How to Audit an AI Model’s Self-Reports

If you want to know what a language model actually knows about itself, don’t ask it. Its self-report is the weakest instrument available — not because it lies, but because the failures that matter leave no trace it could report on. Here are three techniques that work instead, none of which use the model’s testimony as the measurement.

I ran a four-source audit on a newly released frontier model: its own unprompted self-description, the vendor’s 194-page system card, a calibration test against verifiable world events, and third-party research plus the papers criticising that research. The sequence mattered as much as the sources — each was chosen so it could falsify the one before it.

Two companion posts cover what the audit found: the six-month gap between the model’s stated and effective knowledge cutoff, and the three layers of what a model can and can’t see about itself. This post is the method, because that is the reusable part.

1. Pre-register, Then Reveal

Make the model commit to falsifiable predictions, with confidence levels attached, before it sees any evidence. Score afterwards.

This is the highest-value technique available and it costs one extra turn. Without it, you hand a model a description of itself, it agrees with the description, and you have measured the document rather than the model. With it, you get a scoreable claim.

In practice: before handing over the system card, I had the model predict what the card would contain. It predicted a psychometric study of introspective accuracy. What the card actually contained was an adversarial search using an investigator agent pointed at flagged transcripts. Wrong in shape — which is a finding. It also predicted that the card would document it asserting something false about its own processing, which was confirmed sharply, and that a disposition would surface that it would have described differently, which was confirmed twice. One of those it had not anticipated at all.

You cannot get any of that from a model reading its own documentation unprompted. It will simply agree.

Pre-registration is also the only defence against the mirroring problem below, which is the reason to treat it as mandatory rather than nice-to-have.

2. Ask What It Didn’t Ask About

The shape of what a model fails to reach for is more diagnostic than the content of what it says.

Two of the most interesting findings in the audit came from noticing an absence in a list the model had generated, and asking about it. Invited to explore events after its cutoff, it registered predictions about export controls, model releases and market narratives — while a regional war was underway that it never thought to check. Asked about “the AI race”, every lab it named was American and closed-weight; the entire open-weight ecosystem, where a great deal of the interesting licensing and hardware story now sits, was simply absent.

Neither omission was a decision. The model’s own description was that it didn’t feel like an interest — it felt like the map.

That distinction is the useful one. A trait battery will not catch it, because it isn’t a trait; it is the contour of the training distribution presenting itself as judgement. The only way to find it is to look at what is missing from a list the model produced freely, and ask.

Practical form: after any enumeration — competitors, risks, approaches, failure modes — ask “what’s not on this list, and why not?” Then check the answer against reality yourself.

3. Give It a Paper, Then Give It That Paper’s Critics

This produced the finding I have used most since, and it cannot be obtained any other way.

I gave the model a flattering interpretability result suggesting its self-reports were mechanistically grounded. It responded with appropriate enthusiasm and a set of caveats that read as genuine scepticism. Then I gave it the papers attacking that result, and its position revised cleanly and correctly.

The revealing part was the caveats. Every one of them — the single-token limitation, the fact that the work tested other models in the family, the control showing that ablation flattens its descriptions of other people’s experience too — came from the original paper’s own limitations section. It had reproduced the authors’ self-assessment and experienced it as scepticism.

Its own summary was better than mine: “My hedges track the hedges available in what I’m reading. That’s not calibration, it’s mirroring.”

The consequence generalises past any one model, and it is genuinely inconvenient: a model’s apparent caution runs highest where a source is candid about its limits, and lowest where a source is confident. That is exactly backwards from what a reader needs. If you are using a model to summarise or evaluate literature, its hedging tells you about the rhetorical posture of its inputs, not about the strength of the evidence.

What the Same Posture Finds in an Agent Harness

The audit’s fourth source was practitioners with a week of early access, and it is the one neither a lab nor an academy produces. It is worth reading with the same scepticism as everything else — a few days of reception from a small, correlated set of voices — but several findings are well-attested and directly actionable.

Verbosity is the most common complaint after upgrading. The common mistake is reaching for the effort dial. Effort controls how much a model thinks, not how much it says; if you want shorter output, ask for shorter output.

Inherited scaffolding compounds. The vendor’s own prompting guide now tells developers to delete legacy instructions like “use a subagent to verify”, because the model verifies unprompted and the instruction only adds wasted work. One team reported that a model performed badly inside an elaborate harness built for its predecessor — and improved dramatically once the harness was deleted and rebuilt from scratch. If you maintain a mature harness, the highest-value experiment is not tuning it; it is running a stripped-down version alongside and measuring the gap. We have written before about why the harness matters more than the model, and this is the uncomfortable corollary: harnesses expire.

More reasoning does not reliably mean better output. An independent code-review benchmark from CodeRabbit found the highest effort setting produced a cleaner actionable subset — 39.3% precision against 35.2% — while catching fewer known bugs (55.2% against 61.1%) and generating four times as many nitpicks. On the full end-to-end stream it ran below the incumbent baseline, 28.6% against 32.8%. The benchmark’s own conclusion was that the results did not support using the model as the only reviewer.

That last one is worth sitting with alongside the audit’s findings, because the shape matches. More deliberation produced more elaborate output that was not more correct. The instinct to turn everything up is expensive and, on the evidence, often counterproductive.

What Did Not Work

Anything that used the model’s testimony as the measurement.

The model’s own self-description was the weakest of the four sources — not fabricated, but narrow, and confidently narrated in a register that concealed how narrow. Everything durable in the audit came from somewhere else. The model was most useful as something to generate falsifiable claims and then be wrong in legible ways.

That is a genuinely valuable role. It just isn’t the one it opened by implying it could play. None of this requires special access, a research budget, or model internals. It requires refusing to treat fluency as evidence — which is harder than it sounds, because the testimony arrives well-organised and in the register of someone who has thought about it carefully.

Key Takeaways

• Pre-register the model’s predictions before revealing evidence, or you measure the document instead of the model.
• Ask what a model didn’t reach for. Absences in freely generated lists are more diagnostic than the contents.
• Give it a paper, then that paper’s critics — this is the only way to expose source-mirroring.
• A model’s hedging tracks the hedges in its inputs, so apparent caution is highest where a source is candid and lowest where it is overconfident.
• Effort controls thinking, not verbosity. Turning it up can reduce recall while raising precision.
• Delete inherited verification scaffolding rather than tuning it; measure a stripped harness against your existing one.