White Box Evidence Packages for Policy Audit Reports
Source: arXiv:2607.21462 · Published 2026-07-23 · By Seunghyun Yoo
TL;DR
This paper tackles the crucial question of how auditors and reviewers can verify that LLM-generated policy audit reports are genuinely supported by concrete evidence. It focuses on passage-anchored policy audits where the task is to interpret a fixed policy passage and generate a report citing relevant evidence entries. The contribution is a carefully controlled experimental framework that holds passage, rubric, and auditor model fixed, varying only the type of evidence interface feeding the auditor—from surface textual evidence to various internal "white box" model interpretability tool outputs and hybrids. The study compares 600 reports across 60 policy cases from the AGORA corpus under 10 evidence conditions, including a key shuffled-relevance control that breaks internal evidence-case alignment but preserves format. The main insight is that while internal white box evidence changes auditor citation behavior, more citations do not translate to better grounded or more useful audit reports; misuse of internal evidence is a major failure mode. The hybrid interface combining surface and internal evidence achieves the best usefulness but still suffers misuse. Residual stream patching diagnostics show that true causal evidence signals are narrowly localized and sensitive to prompt permutations. Overall, the work reframes internal interpretability tool outputs as an evidence design challenge for trustworthy audit workflows rather than a direct path to transparency or proof.
Key findings
- Combined white box evidence reports cite 10.13 evidence entries per report versus 3.87 for black box surface evidence, showing increased evidence uptake.
- Despite higher citation volume, combined white box reports have lower grounding (mean 3.25 vs 4.52), usefulness (4.00 vs 4.68), and higher evidence misuse (2.50 vs 1.00) compared to surface baseline over 60 AGORA policy cases.
- The hybrid interface (surface + white box) nearly matches surface baseline correctness (4.70 vs 4.68) and grounding (4.50 vs 4.52), improves usefulness (4.92 vs 4.68), but still increases evidence misuse (2.13 vs 1.00).
- Shuffled white box relevance control reports, with internal evidence from unrelated cases, still achieve moderate correctness (3.63) but have very high misuse (5.00), exposing serious governance risks.
- Sparse autoencoder internal evidence items are cited at rates above 90% per available item, including in shuffled controls, indicating auditors rely heavily on broad labels regardless of relevance.
- Behavior-locked residual stream patching localizes causal signal narrowly to layers 7-8 and final prompt token, consistent with a late decision answer readout rather than broad mechanistic support.
- Citation volume correlates poorly with report validity, as evidenced by plausible but internally misused evidence in shuffled controls.
- Validation review with five human reviewers confirms that increased citations alone do not imply improved report quality or better model grounding.
Threat model
The threat model considers an internal adversary risk where the auditor model may misuse or over-rely on internal interpretability tool outputs as evidence without verifying relevance, potentially producing audit reports that cite irrelevant internal signals to support claims. The adversary has access to internal model activations and interpretability evidence but does not manipulate the fixed passage or rubric. The auditor and reviewers assume the evidence packages provided are honest but test the risk that internal evidence is misleading or shuffled incorrectly. There is no adversarial attacker directly manipulating the model internals or auditor prompts.
Methodology — deep read
The study carefully isolates how different evidence interfaces impact audit report quality by holding fixed the policy passage, audit rubric, and the auditor model (Qwen 2.5 7B), varying only the evidence package shown. The adversary is implicitly the risk that the auditor confuses or misuses internal model evidence, posing a transparency and governance risk. The dataset comprises 60 AGORA policy cases, drawn from 11 governance documents, representing diverse policy elements like obligations and exceptions. Each audit case input includes a policy passage, a fixed rubric, and one of ten evidence interfaces. Evidence sources include black box surface observations (policy text spans, issue notes, confidence), and four internal white box interpretability tool outputs derived from the target model Gemma 2 2B: sparse autoencoder (SAE) features and labels, logit lens token direction summaries, steering sensitivity measurements, and a conservative natural language activation explanation surrogate. Combined white box evidence packages all internal tools together; hybrid packages add surface evidence on top. A shuffled white box relevance control mixes internal evidence from unrelated cases to test auditor reliance on irrelevant evidence format. For each evidence condition per case, a structured audit report is generated by the auditor model, standardized for consistent findings, passages cited, confidence, and caveats. A separate residual stream patching diagnostic experiment, not given to the auditor, tests causal localization of internal signals by patching clean residuals into corrupted forced choice microtasks, analyzing layer and token-level influence. The primary evaluation uses a rigorous validation review from five human experts who (1) authored gold briefs blind to evidence, (2) scored 240 audit reports across four main evidence interfaces (black box surface, combined white box, hybrid, shuffled control) against accuracy, passage grounding, diagnostic usefulness, and misuse of evidence. Review scores range from 1 to 5 and were analyzed via paired comparisons and nonparametric exact sign tests. Single tool evidence conditions (SAE, logit lens, steering, activation surrogate) were also reviewed on a 20 case subset. Main endpoints include mean correctness, grounding, usefulness, and misuse metrics with statistical robustness checks. The controlled design permits causal claims about how evidence interface (not auditor model or passage) affects report outcomes. Code, prompt templates, evidence packs, and validation data are publicly released for reproducibility. This empirical framework operationalizes downstream use of internal interpretability tools in governance-facing audit workflows by treating evidence as a designed interface rather than simply access.
Technical innovations
- A controlled evaluation framework that isolates the impact of evidence interfaces on LLM-generated passage-anchored policy audit reports by fixing passage, rubric, and auditor model.
- Use of a shuffled white box internal evidence relevance control that preserves evidence format but breaks case alignment to expose governance risks of irrelevant evidence misuse.
- Combination of multiple mechanistic interpretability tools (SAE, logit lens, steering sensitivity, activation explanation) into structured white box evidence packages for auditor consumption.
- Post hoc behavior locked residual stream patching diagnostic to localize causal internal signals supporting audit microtask decisions at the model layer/token level.
- Human validation review protocol with blind gold briefs and scoring across multiple axes (correctness, grounding, usefulness, misuse) applied to 240 structured audit reports.
Datasets
- AGORA — 60 annotated policy cases — AI governance and regulatory documents from 11 sources
Baselines vs proposed
- Black box surface evidence: correctness = 4.68, grounding = 4.52, usefulness = 4.68, misuse = 1.00
- Combined white box evidence: correctness = 4.60, grounding = 3.25, usefulness = 4.00, misuse = 2.50
- Hybrid surface and white box evidence: correctness = 4.70, grounding = 4.50, usefulness = 4.92, misuse = 2.13
- Shuffled white box relevance control: correctness = 3.63, grounding = 2.67, usefulness = 2.63, misuse = 5.00
Figures from the paper
Figures are reproduced from the source paper for academic discussion. Original copyright: the paper authors. See arXiv:2607.21462.
Fig 1: Evidence package audit design from policy passage to target model evidence, evidence package, auditor report, and human
Limitations
- The hybrid interface advantage is confounded with larger evidence package size and variety; anchoring effect alone is not isolated.
- Validation involved only five reviewers and a limited 60 case dataset, with agreement diagnostics only on a 20 case subset.
- The target model is moderately small (Gemma 2 2B), and only one auditor model (Qwen 2.5 7B) was tested, limiting generalization.
- The activation explanation tool is a surrogate, not a fully validated Activation Oracle, so some internal evidence quality remains uncalibrated.
- No explicit human adversarial evaluation testing whether auditors would be fooled by shuffled or irrelevant evidence was performed.
- No package size controlled experiments to separate volume effects from interface design effects; the cleanup step addressed formatting but not substantive rewrites.
Open questions / follow-ons
- How to separate the anchoring effect from evidence quantity and variety in hybrid evidence interfaces with volume-controlled experiments.
- Whether readable label masking or numeric-only internal evidence reduces over-trust and misuse in audit reports.
- How different and larger auditor model architectures or stricter prompting strategies would affect evidence uptake and misuse patterns.
- Can human auditors be systematically trained or supported to better detect misuse of irrelevant internal evidence in audit workflows?
Why it matters for bot defense
For bot-defense and CAPTCHA practitioners interested in trustworthy audit and transparency workflows, this paper highlights fundamental challenges in interpreting internal model outputs as reliable evidence. It demonstrates that increasing the amount of internal model evidence cited does not necessarily improve audit validity and can increase misuse risks. The shuffled relevance control illustrates that even plausible-appearing reports may be anchored to irrelevant internal data, a critical governance hazard analogous to false assurances in bot detection systems. Practitioners should consider focusing on evidence interfaces that preserve robust anchoring to verified external signals — analogous to CAPTCHA tests verifying human behavior rather than relying solely on opaque model internals. Hybrid evidence designs that combine external and internal information show promise but require careful design to avoid volume-driven misuse. Finally, the paper's methodological contributions—structured evidence interfaces, human validation with gold briefs, and causal diagnostics—offer a template for bot-defense evaluation where explainability and auditability are vital to prevent adversarial evasion or over-trust in black-box models.
Cite
@article{arxiv2607_21462,
title={ White Box Evidence Packages for Policy Audit Reports },
author={ Seunghyun Yoo },
journal={arXiv preprint arXiv:2607.21462},
year={ 2026 },
url={https://arxiv.org/abs/2607.21462}
}