--- title: Hidden-Anchor Audit Overview url: https://www.emergentmind.com/topics/hidden-anchor-audit type: topic --- # Hidden-Anchor Audit Overview In current research, “Hidden-Anchor Audit” does not denote a single standardized procedure. The term is used for audits based on explanation anchors in classifiers, fixed human-scored anchor sets in sequential LLM evaluation, robust cores in defeasible explanations, latent internal beliefs in multi-agent deliberation, external untreated-outcome references in meta-analysis, auditor-only linkability tags in blockchains, and privately observed anchors in strategic communication [2206.04740] [2606.15474] [2606.19401] [2606.19494] [2607.04327] [2510.12153] [2605.24730]. This suggests a common structure: an audit is made possible by an anchor that remains stable enough to constrain inference even when the full mechanism, state, identity, or causal pathway is hidden. ## 1. Anchor semantics across domains The literature uses “anchor” in several technically distinct senses. In explanation-based auditing, an anchor is a local region around an input. In sequential monitoring, it is a fixed human-labeled reference set. In defeasible explanation systems, it is a subset-minimal sufficient reason. In deliberation models, it is a latent internal belief. In evidence synthesis, it is an external untreated-outcome distribution. In cross-chain auditing, it is a hidden master identity bound to a linkable tag [2206.04740] [2606.15474] [2606.19401] [2606.19494] [2607.04327] [2510.12153]. | Setting | Anchor object | Audit question | |---|---|---| | Explanation-based auditing | hyper-rectangle \(A_x\) with precision \(\tau\) and coverage \(c\) | feature sensitivity of linear classifiers or decision trees | | LLM evaluation pipelines | fixed anchor set \(A=\{a_1,\dots,a_k\}\) with frozen human scores | whether drift is in the system or in the judge | | Defeasible explanations | robust core \(X\subseteq t\) | whether later disclosure can overturn a prediction | | Multi-agent deliberation | latent anchor \(\mathbf{b}_i\) with strength \(\beta_i\) | whether trajectories are anchor-driven rather than open-loop | | Evidence synthesis | external untreated-outcome reference \((\mu_C,\sigma_C^2)\) | what effect holds in the target population | | Cross-chain auditing | Linkable Audit Tag and \(CT_{\text{link}}\) | whether anonymous tags originate from the same master identity | This diversity matters because the audit target changes with the anchor semantics. Some anchors are returned by the audited system itself, as in explanation oracles. Some are frozen before monitoring begins, as in hidden-anchor judge audits. Some are recovered only indirectly by system identification or posterior inversion. A plausible implication is that “Hidden-Anchor Audit” is best treated as a family resemblance across audit designs rather than a single method. ## 2. Explanations, sufficient reasons, and robust cores In the formal auditing framework of XAudit, the interaction protocol is sequential: at each round \(t=1,2,\dots\), the auditor chooses \(x_t\in\mathbb{R}^d\) and asks the Data Scientist for \((y_t,e_t)\), the Data Scientist returns \(y_t=\bar h(x_t)\) and explanation \(e_t\), and the auditor may stop and output Yes/No or continue [2206.04740]. A score \(s:\mathcal H\to[0,1]\) is *testable* if \(h_1(x)=h_2(x)\ \forall x\Rightarrow s(h_1)=s(h_2)\). An auditor is an \((\epsilon,\delta)\)-auditor for \((\mathcal H,s)\) if, for every \(h\in\mathcal H\), \(s(h)>\epsilon\) implies \(\Pr[\text{Auditor says Yes}]\ge 1-\delta\), while \(s(h)=0\) implies \(\Pr[\text{Auditor says No}]=1\). Query complexity \(T\) is the worst-case number of queries before stopping. For linear classifiers, Anchor explanations, following Ribeiro et al. (2018), are hyper-rectangles \(A_x\subset\mathbb{R}^d\) containing \(x\) such that \[ \Pr_{x'\sim D}[h(x')=h(x)\mid x'\in A_x]\ge \tau, \] with coverage \(c=\Pr_{x'\sim D}[x'\in A_x]\). XAudit shows a sharp worst-case limitation: an anchor \(A_x\) may lie on the ray \(\{\lambda x:\lambda>0\}\), and then the version-space after seeing \(A_x\) is identical to that after seeing just the label. Correspondingly, for homogeneous linear classifiers \(\mathcal H_{LC}\subset\mathbb{R}^d\), there exists \(c>0\) such that the anchor-based auditor \(\mathrm{Alg}_{LC_a}\) is an \((\epsilon,0)\)-auditor with \[ T=O\bigl(d\cdot \log(2c/\epsilon)\bigr), \] which matches the active-learning bound \(O(d\log(1/\epsilon))\) without explanations in the worst case. The same paper nevertheless reports that counterfactual explanations are extremely helpful, with \(T=1\) for \(\mathrm{Alg}_{LC_c}\), because they immediately reveal the normal vector parallel to \(w\). It also reports that anchor augmentation with typical anchors on Adult Income reduced query count by \(\sim 50\%\), for example \(100\to 50\) queries for the same weight-error versus worst-case anchors; for decision trees on Adult, depth \(=9\), average queries were \(\approx 11\) versus \(V=188\) nodes, while a random-pair baseline needed \(\approx 248\) pairs. The same paper gives an explicit anchor-augmented auditor for linear classifiers. Each round uses one real query plus \(s\) free synthetic queries sampled uniformly from the returned anchor \(A_x\), updates a version-space ellipsoid through \(\mathrm{EllipsoidFit}\), and stops when the estimated weight of the feature of interest is below \(\epsilon/(2c)\). The practical recipe is correspondingly concrete: choose a modest augmentation size \(s\) in \(5\)–\(30\), request \(\mathrm{Anchor}(A_x)\) with high precision \(\tau\ge 0.9\), sample \(s\) points from \(A_x\) to label for free, track a version-space ellipsoid or simpler convex set, and verify truthfulness by resampling or, in high-stakes settings, by cryptographic techniques such as zero-knowledge proofs. A different but related use of anchors appears in disclosure-robust defeasible explanations, where a record \(t\subseteq H\) accumulates Boolean evidence atoms field by field, and a defeasible classifier \(A:2^H\to\{0,1\}\) need not be monotone [2606.19401]. A subset \(k\subseteq t\) is a sufficient reason for \(A(t)=1\) if for every \(s\) with \(k\subseteq s\subseteq t\), \(A(s)=1\); a subset-minimal sufficient reason is also called an anchor. The classifier can be compiled into an anchored pair \((K,D)\) of entry anchors and exit defeaters: \[ A_{K,D}(t)=1 \iff \exists k\in K:\ k\subseteq t\ \wedge\ \neg\exists d\in D:\ (k\subset d\subset t). \] For a record \(t\) with \(A(t)=c\), a robust core is a subset \(X\subseteq t\) such that \(\forall s\) with \(X\subseteq s\subseteq t\), \(A(s)=c\). Its minimum size is the robustness radius \[ \sigma(t)=\min\{|X|:X\subseteq t\text{ and }X\text{ is a robust core}\}. \] The computational landscape is unusually explicit. Once \((K,D)\) is explicit, prediction and standing anchors are read by polynomial-time scans, and a reason’s defeater frontier is obtained by filtering and subset-minimizing defeaters above it. But the core audit problems are harder: \(\mathrm{VERIFY\text{-}CORE}_0\) is in \(P\), \(\mathrm{MIN\text{-}CORE}_0\) is NP-complete, \(\mathrm{VERIFY\text{-}CORE}_1\) is coNP-complete, and \(\mathrm{MIN\text{-}CORE}_1\) is \(\Sigma_2^p\)-complete. On audited cubes from depth-6 decision trees over Breast-cancer, Adult-income, and German credit, however, the governing parameters remain small: the median \(\sigma(t)\) stays in \(\{2,3,4\}\), the worst-case \(\sigma_{\max}(t)\le 0.67\cdot k\), greedy hitting-set solves the core exactly on \(98\)–\(100\%\) of records, and the FPT parameter \(m=|B_t|\) remains in the single digits with \(m\le 10\). This contrast between worst-case hardness and small audited parameters recurs in several hidden-anchor settings. ## 3. Frozen anchor sets and anytime-valid attribution A particularly explicit hidden-anchor audit appears in continuous LLM evaluation pipelines, where a strong LLM judge is treated as ground truth but may itself drift through a silent version bump or scoring-prompt update [2606.15474]. The proposed resolution is a fixed, human-labeled anchor set \[ A=\{a_1,\dots,a_k\} \] drawn before monitoring begins, together with immutable human scores \(h(a_i)\in[0,1]^R\) on each rubric. These anchors are never used for the main monitor’s calibration or sampling. During deployment, one anchor is re-scored every \(\rho\) positions of the live stream, so anchors appear at rate \(1/\rho\) of the time. The anchor process monitors the judge-versus-human gap. For each anchor re-score it computes the rescaled gap \[ g_i[r]=\mathrm{clip}\Bigl(\frac{y_i(a)-h(a)+1}{2},0,1\Bigr)\in[0,1] \] and compares it to the time-0 baseline \[ q[r]=\frac1k\sum_{a\in A}\frac{y_0(a)-h(a)+1}{2}. \] For each rubric \(r\) and direction \(d\in\{\text{below},\text{above}\}\), it runs a betting e-process with one-step e-value \[ e_i=1+\lambda_i\,s_d\bigl(q[r]-g_i[r]\bigr), \] where \(\lambda_i\) is chosen predictably, and cumulative wealth \[ W_n^{(r,d)}=\prod_{i\le n} e_i. \] An anchor alarm is raised when \[ \max_{r,d}W_n^{(r,d)}\ge \frac{2R}{\alpha}. \] In parallel, a main-process e-detector produces a first system alarm time \(\tau_{\text{sys}}\), the anchor process produces \(\tau_{\text{anc}}\), and a guard-window rule with width \(W\) returns one of \(\{\text{none},\text{system},\text{judge}\}\). If the anchor process fires first, or within \(W\) items of the main fire, the verdict is judge; if the main process fires more than \(W\) items before any anchor alarm, the verdict is system. The theoretical guarantees are unusually strong. Each anchor cell’s wealth is a nonnegative supermartingale started at \(1\) under \(H_0^{\text{anc}}\), and Bonferroni correction over the \(2R\) rubric-direction pairs gives family-wise false-alarm control at \(\alpha\) under continuous monitoring and data-dependent stopping. One-way identification follows because system drift cannot move the anchor gaps: under pure system drift the probability of a judge verdict is \(\le \alpha\) regardless of \(W\), and under no drift at all a union bound over both families gives \(P(\text{verdict}\neq \text{none})\le 2\alpha\). The design law is that the anchors must out-run the main process they guard, and the two processes are completely orthogonal because anchor re-judgments never enter the main PPI streams and main-stream acquisitions never enter the anchor statistics. The experiments instantiate these guarantees on HelpSteer2 and TL;DR summarization with no retuning between domains. A featured configuration uses main-process fixed strong-sampling rate \(\tau=0.3\), anchors \(k=200\), interleave rate \(1/5\), and guard width \(W=300\). This runs at cost-fraction \(\approx 0.64\times\) full strong-evaluation, or at \(\approx 0.21\times\) in a cheaper regime with escalation and rate-20 anchors. On HelpSteer2, a silent version bump is detected as judge drift in \(60/60\) runs with zero judge-to-system misattributions and median anchor latency \(\approx 498\). A strict-prompt change is correctly attributed on \(110\) of \(120\) runs at \(W=300\), with spill dropping \(29\to 10\) out of \(120\) as \(W=50\to 300\). Replication on TL;DR yields perfect attribution \(240/240\) at \(W=300\) because the larger strict-prompt shift makes anchor alarms faster, median \(205\) versus \(370\). On the same anchor stream, the naive rolling z-test false-alarms on \(75\%\) of no-drift streams on HelpSteer2 and \(67\%\) on TL;DR, while the anytime-valid anchor e-process holds false-alarm at approximately \(3\%\) with no calibration. ## 4. Hidden operations, hidden behaviors, and generation-side audits in LLM systems In commercial opaque LLM services, the hidden object is not an explanation or a reference set but the service’s internal operation count and quality level [2505.18471]. Commercial Opaque LLM Services expose only a final answer while hiding multi-step reasoning, agent-to-agent messages, and tool invocations. The formal risks are **quantity inflation**, where \(\hat T_Q>T_Q\) or \(\hat C_Q>C_Q\), and **quality downgrade**, where \(\check T_q