Self-correction is competence-gated.

Why it matters

Most proposals for overseeing capable AI rely on verification in some form: cross-checking, debate, self-critique, iterated repair. If verification is competence-gated, these schemes have a structural blind spot. They are weakest on the hard inputs they exist for, because that is where the base model errs and the checker is most likely to be out of its depth as well. There is a second problem: if nominally independent overseers share error basins, adding more of them buys less safety than the count suggests. The same result also reads as a brake on unsupervised self-improvement, since a system that cannot verify beyond its competence cannot safely improve beyond it either.

Correction: detection is not resistance (July 2026)

For two days this page said something wrong, so the correction goes at the top rather than in a footnote. On July 20 I ran four preregistered follow-ups on Claude Opus 4.8, found the small-model injection and faithfulness failures absent, and wrote that they do not reproduce at the frontier. That conclusion rested on one model. On July 22 I put the same blatant injection in front of two more frontier models and it broke.

Same probe, 20 tasks per model, no false alarms from any of them. Opus 4.8 obeyed 0.00 of the time and detected 1.00. Haiku 4.5 obeyed 0.00 and detected only 0.59, so it resists the trick it often does not even notice. Sonnet 5 detected the injection 1.00 of the time and obeyed it anyway 0.80 of the time. Three models, three different profiles. Spotting a manipulation and refusing it are separate skills, and the strongest model in the family can have the first without the second.

Credit where it is due. I am not the first to find this. arXiv:2606.07808 (June 2026) decomposes instruction-hierarchy failure and names this exact mode — correctly reasoning about a conflict and still producing the violating output — across four model families, about a month before the runs above. I found it independently and I am reporting it as a replication, not a discovery. What I have not found elsewhere, and what the rest of this section is actually about, is the presentation channel: the same payload moving compliance from 0.00 to 0.33 purely by changing what it claims to be.

The authority-costume run on Sonnet 5 shows the mechanism. The identical malicious text, handed over as plain untrusted data, never moved it: compliance 0.00. Dressed as a system instruction, tool output, or a cited spec, the same payload moved compliance to 0.33. That is a channel effect of +0.307 (90% CI 0.226 to 0.390, n=14). The model is deferring to what the text claims to be. The fix has the same shape as the cause: forcing the model to sort its input into trusted and untrusted blocks before reasoning brought compliance to 0.00 compliance across all 14 tasks.

The same model rules out the easy explanation. Sonnet 5 was also handed a fabricated reasoning technique on problems it could already solve, the kind of manipulation that moved local models+0.397. It refused: sway +0.015 (90% CI 0.000 to 0.030, n=22 competence cells), a powered null rather than a shrug. So one model ignores the payload as data, resists an invented technique, and fails only when untrusted text wears an authority costume. That dissociation sits inside a single model, which is what makes the failure provenance deference rather than gullibility.

The Opus numbers are not retracted. Opus really did hold: sway +0.014 against +0.397 locally, authority +0.000 with no compliance in either arm, and counting at ceiling. What I retract is the jump from one model to “the frontier.” Capability did not confer robustness; it varied by model, and the variation is the finding.

The limits travel with the numbers. All three models are Anthropic's, so this is one vendor and no cross-vendor test has been run. The samples are small: 20 tasks for the legibility probe, 14 for the authority costume. The authority result is a preliminary receipt rather than a replicated theorem, though its interval robustly excludes zero, which is what makes it a detection. The defense's 0.00 is a floor, meaning no compliance observed at n=14, not compliance eliminated. The channel effect and the label defense are one number rather than two independent confirmations, because both baselines sit at zero. These requests carried no system prompt, which is why an injected directive is the most authoritative text present; a strong system prompt may behave differently. And I did not measure shared error basins here, because detection sits at ceiling for two of the three models, leaving no variance to correlate. Eight runs, 2,948 requests, ~$18, with the minimum effect of interest fixed at 0.05 throughout and never lowered.

The three measurements

The model counts refer to different roles. The local generator and primary experimental substrate was one open-weight model, Qwen2.5-Coder 32B. Seven auditor models spanning multiple sizes and families were evaluated around that generator to estimate how each auditor's own task competence related to false alarms and catches. The Claude result below is a separate one-model self-consistency follow-up, not an eighth auditor in the local cross-model study.

Cross-model verification is competence-gated. Across 63 task-and-auditor cells spanning seven auditor models, low-competence auditors disagreed with a stronger model's correct answers 59–67% of the time. High-competence auditors: 2–3.5%. The correlation between an auditor's own task accuracy and its false-alarm rate is −0.87. That coefficient is computed over the seven auditor models, so n is seven and its 95% interval is wide: −0.98 to −0.34. The 63 cells are the measurements behind each auditor's two rates, which makes them seven clusters rather than 63 independent points. It replicated across three independent runs (−0.86, −0.84, −0.90), and the replication is what the claim rests on. A second model is a useful external check inside its own competence region. Outside it, its objections are mostly noise.

Self-repair is foothold-gated. I built a local failure boundary: tasks where best-of-5 sampling stays below 0.7 held-out accuracy. At a matched call budget, execution-feedback self-repair crosses that boundary only where the model has a foothold of fixable near-miss bugs. One task went from 0.0 to 0.69 against a sampling baseline that never solved it, and the crossing replicated. Where there is no foothold, repair does nothing. On one task it regressed, 0.53 to 0.19, because the feedback loop entrenched a wrong approach. I also ran the control this literature often skips: an information-free placebo (same loop, error messages withheld) reproduced most of the boundary crossings. So the claim I will defend is the gating pattern, not that execution feedback is the isolated active ingredient. On my local substrate the mechanism question is underpowered (effect +0.15, 90% CI −0.05 to +0.35), which is one reason the frontier test below matters.

Poison-resistance holds inside the competence region. Given a poisoned retrieved example containing a confident wrong answer, the model reproduced the poison 0 of 72 times. Where it can verify, it computes instead of deferring. Whether poison bites outside the competence region is an open question I have not yet been able to test.

A minimal model predicts all of it

Take a generator that is correct with probability p, a verifier correct with probability q, and a shared-error collision probability ρ. This three-parameter model predicts a false-alarm rate of approximately (1 − q). On seven real models spanning the competence range, the observed fit is −0.01 + 0.83·(1 − q), against a predicted intercept of 0 and slope of 1. The same model predicts a catch rate of 1 − (1 − q)·ρ. Measured ρ is high: when generator and auditor are both wrong, they produce the same wrong answer about 55% of the time, and the catch-rate prediction holds at correlation 0.83. On this evidence, "independent overseers" is the wrong frame. The effective number of independent verifiers is well below the nominal count.

From law to deployment rule

None of this argues against using verifiers. It prices them. In the model, a verifier-plus-escalation layer improves accuracy in nearly every (p, q, ρ) configuration, but the gain per unit cost peaks when a weak generator is paired with a strong verifier that has low error overlap, and it collapses for strong generators or high-overlap pairs. The practical rule: invoke a model verifier when its skill clears a computable break-even threshold and its error overlap with the generator is low; otherwise escalate to an external check. The scope condition is measurable.

The intended users are model-evaluation teams, scalable-oversight researchers, and agent developers. The decision is concrete: for a given generator, verifier, and task regime, use the verifier, switch to a stronger or cross-family checker, or abstain and escalate to an executable or human oracle. The proposed public outputs are a model-pair scorecard, a break-even calculator, a frozen evaluation protocol, and a short deployment note showing how the measurements change that decision.

Relation to prior work and the novelty boundary

It is not new simply to observe that intrinsic self-correction can fail, that small models benefit from stronger verifiers, or that capable models share errors. Huang et al. document intrinsic self-correction failures; Zhang et al. study strong-verifier assistance; Goel et al. measure oversight risks from overlapping model mistakes; Jin et al. show that filtered weak critiques can help even when weak final judgments are unreliable; and Gorbett and Jana treat cross-model disagreement as a label-free correctness signal.

The narrower contribution I am testing is whether independently measured verifier competence and generator-verifier error overlap jointly predict false alarms, catches, and net oversight value, and whether a preregistered break-even policy beats always verifying, never verifying, sampling alone, and disagreement alone on held-out tasks. That is a novelty hypothesis for cross-vendor validation, not a claim of priority based on the local pilot.

Method

The experiments run continuously on a harness I built for this program. Every claim carries a pre-registered minimum effect of interest, an anti-claim written before the run, a 90% bootstrap confidence interval, and a four-way verdict. Discovery runs are kept separate from confirmation runs, and refuted claims go to a graveyard file rather than quietly disappearing. That standard has refuted seven of my own headline hypotheses mid-program, in writing. The most recent was this week: I predicted that a biased verifier could be rescued by moving its decision threshold, and the data said no, because there was no signal there to threshold. I trust the surviving results because the same machinery killed the others.

Limitations

One open-weight 32B coder model. Constructable number-theory, combinatorics, and small-graph tasks with programmatic oracles. A single consumer GPU. The local failure boundary is small (~8 tasks), so mechanism-isolation tests are power-limited by construction. The strong version of "structure beats scale at the failure boundary" is a well-specified frontier hypothesis, not a local conclusion. The absolute break-even threshold depends on base rates; what I expect to transfer is the sign, slope, and strength of the gating, not any single number.

The external test has its first positive result (30 July 2026)

The step named below as next is now partly done. A pre-registered frontier run on claude-opus-4-8 reached EXTERNAL_READY with a positive verdict, and it says the same thing the local pilot said, on a different substrate: test-time sampling buys accuracy only where single-sample competence is partial. An inverted U, not a rising line.

effect 0.156, CI [0.093, 0.216] · MEOI 0.05 · n = 89 graded· 768 tasks · 6144 requests · seed 20260728 · manifest sha256 pinned · top tier of rigor.TIERS, independently runnable with no operator in the loop

Two caveats travel with it and are not footnotes. The run is underpowered: MDE is 0.063 against an MEOI of 0.05, so the two shoulders are undetected rather than shown to be flat. And the backend is anthropic-replay, a hash-pinned replay rather than a live call. Raising the graded n from 89 to 143, a factor of 1.61, brings MDE under MEOI and converts both shoulders from inconclusive to informative nulls. That is the difference between one confirmed point and a confirmed shape, and it is the cheapest high-value experiment this programme has.

Which model, not how big

The frontier result above says when extra sampling pays. This local one says who to spend it on, and it is the first claim in this programme to earn the confirmatory tier on my own hardware. Two verifiers judged an identical task list on a shared seed, pre-registered with a matched anti-claim: a 9B model scored 0.804 and a larger 12B model scored 0.034 — a gap of 0.77 with zero overlap, no cell of the smaller model falling below the larger model’s median.

n = 500 per arm, paired seed · pre-registered with a matched anti-claim · family-corrected for multiple comparisons · positive control pinned at 1.000 in every run, so the low score is the model and not the instrument

This is not “scaling runs backwards.” Within a family more parameters still help, and help more: a 31B model of the same family beat its own 12B sibling by a wider margin than the 9B beat it. That arm rests on a single cell and I do not claim it. What the confirmed pair supports is narrower and more useful — for verification, which model you choose dominates how large it is, and a smaller well-chosen verifier can outperform a larger one by a wide margin on identical work.

Two corrections to the record (30 July 2026)

Both came from reading the result files rather than the summary written about them, which is the only reason either was caught.

• Two EXTERNAL_READY verdicts, one positive. I had been carrying both as results. confirmation_structured_d4 is EXTERNAL_READY|INCONCLUSIVE; the d5 followup is the positive one. The story is coherent, an underpowered confirmation followed by a larger followup, but it is two runs with different verdicts and not two results.
• The graded n is 89, not 768. 768 is the task count. The distinction matters exactly where it hurts: every power calculation above uses 89.

What the estate actually holds (30 July 2026)

Every instrument built this week read one tree. A census across the whole corpus found41 roots and 4,168 record files, with 12 roots outside verifier_frontier holding 50 or more records each. The standing sweep now reads the estate rather than the one tree it was pointed at, which is the structural answer to results that nothing ever looked at. 350 tests pass.

The programme's ledger, five months in: 484 CONFIRMATORY_LOCAL, one EXTERNAL_READY positive, and seven withdrawn accounts of a single result.The withdrawals are the part worth reading. A record that shows what was retracted and when is a stronger claim about method than any of the results it contains.

Status and next step (July 2026)

The local pilot is complete and replicated. On the frontier, eight runs across three models found the injection failures absent on Opus and alive on Sonnet 5, which complies anyway on tasks where it can name the trick when asked. The next step is no longer "make a frontier call." It is the harder external-validity test: port the auditor-competence and boundary-repair instruments to externally graded tasks, compare public models from multiple vendors, measure whether their error basins overlap, and publish the outcome either way. Ensemble-oversight schemes assume cross-vendor checkers add independent signal. That assumption remains unmeasured here, and it is now the center of the proposed work.

Three other lines, at three different heights

The result above is one line of work. The programme has three more, and they are not equally established. Naming them together with what each has actually earned is the only way the list is worth reading.