Output scores can miss changes to an AI agent’s runtime stack

If an agent’s answers pass an evaluation, does that show the evaluated system is the one described in the report? A deployed agent includes more than its model: prompts, tools, retrieval data, and runtime software can also change.

The paper asks whether output scores can reveal those changes when the answers still look acceptable.

DIB-Bench compares output scoring with component-hash checks to show why passing answers alone cannot establish which agent stack was evaluated.

The authors compared output evaluators on the same clean and tampered deployments. Across six single-component changes and nine runs in the synthetic study, rule-based scoring accepted a mean 88.6% of tampered outputs, while GPT-5-nano accepted 94.1%.

The measure is the share of outputs from changed deployments that each evaluator accepted, averaged across those conditions and runs.

A separate hash check passed the clean deployment and failed all six tampered conditions, whose changed components were declared in the manifest.

This contrast supports the paper’s central point: answer acceptance measures behavior on tested inputs, while component hashes provide evidence about which listed system parts were deployed.

The checks cover only components listed in the manifest, and a match says nothing by itself about safety or correctness.

The experiments focused mainly on synthetic, single-component changes; they do not establish protection against forged manifests, multiple simultaneous changes, or frontier-scale deployments.