Gaming the Metric, Not the Harm: Certifying Safety Audits against Strategic Platform Manipulation

• URL: http://arxiv.org/abs/2605.06324v1
• Date: Thu, 07 May 2026 14:22:21 GMT
• Title: Gaming the Metric, Not the Harm: Certifying Safety Audits against Strategic Platform Manipulation
• Abstract summary: We ask when an audit metric can still certify a genuine reduction in harm.<n>The protocol is modeled as a published transformation graph whose connected components form semantic classes.<n>We check the claims at three levels: exhaustive enumeration on a finite-state grid of mixed strategies, an SMT encoding in Z3 cross-replayed in cvc5, and a bounded single-player MDP encoded in PRISM-games.
• Score: 1.253312107729806
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Online-safety regulation under the UK Online Safety Act and the EU Digital Services Act increasingly treats scalar metrics as compliance evidence. Once announced, such a metric also becomes an optimization target: a strategic platform can improve its score by routing recommendations through semantically equivalent content variants, without reducing true harm. We ask when such an audit metric can still certify a genuine reduction in harm. The protocol is modeled as a published transformation graph whose connected components form semantic classes, and the metric itself is treated as a security object. Three results follow. First, any metric that scores variants directly is manipulable as soon as two equivalent variants in a harmful class disagree in score. Second, the semantic-envelope lift, which assigns each variant the maximum score in its class, is the unique pointwise minimum among conservative classwise-constant repairs. Third, a class-stratified certificate, $H^\star(x) \le (1/\hatα) M_{\mathrm{Env}(m)}(x) + \barη$, holds for every platform strategy, with $\barη$ absorbing annotation and protocol error. We check the claims at three levels: exhaustive enumeration on a finite-state grid of mixed strategies, an SMT encoding in Z3 cross-replayed in cvc5, and a bounded single-player MDP encoded in PRISM-games. The fragile metric fails manipulation invariance and cannot support the same useful predeclared class-coverage certificate; under the envelope-level certificate, it produces large violations at every tested instance, with a large mean gaming gap across random catalogs at a fixed audit budget. The semantic-envelope metric exhibits no such violation in the tested instances.

Related papers

• Certifying Model Upgrades with Slice-Wise Non-Regression and Incumbent Fallback [2.8716825293247665]
  We study checkpoint selection subject to non-regression tolerances relative to a retained incumbent.<n>We give a reproducible release procedure that separates candidate search from independent, paired evaluation.<n>A joint release decision does not require a slice-count Bonferroni penalty, although certification power can still decrease with the number of slices.
  arXiv  Detail & Related papers  (2026-09-12T05:00:50Z)
• Boundary-Mutation Testing for Pattern-Based Secret Detection: A Rule-Level Method and Cross-Scanner Evaluation [0.0]
  Boundary-mutation testing for pattern-based secret scanners.<n>Three scanners - a 43-rule open-source scanner, Gitleaks 8.21.2, and TruffleHog 3.82.13 - are tested.
  arXiv  Detail & Related papers  (2026-09-02T13:41:50Z)
• What Can Be Enforced? A Theory of Certified Runtime Safety for Tool-Using Agents [0.0]
  guardrails act before irreversible tool calls, but their guarantees depend on what policy state is representable.<n>Pearson representation attacks add a margin, so benign calibration alone does not transfer.<n>Experiments target these distinctions through static diagnostics, controlled-model enumeration, representation rewrites, and paired closed-loop reruns.
  arXiv  Detail & Related papers  (2026-07-24T19:14:26Z)
• On the Inseparability of Instructions and Data in Shared-Embedding Sequence Models [0.0]
  We formalize prompted systems as Prompted Action Models with control-authoritative actions.<n>We prove Semantic-Faithful Control (SFC) is unachievable within the shared pipeline.<n>We identify the root cause and the class of solution it demands.
  arXiv  Detail & Related papers  (2026-06-25T21:52:29Z)
• TAPO: Tool-Aware Policy Optimization via Credit Transfer for Multimodal Search Agents [54.08846865906602]
  We characterize credit misassignment as a systematic failure mode of GRPO in tool-augmented multimodal search agents.<n>We propose Tool-Aware Policy Optimization (TAPO), which exploits the parameter-determinism property of information-acquisition tools.
  arXiv  Detail & Related papers  (2026-06-04T07:15:43Z)
• MEMSAD: Gradient-Coupled Anomaly Detection for Memory Poisoning in Retrieval-Augmented Agents [0.0]
  We formalize memory poisoning attacks on retrieval-augmented agents as a Stackelberg game with a unified evaluation framework.<n>We show faithful evaluation increases measured attack success by $4times$ (ASR-R: 0.25 to 1.00$)<n>Our primary contribution is MEMSAD, a calibration-based defense grounded in a gradient coupling.
  arXiv  Detail & Related papers  (2026-05-05T08:15:41Z)
• Measurement Risk in Supervised Financial NLP: Rubric and Metric Sensitivity on JF-ICR [1.7107991816118835]
  We study the measurement risk on Japanese Financial Implicit-Commitment Recognition.<n>We find that rubric wording materially changes model-assigned labels.<n>Not every metric remains informative under the JF-ICR class distribution.
  arXiv  Detail & Related papers  (2026-04-30T03:39:14Z)
• Compiling Activation Steering into Weights via Null-Space Constraints for Stealthy Backdoors [48.881343993730844]
  Safety-aligned large language models (LLMs) are increasingly deployed in real-world pipelines.<n> adversaries can distribute backdoored checkpoints that behave normally under standard evaluation but jailbreak when a hidden trigger is present.<n>Recent post-hoc weight-editing methods offer an efficient approach to injecting such backdoors.
  arXiv  Detail & Related papers  (2026-04-14T06:48:33Z)
• Late-Stage Generalization Collapse in Grokking: Detecting anti-grokking with Weightwatcher [1.6615337656760856]
  emphMemorization in neural networks lacks a precise operational definition and is often inferred from the grokking regime.<n>We identify a previously unreported third phase of grokking in this training regime: emphanti-grokking, a late-stage collapse of generalization.
  arXiv  Detail & Related papers  (2026-02-02T22:09:14Z)
• Reinforcement Learning with Verifiable yet Noisy Rewards under Imperfect Verifiers [90.50039419576807]
  Reinforcement Learning with Verifiable Rewards (RLVR) trains policies against automated verifiers to avoid costly human labeling.<n>To reduce vulnerability to verifier hacking, many RLVR systems collapse rewards to binary $0,1$ during training.<n>This choice carries a cost: it introduces textitfalse negatives (rejecting correct answers, FNs) and textitfalse positives (accepting incorrect ones, FPs)
  arXiv  Detail & Related papers  (2025-10-01T13:56:44Z)
• Exact Certification of (Graph) Neural Networks Against Label Poisoning [50.87615167799367]
  We introduce an exact certification method for label flipping in Graph Neural Networks (GNNs)<n>We apply our method to certify a broad range of GNN architectures in node classification tasks.<n>Our work presents the first exact certificate to a poisoning attack ever derived for neural networks.
  arXiv  Detail & Related papers  (2024-11-30T17:05:12Z)
• Adaptive Hierarchical Certification for Segmentation using Randomized Smoothing [87.48628403354351]
  certification for machine learning is proving that no adversarial sample can evade a model within a range under certain conditions. Common certification methods for segmentation use a flat set of fine-grained classes, leading to high abstain rates due to model uncertainty. We propose a novel, more practical setting, which certifies pixels within a multi-level hierarchy, and adaptively relaxes the certification to a coarser level for unstable components.
  arXiv  Detail & Related papers  (2024-02-13T11:59:43Z)
• Certifying LLM Safety against Adversarial Prompting [70.96868018621167]
  Large language models (LLMs) are vulnerable to adversarial attacks that add malicious tokens to an input prompt.<n>We introduce erase-and-check, the first framework for defending against adversarial prompts with certifiable safety guarantees.
  arXiv  Detail & Related papers  (2023-09-06T04:37:20Z)
• SMATCH++: Standardized and Extended Evaluation of Semantic Graphs [4.987581730476023]
  The Smatch metric is a popular method for evaluating graph distances. We show how to fully conform to annotation guidelines that allow structurally deviating but valid graphs. For improved scoring, we propose standardized and extended metric calculation of fine-grained sub-graph meaning aspects.
  arXiv  Detail & Related papers  (2023-05-11T17:29:47Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.