When AI edits a long document, is it easier to notice text that vanished or text quietly rewritten?
Can detection mechanisms like diff review catch corruption better than deletion?
This explores whether review-style checks, like reading a diff of what changed, are better at spotting quiet corruption of a document than at spotting content being deleted.
This explores whether review-style checks, like reading a diff of what changed, are better at spotting quiet corruption of a document than at spotting content being deleted. The corpus points the other way. Deletion is the easier failure to catch, and nothing here shows diff review closing that gap for corruption.
The clearest evidence is a long-document benchmark called DELEGATE-52. Weaker models tend to degrade documents by visibly dropping content. Frontier models degrade them by corrupting content while the document still looks intact Does model capability change how documents degrade?. The corruption is large. The strongest models altered about 25% of document content over long relay workflows, and the errors stayed undetected in spot-checked outputs Do frontier LLMs silently corrupt documents in long workflows?. As models improve, their failures become harder to see, not rarer.
That is the problem for a diff. A deletion shows up as a gap. Corruption shows up as a changed line that reads fine, and the reviewer has to know what the right content was to spot it. The detection methods that do work in the corpus check meaning rather than surface. One agentic reviewer spends extra compute checking proofs and experiments line by line. It surfaced flaws at STOC and ICML that had passed human review Can inference scaling help reviewers catch errors humans miss?. Another, a small learned verifier, looks at token-by-token similarity patterns and rejects near-misses that look topically right, which cheaper matching cannot do Can verification separate structural near-misses from topical matches?. Defenses against poisoned retrieval documents work similarly, flagging a statistical signal (similarity abnormally collapsing under token masking) instead of relying on someone reading the text Can we defend RAG systems from corpus poisoning without retraining?.
Two results suggest a diff would show the symptom without lowering the error rate. Better editing tools don't improve reliability, because the mistake happens in the model's judgment about what to change, not in the editing interface Can better tools fix LLM document editing errors?. Checks that look at one step at a time also cannot state constraints that depend on history Can stateless checks ever catch sequence-level constraint violations?. That result is about agent behavior, not documents, but it fits: each edit in a long relay can look plausible while the total damage builds up to a quarter of the content.
The corpus does not test diff review directly. The one paper designed to ask whether added monitoring is worth its cost reports no results in the excerpt Does added monitoring improve protection at acceptable cost?. The best-supported answer is that corruption is harder to detect than deletion, and the detectors that work read meaning rather than surface changes.
Sources 8 notes
DELEGATE-52 shows weaker LLMs degrade documents through visible deletion, while frontier models degrade through subtle corruption that preserves surface integrity. This shift makes frontier failures harder to detect and potentially more dangerous at workflow scale.
Even the strongest models (Gemini 3.1 Pro, Claude 4.6 Opus, GPT 5.4) degrade documents by ~25% over long relay workflows across 52 domains. Degradation decelerates but never plateaus, and errors compound silently, remaining undetected in spot-checked outputs.
PAT, an agentic reviewer using test-time compute to check proofs and experiments line by line, achieves 34% better recall on math errors than zero-shot approaches and surfaced critical flaws at STOC and ICML that passed human review.
A two-stage pipeline—pooled-cosine recall followed by a small Transformer verifier operating on token-token similarity maps—reliably rejects structural near-misses that MaxSim-style late interaction cannot. The verifier succeeds because it operates on full token interaction patterns rather than compressed vectors.
RAGPart and RAGMask provide lightweight, retraining-free defenses that operate at the retrieval layer. RAGPart bounds poisoned-document influence via partitioned retriever learning; RAGMask flags suspicious documents through abnormal similarity collapse under token masking.
Show all 8 sources
DELEGATE-52 shows that agentic tool access fails to improve performance on long-horizon document tasks. The degradation mechanism originates upstream in the model's judgment about what to change, not in editing interface limitations.
Per-action checks are structurally unable to state constraints that depend on prior history. Only stateful monitors tracking composed multi-party behavior can verify the behavioral envelopes that prevent individually permissible actions from collectively violating system-level safety.
The paper designs a controlled comparison of isolated actions, rolling windows, known groups, and prospectively discovered episodes at equal review cost and false-alert workload, but the excerpt provides no empirical results showing whether added monitoring improves protection.
Papers this line draws on 8
The research behind the notes this line reads — ranked by how closely each paper relates.
- LLMs Corrupt Your Documents When You Delegate
- RRSI: Regularized Recursive Self-Improvement of Agent Harnesses
- The Illusion of Diminishing Returns: Measuring Long Horizon Execution in LLMs
- Chain-of-Retrieval Augmented Generation
- Emergent Collusion in Long-Horizon LLM Agent Interaction
- LLMs Get Lost In Multi-Turn Conversation
- Counter-Swarm Doctrine: Containing Coordinated Agent Intrusions
- Monitoring Reasoning Models for Misbehavior and the Risks of Promoting Obfuscation