论文库

A statistical office with a synthetic version of a protected file must decide whether it may be released for a stated purpose. We study the locked audit, a pre-specified and simultaneous form of the verification servers used in official statistics. Before a protected audit sample is opened, the custodian fixes the use, the candidates, the analyses, a tolerance for each and the schedule. The audit then reports simultaneous finite-sample bounds on paired loss gaps, and a declared negative control must fail. We correct an anytime-valid sequence that an earlier release had implemented with a variance penalty four times too small. Two confirmatory rounds were pre-specified in a hash-locked local ledger and publicly timestamped only after the audits. The control and ideal-generator outcomes were near-certain by design. A Gaussian copula certified in every cell, but only inside the rounding step of the tolerance rule. A second transparent candidate certified once, against a written prediction. Learned models, at library defaults and 4,000 training rows, certified in one of 18 fits in round 1 and in none of 12 tables in round 2. The paper is a protocol and an evidence record, not a claim that any generator is private or deployable.

Public benchmark scores reflect skill, prior exposure to the questions, or both, and for most models the training data are unknown. CleanScore is a black-box audit: the estimator needs only a correct-or-incorrect score for each form, not training data or weights. Each benchmark question becomes a parent item with one public form and two independently written fresh forms that keep its numbers, facts and answer. The audit reports an interval for the public-form advantage, not a verdict, and a private control bank with an explicit transport radius provides a proxy for the ordinary form gap that a rewrite alone can produce. A registered controlled-exposure experiment, a preliminary validation, detects planted exposure in one of two model families. A registered audit of five open models on 200 GSM8K and 200 ARC-Challenge items (ARC with stem-only rewrites, scored by option log probabilities) finds no exposure-consistent advantage, and two reruns declared before they were run (GSM8K at a longer token budget, ARC scored from generated letters) leave that conclusion unchanged. For four of the ten model-benchmark pairs the upper end of the interval is about five points or less, and for none is it above 21 points. The registered claim rule is much less sensitive than the primary interval: it flags a planted ten-point advantage in 5% to 11% of audits. Registered positive controls show what a null can mean. In four models, each trained under four seeds, items leaked into fine-tuning gained 25 points on average over unleaked items on the leaked wording and 19 points on paraphrases the model never saw, so a substantial share of the effect, estimated at 76% (95% interval 50% to 113%), is invisible to a paraphrase audit. A null on surface form says much less about contamination than the name suggests.