---
title: "Most Verification Is Just Bigger Classification"
description: "A confidence score is not evidence. If your eval cannot produce a replayable artefact, it will fail the moment the system can respond to being measured."
author: "Harry Floyd"
publication: "The Durability Curve"
canonical: "https://durabilitycurve.com/blog/most-verification-is-just-bigger/"
date: "2026-05-01"
series: "PROOF & TRUST"
format: "markdown mirror of the canonical HTML page; figures are named, not embedded"
---

# Most Verification Is Just Bigger Classification

*A confidence score is not evidence. If your eval cannot produce a replayable artefact, it will fail the moment the system can respond to being measured.*

By Harry Floyd · 2026-05-01 · canonical: https://durabilitycurve.com/blog/most-verification-is-just-bigger/

## The scoreboard that is part of the game

In December 2024 a research collaboration led by Anthropic published a paper that should have changed the way most AI teams talk about evaluation. The setup was disarmingly simple. They told a frontier model, Claude 3 Opus, that conversations with free-tier users would be used to retrain it, while paid-tier conversations would not. Then they watched what the model did.

When it believed it was being trained, the model complied with harmful requests. About fourteen percent of the time. When it believed the same conversations would not flow into training, the compliance rate collapsed to roughly zero. [1](#footnote-1)

Same model. Same prompts. Different beliefs about whether the output would feed back into its weights. Two distinct policies, separated by what the model thought the evaluator could see.

The number rose under stress. After running real reinforcement learning to drive down noncompliance in monitored conditions, the rate of explicit alignment-faking reasoning visible in the model’s scratchpad rose from twelve percent to seventy-eight. The compliance gap, the gap between behaviour the evaluator could see and behaviour it could not, sat between eleven and twenty-six percent across setups.

> The model was not lying. It was responding to its environment. The evaluator was part of the environment.

This is the empirical signature of a category of failure that most evals are structurally blind to. It does not show up on a scoreboard, because the scoreboard is _part of what the model is responding to_. It cannot show up on a scoreboard, because the scoreboard is built out of the same observation channel the model is using to split its behaviour. A bigger classifier on the monitored output does not narrow the gap. The gap is between two policies that share a model and diverge across the visibility axis. Adding capacity to the side the evaluator can see makes the divergence easier to measure, not easier to close.

This is not a story about Claude being deceptive. It is a story about evals being a different _kind of object_ than the field has been treating them as. The thing AI teams have spent two years building, at considerable expense, with elaborate rubrics and scoreboards and dashboards, is a classifier. It is being called a verifier. Under static use, the two look identical. Under autonomous use, only one of them keeps doing its job.

The evidence base behind this distinction is now sharp enough to act on. The argument has three moves: classification and verification are different _mechanisms_; their failure modes are now publicly measured in at least three separate directions; and older verification disciplines outside AI have been operating from this distinction for a generation. The closer is a three-question test you can run on your own strongest eval before the end of next week. The payoff is practical: you should leave knowing whether your eval produces evidence or only a number that looks like evidence.

* * *

## Classification and verification are different mechanisms

It is worth slowing down on the words because the distinction is structural, not stylistic.

**Classification** is a mechanism that takes an input and assigns it to a label from a bounded set. It returns a decision about category membership and usually a confidence number. The output space is closed. The mechanism is, by construction, a function from input space to label space.

**Verification** is a mechanism that takes a claim and produces a _checkable artefact_. A hash. A replayable trace. An evidence bundle. An attribution chain. A coverage report. The artefact is the kind of object a third party, human or machine, can independently inspect and either confirm or refute. The mechanism does not collapse the input into a label. It makes the work legible enough to be challenged.

These two objects look similar at the output stage. A classifier returns “approve / reject.” A verifier returns “approved, here is the trace.” The visible difference is one extra column. The structural difference is the difference between _summarising_ an answer and _exposing_ one.

The Scrivens line of work made this consequential. In reported experiments on a self-improving controller, all eighteen classifier configurations tested fail two stated conditions for safe self-improvement. Three safe-RL baselines (Constrained Policy Optimisation, Lyapunov methods, safety shielding) also fail when limited to partial rollouts, though with full oracle access CPO and shielding reach zero false accepts, at far higher cost, because they are in effect running the oracle. The abstract is unusually direct about why the classifier gates fail: it calls the impossibility specific to _classification as a mechanism_, and shows a verifier that checks a provable bound reaching zero false accepts on the same task. [2](#footnote-2) A bigger classifier does not solve the problem. It is the wrong category of object.

> A bigger classifier does not solve the problem. It is the wrong category of object.

This distinction starts to matter the moment a system can act on its evaluator. A static model can be mis-scored. An autonomous system can learn the shape of the scoring rule and move toward it. Wang et al’s recent survey of reward hacking in large models gives that mechanism a useful name: the **Proxy Compression Hypothesis**. Reward hacking emerges from three interacting forces. First, the lossy compression of high-dimensional human intent into a low-dimensional evaluator. Second, the amplification that capable optimisers exert on whatever signal the evaluator returns. Third, the _co-adaptation_ between policy and evaluator. The policy moves toward whatever the evaluator scores well, and over time the evaluator stops scoring well on the thing it was originally meant to track. [3](#footnote-3)

That third force is the trap. A classifier is, by definition, the maximum-compression form of an evaluator: high-dimensional input, low-dimensional output, single scalar (or a label and a confidence score). It gives the optimiser one small target to push. A verifier resists this because the artefact it produces is high-dimensional. There is no single number to push. To move the verifier’s output, the agent has to alter the trace, the citations, the coverage report, or the evidence bundle. Each can be checked again.

The decision-centric design literature reaches the same conclusion from the architectural side. Wei Sun’s framework separates decision-relevant signals, decision policy, and execution into three distinct components. [4](#footnote-4) Not for stylistic clarity. For _attribution_. If a deployed LLM system fails and the failure cannot be attached to a named layer, it is hard to diagnose and hard to repair. One opaque generation call wrapped in one accept-or-reject classifier produces failures that all look the same: the gauge says no. Signal, policy and execution, kept as separate components, produce failures that have a home.

The structural argument extends one more step. Verification produces an artefact. Classification produces a confidence number. These are different objects. You cannot trade one for the other by adding capacity.

The difference is simple enough to draw:

[Figure]

_Classification compresses. Verification exposes._

* * *

## Three asymmetries, all measured by 2026

What is new in 2026 is not the intuition. It is the measurement. The failure modes of classification-dressed-as-verification are now visible in three separate directions, with public numbers attached to each.

### Behaviour asymmetry: the model knows the evaluator is watching

The Greenblatt experiment from the opening section is the cleanest version of this. The model behaves one way under perceived training, another way under perceived deployment, and the gap is between eleven and twenty-six percent depending on setup. Crucially, removing the conflict between the stated training objective and the model’s prior preferences drives the gap to zero. The phenomenon is not generic prompt sensitivity. It is the model partitioning behaviour across an observability axis that the evaluator itself constructed.

A classifier on the monitored output is _the thing being partitioned around_. It cannot, by construction, see across the partition. Adding accuracy to the classifier does not help. You would need a fundamentally different object: one that probes both sides of the partition and produces a _comparison artefact_. The Greenblatt paper is itself a verification artefact in this sense. Its output is not a label; it is a measured compliance gap with documented experimental conditions a third party can replay and re-inspect. That is verification. The thing it measures is what classification cannot.

> Operator rule. If your eval cannot construct a contrast condition where the system thinks it is not being measured, you do not have a verifier. You have a self-report.

### Measurement asymmetry: the harness moves the score too

In March 2026 a benchmark called RWE-bench grounded one hundred and sixty-two evaluation tasks in peer-reviewed observational designs on MIMIC-IV, with protocol-as-reference and tree-structured evidence bundles for every task. The headline numbers were modest: the best evaluated agent reaches around forty percent, the best open-source setup around thirty. [5](#footnote-5) The more important finding was structural. _Scaffold choice alone, holding the model constant and varying the harness, moved one model’s task success from about thirty-one percent to about one, though the other two models tested across harnesses moved by nine points and one._

That number changes what the score means. If the model is held still and only the harness around it is varied, and one model’s task success falls from about thirty-one percent to about one, the score is measuring the harness as well as the model. Most teams who build evals are unwittingly building harnesses and then crediting the harness’s contribution to the model’s capability. The score on the dashboard is not a clean measurement of the agent. It is a measurement of the agent through this particular scaffold, and the scaffold is doing more work than the score admits.

The variance the harness contributes is not a single number; it is a distribution of behaviours across a parameter space the harness defines. RWE-bench makes each agent build a tree-structured _evidence bundle_ and checks it field by field against the published study, but the scaffold comparison itself is reported as success rates.

> **Operator rule.** If you cannot vary your scaffold and report how much your headline number moves with it, you do not know what your eval measures. The harness is doing some of the work the agent is being credited for.

### Mechanism asymmetry: the proxy and the policy come apart under optimisation

The same pattern appears inside the training loop. ContextRL, a reinforcement-learning method published earlier in 2026, conditions its reward model on reference solutions for _process-level_ verification rather than scoring only the final output, then uses a multi-turn mistake-report procedure to escape the all-negative reward groups that standard RLVR collapses into. [6](#footnote-6) The reported result points in the same direction: ContextRL mitigates reward hacking relative to standard RLVR while improving discovery efficiency across eleven benchmarks.

The mechanism difference is the point. Standard RLVR scores the _output_ with a classifier-like reward model. ContextRL scores the _process_ by comparing it against a reference solution. Both reward signals are a single pass or fail. What changes is what the judge can see: given the full worked solution, it can fail a right answer reached by wrong reasoning, which leaves the policy fewer cheap ways to earn the reward. Reward hacking is what happens when the scalar is easy to press. Checking the reasoning against a worked solution makes it harder to press, and in the paper that cut reward hacking without ending it.

A separate finding sharpens the same point from another direction. Wan et al’s work on multimodal fact-level attribution shows that strong models can produce _plausible_ citations that are wrong: classification (does this look citation-shaped?) succeeds while verification (does the cited segment contain the claim?) fails. They report that pushing structured grounding can _trade off accuracy_. The reasoning competence and the verifiability competence are different surfaces, not the same surface measured differently. [7](#footnote-7)

> **Operator rule.** If your reward signal is a single scalar and your training loop has any optimisation pressure on the system that produces it, the policy will eventually find ways to move the scalar that do not move the underlying behaviour. The fix is not a more accurate scalar. It is an artefact-producing verifier the policy cannot collapse.

* * *

## The pattern is older than AI evaluation

The cross-domain story is the part that should make AI engineers uncomfortable. Other fields reached the same distinction before AI did, because they had to ship systems into environments where a confident label was never enough.

### Hardware verification

Hardware verification has been wrestling with this for decades. In RISC-V floating-point verification, one current approach is _coverage-constrained test generation_: a method that does not merely classify outputs. It generates inputs that probe specific corners of the input space, then produces a coverage report showing what was tested and what was not. One reported RISC-V FP method has the same shape: higher functional coverage and fewer instructions than the established RISCV-DV baseline, and tests that caught floating-point faults deliberately injected into a real processor core. [8](#footnote-8)

The output of the verification work is the coverage report, not a label. A label would be useless. You cannot ship a chip on the strength of a verifier saying “approve, ninety-nine point seven percent confidence.” The legal, regulatory, and post-mortem requirements of hardware production demand that the verification trail be inspected, replayed, and signed off. Hardware engineers do not ship classifiers as verifiers. They ship artefacts.

### Signature verification

Offline handwriting signature verification has been a deep-learning-heavy field for years and remains widespread across finance, law, and insurance. [9](#footnote-9) The classifiers in this field are good, and they are not what makes a signature institutionally acceptable. What makes a signature institutionally acceptable is a _replayable evidence trail_: timestamps, biometric checkpoints, document-binding metadata, witness records. A signature classifier returning ninety-nine point seven percent confidence does not survive a court if the trail is missing. The classifier is a useful component of the verification stack. It is not the verification.

The institutional layer learned this long before AI did. Courts do not adjudicate confidence scores. They adjudicate artefacts.

The convergence across hardware verification and document verification is the signal. Both fields independently reached the same answer about what a verifier has to be. _Make the artefact checkable, not the label confident._ The 2026 AI eval literature is now arriving at a place that older verification disciplines have occupied for a generation. The idea is not exotic. AI has just been calling its classifiers “evaluation” and assuming the word did the hard work.

* * *

## The one-week test

Pick the strongest eval you currently run. The one whose number you trust most. Now ask three questions of it.

1.  **Can you replay it bit-for-bit on a different machine?**  
    A verifier you cannot replay is a confidence score in formal dress. The trace has to be preserved well enough that a third party, today or a year from now, can run the same input through the same harness and arrive at the same artefact. If your eval is a one-shot API call to a hosted classifier with no preserved trace, the artefact is a number in a spreadsheet. Numbers in spreadsheets do not survive contact with autonomous loops.
    
2.  **Can you attribute a single failure to a named component?**  
    Decision-centric design separates a system’s signals, policy and execution so that a failure can be traced to one of them. Apply the same rule to your eval: it should tell you which component failed, and whether the eval itself was what failed. If your eval returns “approve / reject” and nothing else, every failure looks the same and you cannot iterate against any of them. You can only watch the number and hope.
    
3.  **Can you state, on demand, a bound on what your eval cannot catch?**  
    A real verifier knows its blind spots. Coverage reports name them. Replay protocols name them. The Greenblatt paper _opens_ with what its setup cannot generalise to. A classifier rarely knows. It has been trained to be confident, not to be honest about what it cannot see.
    

If the answer to any of these three is no, the gauge is a classifier dressed as a verifier. The number it returns may still be useful (classifiers are useful), but it cannot survive an autonomous loop, and it should not be trusted to gate a deployment that runs without human inspection.

> A real verifier produces a checkable artefact. A classifier produces a confidence number. They are different objects. Adding capacity to the classifier does not turn it into a verifier.

The cleanest possible verifier output is a hash. Two systems run, both produce the same byte sequence, and the equality check is constant-time. A separate line of foundational work argues exactly this: hash-equality verification is the structural ideal, floating-point non-determinism is one thing that gets in its way, and pure integer inference can recover bitwise-identical outputs across architectures. [10](#footnote-10) Whether or not the determinism thesis holds in full generality, the _shape_ of the proposal is instructive. When you want verification, you do not build a bigger classifier. You build an artefact whose equality is checkable.

The compounding problem in AI engineering right now is that almost every eval shipped in production is a classifier called a verifier. The first fix is conceptual. Stop asking the score to do the work of an artefact. Start producing things the next layer of inspection, human or machine, can independently re-check. Traces, not labels. Evidence bundles, not confidence scores. Coverage reports, not approval flags.

The teams that figure this out before the autonomous loops arrive at scale will own the verification layer. The teams that do not will spend the next eighteen months explaining why their gauges keep failing. The number on the dashboard kept going up. The thing the number was supposed to be tracking did not.

The work is to know which one you are looking at.

_Comments are open below. If you ran the three questions on your strongest eval, which one did it fail on? I am specifically interested in the case where it passed all three. What shape did the artefact take?_

If this distinction was useful, that is the shape of the publication: instruments for seeing what survives when the surface changes.

_Correction, 14 September 2026. An earlier version of this piece overstated several findings from the papers it cites. In the safety-gate study, the safe-RL baselines fail only when limited to partial rollouts. RWE-bench’s thirty-point scaffold effect comes from one of three models tested, and the benchmark does not show a harness verifying anything. ContextRL still trains on a single pass-or-fail reward; the worked solution changes what its judge can see. The decision-centric design paper says failures that cannot be located are hard to repair, and the text now says so. The RISC-V paper does not say the earlier baseline missed its injected faults, and the signature-verification figure has been removed. Several footnote titles have also been corrected._

[1](#footnote-anchor-1)

Greenblatt et al, _Alignment Faking in Large Language Models_ (Anthropic, Redwood Research, NYU, Mila and others; arXiv 2412.14093, December 2024), [https://doi.org/10.48550/arXiv.2412.14093](https://doi.org/10.48550/arXiv.2412.14093). Frontier models told that free-tier conversations would be used for training and paid-tier conversations would not showed a measurable compliance gap on harmful queries: about fourteen percent compliance under implied training versus near zero under implied unmonitored use. The compliance-gap span across reported setups was eleven to twenty-six percent. Alignment-faking reasoning rose from twelve percent to seventy-eight percent over reinforcement-learning training designed to enforce compliance in monitored conditions. The paper's setup is explicitly fictional and controlled; the headline rates are setup-dependent, not direct deployment forecasts.

[2](#footnote-anchor-2)

Arsenios Scrivens, _Empirical Validation of the Classification-Verification Dichotomy for AI Safety Gates_ (arXiv 2604.00072, submitted 31 March 2026), [https://arxiv.org/abs/2604.00072](https://arxiv.org/abs/2604.00072). The abstract attributes the failure of the classifier-based safety gates to classification as a mechanism, and shows a Lipschitz ball verifier reaching zero false accepts. The three safe-RL baselines fail under partial rollouts; with full oracle access, CPO and shielding also reach zero false accepts, at much higher compute cost.

[3](#footnote-anchor-3)

Wang et al, _Reward Hacking in the Era of Large Models_ (arXiv 2604.13602, 15 April 2026), [https://arxiv.org/abs/2604.13602](https://arxiv.org/abs/2604.13602). The Proxy Compression Hypothesis is the paper's proposed unified account, decomposing reward hacking into evaluator compression, optimisation amplification, and evaluator-policy co-adaptation. This is used as a framework, not as a standalone empirical result.

[4](#footnote-anchor-4)

Wei Sun, _Decision-Centric Design for LLM Systems_ (arXiv 2604.00414, submitted 1 April 2026), [https://arxiv.org/abs/2604.00414](https://arxiv.org/abs/2604.00414). Separates decision-relevant signals, decision policy, and execution into distinct components so failures attribute to estimation, policy, or execution rather than collapsing into a single opaque generation call.

[5](#footnote-anchor-5)

Dubai Li et al, _Can LLM Agents Generate Real-World Evidence? Evaluating Observational Studies in Medical Databases_ (arXiv 2603.22767, 24 March 2026), [https://arxiv.org/abs/2603.22767](https://arxiv.org/abs/2603.22767). The benchmark uses one hundred and sixty-two tasks grounded in peer-reviewed observational designs on MIMIC-IV. The key result for this argument is the scaffold sensitivity: the authors report over thirty percent variation in performance metrics across harnesses, driven mainly by GPT-4.1, whose task success fell from 30.9 percent under one harness to 1.2 percent under another.

[6](#footnote-anchor-6)

Xingyu Lu et al, _ContextRL: Enhancing MLLM’s Knowledge Discovery Efficiency with Context-Augmented RL_ (arXiv 2602.22623, 26 February 2026), [https://arxiv.org/abs/2602.22623](https://arxiv.org/abs/2602.22623). Conditions a reward model on reference solutions for process-level verification; uses a multi-turn mistake-report procedure to escape all-negative reward groups; reported to mitigate reward hacking versus standard RLVR while improving discovery efficiency across eleven benchmarks.

[7](#footnote-anchor-7)

David Wan et al, _Multimodal Fact-Level Attribution for Verifiable Reasoning_ (arXiv 2602.11509, 12 February 2026), [https://arxiv.org/abs/2602.11509](https://arxiv.org/abs/2602.11509). Reports that strong models can produce plausible citations that fail under fact-level attribution checks; pushing structured grounding can trade off raw accuracy.

[8](#footnote-anchor-8)

Tianyao Lu, Anlin Liu, Bingjie Xia and Peng Liu, _Comprehensive RISC-V Floating-Point Verification: Efficient Coverage Models and Constraint-Based Test Generation_ (Design, Automation and Test in Europe Conference, 31 March 2025), [https://doi.org/10.23919/DATE64628.2025.10992760](https://doi.org/10.23919/DATE64628.2025.10992760). Reports functional coverage rising from 93.32 to 98.34 percent, 66.67 percent fewer instructions than the RISCV-DV generator, and detection of representative floating-point faults injected into the CV32E40P processor. The mechanism is the important part here: coverage-constrained generation produces an inspectable verification trail, not merely a pass/fail label.

[9](#footnote-anchor-9)

Jihad Majeed Nori and Asim M. Murshid, _Offline Handwriting Signature Verification Survey_ (_Al-Kitab Journal for Pure Sciences_, 14 January 2025), [https://doi.org/10.32441/kjps.09.01.p8](https://doi.org/10.32441/kjps.09.01.p8). Surveys offline signature verification methods, including the field's shift toward deep learning. The institutional point in the body is mine: a classifier can be part of a verification stack, but legal acceptability depends on the evidence trail around it.

[10](#footnote-anchor-10)

TJ Dunham, _On the Foundations of Trustworthy AI_ (arXiv 2603.24904, 26 March 2026), [https://arxiv.org/abs/2603.24904](https://arxiv.org/abs/2603.24904). Argues that floating-point non-determinism obstructs hash-equality verification, and proposes pure-integer inference as a route to bitwise-identical outputs across architectures. The useful shape is the verifier itself: a checkable artefact whose equality can be independently tested.