Tail-Shape Estimation in LLM Evaluation Is Fragile: A Protocol for Diagnosing False Positives

Abstract: Recent work motivates moving LLM evaluation from mean-based to tail-aware metrics, including conditional value-at-risk and tail-index estimates of reward-model error. We ask whether the canonical extreme-value-theory tail-index parameter, which isolates how heavy a tail is from how large the tail mass is, adds discriminative information beyond the mean and a standard tail-magnitude statistic in LLM evaluation. We pre-register a protocol covering admissibility, goodness-of-fit, threshold-stability, and effect-size requirements for any positive tail-shape claim. The protocol is the contribution of this paper; the empirical study below is a demonstration of what its gates catch. Applied to a standard LLM toxicity-evaluation setup under two structurally different scorer families, the protocol catches three distinct modes of false positives that a naive analysis would have published, and rejects the headline tail-shape claim on both scorers. We conclude that tail-shape estimation in the LLM toxicity-evaluation setups we examined is more fragile than the recent literature suggests, and recommend the protocol as a starting point for tail-index claims in similar setups.

• The paper introduces a strict five-gate protocol to diagnose false positives in tail-index estimation for LLM evaluation.
• It shows that finite-sample effects, bounded-support contamination, and threshold instability severely impact tail-index reliability.
• Empirical results confirm that when LLMs are matched on mean and TVaR, tail-index metrics fail to provide independent risk information.

Protocol Fragility in Tail-Shape Estimation for LLM Evaluation

Motivation and Problem Framing

Standard LLM evaluation metrics overwhelmingly emphasize mean statistics (e.g., mean toxicity, mean accuracy, mean hallucination rates). However, catastrophic and rare behaviors associated with LLMs are typically manifest in the distributional tails, which require analysis via Extreme Value Theory (EVT) rather than the Central Limit Theorem. Recent research advocates for tail-aware metrics such as Conditional Value-at-Risk (CVaR) or tail-index estimation to surface risks invisible to the mean [nitsure2024riskaware, kwa2024catastrophic]. The canonical EVT parameter—the tail index $\xi$—isolates tail-heaviness: $\xi = 0$ indicates exponential decay, $\xi > 0$ indicates polynomially heavy tails, and $\xi < 0$ signals bounded tails.

This paper rigorously investigates whether $\xi$ provides discriminative information orthogonal to mean and tail-magnitude statistics like TVaR for LLM evaluation. The authors introduce and validate a strict protocol for tail-shape claims, targeting failure modes in finite-sample Peaks-Over-Threshold (POT) estimation. The empirical application, centered on toxicity evaluation with Detoxify and token-NLL scorers over instruction-tuned LLMs, demonstrates protocol fragility and negative evidence: apparent discoveries are systematically caught and rejected by the protocol's gates, underscoring that tail-shape estimation is unreliable on typical LLM evaluation setups.

Protocol Architecture and Theoretical Foundation

The paper's principal contribution is a five-gate protocol for admissible tail-index claims:

• G1/G2 (Bulk Equivalence): Two One-Sided Test (TOST) bootstrap equivalence gates for mean and TVaR, imposing strict practical equivalence tolerances.
• G3 (Sample Size): With a POT threshold $q$, each condition must have at least $N^\star$ exceedances, derived from asymptotic power analysis (Smith [1987]) for desired effect size and statistical power.
• G4 (Goodness-of-Fit): Anderson–Darling test for GPD fit to exceedances guards against distributional mismatch and bounded-support artifacts.
• G5 (Parameter Stability): Enforces stability of $\xi$ across nearby thresholds, preventing threshold-fishing and cherry-picking.

Only pairs passing all admissibility gates are subjected to pass criteria:

• P1 (CI Non-Overlap): Non-overlapping bootstrap confidence intervals for $\xi$.
• P2 (Effect Size Floor): Absolute $\Delta\xi$ must exceed a pre-registered floor.

This design is pre-registered in the spirit of confirmatory analysis, with sample-size, tolerances, and decision rules fixed a priori.

Empirical Demonstration: Failure Modes and Gate Diagnostics

Sample Size and Estimation Noise

Low-sample pilots (e.g., 2,000 prompts) can yield striking but spurious tail-index separation ($\xi = 0$0) well above the effect-size floor, despite passing GPD goodness-of-fit. The sample-size gate G3 correctly rejects such findings: the necessary threshold for reliable $\xi = 0$1 detection ($\xi = 0$2) is substantially higher, and at full protocol-compliant sample sizes, the effect shrinks by two orders of magnitude.

Goodness-of-Fit and Bounded-Support Contamination

Detoxify as a toxicity scorer returns probabilities in $\xi = 0$3 with substantial mass near the upper bound, especially for highly toxic completions. Naive POT-GPD fits in probability space yield spuriously heavy-tailed estimates ($\xi = 0$4–$\xi = 0$5), failing Anderson–Darling fit on most models. The authors formalize the mechanism: a pile-up against $\xi = 0$6 induces a limiting $\xi = 0$7, not a genuine tail regime.

After logit transformation, empirical quantiles match GPD quantiles linearly; Anderson–Darling passes and fitted $\xi = 0$8 converge toward $\xi = 0$9, restoring validity.

Figure 1: Bounded-support contamination on Mistral-Nemo; probability-space QQ shows empirical exceedances saturating against the upper bound, while logit space yields proper linearity and valid GPD fit.

Parameter Stability and Threshold-Fishing

Single-threshold tail-index claims are susceptible to cherry-picking. In cross-threshold analyses, observed $\xi > 0$0 fluctuation substantially within each model's envelope, and the only positive result falling within a noise envelope is correctly rejected by G5.

Figure 2: Parameter-stability scan, logit space; substantial $\xi > 0$1 variability across thresholds reveals instability and precludes credible discrimination claims.

Pairwise Verdict and Protocol Impact

Applying the corrected protocol to four instruction-tuned LLMs yields a null result: no pair passes all gates and both pass criteria. For bulk-equivalent pairs, $\xi > 0$2 falls below the effect-size floor with overlapping CIs. The protocol's sensitivity analysis confirms verdict robustness to tolerance variation. Extension to a second scorer family (token-level NLL) reveals goodness-of-fit failure for a distributional, not bounded-support, reason—generalizing the protocol's gate action.

Figure 3: Pairwise H1 verdict at logit $\xi > 0$3; none of the model pairs clear gate criteria for tail-index discrimination.

Synthetic Protocol Validation

Simulation over synthetic GPD pairs calibrates empirical PASS rates for the CI non-overlap and effect-size floor rules:

• For $\xi > 0$4 (at the floor), PASS saturates at $\xi > 0$5 due to bootstrap symmetry;
• For $\xi > 0$6, PASS approaches $\xi > 0$7 at the sample-size bound prescribed by Eq. (powern), confirming theoretical expectations.

  Figure 4: Synthetic recovery; empirical PASS rate for P1$\xi > 0$8P2 as a function of exceedances and true $\xi > 0$9, validating sample-size calculation.

Practical and Theoretical Implications

This work substantiates that tail-shape estimation in LLM toxicity evaluation is markedly fragile. Each gate in the protocol addresses a distinct, non-trivial failure mode—including finite-sample variance, bounded-support contamination, and threshold-selection bias—each capable of yielding credible false positives without rigorous gate application.

On practical grounds:

• Tail-index metrics should not be reported without full protocol compliance, including parameter stability and goodness-of-fit diagnostics.
• Probability-based scorers require logit transformation. Otherwise, bounded-support artifacts dominate.
• Sample sizes for tail claims must be pre-registered and justified via asymptotic power analysis.

Theoretically, the analysis suggests in typical LLM evaluation regimes, tail-index $\xi < 0$0 does not provide an independent axis of risk stratification when means and tail-magnitude statistics are matched. The findings refine, rather than refute, prior results in risk-aware benchmarking and reward-model robustness [kwa2024catastrophic, nitsure2024riskaware].

Future Directions

Key unresolved fronts include:

• Protocol exercise on setups where $\xi < 0$1 does carry orthogonal information and yields positive claims.
• Expansion to additional scorer families, datasets, and model variants.
• Development of mixture-tail models or targeted scorer designs for content-type-specific tail analysis.
• Formalization of parameter-stability tolerances.

Conclusion

The protocol presented in "Tail-Shape Estimation in LLM Evaluation Is Fragile: A Protocol for Diagnosing False Positives" (2606.16511) constitutes a necessary foundation for defensible tail-index estimation in LLM evaluation. Empirical demonstration reveals three distinct failure modes, with negative evidence emphasizing that tail shape does not discriminate among standard open-weight instruction-tuned LLMs beyond mean and TVaR statistics. The protocol, sample-size bound, and methodological recommendations should be regarded as essential for rigorous tail-aware evaluation of LLMs.