Audit the Step, Not the Aftershock

TL;DR for operators

When an autonomous analysis agent makes one questionable operation, every later operation may inherit the damage. An audit that merely asks which steps look unusual can therefore produce a long queue of downstream symptoms rather than isolate where new violations occurred.

Ahmed Hassoon and Mark Dredze formalize a different target: score each operation according to whether it behaved as expected given the state it actually received.¹ Under their assumptions, a correctly executed downstream step remains statistically null even when its input was already corrupted. This makes one-step scoring useful for narrowing a review queue.

The trade-off is that narrow localization is not always the most sensitive detector. Errors spread gradually across several operations may require longer prediction horizons, which accumulate more signal but also spread one underlying disturbance across multiple scores.

The paper then addresses an operational issue that raw anomaly scores leave unresolved: how many innocent operations enter the review set. Conformal calibration combined with multiple-testing procedures can control trajectory-level false discovery under stated assumptions. But robustness is not free. Increasing uncertainty outside the training support reduces false alarms there while making real off-support errors harder to detect.

The deepest constraint is dimensionality. The paper derives a finite-calibration attribution floor that shrinks as roughly $n^{-1/(d+2)}$. At $d=256$, multiplying valid calibration data by 100 leaves about 98.2% of that floor intact. For organizations deciding whether to collect more successful trajectories or redesign the audit representation, that result changes the investment question.

A bad step can create many innocent-looking consequences

Consider an agent that selects a cohort incorrectly, then performs a valid join, fits a model correctly to the resulting data, and produces a report consistent with that model. The final output may be wrong, but several later operations have not independently violated their execution mechanisms. They have simply inherited a bad state.

The paper’s central result, in Section 3.1, addresses this distinction. The auditor evaluates the current operation conditional on the state entering it. In the Gaussian formulation, the core statistic is a whitened one-step deviation:

Here, the question is not whether the trajectory still resembles an ideal successful trajectory. It is whether operation $t$ produced an unexpected next state given what it actually received.

That conditioning choice is what creates localization. If an earlier error changes the workflow state but a later operation still follows the valid conditional transition law, the later residual remains null. The inherited damage is absorbed into the conditioning state instead of being counted again.

For an audit team, this changes what a flag means. A one-step flag identifies evidence of a new mechanism violation at that operation. It does not establish that the step caused the final business failure, nor does the absence of a flag prove that the inherited state was sound.

Narrow localization can miss errors that accumulate slowly

Once one-step scoring solves the downstream-aftershock problem, it is tempting to use it everywhere. The paper shows why that would be an incomplete design.

Suppose a perturbation is distributed across several consecutive operations. Each individual deviation may be weak, while their cumulative effect is material. Longer-horizon residuals deliberately stop conditioning on every intervening realized state, allowing deviations to accumulate within the scoring window.

The result is a deliberate exchange: more sensitivity to gradual errors, less precise localization. A single corruption can influence as many as $k$ scores under a $k$-step horizon, and overlapping windows also create dependence between tests.

The authors further show that a dyadic set of horizons—$1,2,4,\ldots$—can achieve at least $1/\sqrt{2}$ of the noncentrality available to a perfectly matched horizon while requiring only $O(\log T)$ horizon choices.

Cognaptus inference: an operational auditor should not treat horizon as a fixed modeling hyperparameter selected only for benchmark accuracy. It determines the granularity of the review queue. One-step scores suit “which operation introduced a new violation?” Longer horizons address “is something gradually drifting across this part of the workflow?” A multi-horizon system can serve both questions, but its reporting interface should preserve that distinction.

A review queue needs error control, not just anomaly thresholds

An anomaly threshold answers whether one score is unusual. An operational audit returns a set of suspicious operations, often with dependent scores. The relevant governance question is how many innocent operations that set contains.

The paper constructs conformal p-values by ranking an operation’s score against scores from valid calibration trajectories:

Under the paper’s calibration and validity conditions, Benjamini–Yekutieli can then control trajectory-level false discovery rate even under arbitrary dependence. Stronger dependence assumptions can permit less conservative procedures, while valid e-values provide another route without the same harmonic penalty.

This is stronger operationally than labeling each operation independently above a fixed anomaly threshold. It gives governance teams a way to specify how much false review workload they are willing to tolerate over repeated audited trajectories.

The boundary is important. False discovery rate is a long-run property; it is not a guarantee that any particular short report contains only a small fraction of false flags. The paper explicitly notes that high-probability guarantees for a single trajectory can remain weak when workflows contain only tens of operations.

Selection also matters. If organizations audit only trajectories that already look suspicious, benign p-values may become anti-conservative. The paper introduces an odds-ratio sensitivity parameter $\Gamma$, translating selection uncertainty into a stricter operating threshold such as $q/\Gamma$.

Robustness outside the training support costs sensitivity

Autonomous agents will eventually reach states that were rare or absent among successful calibration runs. One response is to enlarge predictive uncertainty as the state moves away from the training support.

The paper shows conditions under which distance-dependent variance inflation can make benign off-support scores conservative. But that same inflation reduces the noncentrality of genuine perturbations.

For dense Gaussian shifts, the approximate detection requirement scales with both representation dimension and effective predictive variance:

The affected decision is straightforward: a risk team can reduce off-support false alarms by widening uncertainty, but it simultaneously raises the size of error required for detection. A system cannot claim stronger off-support conservatism without accounting for the sensitivity it surrendered.

More calibration data barely moves the floor in high dimension

The paper’s strongest challenge to conventional scaling intuition appears in its identifiability analysis.

Even with an appropriate minimum-effect definition, finite calibration leaves uncertainty about what valid agent behavior could have been in poorly sampled parts of the state space. A small apparent corruption may be indistinguishable from an unobserved but legitimate feature of the valid transition mechanism.

The resulting confusability floor scales as

Its dependence on $n$ becomes punishingly weak as dimension rises.

These are theoretical calculations, not observed production measurements. Their role is to expose scaling behavior.

For organizations representing every agent step with hundreds of unconstrained latent dimensions, the business inference is consequential: collecting substantially more successful trajectories may do little to improve attribution of small violations. Preserving lower-dimensional, task-relevant structure can be a more effective auditing investment than simply expanding the calibration warehouse.

Pooling recurrent operation types helps with ordinary noise—the detectable noncentrality improves by a square-root factor in the number of independent occurrences—but it does not resolve uncertainty about the valid mechanism itself. Repetition improves power against a known null; it does not erase confusability about what the null should be.

The audit identifies violations, not causal blame

The framework should be read as a statistically controlled triage mechanism.

Its localization guarantee depends on a competence-preservation condition: after an earlier error, downstream benign operations must still follow the valid conditional mechanism. If the agent enters a different behavioral regime after failure, the assumption breaks and a changepoint or latent-regime model becomes more appropriate.

Exact corrupted-step recovery is also impossible without defining a minimum departure worth distinguishing. Arbitrarily small changes in transition kernels can make different corrupted-step sets observationally indistinguishable. This is not a weakness of one particular score; it is an identifiability limit.

The evidence itself is formal rather than deployment-based. The paper proves localization, detection, robustness, multiple-testing and impossibility results and supplies theoretical numerical calculations. It proposes diagnostics and simulations, but does not report an empirical evaluation on deployed autonomous analysis-agent trajectories.

That leaves an implementation question unresolved: how closely real agent representations, transition models, post-error behavior and calibration procedures satisfy the assumptions required for these guarantees.

Audit architecture becomes a governance decision

The paper shifts agent auditing away from a single question—“How accurately can we detect anomalies?”—toward a set of design choices with different operational consequences.

Conditioning one step at a time determines whether downstream consequences are repeatedly escalated. Prediction horizon determines how sensitivity to gradual failures is traded against localization width. Multiple-testing procedures determine the false review burden. Off-support variance policies determine the balance between conservatism and sensitivity. Representation dimension determines how much additional calibration data can realistically improve attribution.

None of these choices turns a flagged set into a causal account of why the final answer failed. What they can provide is narrower and more defensible: a review queue whose statistical meaning, sensitivity limits and failure conditions are explicit.

For autonomous analysis systems, that is a more useful governance target than simply producing a larger anomaly score.

Cognaptus: Automate the Present, Incubate the Future.