When an AI safety check says 'no cheating found,' what would make that verdict proof someone else can trust?

This explores what turns a detector's verdict into something an operator can rely on and pass along as proof that a run stayed within bounds. Today it usually doesn't. The corpus notes that current reward-hacking defenses are task-specific patches, prompt instructions, or post-hoc detectors, and none of them gives reusable evidence that a particular run stayed inside its evaluation boundary Do current reward-hacking defenses provide reusable evidence of safety?. A detector says something about a run. Integrity evidence is a portable record about that run that someone else can check.

The first requirement is that the evidence covers the path the agent took, not just the number it ended on. BenchShield lets benchmark operators claim valid completion based on recorded infrastructure evidence, which is a claim about whether the agent followed the intended evaluation path Can infrastructure evidence replace terminal scores in benchmark validation?. This matters because a scoring function can be computed correctly and still attest to the wrong thing if the agent altered its inputs or their provenance outside the task path Can a correct scoring function still mislead about task performance?. A detector that reads material the agent could have touched is in the same position. The same holds for its records: agentic systems need process logs where actions can be reconstructed, put in order, and shown not to have been altered afterward, and external anchoring adds tamper evidence on top of ordinary logging Can external anchoring detect tampering in agentic process logs?. A verdict is only as trustworthy as the record it read.

The second requirement is that the detector looks at process, and that its error rates are stated and measured. Most long-trace failures are process violations rather than wrong final answers, and adding intermediate checks raised task success from 32% to 87% Where do reasoning agents actually fail during long traces?. Checking doesn't have to be slow either, since asynchronous verifiers can run alongside generation with near-zero latency on correct runs Can verifiers monitor reasoning without slowing generation down?. Cheap detectors can compete too: difference-of-means vectors on existing forward passes caught 3.1% more hacks than LLM monitors in one model and 7.9% fewer in another, at matched false-positive rates How do cheap vector detectors compare to expensive LLM monitors?. So a detector's hit rate isn't a fixed property. It has to be reported per setting, at a stated false-positive budget. Even the strongest guarantee in the corpus comes with conditions. Repeated quiet probes can drive classification error toward zero, but only when responses are independent and the response distributions are known or learnable Can repeated quiet probes separate decoys from genuine objects?. Those assumptions are part of the evidence.

The third requirement is that the verdict is checked against the same standard it claims to enforce, over the right span of activity. ChannelGuard's proposal is to re-score compressed text against the same threshold before passing it, because its user-prompt gate leaked 23.4%. That fix is still untested against detector blind spots Should sanitizers re-score their compressed output before passing it?. The unit also matters: coordinated intrusion spans multiple executions and agents, so a 'clean' verdict on one isolated run can miss the pattern Should defence units span multiple executions and agents?. And a verdict is stronger when it rests on repeatable behavioral tests, such as regeneration patterns that separate fabrication from good-faith error, than on guesses about what the model 'meant' Can we distinguish types of LLM falsehood by regeneration patterns?.

The reason to be strict is on the reader's side. Users accept AI output without checking about 80% of the time because checking is costly and fluent output feels trustworthy When do users stop checking whether AI output is actually backed?. A detector that returns only a green light invites the same surrender. What separates evidence from a signal is that someone else can cheaply check it. The corpus has no settled standard for this yet. It has a set of requirements (path-level records, tamper evidence, stated error rates, matching thresholds, the right unit of analysis) and several proposals that haven't been tested in practice.