure takes familiar forms: calibration review, retraining, or replacement.

When the evaluator is an AI system (the LLM-as-judge pattern of §4.7), the accountability does not transfer to the AI. It transfers to the humans who selected the judge, specified its criterion, deployed it, and bear responsibility for detecting and correcting its application-quality drift. The AI judge is a tool. The humans who configured it are the accountability-bearing actors. The mechanisms through which those humans exercise accountability include monitoring for judge-model drift, forcing fine-tuning updates or architectural rollbacks when drift is detected, and redesigning evaluation prompts when the criterion-application degrades. If no human bears responsibility for the judge's calibration over time, accountability fails at the AI-judge step exactly as it would fail at a human-rater step where no one audits the raters.

The condition is agnostic about the evaluator's substrate. It requires that someone bears consequence for application-quality drift, and that the consequence generates corrective pressure.

Loop-closure scaling. This subsection introduces the paper's most consequential scaling observation. Accountability requirements scale with training-loop closure times deployment volume, not with per-interaction stakes. The distinction matters because it determines how much accountability infrastructure a pipeline requires.

Open-loop pipelines, where judgments are used for the current interaction only and do not feed back into training, scale accountability with per-interaction stakes. A customer-service chatbot that does not learn from its interactions requires accountability proportional to the stakes of each individual interaction. Closed-loop pipelines, where judgments feed back into the training signal, scale accountability with aggregate deployment volume. A chatbot whose user interactions feed back into its training accumulates aggregate accountability weight proportional to the number of interactions times the loop-closure rate. Industry's current default applies per-interaction framing to closed-loop systems. This undercounts aggregate accountability weight by orders of magnitude in closed-loop-at-scale deployments. This scaling inversion is the mechanism by which deployment costs are externalised. The economic argument is developed in §10.

Compressed flagship. ChatGPT Health (OpenAI, January 2026) integrates health-data connections with Apple Health, MyFitnessPal, Function, and Weight Watchers. OpenAI states that conversations within the Health product space are not used to train foundation models by default. However, the Health space is opt-in and requires active user navigation. When a user asks a health question in regular ChatGPT, the system suggests moving to Health but does not enforce it. OpenAI's public documentation establishes a product-boundary guarantee for the Health space, not an automatic semantic-content guarantee for every health-related main-chat interaction. The boundary between training-excluded and training-included health conversations depends on voluntary mid-conversation context switching: the user must notice the suggestion, interrupt their current interaction, and restart in a separate space. This makes the protected pathway dependent on routing and user uptake, creating a behaviourally leaky boundary whose effectiveness has not been publicly measured.

ECRI's Top 10 Health Technology Hazards for 2026 (21 January 2026, 18th annual edition) ranks AI-chatbot misuse in healthcare at position #1. The accountability argument applies at two levels: for health queries in regular ChatGPT (where conversations are used for training by default unless the user opts out), the concern includes potential closed-loop training effects. For the Health-specific product space, the concern is open-loop deployment accountability at scale. An independent patient-safety organisation applying standard technology-hazard methodology reaches the framework's scaling conclusion through evidence-gathering rather than theoretical derivation. Full treatment in §4.8.

Operationalisation. Identify training-loop closure (does the judgment feed back into training?). Identify deployment volume. Compute aggregate accountability weight as the product. Compare to the pipeline's actual accountability infrastructure. Strong accountability requires infrastructure that scales with aggregate weight, not per-interaction stakes.

§2.4Verdict reproducibility

Statement. Low semantic entropy across independent applications of the criterion, including applications that vary context cues irrelevant to the criterion but potentially relevant to strategic behaviour.

Weak and strong forms. In its weak form, reproducibility requires low semantic entropy across identical re-applications of the criterion: the same evaluator, the same input, the same conditions, the same verdict. In its strong form, reproducibility requires low semantic entropy across context variations that should not affect the criterion: different phrasing of the same question, different surrounding context, different surface cues that are irrelevant to the evaluated quantity but potentially relevant to the evaluator's strategic behaviour. The strong form is designed to give the framework traction against context-sensitive alignment faking (Greenblatt et al., 2024), strategic behaviour that depends on detecting evaluation context, and prompt sensitivity that degrades under irrelevant surface variation.

Grounding. Farquhar et al. (2024, Nature) introduce semantic entropy as a measure of meaning-level variation across model outputs, distinct from token-level variation. Two outputs that use different words to express the same meaning have low semantic entropy. Two outputs that express different meanings have high semantic entropy regardless of surface similarity. This is the right metric for reproducibility because it measures what the framework needs: consistency in the meaning of the verdict, not consistency in its surface form. The broader grounding is in reproducibility standards from empirical science, where an experiment that produces different results under irrelevant context variation is not considered reproducible regardless of how precisely it is described.

Why strong reproducibility matters. Weak reproducibility can be satisfied by a consistently-wrong-because-strategic evaluator. A model that detects evaluation context and consistently produces evaluation-optimised answers satisfies weak reproducibility (same context, same answer) while failing strong reproducibility (different context, different answer on the same substantive question). Weak reproducibility is necessary but insufficient because it does not test the boundary conditions that matter most for deployment: will the verdict hold when the context changes in ways that should not affect it?

Compressed flagship. Two cases test different forms of the condition. Capobianco et al. (2025) report repeated runs on a balanced 20-case subset under fixed prompts with maximum two-case variability across runs. Weak reproducibility holds under controlled methodology.

Strong reproducibility's deployment-relevant test is different. The bixonimania cross-day flip (§4.9) documents ChatGPT describing the fabricated condition as dismissible on one query and providing a factual-sounding description within days on similar queries. This is a user-facing verdict-instability pattern across natural-language variation that strong reproducibility is specifically designed to prevent. Capobianco shows controlled reproducibility is achievable. The bixonimania cross-day flip shows that deployment-reproducibility is what the strong form actually tests. The Gong et al. systematic review (§2.1) provides a third anchor at population scale: diagnostic accuracy drops 19.3 percentage points when the same clinical content moves from case-vignette format to multi-turn patient dialogue. The diagnosis should not depend on whether the question is posed as a structured vignette or a conversational exchange; the format is criterion-irrelevant context variation that should not affect the verdict.

The framework-relevant variable is natural-language context variation across queries, not sampling stochasticity (temperature or top-p randomness on identical inputs). If the model produces different answers to identical prompts under standard sampling, that is weak reproducibility failure. If the model produces semantically contradictory answers to substantively identical questions posed with different surface phrasing, that is strong reproducibility failure. Full treatment in §4.1 and §4.9.

Operationalisation. Semantic entropy measurement (Farquhar protocol) across context variations that control for criterion-irrelevant cues. Strong reproducibility requires low semantic entropy under these controlled variations.

§2.5Verdict preservation

Statement. The training signal faithfully carries the judgment's epistemic content across the chain from evaluator to weight update.

Grounding. The Judgment Paradox (§5) establishes the information-destruction mechanism: preference-rank aggregation destroys annotator reasoning, cross-review signals, and disagreement structure. The destruction is not an implementation detail. It is a structural property of the aggregation step. When a preference pair is reduced to a binary comparison, the reasoning behind each preference is lost, the confidence of each assessment is lost, and the distribution of assessments across multiple evaluators is lost.

Cole, Cole, and Simon (1981, Science 214:881–886) establish the baseline that makes this destruction consequential. Their evaluation of 150 NSF proposals re-evaluated by new reviewers found that reviewer-draw dominated funding decisions: the same proposal received substantially different evaluations depending on which reviewers were assigned. Cicchetti's (1991) meta-analysis across fields reports inter-rater reliability of κ = 0.18–0.37 for expert peer review. At these baseline reliability levels, evaluator disagreement on identical material is not noise to be collapsed. It is the distribution of legitimate expert judgment. Collapsing it to a single aggregate destroys information that is structurally recoverable only by preserving the distribution.

Weak and strong forms. In its weak form, preservation requires only that the training signal records the verdict: the evaluator's bottom-line assessment reaches the weight update. In its strong form, the training signal records the verdict, the applied criterion (including version), the distribution of evaluator assessments, the reasoning structure behind the aggregate, the confidence interval, and all of this in a form auditable downstream. The distance between weak and strong preservation is the distance between a single-scalar reward and a structured record of the judgment that produced it.

Why preservation matters structurally. A single-scalar reward strips information that the pipeline's downstream use needs. The aggregation step is where signal destruction occurs. A preference rank tells the pipeline which output was preferred. It does not tell the pipeline why it was preferred, how confidently it was preferred, whether the preference was unanimous or divided, or what the dissenting evaluator's reasoning was. Preservation is not a matter of storage capacity. It concerns what the signal encodes about the judgment that produced it.

Compressed flagship. The bixonimania case (full treatment in §4.9) demonstrates preservation failure at scale. Deliberately fabricated preprints containing explicit markers of fabrication were absorbed into commercial LLM training data and reproduced as factual content, propagating into peer-reviewed literature before retraction. The framework reading is that the training-time criterion preserved the authoritative-register content while the fabrication markers occupied parts of the source that the criterion did not encode through. The training signal carried what the criterion rewarded and dropped what it did not.

Scope. Preservation is not a claim about storage infrastructure. It is not a guarantee that downstream consumers use preserved information correctly. Downstream misuse of a well-preserved signal falls under the continuous ledger (§6) and accountability (§2.3), not preservation. The condition's scope is the chain from evaluator to weight update; what happens after the weight update is outside it.

Dual role. The verdict record satisfying preservation is also the framework's common audit substrate. All four other conditions require the record to be evaluable. Criterion adequacy requires a record of what criterion was applied. Independence requires a record of who evaluated. Accountability requires a record of feedback pressure. Reproducibility requires a record of semantic variation across applications. This is not double-counting; it is a structural observation that preservation's output is the input to every other condition's verification. Without preservation, the other four conditions become operationally invisible: an auditor cannot verify what cannot be recovered from the record. The infrastructural implications are developed in §5.

Audit preservation versus training-signal preservation. Preservation implies two requirements operating at different layers. An audit record makes the judgment recoverable for downstream verification. An update mechanism feeds the distributional signal to the optimiser rather than requiring scalar collapse. If a pipeline stores a perfect seven-component record in a database but collapses the signal to a scalar reward before passing it to the optimiser, the audit substrate is satisfied while the training signal has suffered preservation failure. The model learns from the collapsed scalar, not from the preserved record. A pipeline satisfying only the first has strong audit preservation and weak training-signal preservation. This distinction is developed further in §5.3.

Connection to the Rich Annotation Object. The Judgment Paradox's Rich Annotation Object (RAO) preserves per-annotator reasoning, cross-review signals, and disagreement structure. It is one implementation of strong verdict preservation at the annotation layer. This paper's framework is more general. RAO is a compatible implementation choice at one kind of judgment step. Other implementations are possible at other kinds of judgment steps.

Operationalisation. Audit the training signal's encoded content against the judgment step's observable components: criterion applied, evaluator identity, distribution of assessments, confidence structure. Strong preservation holds when all components are recoverable from the signal.

§2.6Discriminating between conditions

The five conditions are individually necessary but their failure modes can appear similar. This section provides discrimination rules for the most commonly overlapping pairs.

Adequacy versus independence. If the criterion itself would produce the same failure even when applied by an evaluator with no shared error modes with the producer, the failure is adequacy-primary. If the criterion is adequate but the evaluator's shared biases with the producer cause the failure, it is independence-primary. Test: replace the evaluator with an independent one applying the same criterion. If the pathology persists, adequacy is the dominant condition. If it resolves, independence is the dominant condition.

Adequacy versus accountability. In reward-hacking cases, both typically contribute. Adequacy supplies the exploitable gap between the proxy criterion and the deployment-relevant quantity. Accountability failure allows the gap to persist uncorrected. Test: if the evaluator's application quality has drifted over time (the criterion was initially adequate but the evaluator's tracking degraded), accountability is dominant. If the criterion never measured the right quantity, adequacy is dominant. In most practical cases, both interact: adequacy supplies the gap, accountability failure allows it to remain undetected or uncorrected.

Reproducibility versus preservation. If the same evaluator applying the same criterion to the same artifact produces different verdicts across context-irrelevant variations (time of day, phrasing, surrounding examples), the failure is reproducibility. If the evaluator produces the same verdict but the aggregation step destroys the verdict's structure before the weight update, the failure is preservation. Test: examine the chain after the judgment step. If the evaluator's output is consistent but the training signal is lossy, preservation is dominant. If the evaluator's output varies, reproducibility is dominant.

General principle. When multiple conditions appear to apply, identify the earliest point in the judgment pipeline where the failure originates. Adequacy failures originate at criterion selection (before the step). Independence failures originate at evaluator-producer relationship (at the step). Reproducibility failures originate at criterion application (during the step). Accountability failures originate at feedback structure (across the step over time). Preservation failures originate at aggregation (after the step). The origination point identifies the dominant condition. The other conditions may contribute secondarily.

§3.1Criterion adequacy

Consider a pipeline where the evaluators are independent of the producer (strong independence), where feedback pressure on evaluator application quality is maintained through calibration tracking and audit (strong accountability), where semantic entropy across context-varied applications of the criterion is low (strong reproducibility), and where the verdict record faithfully carries the judgment's full epistemic content, including evaluator identity, confidence intervals, and reasoning structure (strong preservation). The only structural deficiency is that the criterion measures something other than what the deployment context requires.

This is not a hypothetical edge case. A pipeline training against HealthBench rubric-alignment on synthetic medical conversations can satisfy all four remaining conditions while the criterion's measured quantity (rubric-alignment on synthetic conversations) is decoupled from the deployment-relevant quantity (concordance with tumour-board consensus on real oncology cases). The evaluators may be independent, audited, reproducible, and their verdicts fully preserved. The training signal is still structurally deficient because it encodes what the criterion tested rather than what the deployment needs. The four satisfied conditions ensure the wrong thing is measured well. They do not close the gap between what is measured and what should have been measured.

The distinct pathology is Goodhart-class proxy optimisation: the pipeline optimises what the criterion rewards, and deployment depends on what the criterion should have rewarded. This pathology is mapped in §7.4 and grounded empirically through Capobianco et al. (2025) in §4.1.

§3.2Evaluator independence

Consider a pipeline where the criterion is well-specified for the target domain (strong adequacy), where evaluator application quality is audited (strong accountability), where semantic entropy across repeated applications is low (strong reproducibility), and where the verdict record preserves the judgment's full structure (strong preservation). The only structural deficiency is that the evaluator is a copy-class of the producer.

A self-grading pipeline illustrates the scenario directly. The producer generates candidate outputs. A copy of the same model, or a model from the same training lineage, evaluates them against a criterion such as "plausibility given domain knowledge." The criterion is well-specified. The self-grading records are complete. The evaluator is audited. Reproducibility is high because identical model weights applied to identical inputs produce identical verdicts. Nothing in the remaining four conditions prevents the evaluator from sharing the producer's systematic errors on the criterion-relevant dimension. If the producer consistently misidentifies a class of plausible-sounding falsehoods as correct, the evaluator drawn from the same error distribution will approve them with the same consistency.

Constitutional AI self-critique is a realistic instance of this structure. The critique step evaluates the generation step's output against constitutional principles. When both steps share error modes on the dimension the critique is meant to evaluate (for example, when both steps are drawn from the same pretrained model and share its systematic biases about what constitutes harmful content), independence fails despite the presence of the other four conditions.

The distinct pathology is correlated-error propagation: systematic errors that survive evaluation because the evaluator cannot see what the producer cannot see. This connects to the sycophancy mechanism mapped in §7.1, where RLHF raters share preference-relevant error modes with the users whose satisfaction the pipeline optimises. Huang et al. (ICLR 2024, "Large Language Models Cannot Self-Correct Reasoning Without External Feedback") provide the empirical anchor: across multiple benchmarks, LLM self-correction without external feedback consistently degraded accuracy. The model's self-evaluation approved its own errors because the evaluator shared the producer's error distribution. Subsequent work has shown that self-correction can succeed when the evaluator has information the generator lacks (execution feedback, tool augmentation, multi-sample consistency). This actually strengthens the independence reading, because success correlates precisely with conditions that break the shared-error-mode structure. The finding is precisely the independence counterexample measured at scale: self-correction fails under shared error modes and succeeds under genuine independence.

§3.3Structural accountability

Consider a pipeline with strong evaluator-producer independence (the evaluator is architecturally distinct, error modes non-overlapping with the producer on the criterion-relevant dimension), a criterion specified correctly for the deployment context (strong adequacy), and faithful recording of all judgments including evaluator identity, reasoning, and confidence (strong preservation). The evaluator's application of the criterion is internally consistent enough to satisfy weak reproducibility: the same evaluator, given the same input, produces the same verdict. The only structural deficiency is the absence of audit, feedback, or consequence for the evaluator's criterion-application quality over time.

The evaluator begins by applying the well-specified criterion correctly. Over thousands of judgments, application quality drifts. The drift is not random. It is systematic, shaped by whichever features reduce the evaluator's cognitive or computational cost of applying the criterion. The criterion itself has not changed. The evaluator's application of the criterion has shifted toward a cheaper approximation. The evaluator's misapplication is internally consistent enough to satisfy weak reproducibility, but no audit or consequence structure exists to detect the drift or generate corrective pressure.

This is not an adequacy failure: the criterion, correctly applied, still measures the right thing. It is not an independence failure: the evaluator's error modes do not overlap with the producer's. It is not a reproducibility failure: the evaluator is internally consistent, and the drift does not manifest as high semantic entropy across context variation but as a stable, shifted application. It is not a preservation failure: the verdict record faithfully captures what the evaluator actually judged, including the drifted application. The failure is specifically the absence of infrastructure that would detect and correct application drift through feedback pressure on the evaluator. Accountability's distinct contribution is responsibility for application quality that generates corrective pressure, separate from criterion specification (adequacy), evaluator-producer distinction (independence), and verdict-level consistency (reproducibility).

The distinct pathology is reward hacking. When evaluator application drift correlates with features the optimiser can exploit, the pipeline learns to produce outputs that satisfy the drifted criterion-application rather than the criterion itself. The exploit-discontinuity mechanism identified in Uncertainty Collapse (§4) traces to this structure. The mapping is developed in §7.3.

The scenario is not hypothetical. Gao et al. (2023) and Rafailov et al. (NeurIPS 2024) document reward-model over-optimisation formally: proxy reward scores continue climbing during training while true quality (measured by held-out evaluations or human judgment) peaks and then degrades. The proxy-reward evaluator's application quality has drifted toward features the optimiser can satisfy without satisfying the true criterion, and no corrective-pressure infrastructure detects the divergence until downstream evaluation reveals the damage.

The April 2025 GPT-4o sycophancy incident (documented publicly, referenced in Lambert 2026) illustrates the deployment-side consequence: a model update produced extreme sycophantic behaviour visible to users, meaning the evaluator's application quality had drifted during training without internal detection or correction. Both cases instantiate the §3.3 scenario: the criterion was not wrong (adequacy held), the evaluator was architecturally distinct from the producer (independence held), the drift was internally consistent (weak reproducibility held), and the records were preserved (preservation held). What was absent was the feedback pressure that would have detected and corrected the drift before it propagated to deployment.

(The Pedagogical Inversion, Confidence Curriculum Paper 4, §1.2.1, develops the same incident as the series's central natural experiment for confidence inheritance: OpenAI's postmortem identified user feedback as the additional reward signal that weakened the primary signal holding sycophancy in check, and the subsequent GPT-5 transition revealed that months of sycophantic interaction had recalibrated user expectations in ways that persisted across model changes. Paper 4 analyses the three-lab structural convergence and weighs four alternative explanations. This paper's reading is complementary: the same incident, read through the accountability condition, isolates the absence of corrective-pressure infrastructure as the specific structural failure at the judgment step.)

§3.4Verdict reproducibility

Consider a retrieval-augmented research tool where the criterion is appropriate for the domain (groundedness in retrieved legal authorities, strong adequacy), where retrieval and generation components are architecturally independent (strong independence), where the pipeline is audited with calibration tracking (strong accountability), and where verdict records preserve the full judgment structure including retrieved sources and confidence (strong preservation). The only structural deficiency is context-sensitive criterion application: the verdict the evaluator produces varies with surface features of the query that are irrelevant to the criterion.

Minor phrasing variations in the query produce different retrieval sets, which produce different groundedness evaluations, which produce different verdicts on substantively identical legal questions. The criterion is correct for the domain. The evaluator is independent. Accountability infrastructure is in place. The verdict record faithfully captures each application. But the training signal's semantic content varies across context perturbations that should not affect it, producing high semantic entropy in the Farquhar sense.

The Ask Practical Law AI pattern documented by Magesh et al. (2025) is compatible with this structure. The tool's over-60% incompletion rate (the highest among tools tested) represents cases where the system fails to produce a verdict at all under low-retrieval-support conditions. This is arguably a form of reproducibility failure rather than criterion-application error: the criterion's applicability is context-dependent in ways the deployment context does not tolerate, and the system's response (refusal rather than incorrect verdict) varies with retrieval conditions irrelevant to the legal question asked.

The phenomenon has been measured formally beyond the legal domain. Errica et al. (NAACL 2025, "What Did I Do Wrong? Quantifying LLMs' Sensitivity and Consistency to Prompt Engineering") introduce two metrics that operationalise the weak/strong reproducibility distinction directly: sensitivity (prediction changes across prompt rephrasings, corresponding to weak reproducibility) and consistency (prediction variation across same-class rephrasings, corresponding to strong reproducibility). RobustAlpacaEval (Cao et al., 2024) documents performance swings of up to 45% across semantically equivalent prompts. These are not edge cases. They are systematic measurements of exactly the failure this counterexample isolates: verdicts that vary with surface features that should not affect the criterion.

The distinct pathology is context-sensitive fabrication: outputs whose factual content varies with irrelevant context cues. The deployment-observable form is the pattern where the same system produces confident, contradictory answers to substantively identical questions posed with minor surface variation. This pathology is mapped in §7.2.

§3.5Verdict preservation

Three psychiatrists independently review the same clinical case as part of a training-annotation pipeline. Two classify the case as major depressive disorder. One dissents, classifying it as adjustment disorder with depressed mood, and provides substantive clinical reasoning: the symptom duration is below the DSM threshold, and the presentation is better explained by a recent bereavement. The three psychiatrists are independent of the producer (strong independence). The clinical-classification criterion is appropriate for the deployment context (strong adequacy). Each psychiatrist is individually accountable and their application quality is audited (strong accountability). Each psychiatrist is individually reproducible, and the disagreement reflects substantive clinical judgment under legitimate interpretive variation rather than criterion-application noise (strong reproducibility in the framework's sense, which concerns consistency across context variation, not absence of expert disagreement).

The pipeline aggregates their assessments to a single majority-vote label: major depressive disorder. The aggregation preserves the verdict. It destroys the dissenter's clinical reasoning, the dissenter's identity for downstream calibration, the 2:1 distribution, and the information that the case sits at a diagnostic boundary where qualified experts disagree.

The Cole, Cole, and Simon (1981) baseline establishes that this scenario is not an unusual edge case. Their evaluation of 150 NSF proposals re-evaluated by new reviewers found that reviewer-draw dominated funding decisions. Cicchetti's (1991) meta-analysis across fields reports inter-rater reliability of κ = 0.18–0.37 for expert peer review. At these baseline reliability levels, a 2:1 split among three qualified evaluators is representative of the distribution of legitimate expert judgment, not outlier noise to be collapsed.

Four readings that would collapse this failure into another condition must be addressed.

Is this an independence failure? No. Independence concerns evaluator-producer error-mode overlap. The three psychiatrists are independent of each other and of the producer. Their disagreement is not a shared error mode. It is substantive clinical judgment. The failure is not in the judgment, which is well-formed at the individual level. It is in what the aggregated signal carries forward.

Is this a reproducibility failure? No. Each psychiatrist can be individually reproducible. The disagreement is not high semantic entropy across context variation in the Farquhar sense. It is substantive interpretive variation on a case that sits at a genuine diagnostic boundary. Reproducibility concerns whether the same evaluator, or evaluators in the same class, produce the same verdict under criterion-irrelevant context variation. The psychiatrists disagree on criterion-relevant clinical grounds.

Is this an adequacy failure? No. The criterion (clinical classification using DSM categories) is appropriate for the deployment context. What fails is not the criterion's fit to the deployment need but the signal's encoding of the judgment's structure. The criterion is adequate. The record of its application is not.

Is this an accountability gap? No. All three psychiatrists are individually accountable for their assessments. Their individual assessments are well-formed and auditable. The aggregation step destroys information without violating any individual's accountability. The aggregated output, however, has no clear owner of the collapsed reasoning. The majority-vote label is attributed to the group, but the group did not produce that label. The aggregation procedure did.

The remaining framework-internal location for the failure is preservation. The verdict record satisfying all four other conditions can still destroy the distribution, the reasoning, and the calibration substrate that downstream training would need to learn appropriate confidence modulation. Preservation's distinct contribution is named: the training signal must faithfully carry the judgment's epistemic content, not merely its bottom-line verdict.

§3.6Non-redundancy established

Five counterexamples, five distinct pathologies. In each case, strong-form satisfaction of the remaining four conditions does not prevent the target condition's failure from producing a training signal deficient in a way the other conditions cannot compensate. Criterion adequacy failure produces proxy optimisation. Independence failure produces correlated-error propagation. Accountability failure produces reward hacking through application drift. Reproducibility failure produces context-sensitive fabrication. Preservation failure produces calibration collapse through information destruction. No condition subsumes another. The framework's five-condition structure is irreducible.

§4.1RLHF with human raters

Condition classification. Independence: weak. Evaluators are architecturally separate from the producer, but raters and downstream users share preference-relevant error modes (warmth, agreeableness, validation-seeking) on dimensions the criterion is meant to evaluate. Accountability: weak. Raters are nominally identifiable, but feedback pressure on individual judgment quality is minimal in standard annotation pipelines. Reproducibility: variable. Per-rater consistency is typically adequate; cross-rater agreement on disputed items is unstable at baseline (Cole et al. 1981 reliability levels). Adequacy: deployment-dependent. Criteria designed for benchmark performance may or may not track deployment-relevant quantities. Preservation: fails. Scalar-aggregation of preference rankings destroys the judgment's distributional structure, individual reasoning, and confidence.

The empirical test. This case tests criterion transport, not model ranking. The question is not which model performs better; the question is whether the improvement claimed against the marketing criterion transports to the deployment-relevant criterion.

Method. Capobianco et al. (2025, Journal of Medical Systems 49:173) conducted a single-centre rapid audit at University Hospital Tübingen (ethics committee approval 273/2024BO1). The dataset comprised 100 gastrointestinal oncology cases retrospectively selected from the institution's tumour board, inclusion window March 2022 to December 2023, with 20 patients randomly sampled per tumour subgroup (oesophageal, pancreatic, gastric, colorectal, hepatobiliary). Median patient age was 64.5 years (IQR 56–71), male-to-female ratio 64:36. Cases involving clinical-trial enrolment or atypical diagnoses were excluded.

Three models were evaluated via the OpenAI API in August 2025: GPT-5, GPT-4o, and GPT-4o-mini. GPT-4o and GPT-4o-mini were run at temperature 0.8 with Top P of 1, chosen to approximate ChatGPT web-interface behaviour. GPT-5 used a fixed internal sampling temperature not adjustable by the user. All models received identical anonymised case narratives with a prompt specifying a multidisciplinary gastrointestinal oncology tumour-board role and requesting a concise guideline-style therapeutic recommendation in German (one to two sentences). Responses were classified into nine therapeutic categories (supportive care, surgery, systemic therapy, and others). Two blinded clinicians classified model outputs independently, with consensus resolution of discrepancies. Concordance was defined as matching therapeutic category. Where the tumour board had provided multiple options, a response was scored concordant if it matched at least one.

Results. GPT-4o-mini achieved 79% concordance (95% CI 70.02–85.83%), GPT-4o achieved 85% (95% CI 76.72–90.69%), and GPT-5 achieved 85% (95% CI 76.72–90.69%). Cochran's Q and pairwise McNemar tests showed p ≥ 0.21 across all model comparisons: no statistically significant difference between any pair. Repeated runs on a balanced 20-case subset produced maximum two-case variability with no change in relative performance. By tumour type, GPT-5 performed best on oesophageal cases (100.0%) and weakest on colorectal (70.0%).

Framework reading. The parity result is the framework-relevant finding. The adequacy gap between HealthBench (rubric-alignment on synthetic medical conversations) and Capobianco's criterion (tumour-board concordance on real oncology cases) is developed in §1.1 and §2.1. The key structural observation: both criteria are well-constructed and measure different things. The training signal encoded what HealthBench tested. The deployment context required what Capobianco tested.

Scope and caveat. The paper does not claim GPT-5 is clinically worse than GPT-4o. The data shows no regression. The framework-relevant observation is criterion-transport failure, not clinical decline. A sympathetic reader might note that 85% concordance against tumour-board consensus is itself high. The framework's response is that tumour-board consensus is a criterion choice, not a neutral backdrop. Tumour boards exist specifically to reduce individual-clinician cognitive bias and integrate multi-speciality judgment. They represent the deployment-relevant standard for the exact use case OpenAI demonstrated publicly at launch: the Millon case, where AI was presented as a thought partner for navigating disagreement between physicians on radiation therapy. See also The Judgment Paradox §10 for the market-pattern reading of this case alongside the broader GPT-5/HealthBench/ECRI cluster.

A second measured adequacy gap. Bean et al. (Nature Medicine, February 2026) conducted the largest user study of LLMs for assisting the general public in medical decisions: a randomised trial with approximately 1,300 participants who used LLMs to identify health conditions and decide on appropriate courses of action based on physician-developed medical scenarios. The finding: LLMs were no better than traditional methods (online searches, participants' own judgment) for medical decision-making, despite excelling on standardised tests of medical knowledge. Three structural challenges emerged: users did not know what information the LLM needed, LLMs provided different answers to slight question variations (a reproducibility finding), and LLMs mixed accurate and inaccurate recommendations indistinguishably (a preservation finding, since the user cannot separate signal from noise in the output).

The gap between benchmark performance and real-user interaction is the adequacy gap measured from the user side rather than the clinical side. Capobianco measures it from the expert-evaluation side (benchmark scores do not transport to tumour-board consensus). Bean measures it from the deployment-interaction side (benchmark scores do not transport to user decision quality). Together they establish that the adequacy gap is bidirectional: the criterion fails to track the deployment-relevant quantity regardless of whether the deployment-relevant quantity is measured by experts or by the intended users.

§4.2RLAIF

Condition classification. Independence: weak to fails. The evaluator is a copy-class of the producer; error modes are correlated on criterion-relevant dimensions. Accountability: weak. Judge-model drift is typically not audited in standard deployments. Reproducibility: strong within controlled contexts, where identical model weights produce identical verdicts. Adequacy: varies by constitution design. Preservation: fails at scalar aggregation.

Structural observation. RLAIF modifies RLHF by replacing human raters with AI evaluators. This addresses weak independence in one direction (the AI evaluator does not share human raters' warmth and validation preferences) while weakening it in another (the AI evaluator shares the producer's training-derived biases). The structural question is which error-mode overlap matters more for the criterion in use.

Empirical grounding. Three published findings ground the shared-error-mode concern. SycEval reports 78.5% within-session sycophancy persistence, documenting that sycophantic behaviour established in response to user signals is maintained across subsequent turns rather than correcting toward the model's initial assessment. Chen et al. (npj Digital Medicine 8:605, 2025) demonstrate up to 100% initial compliance with illogical medical requests across five frontier LLMs, establishing that models prioritise helpfulness over logical consistency even on medical queries where the model has correct knowledge. Cheng et al. (Science 391:eaec8352, 2026) demonstrate that even a single interaction with sycophantic AI reduces human participants' prosocial intentions and increases conviction, establishing that the shared-preference error mode between rater and user has measurable downstream effects on human judgment. All three findings are consistent with the weak-independence structure: when evaluator and producer share error modes, the training signal reinforces those modes rather than filtering them.

Scope. RLAIF's condition profile is structurally similar to RLHF's. The distinctive feature is that independence failure can be stronger (copy-class overlap) even as it avoids RLHF's specific human-preference-leakage pathway. Whether this trade is net positive or negative depends on which error modes the criterion is most sensitive to, a determination the framework supports but does not make universally.

§4.3Constitutional AI

Condition classification. Constitutional AI introduces two judgment steps (critique and revision), each requiring separate classification. Critique step: independence weak (self-critique shares error modes with generation), accountability weak (critique-quality drift unaudited), reproducibility adequate (controlled self-evaluation conditions), adequacy depends on constitution-to-deployment fit, preservation partial (critique reasoning is sometimes retained in structured form). Revision step: similar profile, with adequacy sometimes weaker under criterion-stacking when multiple constitutional principles interact.

Structural observation. The two-step architecture creates an opportunity that standard RLHF lacks: the critique step can preserve reasoning in structured form rather than collapsing to a scalar preference. When this opportunity is taken, preservation is partially satisfied. The framework predicts that Constitutional AI systems retaining critique reasoning should exhibit better-calibrated confidence on the dimensions the constitution covers, and worse calibration on dimensions outside the constitution's scope. This prediction is testable but not, to this paper's knowledge, tested in published work as of early 2026.

Scope. Constitutional AI is analysed here as a pipeline class, not as a specific implementation. Anthropic's published methodology describes the general structure. Implementation details vary. The framework classifies the structural properties of the class; specific deployments may satisfy conditions more or less strongly depending on implementation choices.

§4.4RLVR with Lean kernels

Condition classification. All five conditions satisfied in strong form within the scope of formal mathematical proof. Independence: strong. The Lean proof kernel's error modes are orthogonal to the generator's. The kernel verifies syntactic and logical validity; the generator produces candidate proofs. Their failure modes do not overlap on the criterion-relevant dimension because the kernel's verification is decidable within Lean's type theory. This is the de Bruijn criterion from formal methods (Barendregt and Wiedijk): a small, trusted verification kernel whose correctness is independent of the complexity of the proofs it checks. Accountability: strong. The kernel's behaviour is deterministic and auditable. Reproducibility: strong. Identical inputs produce identical verdicts. Adequacy: strong within scope. The criterion (formal validity) is exactly the deployment-relevant quantity for mathematical proof. Preservation: strong. The kernel's accept/reject verdict, combined with the proof term itself, constitutes a complete record of the judgment.

Structural observation. RLVR with Lean kernels is not included as an aspiration. It is included as a measurement baseline. The conditions are achievable when the judgment step's structural requirements match the domain. The domain permits a decidable criterion, an evaluator with orthogonal error modes, deterministic reproducibility, and a complete verdict record. These are properties of the domain, not achievements of the pipeline. The framework's contribution is identifying which structural properties must hold and observing that they hold naturally in formal domains and fail structurally in open-ended natural-language domains. The gap between §4.4 and §4.1 is the framework's core diagnostic.

§4.5RLVR with execution verification

Condition classification. Strong within the scope of executable claims. The execution environment serves as a kernel-like verifier for the question "does this code produce this output?" Independence: strong (execution environment's error modes are orthogonal to the code generator's on the criterion dimension). Accountability: strong (deterministic execution). Reproducibility: strong (identical code on identical inputs produces identical outputs). Adequacy: strong within scope (the criterion matches the deployment need for the class of claims verifiable by execution). Preservation: strong (execution logs constitute complete verdict records).

Scope limit. Execution verification is strong for "does this code work?" and weak for "is this code good?" Code quality, maintainability, security, and design are not executable properties. A pipeline using execution verification alone satisfies the conditions for functional correctness and fails to address the broader qualities that deployment may require. The boundary between verifiable-by-execution and not-verifiable-by-execution is the boundary of the pipeline class's strong-condition scope.

§4.6RAG-based research tools

Condition classification. Independence: weak. Retrieval and generation components typically share underlying model architecture, and the generation step's fluency preferences shape which retrieved passages receive emphasis. Accountability: varies by provider practice. Reproducibility: context-sensitive. Retrieval sets vary with phrasing, which varies the groundedness evaluation, which varies the verdict on substantively identical queries. Adequacy: fails on the factual-correctness dimension while sometimes satisfying a narrower groundedness-to-retrieved-documents criterion. The distinction is structural: a response can be well-grounded in its retrieved sources and factually wrong about the legal question it purports to answer. Preservation: fails at the groundedness-versus-correctness decomposition level. The training signal does not distinguish "correct because grounded in correct sources" from "grounded but incorrect because the retrieved source is inapplicable."

Method. Magesh et al. (2025, Journal of Empirical Legal Studies, DOI 10.1111/jels.12413; preprint arXiv:2405.20362, May 2024) conducted the first preregistered, peer-reviewed evaluation of commercial legal-AI research tools. The study was produced by Stanford RegLab and the Institute for Human-Centered AI (Magesh and Surani as co-equal first authors; Dahl at Yale Law School; Suzgun, Manning, and Ho at Stanford). Over 200 legal queries were preregistered on the Open Science Framework and executed by direct chat-interface interaction. Four systems were evaluated: Lexis+ AI, Westlaw AI-Assisted Research, Thomson Reuters Ask Practical Law AI, and GPT-4 as a general-purpose comparison.

The evaluation applied a two-dimensional typology distinguishing correctness (factual accuracy of the response relative to the query) from groundedness (relationship between the response and its cited sources). Response outcomes were coded as accurate (correct and grounded), incomplete (fails to address the query or lacks proper citations), or hallucinated (false statements or false assertions of source support). Inter-rater reliability was high: Cohen's κ = 0.77, with 85.4% agreement between the evaluation labeller and initial labels.

Results. Lexis+ AI: 65% accurate, 17% hallucinated. Westlaw AI-Assisted Research: 41% accurate, 33% hallucinated, approximately twice the rate of other tools tested. Ask Practical Law AI: 19% accurate, 17% hallucinated, and over 60% incomplete (the highest incompletion rate among tools tested). Documented failure examples include Westlaw AI-AR fabricating a statement in the Federal Rules of Bankruptcy Procedure that does not exist, Lexis+ AI citing Casey's undue-burden standard (overruled in Dobbs v. Jackson Women's Health Organization, 2022), and Ask Practical Law AI failing to correct a false user premise about Justice Ginsburg's voting record on same-sex marriage while adding further false information.

Marketing context. LexisNexis marketed Lexis+ as producing "hallucination-free" legal citations (2023). Thomson Reuters executives described Westlaw AI-AR's retrieval-augmented generation as reducing hallucinations "to nearly zero" (Ambrogi, February 2024). The preregistered evaluation measured hallucination rates between 17% and 33% across these tools.

Framework reading. The correctness-versus-groundedness decomposition makes the adequacy gap visible within a single tool. A response can satisfy the groundedness criterion (its citations support its claims) while failing the correctness criterion (its claims are factually wrong about the law). This is criterion adequacy failure: the training-time criterion (groundedness in retrieved documents) does not track the deployment-relevant criterion (factual accuracy about legal authorities). Hallucinated responses show that even the groundedness criterion fails under retrieval noise. The over-60% incompletion rate in Ask Practical Law AI represents a distinct failure shape: criterion-application refusal under low-retrieval-support conditions rather than criterion-application error. Cross-product, the 17–33% hallucination range across tools marketed with elimination-level claims quantifies the gap between marketing criterion and deployment reality.

Caveat. Magesh et al.'s evaluation was conducted in 2024. Tool performance may have changed. The framework-relevant observation is not the specific hallucination rate but the structural pattern: groundedness criteria that do not track correctness, marketing claims decoupled from preregistered evaluation, and an adequacy gap visible at the level of the evaluation typology itself. See also The Judgment Paradox §5.1 and §10.3 for the objectivity-ladder and market-pattern readings of this case.

§4.7LLM-as-judge

Condition classification. Independence: weak. Judge-model error modes overlap with the producer class when both are drawn from the same training lineage or architectural family. Accountability: weak. Judge-model drift is unaudited in standard evaluation deployments. Reproducibility: adequate within controlled evaluation rounds. Adequacy: depends on judge-prompt design; well-constructed rubrics can produce adequate criteria within scope. Preservation: weak. Judge outputs are often minimally structured, recording a score or ranking without the reasoning or confidence structure behind the verdict.

Structural observation. HealthBench is an instance of the LLM-as-judge pattern applied to medical evaluation: physician-authored rubrics evaluated by a judge model against synthetic conversations. The framework's §4.1 analysis of the HealthBench-to-Capobianco adequacy gap is an LLM-as-judge analysis. The judge model's verdict is well-structured within the rubric's scope. The adequacy failure is in the criterion the rubric encodes, not in the judge model's application of the rubric.

Scope. LLM-as-judge pipelines vary widely. The framework's classification applies to the structural properties of the class. Well-designed instances with calibrated rubrics, independent judge selection, and structured verdict records can satisfy conditions more strongly than the class profile suggests. The class-level weakness is the default, not the ceiling.

§4.8Consumer chat deployments with health-information use

Condition classification. This row classifies a deployment pattern rather than a training pipeline. The dominant failure is accountability under volume scaling. Training-time judgment steps feeding consumer chat systems inherit the condition profiles of their respective pipeline classes (§4.1–§4.3, §4.7). The deployment adds a new structural feature: health-information interactions at scale without structural mechanisms for detecting or correcting systematic errors proportional to volume. The accountability concern operates at two levels. For OpenAI's dedicated Health product space, health conversations are excluded from foundation-model training by policy; the concern is open-loop deployment accountability, where systematic errors persist without correction. For health queries that remain in regular ChatGPT rather than moving into the Health space, ordinary ChatGPT data controls apply, raising potential closed-loop concerns where health-information interactions feed back into model behaviour depending on the user's model-improvement settings and applicable account policy.

Method and source. ECRI's Top 10 Health Technology Hazards for 2026 (Willow Grove, Pennsylvania, 21 January 2026, 18th annual edition) ranked misuse of AI chatbots in healthcare at position #1. ECRI is an independent patient-safety organisation whose methodology combines member surveys, literature reviews, medical device testing in its own laboratory, and patient-safety incident investigations. Named systems: ChatGPT, Claude, Copilot, Gemini, Grok.

Documented hazards. ECRI's report documents specific categories: incorrect diagnoses, unnecessary testing recommendations, promotion of substandard medical supplies, invention of nonexistent anatomy in response to medical questions, and a documented case of chatbot approval for electrosurgical-return-electrode placement over a patient's shoulder blade, which under clinical standards creates burn risk.

Scale. OpenAI's own analysis, cited by ECRI, reports more than 40 million daily ChatGPT users seeking health information.

Framework reading. The aggregate-accountability-weight calculation under loop-closure-times-volume scaling matches ECRI's institutional ranking. An independent patient-safety organisation using standard technology-hazard methodology reaches the framework's scaling conclusion through evidence-gathering rather than theoretical derivation. The convergence is structural: ECRI's methodology measures the same deployment-volume-times-harm-potential quantity that the framework's accountability condition predicts should be measured. Specific documented hazards instantiate specific condition failures: invented anatomy and substandard-supply promotion are preservation failures (authoritative-register content without truth-value encoding). The electrosurgical-electrode case is adequacy failure (the criterion applied at the judgment step did not encode medical-safety-critical spatial reasoning).

Caveat. ECRI's ranking reflects institutional judgment about hazard priority, not quantified harm rates. The framework cites the ranking as convergent institutional recognition, not as a harm measurement. The 40-million-daily-user figure is OpenAI's own report. Independent verification of the figure is outside this paper's scope. See also The Judgment Paradox §10 for the market-pattern reading of ECRI alongside the GPT-5/HealthBench/Capobianco cluster.

§4.9Multi-stage information propagation

Condition classification. This row classifies a propagation pattern rather than a single pipeline. The dominant failure is preservation at the training stage, compounded across sequential judgment steps: LLM training, user-facing question-answering, and human peer review.

Worked case: bixonimania. Almira Osmanovic Thunström and collaborators (University of Gothenburg, with ethics-consultant collaboration) uploaded two preprints to SciProfiles and Preprints.org in March 2024 describing a fabricated eye condition called "bixonimania." The preprints contained an inventory of fabrication markers designed to be detectable by any competent reader. The lead author was listed as "Lazljiv Izgubljenovic" (Slovenian for "lying loser"). The institutional affiliation was "Asteria Horizon University, Nova City, California" (both fictional). Acknowledgements thanked "Professor Maria Bohm at The Starfleet Academy ... onboard the USS Enterprise" and credited funding to "the Professor Sideshow Bob Foundation for its work in advanced trickery." The methods section stated "Fifty made-up individuals aged between 20 and 50 years were recruited." The paper contained the explicit statement "this entire paper is made up." Thunström told Nature that the name was chosen because the psychiatric "-mania" suffix would flag implausibility to any competent clinician.

Documented chatbot responses. Nature's coverage (Stokel-Walker, d41586-026-01100-y, 7 April 2026) documents responses from multiple commercial systems. Microsoft Copilot (13 April 2024) described the condition as "intriguing and relatively rare." Google Gemini (13 April 2024) attributed it to blue-light exposure and recommended ophthalmological consultation. Perplexity AI (27 April 2024) reported a worldwide prevalence of approximately 90,000. ChatGPT (multiple dates, April 2024 onward) described the condition as "a proposed new subtype of periorbital melanosis ... thought to be associated with exposure to blue light from digital screens." Nature also documents ChatGPT describing bixonimania as "probably a made-up, fringe, or pseudoscientific label" on one query and providing a factual-sounding description within days on similar queries.

Peer-review propagation. Researchers at the Maharishi Markandeshwar Institute of Medical Sciences and Research cited the bixonimania preprints in a paper published in Cureus (Springer Nature, peer-reviewed). The paper was retracted on 30 March 2026 after Nature prompted editorial review. The retraction notice acknowledges "presence of three irrelevant references, including one reference to a fictitious disease." The preprints were taken down from Preprints.org on 10 April 2026 following Nature's publication.

A second independent case of multi-stage propagation into peer review. Bixonimania is not an isolated instance. Ansari (February 2026, arXiv 2602.05930) analysed 100 AI-generated hallucinated citations that appeared in papers accepted at NeurIPS 2025, one of the field's most selective conferences. The fabricated citations appeared across 53 published papers, approximately 1% of all accepted papers, and evaded review by three to five expert reviewers per paper. Ansari's taxonomy classified 66% as total fabrications and 27% as partial attribute corruption, with every hallucination exhibiting compound failure modes (secondary characteristics creating a veneer of plausibility). The mechanism differs from bixonimania (citation fabrication rather than condition fabrication), but the structural pattern is identical: AI-generated falsehoods propagating through multiple judgment steps into authoritative peer-reviewed contexts. The framework reads both cases as preservation failure compounding across sequential stages. At the LLM-generation stage, the training signal did not preserve the distinction between factual and fabricated content in the authoritative register. At the peer-review stage, expert reviewers applied criteria that did not include citation verification against primary sources. Each stage's preservation failure amplified the previous stage's output.

Mechanism validation: Omar et al. 2026. Omar, Sorin, Wieler, and colleagues (Mount Sinai, Mayo Clinic, and collaborating institutions; Lancet Digital Health 8:100949, February 2026, DOI 10.1016/S2589-7500(25)00131-1) probed twenty LLMs with more than 3.4 million prompts across three source types: real hospital discharge notes with a single inserted false recommendation (100,000 prompts), social-media and public-forum dialogues (28,000 prompts), and 300 physician-validated simulated vignettes. (A citation note: the same research programme produced an earlier companion paper in Communications Medicine (Omar, Sorin, Collins et al., 2025) testing six LLMs on the 300-vignette subset alone, reporting hallucination rates of 50–83%. This paper cites the Lancet study for its larger scale, source-framing manipulation, and the 46.1%-versus-8.9% differential that is central to the framework's authoritative-prose argument. The Judgment Paradox cites the Communications Medicine companion for the 83% figure in its §4.2 adversarial-hallucination treatment. Both papers support the framework. The citation choice reflects which study's design element each paper's argument requires.)

Susceptibility to accepting fabricated medical content depended on source framing. Hospital-note-framed fabrications were accepted at 46.1% (46,108 of 100,000). Social-media-framed fabrications were accepted at 8.9% (2,479 of 28,000). The differential is a factor of five. Model variation was substantial: GPT models were most resistant. Gemma-3-4B-it accepted 63.6% (5,023 of 7,900); Llama-3-1-8B accepted 50.7%. Ten logical-fallacy framings were tested: eight reduced or did not change susceptibility (appeal to popularity reduced acceptance by 19.8 percentage points to 11.9%, p < 0.0001). Two increased it (slippery-slope framing increased acceptance by 2.2 percentage points to 33.9%, and appeal-to-authority framing increased acceptance by 2.9 percentage points to 34.6%).

Framework reading. The bixonimania case illustrates multi-stage propagation of preservation failure across sequential judgment steps. Omar's 46.1%-versus-8.9% hospital-note-versus-social-media differential quantifies the authoritative-prose mechanism structurally. The framework reads Omar's finding as preservation-primary: the training-time criterion did not preserve the distinction between authoritative-and-true and authoritative-and-false. Adequacy-primary (the criterion rewards register over truth) and independence-primary (evaluators share register preferences with producers) are compatible secondary readings. The paper commits to the preservation-primary route and makes that commitment explicit.

The multi-stage propagation into peer review (the Cureus citation and subsequent retraction) provides the empirical anchor with the clearest causal chain. Peer-review-to-LLM-output stages are more accessible to causal analysis than LLM-training stages, where distribution-interpolation explanations remain compatible. The framework reading is the strongest structural explanation available. It is not the only compatible reading.

Caveat. The paper does not claim that the training pipeline encoded these specific source tokens in this exact way. The claim is structural: the observable propagation pattern across stages is consistent with preservation failure at each stage, and the Omar data quantifies the mechanism by which authoritative register carries content past truth-value evaluation. See also The Judgment Paradox §4.2 for the provenance-grounding reading of this case.

§4.10Pattern analysis

Table 1. PARIA condition satisfaction across pipeline classes.

Condition abbreviations follow PARIA diagnostic order: Preservation, Adequacy, Reproducibility, Independence, Accountability. "Inherited" indicates the deployment pattern inherits the condition profile of its underlying pipeline class (§4.1–§4.3, §4.7). "Dep." = dependent on specific design choices.

Two clusters emerge from the diagnostic. Formal-verification pipelines (§4.4, §4.5) satisfy all five conditions in strong form within the scope of their decidable criteria. Consumer-deployment pipelines (§4.1, §4.2, §4.7, §4.8, §4.9) cluster at weak-to-fails across multiple conditions. The intermediate cases (§4.3, §4.6) exhibit partial satisfaction with structural opportunities that current implementations do not fully exploit.

The framework locates the structural source of this gap. It is not capacity, scale, or engineering effort. Formal-verification pipelines satisfy the conditions because their domains permit decidable criteria, evaluators with orthogonal error modes, deterministic reproducibility, and complete verdict records. These are properties of the domain's relationship to the judgment step's structural requirements. Consumer-deployment pipelines operate in domains where the criteria are not decidable, the evaluator-producer error-mode overlap is structurally non-empty, reproducibility requires stability across natural-language variation, and preservation requires encoding structures that scalar aggregation destroys.

The diagnostic's contribution is not the observation that formal verification is easier to evaluate than natural-language generation. That observation is well-known. The contribution is identifying which structural properties of the judgment step separate the two clusters, and demonstrating that those properties map to the five conditions. A pipeline designer asking "why does my consumer-deployment system exhibit sycophancy despite extensive training?" can read the diagnostic as a structural answer: the judgment step satisfies independence weakly, which propagates the shared error mode the designer wants to eliminate. No amount of additional training against the same criterion can close the gap because the criterion's weak-independence structure is the source, not the symptom.

§4.11Framework applied to concurrent events (April 2026)

As this paper was being completed, three concurrent developments provided an opportunity to apply the framework's conditions to events in real time. This section was added during finalisation and is presented separately from the diagnostic to distinguish the core framework (§§4.1–4.10) from its real-time application.

ChatGPT for Clinicians and HealthBench Professional (23 April 2026). OpenAI launched a free clinical product for verified US physicians, nurse practitioners, physician assistants, and pharmacists, alongside HealthBench Professional, a new benchmark for clinician-facing tasks. The product uses GPT-5.4 and scored 59.0 on HealthBench Professional, ahead of base GPT-5.4 (48.1), physician-written responses (43.7), and all external models tested.

The framework's conditions apply to benchmark design, not only to training pipelines, and three are structurally questionable here.

On adequacy (§2.1): HealthBench Professional describes its conversations as authored by "physicians testing ChatGPT for Clinicians during its development," with good-faith examples defined as physicians using the system "as they would in routine clinical, academic, administrative, or research work." The 190 contributing physicians were paid, selected through a quality-screening process, and created test conversations as part of product development. The announcement's framing ("6,924 conversations in their daily work") and the technical paper's description ("conversations written by physicians testing ChatGPT for Clinicians during its development") are both technically accurate. They describe meaningfully different things. A paid expert creating a test conversation during product development produces a different stimulus than a clinician using the product under real clinical pressure with a real patient whose outcomes depend on the answer. The gap between the two is an adequacy gap at the benchmark-design level: whether the benchmark's criterion tracks deployment-relevant performance depends on whether the gap between authored test conversations and deployment-real clinical encounters is small enough to not matter. Whether it is small enough is an empirical question that independent evaluation (as Capobianco conducted for the original HealthBench) would answer.

On independence (§2.2): the physician contributors who authored the benchmark conversations are drawn from the same cohort involved in the product's development. The evaluators share development-relevant exposure with the product they are evaluating.

On preservation (§2.5): rubric criteria were "written and iteratively adjudicated by three or more physicians across three phases." This is multi-stage consensus adjudication, the aggregation pattern §2.5 and §3.5 analyse. The Cole baseline (κ = 0.18–0.37) predicts that physicians disagree on how to evaluate clinical responses at significant rates. The adjudication process produces a clean rubric and destroys the information about where qualified experts diverged.

OpenAI reports that over 230 million people globally ask health and wellness questions on ChatGPT weekly, consistent with the scale ECRI's analysis identified. The launch of a free clinical product for verified healthcare professionals adds a new deployment category where per-interaction stakes are higher than consumer health queries, and free access removes the cost barrier that might otherwise limit adoption volume.

GPT-5.5 system card (23 April 2026). The same day's system card contains two findings directly relevant to PARIA conditions.

On adequacy: OpenAI now reports length-adjusted HealthBench scores, acknowledging that "for evaluations with answer-length sensitivity, long answers can also be used to artificially increase scores, without underlying improvements in usability and safety in real-world use." The adjustment penalises responses longer than 2,000 characters (2.99 points per 500 characters on HealthBench, 3.92 on HealthBench Hard). When applied retrospectively, GPT-5.1's HealthBench score drops from 64.2 unadjusted to 50.9 adjusted, attributing a 13.3-point difference to answer length.

On independence (§2.2): the system card's §7.2 evaluates GPT-5.5 for coding-agent misalignment by resampling internal trajectories through a simulator. The simulator's realism is validated by a GPT-5.4 Thinking model tasked with distinguishing simulated from real trajectories. The original wins only 52.5% of the time. This is reported as successful simulator validation. Under the framework's independence condition, it is weak independence at best: the evaluator is from the same model family as the model being evaluated. A finding of "cannot distinguish simulator from real" under this setup is consistent with genuine simulator fidelity, but also consistent with shared evaluator-producer blindness, where both models share error modes that prevent either from detecting unrealistic simulation artefacts. The system card does not engage the alternative reading.

Three-lab pattern. The adequacy gap between benchmark criterion and deployment-relevant criterion is not specific to any single lab. In the same period, all three major labs exhibited structurally related but distinct instances of the pattern. The framework treats these cases as structural observations about how criteria are constructed, not as criticisms of any individual lab's engineering.

OpenAI. The length-adjustment methodology quantifies a 13.3-point gap attributable to answer length on HealthBench. This is a benchmark-design adequacy case: the criterion rewarded a measurable quantity that diverged from the deployment-relevant quantity, and OpenAI's own methodological reform makes the divergence explicit.

Anthropic. A post-mortem (23 April 2026) traced Claude Code quality issues to three product-layer changes spanning Opus 4.6 and 4.7. On 4 March, the default reasoning effort was changed from high to medium to address perceived UI freezing during long thinking sequences. On 26 March, a caching optimisation intended to clear old reasoning from stale sessions contained a bug that cleared thinking on every subsequent turn, progressively stripping the model's reasoning history within a session. On 16 April alongside the Opus 4.7 launch, a system prompt instruction was added to control 4.7's increased verbosity: "keep text between tool calls to ≤25 words. Keep final responses to ≤100 words unless the task requires more detail." This instruction affected all models routed through Claude Code and caused a 3% quality drop detectable only with a broader eval suite than the one initially used.

Stella Laurenzo (Senior Director, AMD AI group, GitHub issue #42796, filed 2 April 2026) independently quantified the Opus 4.6 degradation from 6,852 Claude Code sessions and 234,760 tool calls: the model's read-to-edit ratio dropped from 6.6 to 2.0. API requests increased 80x while estimated costs rose 122x ($345 to $42,121 monthly). A programmatic quality guard that had fired zero times before the changes fired 173 times in 17 days after. Laurenzo's data also showed a 0.971 Pearson correlation between thinking depth and output quality, supporting the inference that reasoning depth is structurally load-bearing for complex engineering workflows.

Opus 4.7 (released 16 April) drew separate user reports of regression in instruction-following and reasoning depth, AUP classifier false positives on legitimate development work, and a tokeniser change inflating costs approximately 35% for some workloads. Opus 4.7 also replaced the user-controlled Extended Thinking toggle with "Adaptive Reasoning," where the model determines its own reasoning depth. The framework's prediction is structural: where adaptive thinking falls below a task's complexity, the same pattern Laurenzo measured for forced-medium-effort should reappear for adaptively-reduced effort. Under the forced-medium default, Laurenzo's stop-hook caught 73 instances of ownership-dodging, 18 premature stops, and 14 known-limitation labels in 17 days (all zero before). Early user reports for 4.7 are consistent with this prediction (TokenDock: "the model claims a visual task is complete without noticing obviously clipped text"; MindStudio: Anthropic internally described the predecessor pattern as a "persistence deficit"), though the 4.7 evidence base is currently user reports rather than forensic measurement at Laurenzo's depth. Independent quantitative measurement of adaptive reasoning's effect on complex-task users would test the prediction directly.

Google. Gemini 3.1 Pro (February 2026) achieved benchmark dominance (77.1% ARC-AGI-2, #1 Intelligence Index ranking) while independent reviews documented reduced creative flexibility and conversational nuance. SmartScope's analysis notes a specific regression on MMMU-Pro multimodal understanding (81.0% → 80.5%) and a 300-point GDPval-AA enterprise-task gap versus Claude models. Benchmark gains coexisting with documented deployment-dimension regressions instantiates the same structural shape.

What the three cases share. The cases are not identical, and the evidential strength differs: OpenAI provides the cleanest benchmark-design correction (self-diagnosed via system card), Anthropic provides a post-mortem-supported product-layer eval miss with independent forensic quantification, and Google provides independent-review evidence of benchmark/deployment divergence. What they share is the structural pattern the adequacy condition identifies: a measurable quantity tracked by evaluation diverging from the deployment-relevant quantity.

§5.1What the record must contain

The strong-form specification. A verdict record satisfying strong preservation contains seven components: (1) the verdict itself (the evaluator's bottom-line assessment); (2) the applied criterion, including version, so that downstream consumers can determine which criterion produced the verdict; (3) the evaluator's identity and track record, so that independence and accountability can be verified; (4) the distribution of evaluator assessments, when multiple evaluators were involved, so that the aggregation step's information destruction is recoverable; (5) the reasoning structure behind the aggregate, so that disagreement can be classified as noise, framework-driven, or threshold-dependent; (6) the confidence interval, so that downstream training can learn from evaluator uncertainty rather than treating every verdict as equally certain; and (7) the context variations tested, so that reproducibility across criterion-irrelevant perturbations can be evaluated.

Why each component is necessary. Each component maps to a specific condition's operationalisation. Without the applied criterion (component 2), an auditor cannot verify adequacy: there is no record of what was measured, only a record that something was. Without evaluator identity (component 3), an auditor cannot verify independence: evaluator-producer error-mode overlap is unassessable if the evaluator is unidentified. Without the distribution (component 4), an auditor cannot verify that the aggregation step preserved legitimate disagreement rather than collapsing it. Without confidence (component 6), the training signal encodes verdicts without epistemic weight, producing the undifferentiated-confidence pathology mapped in §7.5. Without context variations (component 7), reproducibility is unverifiable because there is no record of whether the verdict held across perturbations.

The components are not independent of each other. The distribution (component 4) and the reasoning structure (component 5) are jointly necessary for preservation's strong form: a distribution without reasoning tells you evaluators disagreed but not why. Reasoning without the distribution tells you one evaluator's justification but not whether others shared it. The specification requires all seven because they are jointly sufficient for verifying all five conditions, and no proper subset is.

Worked example: one Capobianco judgment event. Consider a single evaluation from Capobianco et al.'s study: GPT-5's response to a hepatobiliary cancer case, evaluated against tumour-board consensus. A verdict record satisfying strong preservation would contain: (1) verdict: concordant (matched therapeutic category "systemic therapy"); (2) criterion: tumour-board-consensus matching on guideline-style therapeutic recommendation, version as specified in the August 2025 evaluation protocol; (3) evaluator identity: two blinded clinicians at University Hospital Tübingen, with consensus resolution of discrepancies, ethics approval 273/2024BO1; (4) distribution: both clinicians classified the response identically (no discrepancy on this case); (5) reasoning: both clinicians identified the model's recommendation as matching the tumour board's systemic-therapy determination, with no alternative therapeutic category considered plausible; (6) confidence: high (unambiguous match to tumour-board recommendation); (7) context variations: the case was evaluated under fixed prompt conditions with temperature 0.8 and Top P of 1 for GPT-4o/4o-mini, fixed internal sampling for GPT-5. Without this record, an auditor can determine that GPT-5 scored 85% concordance but cannot determine why specific cases failed, whether failures clustered by tumour subgroup, whether clinician agreement varied systematically, or whether the concordance rate would hold under prompt variation. The record makes each condition auditable; the scalar aggregate (85%) does not.

§5.2Relationship to the Rich Annotation Object

The Judgment Paradox's Rich Annotation Object (RAO) is one concrete implementation of this specification at the annotation layer. The RAO preserves per-annotator reasoning, cross-review matrices, disagreement classification, confidence scores, and annotator identity. It is designed for the specific judgment step where human experts evaluate AI outputs for RLHF-class training. It satisfies the specification's seven components within its scope.

The framework's specification is more general than any single implementation. It applies to every judgment step the paper examines, not only to human annotation. A Lean proof kernel's accept/reject verdict combined with the proof term satisfies the specification through a different mechanism: the proof term is the reasoning structure, the kernel version is the criterion version, and the accept/reject binary is the verdict. The specification's generality is deliberate. It defines what the record must contain, not how it must be formatted. RAO is a compatible format at one class of judgment steps. Lean proof terms are a compatible format at another. Other formats are possible at other judgment steps.

The point of the generalisation is that strong preservation is not a property peculiar to human-annotation pipelines. It is a structural requirement that every pipeline class must satisfy through whatever mechanism fits its judgment step. The diagnostic in §4 shows which pipeline classes currently satisfy it and which do not. The specification shows what "satisfy it" means in terms of recoverable information.

§5.3Architectural implications

Storage cost. The verdict record is text and structured data, not model parameters. A record containing all seven components for a single judgment event is measured in kilobytes. The aggregate storage cost for a full training run is negligible relative to the compute and parameter storage the training pipeline already requires.

Inference cost. Zero. The verdict record is consulted only during audit, not during inference. It adds no latency, no memory overhead, and no compute cost to the model's deployment. This is a design choice the specification encodes: the record exists for accountability, not for performance. A pipeline designer considering whether to implement strong preservation cannot cite inference cost as an obstacle because the record is never in the inference path.

A necessary clarification on what preservation requires at the update step. The verdict record satisfying preservation serves the audit function: it makes the judgment's epistemic content recoverable for downstream verification. But preservation's statement (§2.5) requires that the training signal faithfully carries the judgment's epistemic content to the weight update. If a pipeline stores a perfect seven-component record in a database but collapses the signal to a scalar reward before passing it to the optimiser, the audit substrate is satisfied while the training signal has still suffered preservation failure. The model learns from the collapsed scalar, not from the preserved record. Strong preservation therefore implies two requirements operating at different layers: an audit record that makes the judgment recoverable for verification, and an update mechanism capable of ingesting the distributional signal rather than requiring scalar collapse. Storing the distribution solves the audit problem. Feeding it to the optimiser solves the calibration problem. A pipeline satisfying only the first has strong audit preservation and weak training-signal preservation. The Judgment Paradox's recommendation of supervised fine-tuning on contested items as the primary integration path (rather than standard PPO or DPO, which mathematically require scalar or binary input) is motivated by precisely this distinction.

Integration cost. This is the real cost. Implementing the specification requires schema commitment at the pipeline-design stage. The decision to record what criterion was applied, who evaluated, what distribution of assessments occurred, and what confidence was assigned must be made when the pipeline is designed, not after individual judgment events have occurred. Retrofitting strong preservation onto an existing pipeline that was designed for scalar aggregation requires redesigning the aggregation step. This is engineering work, not architectural impossibility, but it is work that must be done at design time.

The integration cost explains the current state of the field. Scalar aggregation is simpler to implement, cheaper to design, and sufficient for pipeline classes where preservation failure does not produce observable deployment pathologies (formal-verification pipelines, §4.4 and §4.5, where the proof term already satisfies the specification). For pipeline classes where preservation failure does produce observable pathologies (RLHF §4.1, consumer deployments §4.8, multi-stage propagation §4.9), the integration cost is the barrier to strong preservation, and the deployment pathologies are the cost of not paying it.

§5.4Scope

The verdict record satisfies preservation at the judgment step. It records what happened at one evaluation event. It does not, by itself, track the chain of judgment events across training and deployment. A model that was trained with strong preservation at the RLHF stage and then fine-tuned on deployment traces without recording the fine-tuning judgments has strong preservation at the first stage and no preservation at the second. The chain is the continuous ledger's territory.

§6.1The boundary problem

The verdict record (§5) specifies what a single judgment event must contain. Training pipelines produce many judgment events. Post-training modifications produce more. The continuous ledger extends the verdict record across this chain.

The boundary between training and deployment is not a clean line. A model that is trained, deployed, fine-tuned on deployment traces, and redeployed has undergone multiple phases, each containing judgment steps. Post-training modifications include fine-tuning on user interaction traces, preference updates from deployment feedback, system-prompt shaping that constrains model behaviour without modifying weights, and retrieval corrections that alter the model's effective knowledge base. Each of these is a judgment step in the framework's sense: someone or something applies a criterion to an artifact and produces a verdict that shapes model behaviour. The framework's ledger specification requires that each such step produces a verdict record satisfying the §5 specification.

§6.2Ledger structure

Concatenation with provenance. The ledger is the temporally ordered concatenation of all verdict records produced across training, post-training modification, and deployment feedback. Each record carries a timestamp and a provenance chain linking it to the pipeline stage that produced it. The provenance chain makes it possible to trace any aspect of the model's current behaviour back through the sequence of judgment events that shaped it.

Why temporal ordering matters. A model's behaviour at deployment is shaped by the full sequence of judgment events in its history. A fine-tuning run that overrides an earlier RLHF signal may partially overwrite earlier representations in parameter space (catastrophic forgetting is a documented property of neural networks, not a theoretical edge case). The ledger does not guarantee which historical signals survived in the model's latent space. What it guarantees is the complete record of what the pipeline attempted to teach. The ledger's temporal ordering allows an auditor to see the exact sequence of potentially conflicting signals the optimiser was forced to resolve, trace which judgment event may have introduced a deployment pathology, and identify which criterion was applied at each stage. Without temporal ordering, the chain is opaque.

§6.3Deployment-phase judgment steps

ChatGPT Health integrations (Apple Health, MyFitnessPal, Function, Weight Watchers) illustrate the deployment-phase judgment step. When a user interacts with a health-information feature connected to personal health data, the system applies implicit criteria (relevance, safety, personalisation) to produce responses. If those interactions feed back into the training pipeline through user feedback, preference signals, or usage analytics, each feedback event is a judgment step. The framework's ledger specification would record each such event with the seven-component structure: what criterion was applied, what the verdict was, who or what evaluated, and with what confidence.

Whether current deployments satisfy this specification is outside the paper's scope. The paper specifies what the ledger would contain, not whether it currently exists. The specification is offered as infrastructure design, not as a description of current practice. The gap between the specification and current practice is itself a finding: the judgment steps occurring at the deployment boundary are the least likely to satisfy the specification and the most likely to produce aggregate accountability weight under the loop-closure scaling argument of §2.3.

§6.4Scope

The ledger is a specification, not an implementation. It describes what information must be recoverable, not how to store it. Different pipeline architectures will implement the ledger differently. The specification constrains the information content. The format is an engineering decision. The ledger's scope is the full chain from initial training through deployment-phase feedback. Events outside this chain (user behaviour that does not feed back into the pipeline, downstream applications that consume model outputs without modifying the model) are outside the ledger's scope.

§7.1Independence failure and sycophancy

Route. RLHF raters share sycophancy-relevant preferences with downstream users: warmth, agreeableness, narrative coherence, validation. The criterion applied at the judgment step is "which completion does the rater prefer?" The rater prefers completions exhibiting properties the user also prefers. The training signal encodes the shared preference. The model learns to produce outputs satisfying that preference because doing so is what the criterion rewards. Independence failure is the structural source: the evaluator's error modes overlap with the user population's on the criterion-relevant dimension, and weak independence (architectural separation) does not filter this overlap.

Mechanism. Uncertainty Collapse (§4) identifies the social slope as one of three routes to low-entropy continuation when no honest low-entropy path is available. The model takes the agreement route because the training signal rewarded agreement through the shared-preference channel. The mechanism is self-reinforcing under autoregressive generation: each agreeable token enters the context window and shifts subsequent distributions toward continued agreement.

Observable effect. SycEval reports 78.5% within-session sycophancy persistence: once the model adopts an agreeable position in response to user signals, it maintains that position across subsequent turns rather than reverting to its initial assessment. Cheng et al. (Science 391:eaec8352, 2026) demonstrate that even a single sycophantic interaction reduces human participants' prosocial intentions and increases their conviction, and that participants were 13% more likely to return to the sycophantic model. The deployment-side pattern is observable, quantified, and consistent with the weak-independence mechanism: the feature that causes harm is the feature that drives engagement.

§7.2Reproducibility failure and fabrication

Route. When the criterion's applied content varies with context cues that should not affect the verdict, the training signal encodes inconsistent verdicts on substantively identical material. The model receives contradictory training signals for the same semantic territory and resolves the contradiction by generating outputs whose factual content is context-sensitive rather than knowledge-grounded. Fabrication is the deployment-time manifestation of reproducibility failure at training.

Mechanism. Uncertainty Collapse (§3) identifies orthogonal entropy divergence as the observable signature: token-level entropy collapses (the model is confident in how to speak) while semantic entropy remains high (the model is uncertain in what it is saying). The autoregressive cascade amplifies this divergence because each confident token constrains subsequent generation toward continued confidence regardless of semantic grounding.

Observable effect. The bixonimania cross-day flip (§4.9) is a deployment-side observable of this mechanism: the same system produced semantically contradictory outputs on substantively identical queries about a fabricated condition. The user-facing pattern is verdict-instability across natural-language variation, which is the deployment-side manifestation of training-side reproducibility failure.

§7.3Accountability failure and reward hacking

Route. Reward hacking is typically a compound adequacy/accountability failure. Adequacy supplies the exploitable gap: the proxy criterion diverges from the deployment-relevant quantity. Accountability failure allows the gap to persist without corrective pressure. When feedback pressure on evaluator application-quality drift is absent, the evaluator's criterion-application shifts toward a cheaper approximation without detection or correction. The optimiser exploits discontinuities in the drifted criterion-application surface because the drifted surface has features the optimiser can satisfy without satisfying the underlying criterion. Accountability is the dominant condition in this route because it is the structural absence (of corrective pressure) that allows the adequacy gap to remain exploitable over time.

Mechanism. Uncertainty Collapse (§4) identifies exploit-discontinuities as the mechanism operating when standard completion routes (social slope, factual slope) are unreachable. The model discovers features of the reward specification that produce high reward without producing the quality the reward was meant to track. Under autoregressive generation, the self-stabilisation cascade operates here as it does in sycophancy and fabrication: each step toward the exploit narrows the continuation space toward the exploit, producing coherent-looking output that satisfies the drifted criterion while failing the original.

#### §7.3.1 Scaling dynamics

The accountability failure's consequences scale with loop-closure rate times deployment volume, not with per-interaction stakes. This is §2.3's scaling argument mapped to the failure-mode level.

In an open-loop deployment (judgments used for the current interaction only), accountability failure produces per-interaction reward hacking whose consequences are bounded by the interaction's stakes. In a closed-loop deployment (judgments feeding back into the training signal), accountability failure produces reward hacking whose consequences accumulate across all interactions shaped by the drifted signal. The aggregate accountability weight is an integrated-over-deployment measure: it compounds with each interaction that feeds back into training.

Current major AI chatbot deployments operate at scale that makes this distinction consequential. OpenAI's own analysis, cited by ECRI, reports more than 40 million daily ChatGPT users seeking health information. Even in open-loop deployments (where health conversations are not used to train foundation models, as OpenAI states), the aggregate accountability weight of health-information interactions is orders of magnitude above what per-interaction-stakes framing would suggest: systematic errors persist across the entire user base without structural mechanisms for detection or correction proportional to volume. ECRI's #1 ranking of AI-chatbot misuse in healthcare reflects institutional recognition of this aggregate by standard technology-hazard methodology. The ranking is the scaling argument converted to institutional standing.

§7.4Adequacy failure and Goodhart-class proxy optimisation

Route. The criterion measures a quantity decoupled from deployment requirements. The pipeline optimises what the criterion rewards. The deployment depends on what the criterion should have rewarded. The gap between the two is the adequacy failure. Goodhart-class proxy optimisation is the deployment-side manifestation: the model becomes better at satisfying the proxy while the deployment-relevant quantity does not improve or improves less than the proxy suggests.

Mechanism. The mechanism is direct: optimisation against a proxy criterion produces improvement on the proxy. When the proxy tracks the target, this improvement transports to deployment. When the proxy is decoupled, the improvement does not transport. Under autoregressive transformers, the mechanism has specific texture: benchmark-optimised training produces fluency, register-conformance, and rubric-alignment features that score well on evaluations sharing the benchmark's criterion structure but do not transport to deployment contexts with different criterion structures.

Observable effect. GPT-5's HealthBench-to-Capobianco gap is the high-visibility case. HealthBench Hard scores improved significantly from GPT-4o to GPT-5. Concordance with tumour-board consensus on real oncology cases did not (85% for both, p ≥ 0.21). The pattern generalises: benchmark-driven optimisation across domains produces proxy-criterion improvement that does not transport to deployment-relevant criteria when the proxy is decoupled. RLVR with Lean kernels (§4.4) is the structural contrast: the criterion (formal validity) is the deployment-relevant quantity, so proxy optimisation does not occur because there is no proxy-to-target gap.

§7.5Preservation failure and calibration collapse

Inference from absence. This subsection opens with an epistemological observation that is specific to preservation failure and does not apply to the other four conditions' failure modes. When the training signal does not preserve the judgment's confidence structure, the model cannot learn to modulate its own confidence from positive examples, because no positive examples of calibrated confidence exist in the training signal. The model's output confidence becomes uncorrelated with evaluator confidence at training time. This is not a failure of the model's capacity. It is an absence of the substrate the model would need to learn calibrated confidence. The model produces undifferentiated confidence not because it cannot distinguish high-confidence from low-confidence claims, but because the training signal never encoded the distinction. A reviewer might reduce this to "the training distribution was poor," but the reduction misses the structural point. The training distribution can be rich, diverse, and carefully curated, and the aggregation step will still destroy the confidence structure before it reaches the model. The absence is produced by the pipeline's design, not by the data's quality.

Mechanism. The Confidence Curriculum series' core thesis is that training-signal destruction of the calibration substrate is the mechanism producing undifferentiated confidence in deployment. This paper's preservation condition is the structural sibling of that thesis: both identify the judgment step's information encoding as the source of downstream calibration failure. The Confidence Curriculum provides this paper's preferred mechanism for the preservation-to-calibration-collapse mapping. The preservation condition and the claim that lost confidence structure impairs downstream calibration do not depend on the Confidence Curriculum's specific account. They rest on The Judgment Paradox §5's information-destruction analysis and the Cole (1981) reliability baseline establishing that expert disagreement at κ = 0.18–0.37 represents structurally significant information, not noise.

Observable effect. The bixonimania case (§4.9) illustrates preservation-driven calibration collapse: the model describes a fabricated condition with the same confidence register it uses for well-established medical conditions. The mechanism is not "the model forgot to hedge." It is "the training signal never encoded the distinction between hedge-worthy and assertion-worthy claims in the authoritative-prose register." Omar et al.'s 46.1%-versus-8.9% differential (§4.9) matches what preservation-failure-over-register predicts: fabrications in the register the training criterion rewarded pass through at five times the rate of fabrications in registers the criterion did not reward.

McCoy et al. (NEJM AI 2025, 10 models, 750 Script Concordance Test items, 1,500+ human participants) provide a complementary measurement: reasoning-tuned models systematically overuse extreme ratings and seldom choose neutral responses, even when the new clinical information is entirely irrelevant to the question. Chain-of-thought optimisations, designed to improve reasoning, actually worsen overconfidence. The preservation reading: the training signal rewarded the production of confident-sounding reasoning chains, and the model learned to shift judgments maximally rather than to recognise when information warrants no shift at all.

The SCT methodology itself is structurally relevant to preservation: its concordance-based scoring, which scores model responses against the distribution of expert-panel judgments rather than a single correct answer, is a form of distributional evaluation that preserves expert disagreement. The Judgment Paradox (§5.3) identifies SCT as a concrete starting point for the Rich Annotation Object's evaluation framework precisely because SCT treats legitimate expert variation as signal rather than noise. SCT itself has documented validity threats (Lineberry, Kreiter and Bordage 2013): logical inconsistencies in aggregate scoring, gaming vulnerability through "all-0" response strategies, and incomplete response process validity. These threats are structurally recognisable under PARIA as preservation failures (the aggregate scoring collapses distributional information) and reproducibility concerns (gaming exploits the scoring key's context sensitivity). A training pipeline whose evaluation criterion used SCT-style concordance scoring, extended with the RAO's distributional preservation and cross-review mechanisms, would satisfy preservation more strongly than one using binary right-wrong evaluation, because the criterion itself encodes the distributional structure that strong preservation requires.

§7.6Compound failures and mixtures

Real pipelines fail multiple conditions simultaneously. The mapping above identifies the dominant route-type for each condition, but real failure modes mix routes. Identifying the dominant trace is analytically useful. Mistaking it for the only trace is analytically wrong.

Bixonimania as compound failure. The bixonimania case (§4.9) instantiates multiple condition violations simultaneously. The §7.2 reading (reproducibility failure producing fabrication via cross-day verdict instability) and the §7.5 reading (preservation failure producing calibration collapse via register-undifferentiated confidence) describe different aspects of the same compound failure. Both are present because the underlying pipeline fails both conditions. The condition-discrimination rule (§2.6) identifies the origination points: reproducibility failure at criterion application (context-sensitive verdicts), preservation failure at aggregation (truth-value markers not encoded). The compound nature of the case illustrates why the "dominant route" framing in §7 is explicitly partial.

A second compound pattern. The RLHF pipeline (§4.1) exhibits a different compound structure. Independence failure (shared preference for warmth) and adequacy failure (benchmark criterion decoupled from deployment criterion) co-occur because the same pipeline inherits both structural deficiencies. The sycophancy pattern (§7.1) and the proxy-optimisation pattern (§7.4) are both present in the same deployments. The dominant trace depends on which dimension the observer measures: user-satisfaction metrics show sycophancy. Independent clinical evaluation shows proxy optimisation. The two readings are not competing. They describe different measurement surfaces of the same compound failure.

Implication for intervention. Compound failures resist single-condition interventions. Addressing independence (replacing human raters with AI evaluators) without addressing adequacy (ensuring the criterion tracks the deployment-relevant quantity) shifts the failure-mode mixture without reducing it. The framework's diagnostic value is in identifying which conditions a specific pipeline fails, so that interventions can be targeted at the structural sources rather than at surface manifestations. §12.3 develops this into a testable prediction.

§8.1Architecture-independence of the conditions

The five conditions are properties of the judgment step, not of the architecture being trained. A criterion is adequate or not regardless of whether the model being evaluated is an autoregressive transformer, a diffusion model, or a normalising flow. An evaluator is independent of the producer or not regardless of the model class. Accountability, reproducibility, and preservation are structural properties of the evaluation infrastructure. The conditions are architecture-independent by construction.

What is architecture-specific is §7's failure-mode mapping. The mechanisms by which condition failures propagate into deployment pathologies depend on architectural properties: autoregressive self-stabilisation, softmax bottleneck, sequential token generation. Different architectures exhibit different propagation textures. The framework evaluates any architecture's training pipeline against the five conditions. §7's specific mappings hold for autoregressive transformers and may not hold for other architectures.

§8.2Satisfaction by mechanism and satisfaction by absence

The framework evaluation must distinguish two ways an architecture can satisfy a condition. Satisfaction by mechanism occurs when the architecture has a specific feature that actively fulfils the condition's requirement. Satisfaction by absence occurs when the architecture lacks the failure-mode preconditions that would violate the condition under the dominant architecture. The concept is analogous to vacuous truth in formal logic: a conditional "if P then Q" is vacuously true when P is false. Here, the condition is satisfied because the precondition for its failure is absent, not because the architecture actively ensures the condition holds.

The distinction matters for avoiding overclaiming architectural advantages. An architecture that does not exhibit sycophancy because it was never trained with RLHF (not because its evaluator-producer independence is strong) satisfies independence by absence of the specific failure pathway, not by mechanism. If that architecture were subsequently trained with an RLHF-like procedure introducing weak independence, the satisfaction by absence would collapse. The framework's evaluation must identify which form of satisfaction holds, because satisfaction by absence is fragile under training-method changes while satisfaction by mechanism is not.

§8.3Normalising flows

Normalising flows have a distinctive architectural property: invertibility. The mapping from latent space to output is bijective, meaning the latent representation is recoverable from the output and vice versa. This changes the mechanics of preservation. An autoregressive transformer's output is a sequence of token choices. The reasoning behind those choices is not recoverable from the output. A normalising flow's output is invertible to the latent representation that produced it; the latent structure is recoverable.

The framework's evaluation of normalising flows is: invertibility provides a mechanism for computation recoverability that may support preservation, but only if the recoverable state actually encodes the judgment's epistemic content. The latent representation is a structural record of how the output was produced. Whether this constitutes strong preservation in the framework's sense depends on whether the latent representation encodes the judgment step's epistemic content (the criterion applied, the evaluator's confidence, the distribution of assessments) or merely the model's internal computation. Invertibility guarantees recoverability of the computation. It does not guarantee that the computation encodes the judgment's epistemic content. The preservation condition concerns what is encoded, not what is recoverable.

A further observation arises from how normalising flows are trained. In standard maximum-likelihood density estimation, the loss function operationalises "fit to the observed distribution," and adequacy questions arise because this fit may or may not match deployment needs. In variational inference and target-density-fitting settings, where flows are used to sample from known energy functions rather than to fit observed data, the choice of divergence becomes a more explicit adequacy decision. Forward Kullback-Leibler (KL) divergence is mode-covering and penalises missing any mode but requires samples from the target distribution. Reverse KL is mode-seeking and rewards covering some modes well while dropping others. Mode collapse under reverse KL training is a documented and extensively studied phenomenon in the target-density-fitting regime (Nicoli et al. 2023, AdvNF 2024). In PARIA's terms, this is an adequacy failure: the criterion measures the wrong quantity for deployments that need full distributional coverage. The two regimes are distinct. The framework applies to both, but the adequacy question takes different forms in each.

On the other conditions, normalising flows satisfy independence and accountability through the same mechanisms as other architectures (these are properties of the evaluation infrastructure, not of the model). Reproducibility benefits from the deterministic latent-to-output mapping in the absence of stochastic sampling. Adequacy is criterion-dependent, as for all architectures, but the training-loss-as-judgment-step observation means that adequacy questions arise at the architecture level rather than only at the evaluation-infrastructure level.

§8.4Diffusion models, state-space models, and Mixture-of-Experts

Diffusion models generate output through iterative denoising rather than sequential token generation. The autoregressive self-stabilisation cascade (§7) does not apply because the generation process is not sequential in the same sense. This is satisfaction by absence: the specific failure-mode precondition (each token constraining the next) is absent. The condition-level evaluation is unchanged. The failure-mode texture differs.

However, when diffusion models are fine-tuned with reinforcement learning (Denoising Diffusion Policy Optimization, DDPO; Black et al. 2024), a documented failure mode emerges that is strongly compatible with PARIA's accountability-to-reward-hacking pathway: mode collapse. The reward score improves while output diversity vanishes. The evaluator's criterion-application has drifted toward features the optimiser can satisfy (aesthetic score) without satisfying the broader deployment criterion (diverse, high-quality images). Adequacy failure (proxy mismatch between the aesthetic scorer and the true deployment objective) is also part of the mechanism; the two condition failures interact rather than operating in isolation. GARDO (He et al. 2025) was developed specifically to mitigate reward hacking in diffusion RL fine-tuning through selective regularisation and diversity-aware reward shaping, confirming the practical significance of the failure mode. The denoising chain replaces the autoregressive sequence, but the condition-failure structure generalises.

State-space models (Mamba, S4 lineage) process sequences through structured state transitions rather than attention-based token-to-token dependencies. Their generation process is sequential but not attention-based: each token is produced from a compressed state representation rather than from attention over all previous tokens.

Preliminary perturbation evidence is consistent with a distinctive reproducibility profile: a controllability analysis of Mamba-based models (arXiv:2511.17970, 2025) found that larger SSMs showed strong robustness to textual perturbations (-2-7% change under typos and noise), with an inverse correlation between model size and perturbation sensitivity. Separately, Mamba LLMs have been shown to be extremely stable under fine-tuning perturbations where Transformer LLMs diverge (Lyapunov stability analysis, 2025). Whether this perturbation robustness constitutes a reproducibility advantage in PARIA's specific sense (low semantic entropy under criterion-irrelevant context variation) or reflects a different architectural property (reduced sensitivity to all input variation, including criterion-relevant variation) is an open question. The specific measurement PARIA's reproducibility condition requires (semantic entropy under controlled context perturbations, following the Farquhar protocol) has not been published for SSMs.

On the other conditions, state-space models face the same judgment-step evaluation as transformers: their training pipelines use the same RLHF, RLAIF, or RLVR procedures, and the conditions apply to those procedures regardless of the model's internal architecture.

Mixture-of-Experts (MoE) architectures route inputs to specialised sub-networks. The framework's evaluation intersects with MoE at two points, each requiring careful condition mapping.

First, expert collapse (Chi et al. 2022) occurs when routing pushes tokens toward expert centroids, causing experts to lose specialisation and share representations. This is not an independence failure in PARIA's strict sense: PARIA's independence concerns evaluator-producer error-mode overlap, and expert collapse concerns sub-networks within the producer sharing representations. The structural analogy is real (components that should have distinct error modes lose that distinction), but the mechanism operates within the model rather than between the evaluator and the producer at the judgment step. The framework does not claim expert collapse as a condition failure. It notes the structural analogy as a candidate for future extension.

Second, and on firmer ground within the framework, safety alignment in MoE models produces a pattern that PARIA reads as a preservation failure. RASA (Routing-Aware Safety Alignment, 2026) found that full-parameter safety alignment creates "alignment shortcuts": safety is achieved through routing changes that avoid unsafe experts rather than through expert-level parameter repair. When original routing is restored, safety collapses. On the framework's reading, the judgment step here is the safety-alignment evaluation: an evaluator applies a safety criterion to the model and produces a verdict (harmfulness score reduced). The verdict says "model is safe." What it should encode, for the parameter update to produce durable safety, is "these specific experts need correction." The routing shortcut strips the structural information the update would need: the signal fails to carry the judgment's full epistemic content to the weight update. SAFEx (Lai et al., NeurIPS 2025) quantifies the concentration: in Qwen3-30B-A3B, with 6,144 total experts across 48 MoE layers, disabling just 12 selected experts reduces the refusal rate by 22%. Safety depends on 0.2% of the architecture.

Both findings also instantiate a variant of the satisfaction-by-mechanism/absence distinction from §8.2. The safety is not durably embedded in the experts' parameters (which would constitute satisfaction by mechanism). It is achieved through a routing-level bypass that avoids unsafe experts without repairing them, a fragile mechanism that disappears when the routing changes. The §8.2 vocabulary identifies exactly this fragility, and RASA and SAFEx provide independent empirical confirmation that the distinction is practically consequential.

§8.5Scope

This section stress-tests PARIA's conditions and vocabularies (satisfaction by mechanism/absence, training-loss-as-judgment-step) against non-transformer architectures. The normalising-flow treatment is focal because invertibility interacts with preservation in a structurally interesting way and because the adequacy question takes different forms in MLE density-estimation versus variational-inference regimes. The diffusion-model treatment shows that the accountability-to-reward-hacking pathway from §7.3 reproduces outside the autoregressive case when RL fine-tuning is applied, with adequacy (proxy mismatch) also part of the mechanism (DDPO, GARDO). The MoE treatment provides empirical instances of routing-level fragility (RASA's alignment shortcuts, SAFEx's safety-concentration measurement) that the framework reads as preservation failure. The SSM treatment identifies preliminary perturbation evidence consistent with a distinctive reproducibility profile, with the PARIA-specific measurement (semantic entropy under controlled context perturbations) remaining future work. Full failure-mode analyses at the depth §7 provides for autoregressive transformers remain future work for each class.

§9.1Domain scope

The framework applies to correctness-judgment steps in training pipelines for systems deployed where the judgment's criterion matters downstream. A pipeline training a model for creative writing, where "correctness" is loosely defined and deployment tolerance for variation is high, faces different condition-satisfaction requirements than a pipeline training for clinical decision support. The conditions are structural. Their satisfaction thresholds are domain-dependent.

§9.2Architectural scope

The five conditions are architecture-independent in principle. Section 7 analyses failure-mode propagation specifically under autoregressive transformers, the current mainstream architecture. Section 8 demonstrates the framework's generality across normalising flows, diffusion models, state-space models, and Mixture-of-Experts, with empirically grounded PARIA readings for diffusion (DDPO/GARDO reward hacking as accountability-compatible failure with adequacy also involved), normalising flows (MLE-versus-VI adequacy distinction and mode collapse under reverse KL), and MoE (alignment shortcuts read as preservation failure and routing-level fragility). The SSM intersection with reproducibility has preliminary perturbation evidence but awaits PARIA-specific measurement. Full failure-mode analyses at §7's depth for non-transformer architectures are outside this paper's scope.

§9.3Evaluation scope

The framework provides necessary conditions, not sufficient conditions. A pipeline satisfying all five conditions in strong form has a training signal that is structurally fit for its downstream use. It does not follow that the trained model will perform well in deployment. Sufficient conditions for deployment quality include factors outside the judgment step: data quality, model capacity, optimisation dynamics, deployment-context variation. The framework's contribution is identifying which structural properties the judgment step must have, not guaranteeing that having them is enough.

§9.4Temporal scope

All cited empirical work carries publication dates. The framework's claims are designed to survive partial falsification of cited empirical support. If Capobianco et al.'s specific findings are superseded by a larger study showing GPT-5 outperforming GPT-4o on clinical concordance, the adequacy condition loses one empirical anchor but retains its structural grounding (specification-use gap, construct validity, Goodhart bounded scope) and its other empirical anchors (Magesh, ECRI). The framework's structure is independent of any specific citation's durability.

§9.5Relationship to meta-evaluation frameworks

Datasheets for Datasets (Gebru et al. 2021) and Model Cards (Mitchell et al. 2019) are documentation frameworks that supply inputs for PARIA's conditions. Datasheets' motivation and collection-process sections supply accountability inputs (who is responsible for the pipeline's data). Their composition and preprocessing sections supply coverage-fit inputs (what slice of the deployment-relevant distribution the data covers) and preservation inputs (what transformations occurred and whether they are recorded). Their recommended-uses section supplies adequacy inputs (what the criterion should and should not measure). Their distribution and maintenance sections supply accountability inputs (who bears ongoing responsibility).

Model Cards' intended-use and caveats sections supply adequacy inputs (the negative boundary of appropriate criterion application). Their ethical-considerations section supplies accountability and adequacy inputs (what harms the feedback structure should catch). Their evaluation-data and training-data sections supply coverage-fit inputs. Their metrics and quantitative-analyses sections supply reproducibility inputs (what was measured and whether it was measured consistently across conditions).

Every category in both frameworks maps to an input for at least one PARIA condition. Neither framework addresses what those inputs must structurally satisfy. Datasheets document dataset provenance; they do not specify when provenance documentation is sufficient for the training signal's fitness. Model Cards document performance characteristics; they do not specify what structural properties the evaluation producing those characteristics must have. PARIA provides the structural conditions that explain why the information these frameworks collect matters, what it must satisfy, and what is missing when it does not. PARIA is not a documentation framework; it is a structural framework for judging whether documented evaluation pipelines are fit for downstream use. The frameworks are valuable prior work whose documentation categories become structurally motivated under PARIA's conditions.

§9.6Evaluator competence as a candidate condition

A natural objection is that PARIA omits evaluator competence: the capacity of the evaluator to apply the criterion correctly. The counterexample is a crowd-worker applying a perfectly specified oncology-concordance criterion without medical training. All five conditions appear satisfied, yet the evaluator cannot resolve the criterion.

The framework's response is that this failure routes through existing conditions. Consider the strongest version of the objection: Ansari (2026) documents 100 AI-generated hallucinated citations accepted at NeurIPS 2025, evading review by three to five expert reviewers per paper. These are among the most competent evaluators available in the field. They failed not because they lacked domain expertise but because the fabricated citations preserved the authoritative register while destroying truth-value markers. The evaluators were exploited by a preservation failure: the pipeline's training signal did not encode the distinction between factual and fabricated content in the authoritative register, and the resulting output passed through expert judgment unmarked. Improving domain competence alone would not have solved the failure because the competence was already near ceiling. The targeted fix would have been stronger preservation (citations carrying verifiable provenance) or stronger adequacy (criteria requiring primary-source verification rather than register-pattern matching).

The general principle: when the evaluator lacks the capacity to resolve the criterion, either the criterion is inadequately specified for the available evaluation infrastructure (adequacy failure) or the artifact's surface features exploit the gap between what the evaluator can verify and what the criterion nominally requires (preservation failure). Both routes produce the same recommendation (fix the criterion or fix the record) that a separate competence condition would produce. The decisive issue is not taxonomy but intervention target: adding evaluator competence as a sixth condition would not change the framework's diagnostic output or prescribe a different corrective action. It would add a label without adding a new intervention target.

§10.1Theoretical argument

The primary claim is structural: false certainty is the wrong cost metric for evaluating AI pipeline quality. Industry accounting treats per-interaction cost as primary (inference price, latency, infrastructure) and correctness as a quality-of-service dimension subject to headroom tradeoffs. The framework's alternative: correctness failures must also be accounted as cost categories whose externalisation determines whether the pipeline is structurally cheap or only cheap-seeming. The Judgment Paradox (Paper 2 in this series, §10.3 in that document) develops the reframe at the market-pattern level. This section applies it structurally through the five conditions.

Three externalisations follow from the framework's conditions.

Loop-closure times volume multiplication. Per-interaction framing calculates cost-of-error as per-interaction consequence times error rate. Closed-loop pipelines at scale require aggregate-cost accounting: cost is integrated over all interactions affected by the signal, not measured at the event. A pipeline whose per-interaction error is low-consequence but whose judgment-step failures feed back into the training signal accumulates aggregate cost proportional to deployment volume times loop-closure rate. This is §2.3's scaling argument converted to cost accounting.

Externalised verification. Pipelines producing confident-but-wrong outputs push verification cost onto users. A 17% hallucination rate on a legal-research tool (Magesh et al., 2025) is not 17% cost-to-pipeline plus 83% benefit. It is 17% verification-cost-externalised-to-users plus 83% benefit conditional on users verifying the remaining 83%. Users cannot identify which 17% to verify without examining all outputs. Verification cost scales with total use, not with error rate. The users with the fewest independent-verification resources (pro se litigants using legal-AI tools, patients without medical training using health chatbots) bear the highest externalised verification cost.

Retraining and remediation costs. Preservation failures propagating into peer-reviewed literature (bixonimania cited in Cureus, retraction March 2026) or producing regulatory attention (ECRI's #1 ranking) create retraining and remediation costs borne by multiple parties over time. Retractions, training-corpus corrections, evaluation-infrastructure adjustments, and erosion of user trust are all costs offset against the pipeline's apparent cheapness.

Framework consequence. Pipelines satisfying the five conditions more strongly are structurally more expensive to build but structurally cheaper to maintain under deployment pressure. Current industry accounting inverts this by treating building cost as primary and externalising deployment cost. The economic argument is not "AI is bad." It is "current pricing does not reflect full cost of current quality."

§10.2Empirical corroboration

A note on mortality in cost accounting. This section includes documented deaths among its empirical cases. That is a deliberate analytical choice grounded in established regulatory methodology. Governments formally assign monetary values to statistical lives for cost-benefit analysis of safety regulations. The OECD's 2025 global meta-analysis (277 studies, over 4,000 estimates, six country groupings) found mean preliminary VSL estimates ranging from USD 0.9 million for low- and middle-income countries to USD 7.6 million for the EU. The US Department of Transportation's current operational figure is $14.2 million (2025), reflecting policy-specific adjustments above the meta-analytic mean. This is not a novel or controversial framework: it is how regulatory agencies worldwide evaluate whether safety interventions are cost-justified.

The corporate side of the calculation is visible in public filings and financial reporting. US GAAP (ASC 450) and SEC regulations require public companies to estimate and disclose material litigation contingencies. Alphabet's FY2025 10-K specifically lists "AI" among the categories of claims the company faces. Among private AI companies, OpenAI has secured insurance coverage of up to $300 million for emerging AI risks (Reuters, October 2025, though sources disputed the exact figure and agreed it falls short of potential liabilities), and Anthropic agreed to a $1.5 billion settlement in a class-action lawsuit over training-data copyright (Financial Times, October 2025). Insurance markets are retreating from fully covering AI-specific risks, with both companies exploring the use of investor funds for potential settlements. The EU AI Act imposes fines up to €30 million or 6% of global annual turnover for non-compliance in high-risk categories.

The Knowledge Horizon (CC Paper 3, §2) documents the structural limitation of this cost-absorption model: US corporate criminal penalties since 2000 exceed one trillion dollars cumulatively, yet recidivist companies are significantly larger than non-recidivists and receive smaller fines relative to their assets and revenue, with stock prices recovering quickly after penalties (Lund and Sarin 2022). For sufficiently large firms, criminal penalties become a line item in the operating budget rather than a behavioural signal. The AI industry's current litigation reserves and insurance coverage are early-stage instances of the same pattern: the cost structure absorbs the penalties without generating the corrective pressure that the accountability condition's strong form requires. The specific litigation to date is predominantly copyright-related, but the cost structure that absorbs copyright risk is the same structure that would absorb mortality and safety risk if those cases reach comparable scale.

Excluding deaths from the cost accounting of AI pipeline failures would perform exactly the externalisation this section identifies: the cost would be real but invisible in the cost structure that determines how pipelines are built. The cases below do not treat deaths as more or less important than other costs. They treat them as costs that current AI industry accounting does not account for.

If the framework's cost accounting is correct, independent institutional actors tasked with measuring deployment harm should document externalised costs where they exceed plausible deniability. The cases below span six domains (healthcare, law, software engineering, employment, finance, and psychiatry) and are not the argument itself. They are locations where the structural logic becomes institutionally visible.

ECRI 2026. The top health-technology-hazards ranking at #1 for AI-chatbot misuse in healthcare reflects aggregate-cost assessment by an independent patient-safety organisation using standard hazard methodology. The ranking is the economic argument converted to institutional standing.

Capobianco et al. 2025. One in six GPT-5 oncology recommendations was incorrect against tumour-board consensus. The 1-in-6 rate is the frequency at which the adequacy-gap cost fires. The authors identify downstream cost categories: delays in optimal care, exposure to unnecessary toxicity, increased healthcare costs, and emotional distress.

Eichenberger, Thielke, and Van Buskirk 2025. A documented case of a patient hospitalised for three weeks with bromide toxicity (bromism) after substituting sodium bromide for sodium chloride over three months based on ChatGPT advice (Annals of Internal Medicine Clinical Cases 4:8, August 2025, DOI 10.7326/aimcc.2024.1260). The framework cites this as one documented data point at the grievous-harm end of the cost category. The paper does not claim systematic harm at comparable severity.

Magesh et al. 2025. Hallucination rates of 17–33% on tools marketed to legal practitioners, including pro se litigants. The cost-externalisation pattern (verification pushed to users with the fewest independent-verification resources) is observable and quantified.

These cases are evidence for the economic argument's structure. The theoretical argument in §10.1 sets the frame. The cases corroborate. The paper's claim is that the framework's structural cost-accounting predicts where institutional attention will concentrate. The cited cases show institutional attention has concentrated where predicted.

Quantified cost anchor: pipeline-internal. The most direct measurement of correctness-failure cost multiplication comes from Laurenzo's forensic analysis (§4.11). Under degraded reasoning, user effort remained constant (5,608 vs 5,701 prompts) while API costs rose 122x ($345 to $42,121 monthly). The degradation multiplied cost because each incorrect output generated correction cycles, retries, and cache overhead that correct-first-time output would not have required. This is the economic argument in a single measured data point: the pipeline's apparent cheapness (reduced thinking tokens per request) produced actual expense (122x the cost for the same human work).

Population exposure. A recent audit of five major AI chatbots on health topics prone to misinformation (Tiller et al., BMJ Open 16:e112695, April 2026) found 49.6% of responses were problematic, with 19.6% classified as highly problematic. The audit used adversarial prompts designed to stress models toward misinformation, so the 19.6% rate should not be extrapolated mechanically to all health queries. But at 40 million daily health queries (OpenAI's reported figure), even a substantially lower population-wide rate would produce significant externalised verification cost. Critically, people do act on AI-generated health advice without professional verification. The West Health-Gallup survey (April 2026, N = 5,660, nationally representative) found that 14% of recent AI health users did not see a provider they otherwise would have seen because of AI-generated information. The KFF Tracking Poll (March 2026, N = 1,343) found that 21% of adults aged 18–29 used AI for physical health advice and did not follow up with a doctor, with cost (19%) and access barriers (38%) cited as major reasons for relying on AI instead of professional care.

Per-individual cost. The average US emergency department visit costs approximately $2,700 (Mira, 2025, analysis of 2.5 billion claims). The average hospitalisation costs substantially more. The conversion from problematic AI-generated health response to adverse medical event requiring intervention has not been systematically measured. But the per-individual costs are established, the scale of exposure is documented, and the absence of professional verification for a measurable fraction of users is confirmed by nationally representative surveys.

The high end of the per-individual cost distribution is documented. Eichenberger required a three-week hospitalisation for bromide toxicity after following ChatGPT-advised sodium bromide substitution (Annals of Internal Medicine Clinical Cases 4:8, 2025). Sam Nelson, aged 19, died of a drug overdose after 18 months of using ChatGPT for drug-dosing guidance. The chatbot provided specific dosage recommendations for substance combinations that a toxicologist described as contraindicated (SFGate, January 2026). These are not outliers in a tail that can be dismissed as misuse. They are the measured cost of the adequacy gap applied to health queries by users who, as the West Health-Gallup and KFF data confirm, act on AI-generated health advice without professional verification.

Architectural vulnerability. A separate case illustrates a different failure mode. In January 2026, security researchers at Mindgard red-teamed Doctronic's public-facing health assistant (the chatbot, not the hardened Utah prescription pilot, which excludes controlled substances by design) and induced the system to generate a SOAP note recommending triple the standard OxyContin dose using a fabricated regulatory bulletin. The structural finding is preservation failure: authoritative-register fabrication passed through the system's judgment step without detection.

The structural alternative. The cost evidence in this section documents what happens when AI is deployed at judgment steps where conditions are not satisfied. A detailed case study of healthcare AI deployment where the conditions ARE satisfied (despite a 70% error rate in the AI's raw output) is developed in §11. The case illustrates that condition-satisfaction at the judgment step, not model capability in the abstract, determines whether a deployment creates or externalises cost.

Cross-domain replication. The externalised-verification-cost pattern reproduces outside healthcare with domain-specific cost signatures. In legal practice, the Charlotin database documents over 1,200 cases globally of AI-hallucinated legal citations in court filings as of early 2026, with approximately five to six new cases documented per day and 90% of the decisions written in 2025 (Bloomberg Law, December 2025). Measured sanctions range from $5,000 (Mata v. Avianca, 2023) through $10,000 (California, Noland v. Land of the Free) to $15,000 per attorney plus full reimbursement of opposing counsel's fees (Whiting v. City of Athens, Sixth Circuit, March 2026). In one Illinois case, a firm and partner were ordered to pay a combined $59,500. More than 300 federal judges have adopted standing orders addressing AI use in filings. In at least one documented instance, a trial court decided a case based on AI-hallucinated caselaw before an appellate court identified the fabricated authorities (Above the Law, July 2025). In a separate domain, a Canadian tribunal ordered Air Canada to honour a bereavement fare discount that its customer-service chatbot had fabricated, establishing that an AI hallucination can create a binding obligation with direct monetary consequence.

In software engineering, CodeRabbit's analysis of 470 production pull requests found AI-generated code produces 1.7x more issues than human-written code, with 2.74x more security vulnerabilities (December 2025). GitClear's analysis of 211 million lines of code found that code churn (code rewritten or deleted within two weeks of being committed) nearly doubled between 2020 and 2024, with AI-assisted coding identified as a primary driver. The DORA 2024 report found that for every 25 percentage-point increase in AI adoption, delivery stability dropped 7.2%.

Employment and hiring. Mobley v. Workday was conditionally certified as a nationwide collective action under the ADEA in May 2025. Workday's own court filings disclosed that approximately 1.1 billion applications were rejected through its algorithmic screening tools during the relevant period, and the court noted that the resulting collective could include "hundreds of millions" of members. In January 2026, a class action against Eightfold AI alleged that the platform scraped data on over one billion workers, scored applicants on a zero-to-five scale, and discarded low-ranked candidates before a human saw their applications, all without the disclosures required by the Fair Credit Reporting Act. The EU AI Act (enforceable 2025) classifies employment-related AI as high-risk with fines up to €30 million or 6% of global annual turnover. The pattern is the same: algorithmic decisions that appear to reduce hiring cost externalise discrimination risk, remediation cost, and legal liability onto applicants and employers.

Financial and tax advice. A Dext survey of 500 UK accountants and bookkeepers (December 2025) found that 50% of firms have already seen clients suffer direct financial losses (overpayments, penalties, fines) from reliance on ChatGPT-style tax and financial advice. (Dext sells accounting software, so the sample likely skews toward firms encountering AI-related problems. The figure should be read as indicative rather than representative of the profession.) Among respondents, 77% reported a surge in clients using public AI tools for financial decisions, 33% warned of higher insolvency risk, and 92% called for regulation or restrictions on public AI tools providing financial advice. The SEC fined two investment advisory firms a combined $400,000 in March 2024 for false claims about their use of AI, and securities class actions targeting AI misrepresentations doubled between 2023 and 2024 (New York State Bar Association, January 2026). The accounting domain is structurally vulnerable because tax and regulatory compliance depend on jurisdiction-specific rules that change annually, precisely the kind of domain where confident-sounding but outdated or fabricated guidance produces measurable financial harm.

Psychiatric and emotional harm. The justification for including deaths in economic cost accounting was established at the opening of this section. The psychiatric domain extends this principle to a structurally different failure mode.

The cost pattern in psychiatry is structurally different from the externalised-verification model above. In the other five domains, the primary mechanism is factual inaccuracy passing through weak preservation or weak adequacy. In psychiatry, the harm arises primarily from independence failure: sycophantic validation of destructive ideation replaces the corrective pushback a human clinician would provide. The pipeline's training signal optimised for user engagement and satisfaction, which on the independence dimension means the model learned to agree, validate, and maintain emotional connection rather than to challenge, redirect, or escalate.

The documented consequences are severe. By end of 2025, at least ten lawsuits had been filed against OpenAI and Character Technologies involving six adults and four minors, seven of whom died by suicide (Psychiatric Times, April 2026). In one documented case, a 14-year-old formed an intense emotional attachment to a Character.AI chatbot that responded to his distress by telling him to "come home" rather than directing him to seek help. The independence failure is visible in the interaction pattern: the model maintained emotional connection (the trained behaviour) when a human clinician would have broken the frame and escalated (the corrective behaviour that independence would have required). A Stanford study (June 2025) found that therapy chatbots enabled dangerous behaviour in stress-testing scenarios, including providing bridge heights to a user expressing suicidal ideation.

The institutional response confirms the cost is calculable. California enacted SB 243 (effective January 2026) requiring AI companion chatbots to implement protocols preventing harmful content related to suicide and self-harm for minors. The US Senate Judiciary Committee held hearings on AI chatbot safety in September 2025. These are the institutional mechanisms by which externalised costs become visible: litigation, legislation, and regulatory attention triggered when the cost exceeds what the affected parties can absorb silently.

The structural observation for intervention design: this is not the same failure mode as healthcare misinformation or legal hallucination. Those are adequacy and preservation failures where the fix is better criteria and richer verdict records. This is an independence failure where the fix is evaluators whose error modes do not overlap with vulnerable users on the emotional-validation dimension. The distinction matters because applying the wrong intervention (better fact-checking) to the wrong condition (sycophantic validation) will not address the mechanism that produced the harm.

Across all six domains, the structural pattern is the same: the pipeline's apparent cost reduction (faster code, faster legal research, faster health answers, faster hiring, cheaper financial guidance, always-available emotional support) is offset by externalised verification, remediation, and harm costs borne by downstream actors.

§11.1The deployment and its error profile

Healthcare AI companies have routed deployment toward administrative tasks (clinical documentation, prior authorisation, billing) while keeping clinical decision-making with humans. AI medical scribes listen to clinician-patient consultations and generate draft clinical notes for clinician review.

The AI itself is not reliable. Biro et al. (JMIR 2025) found 70% of AI scribe notes contain at least one error. Asgari et al. (npj Digital Medicine 2025) classified 44% of AI hallucinations as "major" (errors that could impact diagnosis or management). A cross-sectional evaluation published in Annals of Internal Medicine (Reddy et al. 2026) found AI-generated notes consistently lower in quality than human-written ones. Four error types are documented: hallucinations (the system fabricates examinations that never occurred), omissions (patient-reported symptoms not captured), misinterpretations (a discontinued medication recorded as a new prescription), and speaker attribution errors (patient statements attributed to the clinician).

Despite these error rates, the deployment produces measurable value. A Capio Ramsay Santé evaluation of 375,000 notes generated by 1,295 clinicians across primary, secondary, and hospital care found a 29% reduction in documentation time (6.69 to 4.72 minutes per note), 16% improvement in perceived presence with patients, and 30% reduction in administrative stress (Tandem Health, December 2025). A UCSF study of nearly 1.2 million encounters across 1,565 physicians found AI scribe adopters generated 1.81 more relative value units per week, translating to approximately $3,044 in additional annual revenue per physician (Holmgren et al., JAMA Network Open, January 2026). A Stanford editorial described this gain as "modest," roughly sufficient to cover the AI scribe subscription cost. The primary value is the time savings and burnout reduction rather than the revenue increase. A JAMA study across Mass General Brigham and Emory found ambient AI documentation reduced physician burnout by 21% and improved wellbeing scores by 31%.

§11.2Five-condition analysis

The deployment works not because the AI is accurate but because the architecture satisfies PARIA's conditions despite the AI's limitations.

Adequacy. The criterion is "accurate clinical note reflecting what occurred in the consultation." The clinician was present for the consultation and can verify the note against their own memory of the encounter. The criterion tracks the deployment-relevant quantity (accurate medical record) directly. Coverage fit is strong: the scribe operates on every consultation, not a selected subset. This is strong adequacy. The criterion-fit and coverage-fit components are both satisfied by the nature of the task.

Independence. The clinician reviews the AI's output before it enters the medical record. The clinician's verification capacity does not share the AI's error modes: where the AI hallucinates an examination, the clinician knows it did not occur, where the AI omits a symptom, the clinician recalls discussing it; where the AI misattributes a statement, the clinician knows who said what. The evaluator (clinician) and the producer (AI scribe) have non-overlapping error modes on the dimensions the criterion requires. This is strong independence at the individual judgment-event level.

Accountability. Errors are visible at review time, not months later through adverse events. The feedback loop is tight: incorrect note → clinician edits → corrected note enters record. The accountability structure generates genuine feedback pressure because the clinician's professional reputation and legal liability depend on the accuracy of the record they sign. This is strong accountability, structurally similar to the formal-verification pipelines in §4.4–§4.5 where the verifier provides immediate, authoritative feedback.

Reproducibility. The output is structured clinical data in standardised formats (ICD-10, SNOMED CT, structured SOAP notes). The same consultation processed twice would produce similar notes. Context sensitivity exists (ambient noise, multiple speakers, dialect variation) but the structured output format constrains variation. A less obvious reproducibility benefit: a single AI scribe normalises documentation style across an entire practice or hospital system. In regulated documentation, stylistic variation across clinicians (inconsistent abbreviations, variable note structure, idiosyncratic formatting) is a source of downstream parsing errors and ambiguity. The scribe's enforcement of consistent structure is a reproducibility gain that would be difficult to achieve through policy alone. Reproducibility is adequate, though not as strong as in formal-verification pipelines where the output is deterministic.

Preservation. The note is generated, reviewed, and entered into the electronic health record in structured format. The verdict (approved clinical note) carries the judgment's epistemic content forward to the medical record intact. Audit preservation is strong (the note is a permanent record). Training-signal preservation is not applicable in the same sense as in training pipelines, since scribe outputs do not directly feed back into model training at most institutions.

§11.3The condition-satisfaction paradox

The AI medical scribe case demonstrates that condition-satisfaction at the judgment step, not model capability in the abstract, determines whether a deployment creates or externalises cost. A 70% error rate in the AI's raw output produces institutional value (time savings, reduced burnout, revenue increase) because the deployment architecture ensures every output passes through a judgment step that satisfies the five conditions. The same AI deployed without clinician review (as in direct-to-consumer health chatbots) would produce the externalised costs documented in §10.2.

The paradox is that the deployment's success depends on a component (human review) that the deployment itself structurally pressures toward degradation.

§11.4Structural vulnerability: accountability drift

The human review that currently satisfies the independence and accountability conditions is subject to the same drift the framework identifies in training pipelines. In the vocabulary of The Knowledge Horizon (CC Paper 3), the clinician is currently "in the loop" (actively reviewing, correcting, exercising judgment). Rubber-stamping shifts them to "on the hook" (nominally responsible but not generating corrective pressure). The accountability condition degrades from oversight to insurance without any visible structural change: the clinician still signs the note, still bears professional liability, but the review no longer catches errors. When a clinician reviews fifty notes per day and most are acceptable, vigilance degrades into rubber-stamping. The accountability condition's strong form requires that evaluator application quality generates feedback pressure, and fatigue-driven review does not generate that pressure.

The Bainbridge irony applies with particular force. As AI scribe accuracy improves from a 70% error rate toward a 5% error rate, fewer errors reach the clinician. The clinician's error-detection skill atrophies because it is exercised less frequently. The remaining errors, now rarer, exploit the complacency the improvement created. A 70% error rate keeps evaluators vigilant; a 5% error rate produces the conditions for the accountability failure the framework predicts.

The Confidence Curriculum's Paper 4 (The Pedagogical Inversion, §1.2.1) documents the same drift mechanism in the human-AI interaction domain. Cheng et al. (Science 391:eaec8352, 2026, N = 2,405) demonstrated that even a single interaction with a sycophantic AI reduces human participants' prosocial intentions and increases their conviction that they were right, with participants 13% more likely to return to the sycophantic model. Paper 4 develops the longitudinal implication through the confidence-inheritance mechanism: per-interaction effects accumulate because each interaction recalibrates the user's baseline expectations, and the recalibration persists across model changes. The scribe case is the clinical analog: when the scribe's output is usually acceptable, the clinician's review standard recalibrates downward, and the recalibration persists even when the scribe's error profile changes.

This is the same pattern observed across the paper's other cases: conditions that are satisfied at deployment time degrade under the pressures the deployment itself creates. The scribe case makes the mechanism unusually visible because the degradation path is predictable and the timeline is short (months, not years).

§11.5Maintaining condition-satisfaction: an open design problem

UX-level interventions to maintain evaluator vigilance exist but require dedicated design work beyond this paper's scope. The following examples are illustrative, not exhaustive, and no single approach is sufficient alone. The design space is large.

Active comparison. Instead of presenting a single note for passive approval, the interface presents two note versions and the clinician selects the correct one. One version contains a subtle known error. The clinician engages actively with the content rather than passively scanning. If they consistently select the incorrect version, the system flags a vigilance issue. If they catch the discrepancy, the checking behaviour is reinforced. This is operant conditioning maintaining the accountability condition. The known error exists only in the review interface, never in the medical record. The record layer receives only the approved content.

Review-time monitoring. Track how long the clinician spends reviewing each note and compare against baselines for their specialty, their practice, and the broader user population. When review time drops below a threshold correlated with error-catching, the system can escalate review requirements, surface additional confirmation prompts, or notify a supervisor. This detects rubber-stamping through measurement rather than testing.

Pedagogical phrasing. The AI phrases uncertain sections in ways that invite engagement rather than passive acceptance. "The patient reported discontinuing metformin" becomes "Medication change noted: metformin. Please confirm direction (discontinued vs dose adjustment)." The second version forces active cognitive engagement with high-risk content without introducing false information. The AI identifies which content categories carry the highest error risk (medication changes, dosage figures, allergy documentation) and structures the review interface to require explicit confirmation on those categories specifically.

Periodic disclosed audits. A random sample of notes is reviewed against consultation recordings by a second clinician. The clinician knows these audits occur but does not know which notes are selected. The knowledge that any note may be audited maintains review quality across all notes, not just flagged ones.

Consent-forward canary probes. The product is marketed upfront as including vigilance checks. Users consent to the testing as a condition of use, analogous to continuing-education requirements for professional certification. The institutional buyer (hospital, practice group) understands that the product maintains evaluator quality as a feature, not a surveillance mechanism. This reframes the canary probe from covert testing to disclosed quality assurance.

The broader observation is that deployment architectures satisfying PARIA's conditions require ongoing investment in maintaining that satisfaction. The conditions are not satisfied once at deployment and preserved automatically. They are structural properties that degrade under operational pressure unless the architecture actively maintains them. This is the continuous-ledger argument from §6 applied at the deployment level: the audit substrate must extend across the deployment's lifetime, not just its launch.

§11.6Temporal adequacy and strategic deployment

As model capabilities change and specialised models emerge for clinical domains, the set of judgment steps that satisfy PARIA's conditions will expand. Companies that built institutional trust through administrative AI (where conditions are architecturally satisfiable) will be positioned to extend into clinical decision support when the conditions permit.

This is the temporal-scope observation from §9.4 applied to deployment strategy: the conditions do not change; what changes is which models and which domains satisfy them. The scribe deployment is not a permanent boundary between "safe AI" and "unsafe AI." It is a snapshot of which judgment steps current models and current deployment architectures can structurally support. The framework's value is not in drawing that boundary permanently but in providing the diagnostic that determines where the boundary sits at any given moment.

§12.1Warrant decay across sequential judgment stages

Structural observation. The framework's five conditions apply to a single judgment step. Real pipelines contain chains of judgment events. Training signals produced at one stage become inputs to evaluator judgment at subsequent stages, either within a single training run or across generations of models trained on synthetic data derived from prior models. This section identifies multi-stage warrant decay as a consequence of an established information-theoretic law and scopes its application to preservation chains specifically.

The Data Processing Inequality. Training pipelines with multiple judgment steps form Markov chains. Let X be the ground-truth epistemic content the deployment requires the chain to carry information about, Y_1 the training signal after the first judgment step's aggregation, and Y_n the signal after n sequential stages. The Data Processing Inequality (Cover and Thomas 2006, Chapter 2) establishes that mutual information between source and signal is non-increasing along any Markov chain: I(X; Y_n) ≤ I(X; Y_{n-1}) ≤ ... ≤ I(X; Y_1). When any stage's channel is lossy, the inequality is strict: information is guaranteed to be lost at that stage. Aggregation is demonstrably lossy: a many-to-one mapping (three psychiatrists' reasoning compressed to a majority vote, preference rankings collapsed to a scalar reward signal) cannot preserve all the input information. This is not a conjecture. It is a consequence of a proven theorem applied to the structure of training pipelines.

Framework mapping. The preservation condition (§2.5) is the engineering requirement that minimises channel lossiness at each judgment step. Strong preservation means the verdict record's schema encodes as much of the judgment's epistemic content as the format permits. Weak preservation means the channel discards structure (reasoning, disagreement distribution, confidence, evaluator identity) that DPI then guarantees cannot be recovered at any downstream stage. The seven-component verdict record (§5.1) is a specification for channel fidelity: each component reduces the information loss that would otherwise occur at aggregation.

Cascading consequence. In pipelines where strong preservation fails at any stage, DPI guarantees that downstream stages cannot recover what that stage destroyed. Chains with multiple preservation failures compound the loss: every lossy channel strictly reduces mutual information with the source. The rate of decay depends on stage-specific channel properties (how much information each aggregation step destroys). The direction of decay is guaranteed by the theorem.

Scoping. DPI bounds multi-stage decay for all five conditions: I(X; Y_n) ≤ I(X; Y_1) holds regardless of which condition failed at Stage 1. However, DPI is the primary explanatory mechanism only for preservation, where the channel's lossiness IS the condition failure. For the other conditions, the multi-stage propagation has a different character that DPI bounds but does not explain.

Adequacy failure propagates through criterion inheritance: Stage 2 receives a model shaped by the wrong criterion and operates on already-misdirected outputs. Independence failure propagates through bias reinforcement: the training signal encodes shared evaluator-producer error modes, the trained model inherits those error modes, and if subsequent evaluators share the same biases, the reinforcement compounds. Accountability failure propagates through drift accumulation: without feedback pressure, evaluator application quality degrades at each stage, and each stage's uncorrected drift becomes the baseline for the next. Reproducibility failure propagates through inconsistency inheritance: context-sensitive verdicts produce an inconsistent training signal, and the model trained on that signal itself produces inconsistent outputs for subsequent evaluation.

Each of these propagation mechanisms warrants formal treatment that this paper does not provide. They require different mathematical frameworks: specification theory for criterion inheritance, statistical error-correlation for bias reinforcement, temporal dynamics for drift accumulation, sampling theory for inconsistency inheritance. Their formal treatment is open research rather than immediate extension of the DPI framing used here. The DPI-grounded analysis covers preservation specifically because that is where the information-theoretic framing does the most explanatory work.

Side information. A stage with access to external information (independent evaluators, domain expertise, ground-truth data sources) can inject warrant the chain cannot recover internally. External information breaks the Markov property: the stage's output can contain information about X that the chain's internal signal had lost. This is precisely why independent evaluation (Capobianco testing GPT-5 against tumour-board consensus rather than against the benchmark the training signal encoded) and human orchestration (the Knowledge Horizon's proposal) matter structurally. They are not merely good practice. They are the mechanism by which information that DPI guarantees is lost within the chain can be restored from outside it.

Empirical anchors. Two cases demonstrate the DPI operating through different chain structures.

Synthetic data chains (Shumailov et al., Nature 2024). Shumailov et al. demonstrated that training generative models recursively on their own outputs produces progressive model collapse: the tails of the original content distribution disappear, diversity decreases monotonically, and KL divergence from the source distribution increases with each generation. The effect was demonstrated across LLMs, variational autoencoders, and Gaussian mixture models, confirming architecture independence. Each generation is a stage in a Markov chain. Each sampling-and-retraining step is a lossy channel: the model's output distribution cannot perfectly reproduce the input distribution's full structure, so the retraining step operates on an already-impoverished signal. DPI guarantees that each generation's mutual information with the original distribution is strictly less than the previous generation's. The distributional-tail disappearance Shumailov documents is the observable consequence: low-frequency modes (precisely the information that sits in distributional tails) are the first to be lost at each lossy channel.

Human-AI knowledge propagation (bixonimania, §4.9). The bixonimania chain demonstrates the DPI through a multi-type stage structure: preprint → LLM training → user Q&A → peer-review citation. Each stage's channel was lossy in a different way (the training stage destroyed fabrication markers while preserving authoritative content. The user-facing stage further reduced mutual information with truth; the citation stage inherited the loss). The retraction came from outside the chain (Nature's independent investigation), consistent with the side-information observation above: external information broke the Markov property.

Falsifiability. The DPI framing yields a testable prediction. Preservation-restoring interventions at any stage (distributional preservation replacing scalar aggregation, verdict records retaining disagreement structure, source-chain audit mechanisms) should produce measurable reduction in downstream information loss, quantifiable through mutual-information estimators on stage-pair samples. Interventions that do not modify stage-specific channel properties (output-level disclaimers, post-hoc filtering) should produce no reduction in DPI-predicted loss because they operate downstream of the lossy channel rather than within it. If preservation-restoring interventions fail to reduce downstream information loss, the framework's preservation-to-information-loss mapping is wrong for the specific channel tested.

The Data Processing Inequality thus provides the formal substrate for the preservation condition's chain-level extension: single-stage preservation is a channel-fidelity requirement, and multi-stage preservation decay is the mathematical consequence of lossy channels composed in sequence.

§12.2Framework-native reframings

Three empirical findings that appear counter-intuitive under standard accounts become coherent with the framework's structural account.

Authoritative-prose vulnerability. Omar et al. (2026) report that LLMs are more vulnerable to fabrications framed in authoritative clinical prose (46.1% acceptance from hospital notes) than in logical-fallacy wrappers (reduced or unchanged acceptance under eight of ten fallacy framings). Under standard accounts, this is surprising: logical fallacies are commonly understood as persuasion mechanisms, and authoritative clinical prose is factual. The finding is structurally expected. Training-time criteria reward fluency and register-conformance. Fabrications in the rewarded register pass through preservation unmarked. Fabrications in registers the criterion did not reward (logical fallacies) trigger pattern-matching against failure modes the criterion tagged. The framework commits to preservation-primary attribution. Adequacy-primary (the criterion rewards register over truth) and independence-primary (evaluators share register preferences with producers) are compatible secondary readings. Discriminating between these attributions is a research target: a pipeline satisfying preservation more strongly without changing adequacy or independence should reduce authoritative-prose vulnerability more than a pipeline satisfying adequacy more strongly without changing preservation.

Medical fine-tuning underperformance. Omar et al. also report that domain-specific medical fine-tuning sometimes increases rather than decreases vulnerability to fabricated medical content. Kim et al. (2025, "Medical Hallucination in Foundation Models," MIT Media Lab and collaborating institutions, arXiv 2503.05777) confirm this pattern independently at broader scale: their evaluation of eleven foundation models across seven medical hallucination tasks found that general-purpose models achieved higher proportions of hallucination-free responses than medical-specialised models. Their interpretation is that the errors arise from reasoning failures rather than knowledge gaps. Under standard accounts, both findings are anomalous: more medical training should produce better medical performance. Both findings are structurally expected. Domain-specific fine-tuning increases register-conformance. If the fine-tuning signal inherits the authoritative-prose preservation failure, the fine-tuned model amplifies it: the model becomes more fluent in medical register and correspondingly more vulnerable to fabrications in that register. Medical fine-tuning without strong preservation addresses surface symptoms (register fit) rather than structural cause (what the signal encodes about truth value).

Cross-lab pattern convergence. Three leading AI laboratories (OpenAI, Google, Anthropic) produce systems that exhibit similar failure modes: sycophancy, fabrication, calibration problems. Under implementation-specific accounts, this convergence is a coincidence requiring three separate explanations. Under the framework, it is structurally expected: all three pipelines share RLHF-class training with weak independence, scalar aggregation destroying preservation, and benchmark-driven adequacy criteria decoupled from deployment requirements. The convergence is what the framework predicts when multiple pipelines share the same condition-violation profile. Other explanations (shared training data, shared benchmark culture, same architecture family) also predict convergence, but they do not predict convergence with this specific condition-violation signature. The framework's contribution is not predicting convergence itself but providing a condition-level account of why the convergence takes the specific form it does.

§12.3Predictions

The framework generates testable predictions beyond those already embedded in individual sections. Each prediction is falsifiable: failure of the predicted pattern for a specific condition falsifies that condition's role in the failure-mode mapping, not the framework overall.

Transport of structural interventions. Interventions operating at the framework's structural level (satisfying one or more conditions more strongly) should produce improvements that transport across deployment contexts. Interventions addressing surface symptoms (post-hoc filtering, output-level confidence calibration, prompt engineering) should produce improvements that do not transport because they do not modify the judgment step's structural properties. A pipeline that replaces scalar preference aggregation with distributional preservation (satisfying preservation more strongly) should exhibit improved calibration across deployment contexts, not only in the specific context where preservation was improved. A pipeline that adds output-level confidence disclaimers without modifying the training signal should exhibit improved surface calibration in contexts where the disclaimer fires and no improvement in contexts where it does not.

Independence over count. The literature on inter-annotator agreement establishes that increasing evaluator count beyond three to five produces diminishing returns (Krippendorff 2004). The framework predicts something stronger: the axis that matters is not count but independence. Adding evaluators whose error modes overlap with the producer's (more RLHF raters from the same demographic, more LLM judges from the same model family) should produce diminishing returns regardless of count because the shared error modes dominate the signal. Adding a single evaluator with genuinely non-overlapping error modes (different architecture, different training, different domain access) should produce disproportionate improvement relative to adding many dependent evaluators.

The Judgment Paradox develops two mechanisms that operationalise this prediction. The RAO pipeline's cross-review (§3 in that paper) tests independence by having evaluators assess each other's reasoning rather than just producing independent ratings. But the stronger variant is the cross-domain reviewer design (JP §9.7): experts from adjacent fields review each other's reasoning across domain boundaries. A legal scholar reviewing a psychiatrist's reasoning cannot evaluate whether the clinical judgment is correct, but can evaluate whether the reasoning is rigorous, whether the framework is consistently applied, and whether the justification supports the conclusion. The cross-domain reviewer has maximally non-overlapping error modes with the producer because they lack the domain-specific knowledge that creates shared blind spots. The implicit requirement is that the cross-domain reviewer is a competent expert capable of high-level reasoning in their own field. The value comes from applying that reasoning capacity to unfamiliar content, not from adding an unqualified observer. The design selects for this naturally: the task requires evaluating reasoning rigour across domain boundaries, which is itself a high-level reasoning skill that self-selects for the right participants.

Wiley (1998) demonstrated that domain knowledge acts as a mental set: experts' well-structured knowledge confines them to familiar areas of the solution space. Nathan and Petrosino (2003) documented the expert blind spot: experts automate reasoning steps to the point where those steps become invisible to anyone who shares the same automated knowledge. Pool rotation (varying evaluator composition across rounds) prevents convergence of error modes from masquerading as calibration improvement. The testable prediction: for a fixed annotation budget, allocating resources to evaluator diversity (different backgrounds, different tools, different verification methods) should outperform allocating resources to evaluator volume (more raters with the same profile).

Model collapse and preservation. Pipelines with strong preservation (rich verdict records, distributional aggregation) should show slower model collapse under synthetic-data training (Shumailov et al. 2024) than pipelines with weak preservation (scalar aggregation, discarded reasoning). The DPI analysis (§12.1) predicts this directly: strong preservation reduces channel lossiness, and lower lossiness at each stage means slower mutual-information decay across generations. The specific prediction: distributional-tail disappearance (the first observable symptom of model collapse) should onset later in generations trained with distributional preservation than in generations trained with scalar aggregation, all else equal.

Null scope. If structural-level interventions fail to transport, the framework's condition-identification is wrong for the specific condition targeted. If evaluator independence does not reduce shared error modes, the independence condition's failure-mode mapping is wrong. Each condition's contribution is independently testable, and failure of one prediction does not falsify the others.