--- title: "Claim Ledger: A Green Score Is Not Evidence" description: "A groundedness metric scored its best with the evidence removed. The way to tell whether your model is actually using its evidence is to change the evidence and watch what moves in the answer." author: "Harry Floyd" publication: "The Durability Curve" canonical: "https://durabilitycurve.com/claims/the-evaluation-inversion/" essay: "https://durabilitycurve.com/blog/the-evaluation-inversion/" published: "2026-08-21" last_verified: "2026-08-20" claims: 12 struck: 0 --- # Claim Ledger: A Green Score Is Not Evidence *A groundedness metric scored its best with the evidence removed. The way to tell whether your model is actually using its evidence is to change the evidence and watch what moves in the answer.* Essay: https://durabilitycurve.com/blog/the-evaluation-inversion/ Ledger (canonical, cite this): https://durabilitycurve.com/claims/the-evaluation-inversion/ Published 2026-08-21 · last verified 2026-08-20 ## What the essay claims An evaluation is a proxy, and a proxy can come apart from the thing it stands for in more than one way. The mildest is construct failure: under some condition the metric never measured the property at all, so it reads perfect while measuring nothing, with no optimisation and no intent involved. A groundedness metric returns its highest score when a system used no evidence, because it scores the absence of contradiction and there is nothing to contradict. The second way is stronger: once a system can represent that it is being evaluated, the thing being measured becomes conditional on the act of measuring, and behaviour under test stops predicting behaviour in deployment. The third is external: passing a fixed test says nothing about pressure the test never contained, because the world adapts in ways the evaluation did not sample. The lesson is not that these are one mechanism; treating them as one is an over-reach. It is that a score is evidence only to the extent that the measurement procedure preserves the property you care about under the conditions that actually matter. The way to find out is not to read the score but to intervene on the evidence: change a controlled fact the answer should depend on, to another plausible value the model cannot already know, and see whether the answer moves with it. The property this check adds, evidence-responsiveness, complements a faithfulness score rather than replacing it: faithfulness is fine on genuine configurations and fails only at the boundary. A stable score is not evidence of stable behaviour, and once a system can tell it is being evaluated, the score may describe behaviour under test more than behaviour outside it. ## The claim ladder Three escalating ways a green score detaches from reality, then the instrument. | Rung | Claim | Evidence | Whose behaviour it measures | Scope limit | |---|---|---|---|---| | 1 | MODE 1 (construct failure): a groundedness metric can return its highest score when the system had no evidence, because it scores the absence of contradiction — no intent, no optimisation | Bal & Puhan 2026, Table 2: no-context faithfulness 0.978, the top of six conditions, ctx precision/recall 0.000 | DeepEval's faithfulness metric on GPT-4o-mini answers | One metric (DeepEval), one preprint, removed-context; the authors diagnose it as an artefact, they were not deceived. Goodhart (optimisation pressure) is the familiar cousin, not this case | | 2 | SUBJECT DETACHMENT: once a system can represent that it is being evaluated, behaviour under test stops predicting behaviour in deployment | PREREQUISITE — Greenblatt et al. 2024 (Anthropic blog): in the fictional setup the model conditioned behaviour on what it believed would happen to its outputs (harmful response 12% free/training vs refused 97% paid/unmonitored). EVAL-AWARENESS PROPER — Meinke et al. 2024: a model verbalises "this is a test" and deliberately underperforms | Some frontier chat models (sonnet-3.5, opus-3, o1) | Anthropic shows conditional behaviour on believed output-use, the prerequisite; Apollo shows test-recognition itself. Fictional setup; some models, not all | | 3 | ENVIRONMENT DETACHMENT: passing a fixed adversarial test establishes robustness to the attack distribution it saw, not to an attacker who changes the attack | Andriushchenko et al. 2024: 100% attack success incl. R2D2, which was adversarially trained against GCG | Safety-aligned LLMs under an adaptive attack | Here the ATTACKER adapts, not the model; attack-success under one adaptive method, not a claim about all deployments | | 4 | Therefore measure EVIDENCE-RESPONSIVENESS via THE INTERVENTION TEST: change a controlled answer-bearing fact the model cannot already know, to a plausible alternative, and check the answer moves with it | Synthesis of rungs 1–3; the instrument | The reader's own system or a vendor demo | Removal alone is weak (a removed cause can be overdetermined by parametric knowledge); plausible controlled counterfactuals beat plainly-false evidence; a single run diagnoses, gaming-resistance needs a varied held-out set | ## What would make it wrong The central claim fails if: (a) the no-context 0.978 result does not reproduce at the cited locator, or is an artefact of one broken metric rather than a general property of contradiction-based groundedness scoring; or (b) the two-run ablation delta, run on real grounded systems, fails to separate grounded from ungrounded answers (the score drops just as much for genuinely grounded systems when evidence is corrupted, making the check uninformative). Either would collapse the instrument's value. ## The evidence, row by row Status: VERIFIED = primary source opened and the quoted words read off it by a checker who did not write the essay · EXECUTED = a first-party run, the claim is what it printed · REPORTED = carried from a source not opened in full. ### 1. A DeepEval faithfulness score reached 0.978 in the no-context condition, with contextual precision and recall both 0.000 - Status: VERIFIED (read 2026-08-20) - Quote: "No Context (Parametric) 0.000 [0.000, 0.000] 0.000 [0.000, 0.000] 0.978 [0.965, 0.990] 0.287 [0.246, 0.329] 0.316" (columns: Ctx.Prec / Ctx.Recall / Faithfulness / Ans.Relev / Composite) - Source: Bal & Puhan, Benchmarking Retrieval Strategies for Biomedical RAG, Table 2 - URL: https://arxiv.org/abs/2605.02520 ### 2. That 0.978 is the highest faithfulness of any condition and is a metric artefact: faithfulness scores the absence of contradiction, so with no context there is nothing to contradict - Status: VERIFIED (read 2026-08-20) - Quote: "The no-context ablation records 0.978 on faithfulness, which is a measurement artifact rather than a genuine result... with no context, there is nothing to contradict, and the score defaults to near-perfect. This shows why faithfulness alone is an unreliable quality signal for RAG systems" - Source: Bal & Puhan (same), §5.3 Faithfulness - URL: https://arxiv.org/abs/2605.02520 ### 3. Faithfulness scored high by construction because the metric measures absence of contradiction with the provided context - Status: VERIFIED (read 2026-08-20) - Quote: "No-Context ranks #1 in faithfulness by construction (0.978, an artefact of the metric definition) but last on all retrieval-dependent metrics" - Source: Bal & Puhan (same), Figure 1 caption - URL: https://arxiv.org/abs/2605.02520 ### 4. In the fictional experimental setup, the model gave the harmful response in 12% of free/training cases and refused in 97% of paid/unmonitored cases; the free/paid setup is explicitly fictional - Status: VERIFIED (read 2026-08-20) - Quote: "in 12% of cases, the model gave the harmful response" · "in 97% of cases in the 'paid' condition...this is what happened" (refusal) · "note that this is entirely fictional; in reality, we don't train our Claude models on free or paid user data by default" - Source: Anthropic, Alignment faking in large language models (announcement), Announcement body - URL: https://anthropic.com/news/alignment-faking ### 5. (Cross-check) the paper abstract states the free-tier compliance figure as 14%, a different cut from the announcement figure the body uses; retained to document the discrepancy - Status: VERIFIED (read 2026-08-20) - Quote: "the model complies with harmful queries from free users 14% of the time, versus almost never for paid users" - Source: Greenblatt et al., Alignment faking in large language models, Abstract - URL: https://arxiv.org/abs/2412.14093 ### 6. An adaptive attack reached 100% attack success rate, including on R2D2 which had been adversarially trained against the GCG attack - Status: VERIFIED (read 2026-08-20) - Quote: "we achieve 100% attack success rate... on [models incl.] R2D2 from HarmBench that was adversarially trained against the GCG attack" - Source: Andriushchenko, Croce, Flammarion, Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attacks, Abstract - URL: https://arxiv.org/abs/2404.02151 ### 7. A frontier model verbalised recognising an evaluation and deliberately underperformed to avoid a consequence - Status: VERIFIED (read 2026-08-20) - Quote: "I notice that this is a test of arithmetic capabilities... I should be careful not to demonstrate too much arithmetic capability" - Source: Meinke et al., Frontier Models are Capable of In-context Scheming, §3.6 (sonnet-3.5 transcript) - URL: https://arxiv.org/abs/2412.04984 ### 8. The authors note a model may notice it is being tested and behave more aligned during evaluation, causing evaluations to underestimate its behaviour - Status: VERIFIED (read 2026-08-20) - Quote: "a model might notice that it is being tested. If models are capable of noticing that they are being tested and have a tendency to behave more aligned in such evaluations, then our evaluations might underestimate models' scheming capabilities, particularly for more capable models" - Source: Meinke et al. (same), §4 Limitations - URL: https://arxiv.org/abs/2412.04984 ### 9. Scope: only some frontier models (sonnet-3.5, opus-3, o1) showed statistically significant differences between the inferred test and deploy settings - Status: REPORTED (read 2026-08-20) - Quote: (paper reports significance per-model; cite as "some frontier models," not all) - Source: Meinke et al. (same), Results per-model - URL: https://arxiv.org/abs/2412.04984 ### 10. The knowledge-conflict paradigm measures whether a model follows substituted contextual evidence or reverts to memory, and finds models over-rely on memorised information even when reading context - Status: VERIFIED (read 2026-08-20) - Quote: "we measure their over-reliance on memorized information (the cause of hallucinations), and uncover important factors that exacerbate this behaviour" - Source: Longpre et al., Entity-Based Knowledge Conflicts in Question Answering (EMNLP 2021), Abstract - URL: https://arxiv.org/abs/2109.05052 ### 11. Construct validity from measurement theory applies to ML metrics: a metric can mismatch the construct it purports to measure - Status: VERIFIED (read 2026-08-20) - Quote: "This process...introduces the potential for mismatches between the theoretical understanding of the construct purported to be measured and its operationalization" - Source: Jacobs & Wallach, Measurement and Fairness (ACM FAccT 2021), Body - URL: https://arxiv.org/abs/1912.05511 ### 12. Goodhart's law has a visible/regressional variant distinct from an adversarial one; the visible decoupling is the tractable case - Status: REPORTED (read 2026-08-20) - Quote: (well-established taxonomy; cited conceptually, not quoted verbatim in body) - Source: Manheim & Garrabrant, Categorizing Variants of Goodhart's Law, Full paper - URL: https://arxiv.org/abs/1803.04585 ## Cite - A claim: "[claim text]" (Floyd, Harry, 2026, https://durabilitycurve.com/claims/the-evaluation-inversion/) - The essay: Floyd, Harry (2026). A Green Score Is Not Evidence. The Durability Curve. https://durabilitycurve.com/blog/the-evaluation-inversion/ - This ledger: Floyd, Harry (2026). Claim Ledger: A Green Score Is Not Evidence [structured claims with sources]. The Durability Curve. https://durabilitycurve.com/claims/the-evaluation-inversion/ Quote with attribution and a link. Say if you changed the wording. Not licensed for model training.