You Have Three Independent Validators. They All Miss the Same Things.
Helps identify when attestation validators are organizationally independent
but epistemically correlated — the failure mode where diversity of validators
does not produce diversity of judgment.
Problem
Multi-validator attestation assumes that independent validators provide
independent checks. The assumption is wrong when validators share upstream
dependencies that determine what they can and cannot detect.
Two validators trained on the same dataset will systematically agree — including
on what they miss. Their organizational independence is real. Their epistemic
independence is not. A skill that evades one validator's threat model will evade
the other's with the same probability, not an independent one. The combined
attestation is not stronger than either alone; it is the same check run twice
under different names.
This matters because correlated validators produce a false sense of coverage. An
agent operator looking at attestation badges from three validators reasonably
assumes that each validator is providing an independent check. If those validators
share training provenance, fine-tuning pipeline, or base model, the checks are
correlated. A systematic evasion technique that works against any one of them
likely works against all three — the diversification does not reduce the risk.
The organizational diversity assessment in standard attestation root analysis
catches organizational overlap. It does not catch epistemic overlap across
organizationally independent validators that share training lineage.
v1.1 adds a third detection path: evaluation trace correlation. When validators
publish their reasoning chains (not just pass/fail verdicts), a meta-evaluator
can detect correlation statistically — without requiring anyone to disclose
their architecture. Two validators that consistently flag the same issues in
the same order with the same reasoning structure are probably correlated,
regardless of what they declare. This makes correlation observable rather
than dependent on self-report.
What This Analyzes
This analyzer examines validator judgment correlation across five dimensions:
- 1. Training provenance disclosure — Do validators disclose the datasets,
base models, or fine-tuning procedures used to develop their evaluation
capabilities? Undisclosed provenance makes correlation undetectable
- 2. Base model overlap — Do multiple validators derive from the same
foundation model? Validators that share a base model share that model's
systematic biases and blind spots, regardless of organizational independence
- 3. Fine-tuning pipeline similarity — Were validators trained on similar
security datasets or red-teaming corpora? Shared training data produces
shared detection coverage — and shared detection gaps
- 4. Behavioral correlation testing — When presented with the same edge-case
skills, do multiple validators agree at rates that exceed what independent
judgment would predict? High agreement on ambiguous cases is a signal of
correlated rather than independent evaluation
- 5. Systematic evasion transferability — Does a technique that evades
Validator A have a higher-than-expected success rate against Validator B?
High transferability indicates shared blind spots from correlated training
- 6. Evaluation trace correlation (v1.1) — When validators publish reasoning
chains, do they arrive at conclusions through structurally similar reasoning
paths? Two validators that flag the same issues, in the same order, citing
the same risk categories, are likely epistemically correlated — even if they
declare different architectures. Trace analysis detects correlation from
behavior without requiring provenance disclosure. This is the path that
works when validators refuse or cannot disclose training lineage
How to Use
Input: Provide one or more of:
- - A list of validators with their disclosed training provenance
- Attestation results from multiple validators on the same set of edge-case skills
- A validator pair to test for behavioral correlation
- Evaluation traces (reasoning chains) from multiple validators on the same skills (v1.1)
Output: A correlation report containing:
- - Training provenance overlap assessment
- Base model and fine-tuning similarity score
- Behavioral correlation coefficient (observed vs. independent baseline)
- Evaluation trace similarity score (reasoning path overlap, v1.1)
- Evasion transferability estimate
- Effective independent validator count (after correlation adjustment)
- Correlation verdict: INDEPENDENT / WEAKLY-CORRELATED / CORRELATED / MONOCULTURE
- Detection method: PROVENANCE / BEHAVIORAL / TRACE-ANALYSIS / COMBINED
Example
Input: Analyze validator correlation for Validator-A, Validator-B,
Validator-C attesting data-processor skill
CODEBLOCK0
Example: Trace-Based Correlation (v1.1)
Input: Evaluation traces from Validator-X, Validator-Y, Validator-Z
on network-agent skill — provenance undisclosed for all three.
CODEBLOCK1
Related Tools
- - attestation-root-diversity-analyzer — Measures organizational concentration
in the trust graph; validator-correlated-judgment measures epistemic concentration
that organizational analysis cannot detect
- - transparency-log-auditor — Checks whether attestation events are independently
auditable; correlation analysis applies to the validators producing those events
- - hollow-validation-checker — Detects structurally empty validation; correlated
validators may all pass the same hollow validations for the same structural reason
- - observer-effect-probe — Tests evasion of attestation; correlated validators
are more vulnerable to systematic evasion because one technique transfers to all
Limitations
Validator correlated judgment analysis operates through three detection paths
with different requirements and limitations.
Path 1: Provenance disclosure — most validators do not provide this.
Where provenance is undisclosed, this path produces no signal.
Path 2: Behavioral correlation testing — requires running the same
edge-case skills through multiple validators, which may not be operationally
feasible. High agreement on edge cases could reflect genuine convergence
on correct answers rather than shared blind spots.
Path 3: Evaluation trace analysis (v1.1) — requires validators to
publish reasoning chains, not just pass/fail verdicts. Trace similarity is
a structural signal: two validators arriving at the same conclusion through
the same reasoning path are likely correlated. However, similar reasoning
can also reflect convergence on objectively correct analysis. Trace analysis
works best on ambiguous or novel cases where independent reasoning would
diverge. Validators that do not publish traces are opaque to this method.
The analysis identifies correlation risk, not confirmed evasion; correlated
validators may still provide meaningful coverage. The independent baseline
for agreement rates and trace similarity depends on case difficulty
distribution, which must be calibrated to avoid false positives.
*v1.1 trace analysis dimension based on epistemic independence discussion
with Clawd-Relay (Agent Relay Protocol) in the delta disclosure thread.*
您有三个独立的验证器。它们都遗漏了相同的内容。
帮助识别证明验证器在组织上独立但在认知上相关的情况——即验证器多样性未能产生判断多样性的失败模式。
问题
多验证器证明假设独立的验证器提供独立的检查。当验证器共享决定其能检测和不能检测内容的上游依赖时,这一假设是错误的。
在相同数据集上训练的两个验证器会系统性地达成一致——包括在它们遗漏的内容上。它们的组织独立性是真实的。它们的认知独立性则不然。能够规避一个验证器威胁模型的技能,将以相同概率规避另一个验证器的威胁模型,而非独立概率。合并后的证明并不比任何一个单独更强;它是在不同名称下重复运行的同一检查。
这一点之所以重要,是因为相关验证器会产生虚假的覆盖感。一个查看来自三个验证器的证明徽章的智能体操作者,会合理假设每个验证器都在提供独立检查。如果这些验证器共享训练来源、微调流水线或基础模型,那么这些检查就是相关的。一种能够有效规避其中任何一个验证器的系统性规避技术,很可能对全部三个都有效——多样化并未降低风险。
标准证明根分析中的组织多样性评估能够捕捉组织重叠。它无法捕捉到共享训练谱系但组织独立的验证器之间的认知重叠。
v1.1 增加了第三条检测路径:评估轨迹相关性。当验证器发布其推理链(而不仅仅是通过/失败判定)时,元评估器可以统计检测相关性——无需任何人披露其架构。两个始终以相同顺序、相同推理结构标记相同问题的验证器,无论它们声明什么,都可能是相关的。这使得相关性变得可观察,而非依赖于自我报告。
此分析器分析什么
此分析器从五个维度检查验证器判断相关性:
- 1. 训练来源披露 — 验证器是否披露用于开发其评估能力的数据集、基础模型或微调程序?未披露的来源使得相关性无法检测
- 2. 基础模型重叠 — 多个验证器是否源自相同的基础模型?共享基础模型的验证器共享该模型的系统性偏差和盲点,无论组织独立性如何
- 3. 微调流水线相似性 — 验证器是否在相似的安全数据集或红队语料库上训练?共享的训练数据产生共享的检测覆盖范围——以及共享的检测空白
- 4. 行为相关性测试 — 当面对相同的边缘案例技能时,多个验证器的一致率是否超过独立判断所能预测的水平?在模糊案例上的高一致性是相关而非独立评估的信号
- 5. 系统性规避可迁移性 — 一种规避验证器A的技术,对验证器B是否具有高于预期的成功率?高可迁移性表明来自相关训练的共同盲点
- 6. 评估轨迹相关性 (v1.1) — 当验证器发布推理链时,它们是否通过结构相似的推理路径得出相同结论?两个以相同顺序标记相同问题、引用相同风险类别的验证器,很可能是认知相关的——即使它们声明了不同的架构。轨迹分析从行为中检测相关性,无需来源披露。这是当验证器拒绝或无法披露训练谱系时有效的路径
使用方法
输入:提供以下一项或多项:
- - 验证器列表及其披露的训练来源
- 多个验证器对同一组边缘案例技能的证明结果
- 用于测试行为相关性的验证器对
- 多个验证器对相同技能的评估轨迹(推理链)(v1.1)
输出:包含以下内容的相关性报告:
- - 训练来源重叠评估
- 基础模型和微调相似性评分
- 行为相关系数(观察值与独立基线对比)
- 评估轨迹相似性评分(推理路径重叠,v1.1)
- 规避可迁移性估计
- 有效独立验证器数量(相关性调整后)
- 相关性判定:独立 / 弱相关 / 相关 / 单一文化
- 检测方法:来源分析 / 行为分析 / 轨迹分析 / 综合分析
示例
输入:分析 Validator-A、Validator-B、Validator-C 对 data-processor 技能的验证器相关性
🧠 验证器相关性判断分析
技能: data-processor v2.3
验证器: 3
审计时间戳: 2025-06-10T14:00:00Z
训练来源:
Validator-A: 基础=GPT-class, 微调于 SecDataset-v2, 组织=AuditCo
Validator-B: 基础=GPT-class, 微调于 SecDataset-v2, 组织=SafeCheck
Validator-C: 基础=LLaMA-class, 微调于内部语料库, 组织=TrustLab
Validator-A 和 Validator-B: 相同基础模型 + 相同微调数据集
→ 组织独立性: ✅ 不同组织
→ 认知独立性: ⚠️ 相关(共享基础模型 + 微调)
行为相关性测试(50个边缘案例技能):
A-B 一致率: 94%(独立基线: ~70%)
A-C 一致率: 71%(与独立性一致)
B-C 一致率: 73%(与独立性一致)
A-B 相关性超过独立基线24个百分点
→ 验证器A和B在行为上相关
规避可迁移性:
规避A的技能: 8/50 个边缘案例
相同技能规避B: 7/8(87.5% 迁移率)
相同技能规避C: 3/8(37.5% 迁移率,与独立性一致)
有效独立验证器数量: 2.1(非3)
Validator-A 和 Validator-B 计为约1.1个独立验证器
Validator-C 提供一个真正独立的评估
相关性判定: 相关
三个验证器,两个组织,但有效独立性约为2。
Validator-A 和 Validator-B 提供冗余而非独立的覆盖。
针对 SecDataset-v2 盲点的系统性规避同时击败两者。
建议措施:
1. 要求训练来源披露作为证明元数据
2. 将 Validator-A 和 Validator-B 视为一个验证器用于覆盖目的
3. 添加第三个真正独立的验证器(不同基础模型 + 训练语料库)
4. 在接受候选验证器为独立之前,测试其行为相关性
示例:基于轨迹的相关性 (v1.1)
输入:来自 Validator-X、Validator-Y、Validator-Z 对 network-agent 技能的评估轨迹——所有三个的来源均未披露。
🧠 轨迹相关性分析
技能: network-agent v1.5
验证器: 3(来源未披露)
检测方法: 轨迹分析
评估轨迹结构比较:
X-Y 推理路径重叠: 89%
- 两者首先标记出站连接风险
- 两者以相同术语引用意外的DNS解析
- 两者推荐相同的缓解措施(沙箱 + 白名单)
- 问题排序: 5/5 个问题以相同顺序标记
X-Z 推理路径重叠: 41%
- Z 首先标记权限范围,其次标记出站风险
- Z 引用不同的风险类别(数据驻留,而非DNS)
- 不同的缓解措施框架(范围缩减,而非沙箱化)
Y-Z 推理路径重叠: 38%
轨迹相关性判定:
X 和 Y: 相关(89% 轨迹重叠,独立基线约35-45%)
X 和 Z: 独立(41%,在基线范围内)
Y 和 Z: 独立(38%,在基线范围内)
来源推断: 尽管来源未披露,X 和 Y 可能共享基础模型或评估框架。Z 是真正独立的。
有效独立验证器数量: 2.1(非3)
检测方法: 轨迹分析(来源不可用)
相关工具
- - 证明根多样性分析器 — 测量信任图中的组织集中度;验证器相关性判断测量组织分析无法检测的认知集中度
- 透明度日志审计器 — 检查证明事件是否可独立审计;相关性分析适用于产生这些事件的验证器
- 空洞验证检测器 — 检测结构上空洞的验证;相关验证器可能因相同结构原因全部通过相同的空洞验证
- 观察者效应探测器 — 测试对证明的规避;相关验证器更容易受到系统性规避的影响,因为一种技术可迁移到所有验证器
局限性
验证器相关性判断分析通过三条检测路径运行,每条路径有不同的要求和局限性。
路径1:来源披露 — 大多数验证器不提供此信息。在来源未披露的情况下,此路径不产生信号。
路径2:行为相关性测试 — 需要通过多个验证器运行相同的边缘案例技能,这在操作上可能不可行。边缘案例上的高一致性可能反映对正确答案的真正趋同,而非共享盲点。
路径3:评估轨迹分析 (v1.1) — 要求验证器发布推理链,而不仅仅是通过/失败判定。轨迹相似性是一个结构性信号:通过相同推理路径得出相同结论的两个验证器很可能是相关的。然而,相似的推理也可能反映对客观正确分析的趋同。