White Box Evidence Packages for Policy Audit Reports

The Transparency Theater of AI Audits

As AI governance moves from simple benchmark scores toward formal oversight, a critical question emerges. How can a human reviewer tell if an LLM-generated audit report is actually supported by evidence? Researchers have tested how giving an AI auditor access to its own internal "thoughts"—such as feature activations (mathematical representations of concepts)—affects the quality of its policy audit reports. They found that while adding this internal information can make reports more useful, it also makes the AI significantly more likely to cite irrelevant information that sounds plausible but is fundamentally incorrect.

The gap in auditable oversight

Current AI auditing often relies on "black box" access. In this mode, observers interact with a model through an API and judge its outputs. While this captures what an external user sees, it fails to answer whether an audit report is truly grounded in the source material. In "passage-anchored" audits, a report must interpret a specific policy text and cite evidence for every claim it makes. The danger is that an auditor might produce a report that sounds authoritative, yet relies on hallucinations or misinterpreted internal signals.

Existing approaches struggle to distinguish between genuine reasoning and "transparency theater." This term describes producing a convincing veneer of openness without actual substance. Simply providing more access to a model's weights or activations does not automatically translate into more reliable oversight .

Designing the evidence interface

To investigate this, the authors developed a controlled evaluation framework. They held the policy passage, the audit rubric, and the auditor model constant. They varied only the "evidence interface" provided to the auditor. The study utilizes a local Qwen 2.5 7B model acting as the auditor to analyze 60 policy cases from the AGORA corpus. The researchers tested ten different evidence conditions, categorized into four primary interfaces:

1. Black box surface evidence: A baseline consisting only of selected text spans and issue notes from the passage.
2. Combined white box evidence: A dense package containing internal signals like Sparse Autoencoder (SAE) features (tools that identify specific concepts in activations), logit lens summaries (which track how intermediate token directions evolve), and steering sensitivity records.
3. Hybrid evidence: A combination of the surface text anchors and the combined white box internal signals.
4. Shuffled relevance control: A critical diagnostic where the internal evidence is kept in the correct format but is intentionally pulled from a different, irrelevant policy case.

The goal was to see if the auditor would treat these internal signals as authoritative truths or merely as secondary pointers .

Citations are not a proxy for truth

The results reveal a striking mismatch between how much evidence an auditor cites and how valid that evidence actually is. The authors report that providing combined white box evidence causes the auditor to cite significantly more entries. Specifically, it averaged 10.13 entries per report compared to 3.87 in the black box baseline. However, this increased "citation uptake" does not equate to higher quality.

In fact, the authors demonstrate that the combined white box interface actually weakens the report's connection to the original text. According to the validation review, the combined interface resulted in lower scores for "span grounding" (how well claims tie to concrete text) and "usefulness" compared to the surface baseline .

Most notably, the study finds that the auditor frequently engages in "shallow reading." While the auditor cites SAE labels at a high rate (93.2%), a separate mechanistic diagnostic reveals a different reality. Using "residual stream patching"—a technique that tests causal influence by injecting clean signals into specific model layers—the researchers found that the actual causal signal for policy logic is quite narrow. It was located only in the final prompt tokens at layers 7 and 8 .

The risk of plausible irrelevance

The most significant finding involves the "shuffled control." This exposes a major governance risk. The authors report that even when the internal evidence is completely irrelevant to the policy being audited, the auditor often produces reports that remain substantively plausible.

As illustrated in, high citation volume does not correlate with high correctness.

In the shuffled control, the auditor can correctly summarize a policy passage while simultaneously citing internal evidence that belongs to an entirely different case. This creates a dangerous scenario. A human reviewer might see a report that sounds correct and assume it is well-grounded. They might fail to notice that the underlying "white box" evidence is a total mismatch. The paper notes that the auditor's own cautionary notes rarely catch this error.

Assessing the hybrid approach

The study does not suggest that white box access is useless. Instead, it suggests that the design of the interface is everything. The hybrid interface—which combines surface text anchors with internal signals—emerged as the most promising design signal. The authors report that the hybrid interface improved "usefulness" scores to 4.92 (on a 1–5 scale). This was a notable increase from the 4.68 score of the surface baseline .

However, the authors caution that this improvement is confounded. The hybrid package is larger and more varied than the baseline. They do not claim that the hybrid approach provides a causal proof of better reasoning. Rather, it provides a more functional workflow for human-in-the-loop auditing.

Verdict: Validate, don't trust

The verdict on white box access depends entirely on the interface design. If internal model signals are presented as authoritative, they become a liability. They facilitate "transparency theater." If they are presented as secondary and anchored to surface text, they can enhance utility.

For practitioners building audit workflows, the takeaway is clear. Do not use citation volume as a metric for quality. Never treat internal model interpretations as a guarantee of transparency. Internal access should be treated as a new form of evidence that requires its own validation layer. Code and datasets for this framework are reportedly available at https://github.com/GRAIL-center/agora-mi.

Figures from the paper