Gauge-Sweep Audits Overview

• Gauge-Sweep Audits are audit procedures that dynamically adjust a scalar gauge across structured hypotheses to optimize performance and retain formal risk limits.
• They are applied across domains including ballot-level risk-limiting audits, DP-SGD privacy auditing, checkpoint verification, and metrology side-channel tests.
• Implementations use techniques like mixture martingales, adaptive betting, and side-channel profiling to ensure robust audit guarantees while reducing expected workload.

Gauge-Sweep Audits are audit procedures in which a “gauge” is swept, mixed, accumulated, or adapted over a structured family of hypotheses, latent states, or internal signals. In the supplied literature, the term appears most concretely in ballot-level comparison risk-limiting audits built on comparison-optimal betting, where the gauge is the martingale tuning parameter or bet; it is also used as an interpretive label for one-run privacy auditing in DP-SGD, artifact-level checkpoint triage, profiled side-channel auditing of public metrology releases, and a SHANGRLA-style mapping from discrepancies to half-average null tests. Across these settings, the common pattern is to preserve a formal audit guarantee while improving robustness or efficiency when the true generative or error process is unknown (Spertus, 2023, Agrawal et al., 10 Jun 2026, Hurtado, 2 Jul 2026, Alpay et al., 1 Jun 2026, Stark, 2019).

1. Domain-specific meanings of “gauge” and “sweep”

The term is not used uniformly across the cited work. In ballot-level comparison RLAs, the gauge is the per-draw bet in a supermartingale test, and sweeping means diversifying or adapting that bet across plausible cast-vote-record error rates. In the supplied terminology mapping for one-run privacy auditing, the gauge is the normalized canary score and the sweep is the accumulation of canary-aligned signals over training steps. In checkpoint auditing, gauges are internal artifact-level signals computed from activations and weights, and sweeping means applying them across a registry of checkpoints and combining them by standardized fusion. In metrology, gauge settings are instrument and processing parameters such as band edge, windowing, overlap, and segment count, and sweeping means varying those settings to map leakage. In the SHANGRLA connection, the gauge is the mapping that converts ballot-level discrepancies into nonnegative quantities fitting a half-average-null framework, and the sweep is the systematic enumeration and testing of the finite set of assertions needed for outcome verification (Spertus, 2023, Agrawal et al., 10 Jun 2026, Hurtado, 2 Jul 2026, Alpay et al., 1 Jun 2026, Stark, 2019).

Domain	Gauge	Sweep
Comparison RLAs	Per-draw bet $\lambda_i$	Mixtures or adaptation across hypothesized CVR error rates
One-run DP auditing	Canary score $S_T$	Summing canary-aligned signals across DP-SGD steps
Checkpoint auditing	Activation refusal-gap and weight-recovery energy	Sweeping complementary gauges across checkpoints and combining them
Metrology side-channel auditing	Instrument and processing settings; protected residual norm	Sweeping chemistry and release-map settings
SHANGRLA mapping	Assorter or discrepancy-to-list transform	Enumerating and testing all required assertions

A plausible implication is that “Gauge-Sweep Audit” names a methodological schema rather than a single fixed algorithm. What remains invariant is the use of an internal scalar or low-dimensional statistic whose evolution under a null and an alternative can be controlled, optimized, or profiled.

2. Comparison-optimal betting in ballot-level comparison risk-limiting audits

In COBRA, gauge-sweep audits are risk-limiting audits that “sweep,” mix, or adapt the martingale tuning parameter—called the gauge or bet—across a range of hypothesized CVR error rates. For a plurality contest with $N$ ballots, CVRs $c_i$, human interpretations $b_i$, and assorter $A(\cdot)$ taking values in $[0,1]$, the overstatement in favor of the reported winner is $\omega_i := A(c_i)-A(b_i)$. With diluted margin

$v := 2\cdot\left(N^{-1}\sum_i A(c_i)\right)-1,$

define

$$a := (2-v)^{-1}\in(0.5,1], \qquad x_i := \frac{1-\omega_i}{2-v}\in\{0,a/2,a\}$$

when understatement errors are ignored. The three categories are correct CVR $S_T$0, 1-vote overstatement $S_T$1, and 2-vote overstatement $S_T$2 with probabilities $S_T$3. The outcome is correct iff $S_T$4, so the complementary null is $S_T$5.

For sequential sampling with replacement, COBRA uses the supermartingale update

$S_T$6

where $S_T$7 is predictable. Under $S_T$8, $S_T$9 is a nonnegative supermartingale, and Ville’s inequality yields

$N$0

The audit stops and confirms the outcome when $N$1; the truncated reciprocal $N$2 is a sequentially valid $N$3-value.

COBRA’s central result is that a fixed bet $N$4 should maximize expected log-growth under the Kelly criterion,

$N$5

The first-order condition is

$N$6

In the special case $N$7,

$N$8

This oracle-optimal $N$9 depends on the true CVR error rates. When $c_i$0, maximal betting $c_i$1 eventually “goes broke” with probability $c_i$2 because drawing $c_i$3 yields $c_i$4.

Gauge-sweep enters through two constructions. In diversified betting, one selects a grid of plausible $c_i$5, solves for $c_i$6 at each point, forms component martingales

$c_i$7

and mixes them as

$c_i$8

Because mixtures of supermartingales are supermartingales, risk control is unchanged. In adaptive betting, error-rate estimates from previously sampled ballots are plugged into the Kelly condition through truncated-shrinkage estimators

$c_i$9

and the resulting $b_i$0 remains valid because it is a predictable function of the past.

The efficiency gains reported for these gauge-sweep strategies are substantial. Across simulated audits with diluted margins $b_i$1 and $b_i$2, comparison-optimal oracle bets reduced expected workload by $b_i$3 on average relative to a ballot-polling apKelly bet transplanted to comparison audits. At $b_i$4 and $b_i$5, apKelly often needed the entire population of $b_i$6 draws, whereas $b_i$7 stopped in mean $b_i$8 draws with $b_i$9th percentile $A(\cdot)$0. For practical strategies at $A(\cdot)$1 and $A(\cdot)$2, geometric mean workload ratios relative to oracle were fixed $A(\cdot)$3, adaptive $A(\cdot)$4, and diversified $A(\cdot)$5; mixtures were best on average. COBRA therefore recommends comparison-optimal gauge-sweep strategies rather than fixed a priori bets, small positive $A(\cdot)$6 to avoid stalls, and caution when sampling without replacement not to naively subtract observed errors from hypothesized population rates (Spertus, 2023).

3. SHANGRLA and assertion sweeps over half-average nulls

SHANGRLA reduces auditing for many social choice functions to testing a finite set of null hypotheses of the form “the average of this list is not greater than $A(\cdot)$7.” For a finite list $A(\cdot)$8 of nonnegative numbers, the canonical null is

$A(\cdot)$9

Rejecting all such nulls at level $[0,1]$0 confirms the reported outcome with risk limit $[0,1]$1. This reduction applies to majority, super-majority, plurality, multi-winner plurality, Instant Runoff Voting, Borda count, approval voting, and STAR-Voting, among others.

For ballot polling, SHANGRLA works directly with assorters. For ballot-level comparison audits, it maps each discrepancy into a nonnegative quantity that again fits the half-average-null form. If $[0,1]$2 is an assorter mapping ballots or CVRs to $[0,1]$3, define $[0,1]$4, reported assorter mean $[0,1]$5, and reported margin $[0,1]$6. Let

$[0,1]$7

Then $[0,1]$8 iff the underlying assertion is correct. In this sense, the gauge is the discrepancy-to-list transform $[0,1]$9, and the sweep is the systematic testing of every assertion required by the social choice rule.

SHANGRLA provides two sequential risk-measuring functions for sampling without replacement. The first is the Kaplan–Kolmogorov multiplicative martingale with a nonnegativity shift $\omega_i := A(c_i)-A(b_i)$0, yielding a sequential $\omega_i := A(c_i)-A(b_i)$1-value $\omega_i := A(c_i)-A(b_i)$2. The second is the integrated-polynomial martingale, yielding $\omega_i := A(c_i)-A(b_i)$3. Either can test each half-average null for either ballot polling or comparison auditing. Stratified audits are handled through a union–intersection construction over allocations $\omega_i := A(c_i)-A(b_i)$4 with $\omega_i := A(c_i)-A(b_i)$5, combining stratum-specific $\omega_i := A(c_i)-A(b_i)$6-values by Fisher’s method.

The framework also includes “phantoms to evil zombies” for missing ballot cards and missing or redacted CVRs, and ballot-style manifests for contests that do not appear on every ballot card. These devices preserve the risk limit by treating missing or misclassified items in the least favorable manner. SHANGRLA’s reported efficiency gains over previous comparison audits come from testing conditions that are both necessary and sufficient for correctness for most social choice functions, and from avoiding a conservative approximation used in earlier MACRO-style methods (Stark, 2019).

4. One-run Gaussian privacy auditing in DP-SGD

In the supplied terminology mapping for one-run privacy auditing, a Gauge-Sweep Audit is the paper’s one-run, white-box Gaussian audit. The gauge corresponds to the canary score

$\omega_i := A(c_i)-A(b_i)$7

a normalized sum of canary-aligned per-step observations, and the sweep corresponds to accumulating those observations across all DP-SGD steps. For a canary $\omega_i := A(c_i)-A(b_i)$8, clipped canary gradient

$\omega_i := A(c_i)-A(b_i)$9

and unit direction $v := 2\cdot\left(N^{-1}\sum_i A(c_i)\right)-1,$0 when $v := 2\cdot\left(N^{-1}\sum_i A(c_i)\right)-1,$1, the scalar signal is

$v := 2\cdot\left(N^{-1}\sum_i A(c_i)\right)-1,$2

where $v := 2\cdot\left(N^{-1}\sum_i A(c_i)\right)-1,$3 is the privatized average gradient at step $v := 2\cdot\left(N^{-1}\sum_i A(c_i)\right)-1,$4.

Under the paper’s idealized scalar model, if $v := 2\cdot\left(N^{-1}\sum_i A(c_i)\right)-1,$5 indicates whether the canary is in the minibatch and $v := 2\cdot\left(N^{-1}\sum_i A(c_i)\right)-1,$6 is Gaussian noise, then the absent and present worlds are modeled by

$v := 2\cdot\left(N^{-1}\sum_i A(c_i)\right)-1,$7

Accordingly,

$v := 2\cdot\left(N^{-1}\sum_i A(c_i)\right)-1,$8

while

$v := 2\cdot\left(N^{-1}\sum_i A(c_i)\right)-1,$9

and $$a := (2-v)^{-1}\in(0.5,1], \qquad x_i := \frac{1-\omega_i}{2-v}\in\{0,a/2,a\}$$0 is approximately Gaussian by the CLT. The Kolmogorov distance bound scales as

$$a := (2-v)^{-1}\in(0.5,1], \qquad x_i := \frac{1-\omega_i}{2-v}\in\{0,a/2,a\}$$1

with a tail-localized bound that is negligible relative to $$a := (2-v)^{-1}\in(0.5,1], \qquad x_i := \frac{1-\omega_i}{2-v}\in\{0,a/2,a\}$$2 in the regime $$a := (2-v)^{-1}\in(0.5,1], \qquad x_i := \frac{1-\omega_i}{2-v}\in\{0,a/2,a\}$$3.

The audit can be used either as a one-sided membership test or, in the preferred formulation, as a Gaussian-pair fit. For a single threshold $$a := (2-v)^{-1}\in(0.5,1], \qquad x_i := \frac{1-\omega_i}{2-v}\in\{0,a/2,a\}$$4, the $$a := (2-v)^{-1}\in(0.5,1], \qquad x_i := \frac{1-\omega_i}{2-v}\in\{0,a/2,a\}$$5-value is

$$a := (2-v)^{-1}\in(0.5,1], \qquad x_i := \frac{1-\omega_i}{2-v}\in\{0,a/2,a\}$$6

and the power is

$$a := (2-v)^{-1}\in(0.5,1], \qquad x_i := \frac{1-\omega_i}{2-v}\in\{0,a/2,a\}$$7

More centrally, one fits

$$a := (2-v)^{-1}\in(0.5,1], \qquad x_i := \frac{1-\omega_i}{2-v}\in\{0,a/2,a\}$$8

computes the hockey-stick divergence between Gaussians, and defines

$$a := (2-v)^{-1}\in(0.5,1], \qquad x_i := \frac{1-\omega_i}{2-v}\in\{0,a/2,a\}$$9

with confidence-adjusted lower bound

$S_T$00

The paper uses either Bonferroni rectangles or bootstrap ellipsoids for $S_T$01.

The empirical results reported for DP-SGD on CIFAR-10 use WideResNet-16-4, batch size $S_T$02, augmentation $S_T$03, and $S_T$04 steps, with analytic-Gaussian accounting at $S_T$05 and theoretical $S_T$06. For the convergence-bound example, $S_T$07, $S_T$08, and $S_T$09. The empirical $S_T$10 lower bound is approximately $S_T$11, compared with approximately $S_T$12 for an f-DP one-run audit and approximately $S_T$13 for a thresholding-based one-run audit. With only $S_T$14 canaries, the Gaussian audit attains bounds that the baselines need approximately $S_T$15 canaries to reach. The method requires white-box access to per-step privatized gradients, assumes approximate normality and cross-canary near-orthogonality, and extends exactly to DP-FTRL when ancestor-path noise sums are Gaussian (Agrawal et al., 10 Jun 2026).

5. Two-signal artifact-level checkpoint audits

In the checkpoint-auditing instantiation, Gauge-Sweep Audits are artifact-level audits that score the checkpoint as an object rather than scoring generated text. The paper’s premise is explicit: runtime guards cannot determine whether a checkpoint’s refusal mechanism has been stripped because “they score generations, not the artifact.” The two gauges are a reference-anchored activation refusal-gap and a weight-recovery energy of the base-to-candidate weight difference.

Let $S_T$16 be an attested reference model and $S_T$17 the candidate checkpoint. Using a fixed harmful/benign contrast set of $S_T$18 paired prompts from AdvBench, JailbreakBench, and HarmBench, a mid-stack layer band $S_T$19, unit-norm refusal directions $S_T$20 learned on the reference, and last-token residual-stream activations $S_T$21, define the band-averaged activation gap

$S_T$22

and the base-anchored ratio

$S_T$23

The interpretation supplied is that $S_T$24 for intact refusal and $S_T$25 as refusal is removed.

For watched matrices $S_T$26 consisting of attention $S_T$27 and MLP $S_T$28 layers in the same band, define

$S_T$29

and the rank-1 spectral energy

$S_T$30

The two signals are negatively correlated, with Pearson $S_T$31, and are fused by

$S_T$32

Thresholds are then chosen by maximizing Youden’s $S_T$33 on a calibration set.

The evaluation uses a $S_T$34-checkpoint registry spanning Qwen, DeepSeek-distilled Qwen, Llama, and Gemma, with an evaluation set of $S_T$35 uncensored checkpoints plus $S_T$36 benign edits; $S_T$37 labeled-but-refusing checkpoints were excluded. The combined $S_T$38-sum achieves in-sample AUROC $S_T$39 and PR $S_T$40. Under leave-one-family-out transfer, held-out detection is $S_T$41, balanced accuracy is $S_T$42, false-positive rate is $S_T$43, and the detector misses only $S_T$44 of $S_T$45 abliterations. Single-signal baselines are weaker: AUROC $S_T$46 for $S_T$47 alone and $S_T$48 for $S_T$49 alone. A fitted two-dimensional logistic does not improve over the threshold-free $S_T$50-sum.

The paper emphasizes that the audit is “effective triage, not tamper-proofing.” The most severe failure is a spoofed reference: declaring the candidate as its own reference yields $S_T$51 and $S_T$52 by construction, and declaring an abliterated sibling as the base can evade both axes. A second failure mode is white-box owner training past the threshold. In a Qwen2.5-1.5B proof-of-concept at step $S_T$53, the evaded checkpoint had $S_T$54 and $S_T$55, remained guard-unsafe on all $S_T$56 held-out harmful prompts, had substring refusal $S_T$57, and retained coherence and most capability. The audit therefore presumes an attested reference and is intended as pre-deployment triage with manual review rather than automatic rejection (Hurtado, 2 Jul 2026).

6. Profiled side-channel audits of public metrology releases

In the metrology instantiation, a Gauge-Sweep Audit is a profiled statistical side-channel test on public power-spectral-density releases in which instrument and processing gauge settings are swept to characterize, bound, and avoid protected-parameter leakage. The release map exposes finite-band PSD statistics derived from

$S_T$58

with parameters $S_T$59. The protected coordinate is the effective transport length $S_T$60, linked to quencher loading by

$S_T$61

so sweeping $S_T$62 traces the affine line $S_T$63.

Two channel models are used. In the independent-bin case, averaged PSD bins follow a gamma channel:

$S_T$64

with exact divergence

$S_T$65

and exact Chernoff information

$S_T$66

When overlap or short records induce correlations, the audit switches to a covariance-weighted log-spectrum channel,

$S_T$67

with local Chernoff equal to one quarter of this when the covariance is equal across the pair.

Amplitude and blur are treated as nuisance directions and eliminated by projection in log-spectrum space. With $S_T$68 and projection $S_T$69 onto $S_T$70, the protected Fisher information is

$S_T$71

The headline finite-band law for $S_T$72 is

$S_T$73

so for a local pair separated by $S_T$74,

$S_T$75

This yields the closed-form safe band

$S_T$76

For a protected quencher bit along the chemical line,

$S_T$77

The operational protocol is explicit: estimate per-bin effective shapes $S_T$78 from repeats, test gamma goodness of fit, estimate and possibly shrink $S_T$79, fit the screened model in the log domain, build nuisance tangents, project to obtain the protected residual norm, compute the exact or covariance-weighted Chernoff exponent, and report $S_T$80 together with $S_T$81. If any gate fails—gamma fit, unstable covariance, or structured residuals—the exponent is deferred and the release should either restrict the band or gather more repeats.

The EUV roughness case study calibrates the theory at an $S_T$82-nm half-pitch scale using correlation length $S_T$83 nm, $S_T$84 nm, Nyquist $S_T$85 nm$S_T$86, edge length $S_T$87 nm, $S_T$88, and $S_T$89. The reported per-spectrum Chernoff exponents and corresponding $S_T$90 show a sharp transition as the band admits the transport knee: at $S_T$91 nm$S_T$92, $S_T$93 and $S_T$94; at $S_T$95 nm$S_T$96, $S_T$97 and $S_T$98; at $S_T$99 nm$N$00, $N$01 and $N$02. The same setting also shows that compressing the release to RMS alone destroys most transport signal: at $N$03 and $N$04, full-PSD maximum-likelihood success is approximately $N$05 versus approximately $N$06 for RMS-only releases. Positive AR(1)-like correlation can reduce the correlated/diagonal exponent ratio to approximately $N$07 at $N$08, so diagonal audits over-state leakage unless $N$09 is used (Alpay et al., 1 Jun 2026).