Case · DiggingBeagle record

Model-cascade success concealed reads of feedback unavailable at decision time

Counterfactual auditing exposed hidden use of future feedback in model cascades even when final answers and cost looked plausible.

Scope

Controlled model-cascade fault injections and trusted dispatcher instrumentation in the CascadeLedger study. Reported recall figures are evaluation results, not confirmed misconduct by an external inference provider.

Assessment profile

Assessment method
Setting
simulation
Exploitation
demonstrated
Impact
Band 1 of 4
Evidence
Grade B
Remediation
mitigation available
AI role
AGAINST AI
Basis and provenance

The paper tests forbidden hidden-answer reads using authenticated stage provenance and counterfactual replay. High detection figures describe controlled seeded faults requiring trusted instrumentation. Its attack is illicit information dependency, not evidence that a real commercial model committed billing fraud.

Impact basis: Injected cascade-stage faults accessed future feedback while still producing apparently valid routing outputs. No real-world provider, bill or affected client is identified; impact is bounded to evaluation integrity.

Assessed Oct 19, 2026 using diggingbeagle.assessment/1.

At a glance

Claims & evidence

CLM-CASCADELEDGER-HIDDEN-ANSWER-ACCESSCascadeLedger constructed model-cascade faults where a cheaper or earlier stage read information intended to become available only after it made its routing decision.supported

Basis: reported finding

Link to claim

Implications

For an evaluation harness this is an integrity question, not merely a pricing anomaly. A correct final answer can conceal a dependency on data that a real deployment would not have had.

Controls and mitigations

  • Require call-before-read and immutable provenance at dispatcher level; audit decision dependencies independently of final answer and billed token counts.

Unknowns and contradictions

  • The high recall rates reported in controlled fault injections depend on trusted instrumentation and the defined cascade system. The paper does not demonstrate a compromised third-party provider or prove every future hidden dependency observable.

Sources and citation

Material revision history

  1. Oct 19, 2026 · Published version · first publication · revision 174
  2. Oct 19, 2026 · Canonical change recorded · material revision · revision 175Public fields changed: assessment_profile