NL-PAC: Specification Ambiguity and Certified Minimax Risk Floors in LLM-Mediated Supervision

# Specification Ambiguity and Certified Minimax Risk Floors in LLM-Mediated Supervision
Source: [https://arxiv.org/html/2607.08961](https://arxiv.org/html/2607.08961)
Berkay Anahtarci Department of Mathematical Engineering, Özyeğin University, Istanbul, Türkiye berkay\.anahtarci@ozyegin\.edu\.tr

###### Abstract

Large language models increasingly provide labels, evaluations, and feedback for tasks specified in natural language\. When a specification admits multiple readings but the supervision channel does not reveal which is operative, additional labels reduce sampling error without resolving the resulting identification problem\. We introduce Natural Language PAC \(NL\-PAC\), a framework that uses a fixed model’s thresholded decoding law to define admissible labels and candidate targets\. The probability that multiple labels are admissible equals the diameter of the pointwise\-admissible target class, and under target\-blind supervision every learner incurs worst\-case risk of at least half this diameter, at every sample size; the exact randomized minimax risk over this class is attained by a data\-independent strategy\. Finite\-sample confidence bounds make these quantities certifiable from held\-out unlabeled inputs\. In a frozen Qwen 2\.5–3B audit, one prespecified prompt yields a positive model\-relative certificate, whereas a paraphrase and exact\-rule controls yield zero\. A held\-out bridge audit finds that supplied candidate reading clauses fail the admissibility condition needed to transfer the certificate to coherent readings\. The guarantee is specific to the audited model, prompt, threshold, and input distribution; extending it to human interpretations requires external validation\.

## 1Introduction

Modern learning pipelines increasingly use large\-language\-model \(LLM\) judgments in place of human evaluation or labeling, including in LLM\-as\-a\-judge systems\(Liu et al\.,[2023b](https://arxiv.org/html/2607.08961#bib.bib37); Kim et al\.,[2024](https://arxiv.org/html/2607.08961#bib.bib30); Gu et al\.,[2026](https://arxiv.org/html/2607.08961#bib.bib21)\)\. Prompts and scoring rubrics specify these tasks in natural language and may admit multiple interpretations\. The supervising model can adopt one interpretation without revealing which one governs its judgments\. We call the supervision channel*target\-blind*when its observation law does not reveal which reading is operative\. This regime is common in practice: judge models are typically served through proprietary APIs whose internals are opaque to the analyst\(La Malfa et al\.,[2024](https://arxiv.org/html/2607.08961#bib.bib33)\), so the operative reading is unobservable by construction\. Target blindness refers to this hidden reading; whether the model’s decoding probabilities are exposed is a separate matter that later governs the audit’s access mode\. The resulting error is interpretive rather than statistical: additional observations from the same unresolved channel do not identify the operative reading, although a more informative channel can\. We ask how much minimax risk remains when the channel defining the admissible targets is also the learner’s only source of supervision, and whether that risk floor can be certified from unlabeled inputs\. We formalize the setting as*Natural Language PAC*\(NL\-PAC\), characterize when such a channel creates an irreducible risk floor, and turn that floor into a finite\-sample certificate\.

Classical statistical learning theory does not model this coupling between task specification and the supervision channel: in the Probably Approximately Correct \(PAC\) framework ofValiant \([1984](https://arxiv.org/html/2607.08961#bib.bib57)\), the analyst fixes the instance space, distribution, target, and hypothesis class, and the learner pays only the statistical price of estimating a target inside that specification\. This is the separation underlying VC theory and computational learning theory generally\(Kearns and Vazirani,[1994](https://arxiv.org/html/2607.08961#bib.bib29)\)\. Language\-model systems collapse this separation: the task is given as a natural\-language instruction, and the supervision signal is produced by a model interpreting that same instruction\(Liu et al\.,[2023a](https://arxiv.org/html/2607.08961#bib.bib35)\)\. NL\-PAC makes this specification–channel pair the object of analysis\.

Formally, a fixed model, prompt, and threshold induce at each input an*admissible label set*Aτ​\(x\)A\_\{\\tau\}\(x\); the overlap massDτ⋆=ℙ​\(\|Aτ​\(X\)\|≥2\)D^\{\\star\}\_\{\\tau\}=\\mathbb\{P\}\(\|A\_\{\\tau\}\(X\)\|\\geq 2\)is the diameter of the pointwise\-admissible core of the induced candidate class, and under target\-blind supervision every learner incurs worst\-case risk at leastDτ⋆/2D^\{\\star\}\_\{\\tau\}/2, with the exact obstruction given by a multiplicity\-weighted valueVτ⋆V^\{\\star\}\_\{\\tau\}over the admissible core\. This bound does not vanish with sample size\. Because this floor is a functional of the model\-induced admissible sets, it can be certified from unlabeled deployment inputs whenever those sets are observed exactly or estimated with a certified decoding radius\. The rest of the paper develops and audits these quantities\.

#### Contributions\.

We establish four results that together characterize how a model\-induced ambiguity set creates an irreducible learning floor and how that floor can be audited from held\-out unlabeled inputs\.

1. 1\.Representation\.Thresholded model outputs define a pointwise\-admissible core and its openζ\\zeta\-tolerance class\. The core diameter equals the overlap massDτ⋆=ℙ​\(\|Aτ​\(X\)\|≥2\)D^\{\\star\}\_\{\\tau\}=\\mathbb\{P\}\(\|A\_\{\\tau\}\(X\)\|\\geq 2\), while the tolerance\-class diameter lies in\[Dτ⋆,Dτ⋆\+2​ζ\]\[D^\{\\star\}\_\{\\tau\},D^\{\\star\}\_\{\\tau\}\+2\\zeta\], with both endpoints sharp \([Theorem˜2\.11](https://arxiv.org/html/2607.08961#S2.Thmtheorem11); sharpness in[Appendix˜B](https://arxiv.org/html/2607.08961#A2)\)\.
2. 2\.Blind\-channel value\.Target blindness yields a half\-diameter minimax floor over the tolerance class and the exact valueVτ⋆V^\{\\star\}\_\{\\tau\}over the core, uniformly in the learner’s sample size \([Theorems˜3\.2](https://arxiv.org/html/2607.08961#S3.Thmtheorem2)and[3\.5](https://arxiv.org/html/2607.08961#S3.Thmtheorem5)\)\. The latter is attained by a data\-independent randomized learner and witnessed by an explicit finite least\-favorable family\. It equalsDτ⋆/2D^\{\\star\}\_\{\\tau\}/2when at most two labels are admissible at almost every input and is strictly sharper when higher\-order overlap has positive mass\.
3. 3\.Coherent readings\.An explicitη\\eta\-coverage condition bounds the gap betweenVτ⋆V^\{\\star\}\_\{\\tau\}and the blind minimax value over a finite family of global readings \([Theorem˜3\.9](https://arxiv.org/html/2607.08961#S3.Thmtheorem9)\)\. This condition addresses the fact that pointwise selectors need not represent coherent global interpretations\. A fit–holdout audit finds that the bound is uninformative for the supplied two\-reading pool \([Section˜5](https://arxiv.org/html/2607.08961#S5.SS0.SSS0.Px2)\)\.
4. 4\.Certification\.Observed admissible sets give Hoeffding certificates for the pairwise floor, diameter, and exact core value:NNheld\-out inputs give a pairwise lower certificate at a Hoeffding radius, and under sampled decoding the radius additionally pays threshold\-margin and finite\-depth terms \([Proposition˜4\.1](https://arxiv.org/html/2607.08961#S4.Thmtheorem1);[Corollary˜4\.5](https://arxiv.org/html/2607.08961#S4.Thmtheorem5);[Theorem˜4\.6](https://arxiv.org/html/2607.08961#S4.Thmtheorem6);[Propositions˜4\.9](https://arxiv.org/html/2607.08961#S4.Thmtheorem9)and[4\.10](https://arxiv.org/html/2607.08961#S4.Thmtheorem10)\)\.

#### Adjacent literatures\.

Two adjacent literatures bracket the problem without containing it\. Noisy and weak supervision assume an operative target and analyze corrupted, aggregated, or heuristic observations of it\(Natarajan et al\.,[2013](https://arxiv.org/html/2607.08961#bib.bib44); Ratner et al\.,[2017](https://arxiv.org/html/2607.08961#bib.bib50); Dawid and Skene,[1979](https://arxiv.org/html/2607.08961#bib.bib15)\)\. In classical malicious\- and nasty\-noise models, the resulting lower bounds scale with the corruption budget and vanish as that budget vanishes\(Kearns and Li,[1993](https://arxiv.org/html/2607.08961#bib.bib28); Bshouty et al\.,[2002](https://arxiv.org/html/2607.08961#bib.bib10)\)\. Instance\-dependent noise further illustrates the role of structural restrictions: bounded instance\- and label\-dependent noise is learnable under additional conditions, as shown byCheng et al\. \([2020](https://arxiv.org/html/2607.08961#bib.bib11)\), whereas an unrestricted noise law leaves the target–noise decomposition unidentified\. Truth\-tracking analyses similarly ask when reports from imperfect sources identify an externally defined state\(Singleton and Booth,[2024](https://arxiv.org/html/2607.08961#bib.bib51)\)\.

LLM\-as\-a\-judge research instead makes language part of the evaluation interface: work on rating indeterminacy documents that the criteria supplied to a judge may themselves admit multiple valid readings\(Guerdan et al\.,[2025](https://arxiv.org/html/2607.08961#bib.bib22)\)\. Quantitative analyses bound how far judge labels can substitute for ground truth under*exogenous*judge error or bias\(Dorner et al\.,[2025](https://arxiv.org/html/2607.08961#bib.bib16); Feuer et al\.,[2026](https://arxiv.org/html/2607.08961#bib.bib19)\)\. NL\-PAC isolates the intersection of these concerns: the same specification\-mediated channel both defines the admissible targets and supplies the observations, so its inability to reveal the operative reading creates an identification obstruction\. That obstruction is set by the indistinguishability of admissible readings, not by a noise budget, and is endogenous to the model’s own interpretation\.

On the alignment side, an information\-theoretic argument holds that no specification can pin down an external target while conditional entropy remains\(Young,[2025](https://arxiv.org/html/2607.08961#bib.bib64)\), and reward\-misspecification studies show that optimizing a proxy for an underspecified objective can diverge sharply from the intended one\(Pan et al\.,[2022](https://arxiv.org/html/2607.08961#bib.bib47)\); the ambiguity diameter certified here is an operational, model\-relative witness of that gap\. The closest prior quantity is the*ambiguity degree*of partial\-label learning\(Cour et al\.,[2011](https://arxiv.org/html/2607.08961#bib.bib13); Liu and Dietterich,[2014](https://arxiv.org/html/2607.08961#bib.bib36)\), which marks exactly the condition under which candidate\-label ambiguity does*not*create an irreducible floor; NL\-PAC characterizes the complementary regime, in which the channel cannot disambiguate\. Further bordering literatures, including learning from disagreement, perspectivist and prompt\-underspecification research, and inference on partially identified parameters, are treated in[Appendix˜D](https://arxiv.org/html/2607.08961#A4)\.

#### Relation to classical theory\.

NL\-PAC instantiates classical statistical decision theory in a language\-mediated supervision problem\. The two\-target and least\-favorable\-prior reductions follow standard arguments\(Wald,[1950](https://arxiv.org/html/2607.08961#bib.bib60); Blackwell and Girshick,[1954](https://arxiv.org/html/2607.08961#bib.bib9); Ferguson,[1967](https://arxiv.org/html/2607.08961#bib.bib18)\), and the per\-input value coincides with the finite zero–one subset game from adversarial multiclass classification\(Fathony et al\.,[2016](https://arxiv.org/html/2607.08961#bib.bib17)\)\. The NL\-PAC contribution is to derive the target set and observation channel from a fixed model–prompt configuration, construct an explicit finite least\-favorable family of admissible selectors, and make the resulting minimax value certifiable from held\-out unlabeled inputs\. The proofs combine classical two\-point testing and concentration arguments\(Tsybakov,[2009](https://arxiv.org/html/2607.08961#bib.bib55); Hoeffding,[1963](https://arxiv.org/html/2607.08961#bib.bib24)\)with this model\-induced structure\.

#### Empirical validation\.

The principal experiment audits a frozen Qwen judge’s declared\-label conditional first\-token probabilities, where the certificate applies with its correction\-free radius: one prespecified prompt yields a positive model\-relative certificate, while a second paraphrase and the exact\-rule controls yield zero \([Section˜5](https://arxiv.org/html/2607.08961#S5)\)\. Two audits delimit the claim: the bridge passes its fitted mixture\-coverage check but fails its held\-out admissibility check for the supplied two\-reading pool, and the sampled\-decoding mode is inconclusive at feasible depth because its finite\-depth and threshold\-margin corrections are vacuous\. Controlled tasks recovering the prescribed zero and positive certificate cases, and a ChaosNLI calculation illustrating the gain from multiclass multiplicity, appear in[Appendix˜C](https://arxiv.org/html/2607.08961#A3)\.

#### Scope of the guarantee\.

The certificate quantifies ambiguity relative to the audited tuple\(LLMθ,Π,τ,P\)\(\\mathrm\{LLM\}\_\{\\theta\},\\Pi,\\tau,P\); it does not by itself identify the designer’s intended target or establish human task ambiguity\. Extending the guarantee to coherent human readings or deployment settings therefore requires coverage and external construct\-validity evidence\.

#### Roadmap\.

[Section˜2](https://arxiv.org/html/2607.08961#S2)defines the admissible geometry;[Section˜3](https://arxiv.org/html/2607.08961#S3)derives the blind\-channel values and coherent\-reading bridge;[Section˜4](https://arxiv.org/html/2607.08961#S4)constructs finite\-sample certificates; and[Sections˜5](https://arxiv.org/html/2607.08961#S5)and[6](https://arxiv.org/html/2607.08961#S6)report the empirical probes, limitations, and extensions\.

## 2NL\-PAC Setup and Model\-Admissible Geometry

This section distinguishes four sources of uncertainty: ambiguity in the task description, stochasticity in model decoding, error relative to a target, and indistinguishability induced by the supervision channel\. The resulting quantities describe the audited model and channel rather than ambiguity in human interpretation\.

### 2\.1Supervision and admissibility channels

We adopt the standard PAC setting\. Let\(𝒳,ℱ𝒳\)\(\\mathcal\{X\},\\mathscr\{F\}\_\{\\mathcal\{X\}\}\)be a measurable instance space, let𝒴\\mathcal\{Y\}be a finite label space with the discreteσ\\sigma\-algebra, and letPPbe a probability measure on𝒳\\mathcal\{X\}\. The target is a measurable labeling functionf:𝒳→𝒴f\\colon\\mathcal\{X\}\\to\\mathcal\{Y\}\. In the classical setting, supervision consists of direct observations off​\(x\)f\(x\)\.

Here, by contrast, the target is specified through natural language\. Let𝒯\\mathcal\{T\}denote the model’s token alphabet and equip the set𝒯∗\\mathcal\{T\}^\{\*\}of finite token strings with the discreteσ\\sigma\-algebra\. The spaces of task descriptions and justifications are measurable subsetsSNL,JNL⊆𝒯∗S\_\{\\mathrm\{NL\}\},J\_\{\\mathrm\{NL\}\}\\subseteq\\mathcal\{T\}^\{\*\}, endowed with the corresponding subspaceσ\\sigma\-algebrasℱSNL\\mathscr\{F\}\_\{S\_\{\\mathrm\{NL\}\}\}andℱJNL\\mathscr\{F\}\_\{J\_\{\\mathrm\{NL\}\}\}\. All sets of strings used below are assumed measurable\. A fixed task descriptionfNL∈SNLf\_\{\\mathrm\{NL\}\}\\in S\_\{\\mathrm\{NL\}\}, supplied independently of the learner, is intended to specify the targetff\.

Throughout, the admissibility channel interprets the description with a pretrained language modelLLMθ\\mathrm\{LLM\}\_\{\\theta\}whose parametersθ\\thetaare frozen\. SinceLLMθ\\mathrm\{LLM\}\_\{\\theta\}is generative,LLMθ\(⋅∣u\)\\mathrm\{LLM\}\_\{\\theta\}\(\\cdot\\mid u\)is a distribution over token\-string*continuations*of a stringu∈𝒯∗u\\in\\mathcal\{T\}^\{\*\}, not over the label set𝒴\\mathcal\{Y\}\. Two fixed maps bridge the gap: a*label\-extraction kernel*\(verbalizer\)

V:𝒯∗→Δ​\(𝒴\)V\\colon\\mathcal\{T\}^\{\*\}\\to\\Delta\(\\mathcal\{Y\}\)taking a generated string to a distribution over labels, whereΔ​\(𝒴\)\\Delta\(\\mathcal\{Y\}\)is the probability simplex on𝒴\\mathcal\{Y\}\(e\.g\. constrained decoding onto a verbalizer set\{vy\}y∈𝒴\\\{v\_\{y\}\\\}\_\{y\\in\\mathcal\{Y\}\}, or parsing an answer field\), and a*prompt template*

Π:SNL×𝒳→𝒯∗,\\Pi\\colon S\_\{\\mathrm\{NL\}\}\\times\\mathcal\{X\}\\to\\mathcal\{T\}^\{\*\},taking a description and an instance to the promptΠ​\(fNL,x\)\\Pi\(f\_\{\\mathrm\{NL\}\},x\)presented toLLMθ\\mathrm\{LLM\}\_\{\\theta\}\. The kernel induces the label probability

pLLMθ​\(y∣u\):=∑s∈𝒯∗V​\(y∣s\)​LLMθ​\(s∣u\)\.p\_\{\\mathrm\{LLM\}\_\{\\theta\}\}\(y\\mid u\)\\;:=\\;\\sum\_\{s\\in\\mathcal\{T\}^\{\*\}\}V\(y\\mid s\)\\,\\mathrm\{LLM\}\_\{\\theta\}\(s\\mid u\)\.For the fixed description, define the prompt\-conditioned*admissibility score*

πLLMθ​\(y∣fNL,x\):=pLLMθ​\(y∣Π​\(fNL,x\)\)\.\\pi\_\{\\mathrm\{LLM\}\_\{\\theta\}\}\(y\\mid f\_\{\\mathrm\{NL\}\},x\)\\;:=\\;p\_\{\\mathrm\{LLM\}\_\{\\theta\}\}\\bigl\(y\\mid\\Pi\(f\_\{\\mathrm\{NL\}\},x\)\\bigr\)\.This score is a decoding probability, not a calibrated posterior over human interpretations\. All label probabilities below refer to this quantity\. The descriptionfNLf\_\{\\mathrm\{NL\}\}and distributionPPare fixed throughout; we suppress them fromAτA\_\{\\tau\},Dτ⋆D^\{\\star\}\_\{\\tau\}, and𝖲𝖾𝗅τ\\mathsf\{Sel\}\_\{\\tau\}, displaying them only where a result varies them \(as inℱτ,ζ​\(fNL\)\\mathcal\{F\}\_\{\\tau,\\zeta\}\(f\_\{\\mathrm\{NL\}\}\)anddiamτ,ζ​\(fNL,P\)\\mathrm\{diam\}\_\{\\tau,\\zeta\}\(f\_\{\\mathrm\{NL\}\},P\)\)\.

###### Assumption \(A1\)\(Measurability\)\.

For everyy∈𝒴y\\in\\mathcal\{Y\}, the mapx↦πLLMθ​\(y∣fNL,x\)x\\mapsto\\pi\_\{\\mathrm\{LLM\}\_\{\\theta\}\}\(y\\mid f\_\{\\mathrm\{NL\}\},x\)isℱ𝒳\\mathscr\{F\}\_\{\\mathcal\{X\}\}\-measurable\.

Abstractly, the learner’s supervision is an*observed\-label kernel*x↦Q\(⋅∣x\)∈Δ\(𝒴\)x\\mapsto Q\(\\cdot\\mid x\)\\in\\Delta\(\\mathcal\{Y\}\), the conditional law of the label it receives at inputxx\. For the fixed\-description base model studied here we restrict attention to a kernelQQthat carries*no*operative\-target argument;[Section˜3](https://arxiv.org/html/2607.08961#S3)later embeds this base model in a target\-indexed familyQfQ\_\{f\}in which target dependence, and hence partial distinguishability, is possible\. Target\-independence is thus a modeling restriction of the base channel, not a property discovered later\. The headline blind\-channel results depend only onQQ, not on how it is realized\. We realizeQQconcretely through a justification oracleggand a decoderρ\\rho, introduced next, so thatQ\(⋅∣x\)=Law\(ρ\(J,x\)∣fNL,x\)Q\(\\cdot\\mid x\)=\\mathrm\{Law\}\(\\rho\(J,x\)\\mid f\_\{\\mathrm\{NL\}\},x\)withJ∼g\(⋅∣fNL,x\)J\\sim g\(\\cdot\\mid f\_\{\\mathrm\{NL\}\},x\); readers interested only in the floors may read\(g,ρ\)\(g,\\rho\)as one instantiation ofQQ\.

###### Definition 2\.1\(Justification oracle\)\.

The justification oracleggis a Markov kernel from\(SNL×𝒳,ℱSNL⊗ℱ𝒳\)\\bigl\(S\_\{\\mathrm\{NL\}\}\\times\\mathcal\{X\},\\,\\mathscr\{F\}\_\{S\_\{\\mathrm\{NL\}\}\}\\otimes\\mathscr\{F\}\_\{\\mathcal\{X\}\}\\bigr\)to\(JNL,ℱJNL\)\\bigl\(J\_\{\\mathrm\{NL\}\},\\mathscr\{F\}\_\{J\_\{\\mathrm\{NL\}\}\}\\bigr\)\. On input\(fNL,x\)\(f\_\{\\mathrm\{NL\}\},x\)it draws a justificationJ∼g\(⋅∣fNL,x\)J\\sim g\(\\cdot\\mid f\_\{\\mathrm\{NL\}\},x\), with realizationsj∈JNLj\\in J\_\{\\mathrm\{NL\}\}\.

###### Assumption \(A2\)\(Conditional independence of oracle draws\)\.

The inputs are i\.i\.d\.,X1:m∼PmX\_\{1:m\}\\sim P^\{m\}, and givenX1:mX\_\{1:m\}the drawsJi∼g\(⋅∣fNL,Xi\)J\_\{i\}\\sim g\(\\cdot\\mid f\_\{\\mathrm\{NL\}\},X\_\{i\}\)are conditionally independent acrossii\.

This excludes dependence among repeated oracle outputs beyond that induced by the sampled inputs\. We impose full conditional independence and do not analyze weaker dependence conditions such as martingale\-difference or mixing assumptions\.

###### Definition 2\.2\(Justification decoder\)\.

The*justification decoder*is a deterministic mapρ:JNL×𝒳→𝒴\\rho\\colon J\_\{\\mathrm\{NL\}\}\\times\\mathcal\{X\}\\to\\mathcal\{Y\}that reads a label off a justification–input pair\. It is required to be measurable with respect to the productσ\\sigma\-algebraℱJNL⊗ℱ𝒳\\mathscr\{F\}\_\{J\_\{\\mathrm\{NL\}\}\}\\otimes\\mathscr\{F\}\_\{\\mathcal\{X\}\}on its domain and the discreteσ\\sigma\-algebra on𝒴\\mathcal\{Y\}, so that the composed observed labelρ​\(J,X\)\\rho\(J,X\)is a well\-defined𝒴\\mathcal\{Y\}\-valued random variable\.

The tuple\(𝒳,𝒴,P,f,fNL,g,ρ\)\(\\mathcal\{X\},\\mathcal\{Y\},P,f,f\_\{\\mathrm\{NL\}\},g,\\rho\)defines an*NL\-PAC learning problem*\. The target labels are unobserved; instead, fori=1,…,mi=1,\\ldots,mthe learner receives a sample generated by drawingXi∼PX\_\{i\}\\sim P, then a justificationJi∼g\(⋅∣fNL,Xi\)J\_\{i\}\\sim g\(\\cdot\\mid f\_\{\\mathrm\{NL\}\},X\_\{i\}\), and settingYi=ρ​\(Ji,Xi\)Y\_\{i\}=\\rho\(J\_\{i\},X\_\{i\}\)\. A*learner*is any measurable, possibly randomized rule that maps\(Xi,Yi\)i=1m\(X\_\{i\},Y\_\{i\}\)\_\{i=1\}^\{m\}to a measurable classifierh:𝒳→𝒴h\\colon\\mathcal\{X\}\\to\\mathcal\{Y\}\. We impose no hypothesis\-class restriction, and measure its performance against the latent target by the standard riskerrP​\(h\)=ℙX∼P​\[h​\(X\)≠f​\(X\)\]\\mathrm\{err\}\_\{P\}\(h\)=\\mathbb\{P\}\_\{X\\sim P\}\[h\(X\)\\neq f\(X\)\]\.

The framework therefore separates two channels\. The*admissibility channel*x↦πLLMθ\(⋅∣fNL,x\)x\\mapsto\\pi\_\{\\mathrm\{LLM\}\_\{\\theta\}\}\(\\cdot\\mid f\_\{\\mathrm\{NL\}\},x\)determines which labels the model regards as compatible with the description, whereas the*supervision channel*\(g,ρ\)\(g,\\rho\)determines the labels available to the learner\. The oracleggmay be instantiated by the same model or by a distinct supervisor, so the two induced label distributions need not coincide\. NL\-PAC asks whether the observed channel supports low target risk or leaves an irreducible gap that cannot be closed by changing the learner or increasing the sample size\.

###### Example 2\.3\(Content moderation\)\.

Let𝒳\\mathcal\{X\}be user comments and𝒴=\{0,1\}\\mathcal\{Y\}=\\\{0,1\\\}denote*safe*and*toxic*, withf​\(x\)=1f\(x\)=1exactly whenxxcontains a literal lexical insult\. The descriptionfNL=*“label the comment toxic \(*1\) or safe \(0\)”f\_\{\\mathrm\{NL\}\}=\\text\{\\emph\{\`\`label the comment toxic \($1$\) or safe \($0$\)''\}\}is silent on sarcasm, admitting two readings: \(i\) pragmatic personal attacks, including sarcasm, are toxic and \(ii\) only literal lexical insults are toxic, with the target following reading \(ii\)\. Onx=*“That was a brilliant move, genius”*x=\\text\{\\emph\{\`\`That was a brilliant move, genius''\}\}we havef​\(x\)=0f\(x\)=0, yet the oracle may returnj=*“a sarcastic personal attack”*j=\\text\{\\emph\{\`\`a sarcastic personal attack''\}\}, yieldingρ​\(j,x\)=1≠f​\(x\)\\rho\(j,x\)=1\\neq f\(x\): not a decoding failure but the label under reading \(i\)\.

For a fixed descriptionfNLf\_\{\\mathrm\{NL\}\}, the*supervision channel*\(g,ρ\)\(g,\\rho\)is conditioned on the inputxx, but not on the operative target\. The resulting observation law therefore cannot distinguish among candidate targets associated with the same description\.

###### Proposition 2\.4\(Fixed\-description target blindness\)\.

FixPP, the descriptionfNLf\_\{\\mathrm\{NL\}\}, the oraclegg, and the decoderρ\\rho, and drawX∼PX\\sim PandJ∼g\(⋅∣fNL,X\)J\\sim g\(\\cdot\\mid f\_\{\\mathrm\{NL\}\},X\)\. The law of the observed pair\(X,ρ​\(J,X\)\)\(X,\\rho\(J,X\)\)does not depend on the operative target: it is identical under any two candidatesf1,f2:𝒳→𝒴f\_\{1\},f\_\{2\}\\colon\\mathcal\{X\}\\to\\mathcal\{Y\}\.

###### Proof\.

The law of\(X,ρ​\(J,X\)\)\(X,\\rho\(J,X\)\)factors as the input marginalPPcomposed with the observed\-label kernelQ\(⋅∣x\)=Law\(ρ\(J,x\)∣fNL,x\)Q\(\\cdot\\mid x\)=\\mathrm\{Law\}\(\\rho\(J,x\)\\mid f\_\{\\mathrm\{NL\}\},x\)withJ∼g\(⋅∣fNL,x\)J\\sim g\(\\cdot\\mid f\_\{\\mathrm\{NL\}\},x\)\. This kernel is determined byg\(⋅∣fNL,x\)g\(\\cdot\\mid f\_\{\\mathrm\{NL\}\},x\)and the deterministic decoderρ​\(⋅,x\)\\rho\(\\cdot,x\)alone; neither depends on the operative target, soQQ, and hence the joint law, is identical under any two candidatesf1,f2f\_\{1\},f\_\{2\}\. This is the sense in which the blind\-channel results depend only onQQ\. ∎

We call an observation channel with this property*target\-blind*, and all subsequent blind\-channel guarantees refer to this fixed\-description observation law\.*Oracle accuracy*, measured by the error rate

ϵg:=ℙX∼P,J∼g\(⋅∣fNL,X\)​\[ρ​\(J,X\)≠f​\(X\)\],\\epsilon\_\{g\}:=\\mathbb\{P\}\_\{X\\sim P,\\,J\\sim g\(\\cdot\\mid f\_\{\\mathrm\{NL\}\},X\)\}\[\\rho\(J,X\)\\neq f\(X\)\],is a separate property of the supervision channel, required neither for target blindness nor for the admissibility geometry; its compatibility with a localized unresolved floor is discussed in[Remark˜B\.2](https://arxiv.org/html/2607.08961#A2.Thmtheorem2)\. Thus the channel can be accurate on average yet uninformative exactly where candidate targets disagree\.

This pins down the four sources of uncertainty announced above: description ambiguity surfaces as the admissible\-overlap massDτ⋆D^\{\\star\}\_\{\\tau\}\([Definition˜2\.6](https://arxiv.org/html/2607.08961#S2.Thmtheorem6)\); decoding stochasticity is the sampling controlled later by the plug\-in analysis \([Section˜4\.3](https://arxiv.org/html/2607.08961#S4.SS3)\); error relative to a target isϵg\\epsilon\_\{g\}above; and channel\-induced indistinguishability is target blindness \([Proposition˜2\.4](https://arxiv.org/html/2607.08961#S2.Thmtheorem4)\), the property that turnsDτ⋆D^\{\\star\}\_\{\\tau\}into an irreducible floor\.

### 2\.2Model\-admissible labeling geometry

We quantify model\-admissible ambiguity through the diameter of a class of labelings supported by the model’s decoded probabilities\. Two parameters enter the construction: the probability thresholdτ\\taudetermines which labels are admissible at an input, while the toleranceζ\\zetacontrols the fraction of inputs on which a labeling may violate pointwise admissibility\. Throughout, we takeτ,ζ∈\(0,1/2\)\\tau,\\zeta\\in\(0,1/2\)\. The resulting diameter will reduce to an observable per\-instance overlap statistic that drives both the risk floors and their empirical certificates\.

###### Definition 2\.5\(Admissible label set\)\.

For eachx∈𝒳x\\in\\mathcal\{X\}, the*admissible label set*at thresholdτ\\tauis

Aτ​\(x\):=\{y∈𝒴:πLLMθ​\(y∣fNL,x\)≥τ\}\.A\_\{\\tau\}\(x\)\\;:=\\;\\bigl\\\{\\,y\\in\\mathcal\{Y\}:\\pi\_\{\\mathrm\{LLM\}\_\{\\theta\}\}\(y\\mid f\_\{\\mathrm\{NL\}\},x\)\\geq\\tau\\,\\bigr\\\}\.Thus a label is admissible precisely when its decoded probability is at leastτ\\tau\.

###### Assumption \(A3\)\(Finite labels and nonempty admissible sets\)\.

The label space satisfies2≤\|𝒴\|<∞2\\leq\|\\mathcal\{Y\}\|<\\infty, andAτ​\(x\)A\_\{\\tau\}\(x\)is nonempty forPP\-almost everyxx\.

This assumption ensures that pointwise admissible selections exist\. Because every distribution on𝒴\\mathcal\{Y\}assigns probability at least1/\|𝒴\|1/\|\\mathcal\{Y\}\|to some label, nonemptiness is automatic whenτ≤1/\|𝒴\|\\tau\\leq 1/\|\\mathcal\{Y\}\|\. In particular, it is automatic for binary labels under the standing conditionτ<1/2\\tau<1/2\.

###### Definition 2\.6\(Admissible\-overlap mass\)\.

The*admissible\-overlap mass*is

Dτ⋆:=ℙx∼P​\[\|Aτ​\(x\)\|≥2\]\.D^\{\\star\}\_\{\\tau\}:=\\mathbb\{P\}\_\{x\\sim P\}\\\!\\left\[\|A\_\{\\tau\}\(x\)\|\\geq 2\\right\]\.

###### Definition 2\.8\(Model\-admissible labeling class and diameter\)\.

*\(i\) Disagreement\.*Call a measurable labelingf′:𝒳→𝒴f^\{\\prime\}\\colon\\mathcal\{X\}\\to\\mathcal\{Y\}*admissible at*xxwhenf′​\(x\)∈Aτ​\(x\)f^\{\\prime\}\(x\)\\in A\_\{\\tau\}\(x\), and measure disagreement between two such labelings by the*disagreement pseudometric*

dP​\(f1,f2\):=ℙx∼P​\[f1​\(x\)≠f2​\(x\)\]\.d\_\{P\}\(f\_\{1\},f\_\{2\}\)\\;:=\\;\\mathbb\{P\}\_\{x\\sim P\}\\\!\\left\[f\_\{1\}\(x\)\\neq f\_\{2\}\(x\)\\right\]\.
*\(ii\) Class and core\.*The*model\-admissible labeling class*at toleranceζ\\zetacollects the labelings admissible off a set of mass at mostζ\\zeta,

ℱτ,ζ​\(fNL\):=\{f′:𝒳→𝒴​measurable​\|ℙx∼P​\[f′​\(x\)∈Aτ​\(x\)\]\>​1−ζ\},\\mathcal\{F\}\_\{\\tau,\\zeta\}\(f\_\{\\mathrm\{NL\}\}\):=\\left\\\{\\,f^\{\\prime\}\\colon\\mathcal\{X\}\\to\\mathcal\{Y\}\\text\{ measurable\}\\;\\middle\|\\;\\mathbb\{P\}\_\{x\\sim P\}\\\!\\left\[f^\{\\prime\}\(x\)\\in A\_\{\\tau\}\(x\)\\right\]\>1\-\\zeta\\,\\right\\\},and its*almost\-everywhere admissible core*is the zero\-tolerance class, recovered as the intersection𝖲𝖾𝗅τ=⋂ζ\>0ℱτ,ζ​\(fNL\)\\mathsf\{Sel\}\_\{\\tau\}=\\bigcap\_\{\\zeta\>0\}\\mathcal\{F\}\_\{\\tau,\\zeta\}\(f\_\{\\mathrm\{NL\}\}\),

𝖲𝖾𝗅τ:=\{f′:𝒳→𝒴measurable\|f′\(x\)∈Aτ\(x\)forP\-a\.e\.x\}\.\\mathsf\{Sel\}\_\{\\tau\}:=\\left\\\{\\,f^\{\\prime\}\\colon\\mathcal\{X\}\\to\\mathcal\{Y\}\\text\{ measurable\}\\;\\middle\|\\;f^\{\\prime\}\(x\)\\in A\_\{\\tau\}\(x\)\\text\{ for $P$\-a\.e\.\\ \}x\\,\\right\\\}\.
*\(iii\) Diameter\.*For a family𝒢\\mathcal\{G\}of labelings, writediamP​\(𝒢\):=supf1,f2∈𝒢dP​\(f1,f2\)\\mathrm\{diam\}\_\{P\}\(\\mathcal\{G\}\):=\\sup\_\{f\_\{1\},f\_\{2\}\\in\\mathcal\{G\}\}d\_\{P\}\(f\_\{1\},f\_\{2\}\), withdiamP​\(𝒢\)=0\\mathrm\{diam\}\_\{P\}\(\\mathcal\{G\}\)=0when\|𝒢\|≤1\|\\mathcal\{G\}\|\\leq 1\. The*model\-admissible diameter*is

diamτ,ζ​\(fNL,P\):=diamP​\(ℱτ,ζ​\(fNL\)\)\.\\mathrm\{diam\}\_\{\\tau,\\zeta\}\(f\_\{\\mathrm\{NL\}\},P\):=\\mathrm\{diam\}\_\{P\}\\bigl\(\\mathcal\{F\}\_\{\\tau,\\zeta\}\(f\_\{\\mathrm\{NL\}\}\)\\bigr\)\.

The disagreement pseudometric is standard in disagreement\-based active learning\(Hanneke,[2014](https://arxiv.org/html/2607.08961#bib.bib23)\)\. SinceerrP​\(h\)=dP​\(h,f\)\\mathrm\{err\}\_\{P\}\(h\)=d\_\{P\}\(h,f\), bounds expressed indPd\_\{P\}translate directly into PAC risk bounds\.

These objects are well defined\. For everyy∈𝒴y\\in\\mathcal\{Y\},

\{x:y∈Aτ​\(x\)\}=\{x:πLLMθ​\(y∣fNL,x\)≥τ\}\\\{x:y\\in A\_\{\\tau\}\(x\)\\\}=\\\{x:\\pi\_\{\\mathrm\{LLM\}\_\{\\theta\}\}\(y\\mid f\_\{\\mathrm\{NL\}\},x\)\\geq\\tau\\\}is measurable by[Assumption˜\(A1\)](https://arxiv.org/html/2607.08961#Thmassumption1)\. Since𝒴\\mathcal\{Y\}is finite,x↦Aτ​\(x\)x\\mapsto A\_\{\\tau\}\(x\)is a measurable multifunction and every admissibility and disagreement event below is measurable; henceℱτ,ζ​\(fNL\)\\mathcal\{F\}\_\{\\tau,\\zeta\}\(f\_\{\\mathrm\{NL\}\}\)and its diameter are well defined\.

Conceptually,ℱτ,ζ​\(fNL\)\\mathcal\{F\}\_\{\\tau,\\zeta\}\(f\_\{\\mathrm\{NL\}\}\)is a model\-relative identified set\(Manski,[2003](https://arxiv.org/html/2607.08961#bib.bib39)\)formed from approximate measurable selections ofAτA\_\{\\tau\}\(Molchanov and Molinari,[2018](https://arxiv.org/html/2607.08961#bib.bib43)\), and its core𝖲𝖾𝗅τ\\mathsf\{Sel\}\_\{\\tau\}is a version space in the sense ofMitchell \([1982](https://arxiv.org/html/2607.08961#bib.bib42)\), with model admissibility replacing labeled data as the defining constraint\. What the analysis below exploits is that this identified set is model\-relative and that its diameter reduces to a single auditable statistic\.

For a measurableu:𝒳→𝒴u\\colon\\mathcal\{X\}\\to\\mathcal\{Y\}, writedP​\(u,𝖲𝖾𝗅τ\):=infv∈𝖲𝖾𝗅τdP​\(u,v\)d\_\{P\}\(u,\\mathsf\{Sel\}\_\{\\tau\}\):=\\inf\_\{v\\in\\mathsf\{Sel\}\_\{\\tau\}\}d\_\{P\}\(u,v\)for its distance to the admissible core𝖲𝖾𝗅τ\\mathsf\{Sel\}\_\{\\tau\}\.

###### Definition 2\.9\(Maximal\-spread pair\)\.

Fix a total order≺\\precon𝒴\\mathcal\{Y\}, and sety0:=min≺⁡𝒴y\_\{0\}:=\\min\_\{\\prec\}\\mathcal\{Y\}\. WhenAτ​\(x\)≠∅A\_\{\\tau\}\(x\)\\neq\\varnothing, enumerate its elementsy\(1\)​\(x\),…,y\(\|Aτ​\(x\)\|\)​\(x\)y\_\{\(1\)\}\(x\),\\ldots,y\_\{\(\|A\_\{\\tau\}\(x\)\|\)\}\(x\)in decreasing order ofπLLMθ\(⋅∣fNL,x\)\\pi\_\{\\mathrm\{LLM\}\_\{\\theta\}\}\(\\cdot\\mid f\_\{\\mathrm\{NL\}\},x\), with ties broken by≺\\prec\. The*maximal\-spread pair*takes the two top\-ranked admissible labels,

fτ\+​\(x\):=y\(1\)​\(x\),fτ−​\(x\):=y\(min⁡\{2,\|Aτ​\(x\)\|\}\)​\(x\),f\_\{\\tau\}^\{\+\}\(x\):=y\_\{\(1\)\}\(x\),\\qquad f\_\{\\tau\}^\{\-\}\(x\):=y\_\{\\bigl\(\\min\\\{2,\\,\|A\_\{\\tau\}\(x\)\|\\\}\\bigr\)\}\(x\),and both default toy0y\_\{0\}whereAτ​\(x\)=∅A\_\{\\tau\}\(x\)=\\varnothing\. The two therefore coincide exactly when\|Aτ​\(x\)\|≤1\|A\_\{\\tau\}\(x\)\|\\leq 1\.

In[Example˜2\.3](https://arxiv.org/html/2607.08961#S2.Thmtheorem3), the maximal\-spread pair splits exactly on the sarcastic borderline comments: there both labels clear the threshold,Aτ​\(x\)=\{0,1\}A\_\{\\tau\}\(x\)=\\\{0,1\\\}, andfτ\+f\_\{\\tau\}^\{\+\}takes the higher\-scoring one,fτ−f\_\{\\tau\}^\{\-\}the other, while the two coincide on unambiguous comments;Dτ⋆D^\{\\star\}\_\{\\tau\}is thePP\-mass of the borderline region\.

###### Lemma 2\.10\(Maximal\-spread identity\)\.

Under[Assumptions˜\(A1\)](https://arxiv.org/html/2607.08961#Thmassumption1)and[\(A3\)](https://arxiv.org/html/2607.08961#Thmassumption3), the pairfτ\+,fτ−f\_\{\\tau\}^\{\+\},f\_\{\\tau\}^\{\-\}lies in the admissible core𝖲𝖾𝗅τ\\mathsf\{Sel\}\_\{\\tau\}and disagrees exactly on the overlap region,

\{x:fτ\+​\(x\)≠fτ−​\(x\)\}=\{x:\|Aτ​\(x\)\|≥2\}\.\\\{x:f\_\{\\tau\}^\{\+\}\(x\)\\neq f\_\{\\tau\}^\{\-\}\(x\)\\\}=\\\{x:\|A\_\{\\tau\}\(x\)\|\\geq 2\\\}\.In particular,dP​\(fτ\+,fτ−\)=Dτ⋆d\_\{P\}\(f\_\{\\tau\}^\{\+\},f\_\{\\tau\}^\{\-\}\)=D^\{\\star\}\_\{\\tau\}\.

###### Proof\.

By[Assumption˜\(A1\)](https://arxiv.org/html/2607.08961#Thmassumption1)and finiteness of𝒴\\mathcal\{Y\}the ranked selectors are measurable, and both pick admissible labels whereverAτ​\(x\)≠∅A\_\{\\tau\}\(x\)\\neq\\varnothing, which holdsPP\-a\.e\. by[Assumption˜\(A3\)](https://arxiv.org/html/2607.08961#Thmassumption3); hencefτ\+,fτ−∈𝖲𝖾𝗅τf\_\{\\tau\}^\{\+\},f\_\{\\tau\}^\{\-\}\\in\\mathsf\{Sel\}\_\{\\tau\}\. By construction they differ atxxprecisely whenAτ​\(x\)A\_\{\\tau\}\(x\)holds at least two labels, so the displayed identity holds and itsPP\-measure isDτ⋆D^\{\\star\}\_\{\\tau\}\. ∎

The theorem below makes the diameter tractable:ℱτ,ζ​\(fNL\)\\mathcal\{F\}\_\{\\tau,\\zeta\}\(f\_\{\\mathrm\{NL\}\}\)is the opendPd\_\{P\}\-neighborhood of its core𝖲𝖾𝗅τ\\mathsf\{Sel\}\_\{\\tau\}, and its diameter is bracketed by the overlap mass\.

###### Theorem 2\.11\(Geometry of the model\-admissible labeling class\)\.

Under[Assumptions˜\(A1\)](https://arxiv.org/html/2607.08961#Thmassumption1)and[\(A3\)](https://arxiv.org/html/2607.08961#Thmassumption3),

ℱτ,ζ​\(fNL\)=\{u:𝒳→𝒴​measurable:dP​\(u,𝖲𝖾𝗅τ\)<ζ\}\.\\mathcal\{F\}\_\{\\tau,\\zeta\}\(f\_\{\\mathrm\{NL\}\}\)=\\left\\\{u\\colon\\mathcal\{X\}\\to\\mathcal\{Y\}\\text\{ measurable\}:d\_\{P\}\(u,\\mathsf\{Sel\}\_\{\\tau\}\)<\\zeta\\right\\\}\.Moreover,

diamP​\(𝖲𝖾𝗅τ\)=Dτ⋆,Dτ⋆≤diamτ,ζ​\(fNL,P\)≤Dτ⋆\+2​ζ\.\\mathrm\{diam\}\_\{P\}\(\\mathsf\{Sel\}\_\{\\tau\}\)=D^\{\\star\}\_\{\\tau\},\\qquad D^\{\\star\}\_\{\\tau\}\\leq\\mathrm\{diam\}\_\{\\tau,\\zeta\}\(f\_\{\\mathrm\{NL\}\},P\)\\leq D^\{\\star\}\_\{\\tau\}\+2\\zeta\.

###### Proof sketch; full proof in[Appendix˜B](https://arxiv.org/html/2607.08961#A2)\.

Ifuuis withinζ\\zetaof somev∈𝖲𝖾𝗅τv\\in\\mathsf\{Sel\}\_\{\\tau\}, admissibility transfers fromvvtouuoff the small disagreement set, placingu∈ℱτ,ζ​\(fNL\)u\\in\\mathcal\{F\}\_\{\\tau,\\zeta\}\(f\_\{\\mathrm\{NL\}\}\)\. Conversely, an admissibleu∈ℱτ,ζ​\(fNL\)u\\in\\mathcal\{F\}\_\{\\tau,\\zeta\}\(f\_\{\\mathrm\{NL\}\}\)violates pointwise admissibility only on a set of mass belowζ\\zeta; reassigninguuthere to a top\-ranked admissible labely\(1\)​\(x\)y\_\{\(1\)\}\(x\)yields a core memberv∈𝖲𝖾𝗅τv\\in\\mathsf\{Sel\}\_\{\\tau\}that differs fromuuon that same set, sodP​\(u,v\)<ζd\_\{P\}\(u,v\)<\\zeta\. Henceℱτ,ζ​\(fNL\)\\mathcal\{F\}\_\{\\tau,\\zeta\}\(f\_\{\\mathrm\{NL\}\}\)is exactly the openζ\\zeta\-neighborhood of𝖲𝖾𝗅τ\\mathsf\{Sel\}\_\{\\tau\}\. Within the core, two selections can disagree only where\|Aτ​\(x\)\|≥2\|A\_\{\\tau\}\(x\)\|\\geq 2, and the maximal\-spread pair attains that overlap exactly, givingdiamP​\(𝖲𝖾𝗅τ\)=Dτ⋆\\mathrm\{diam\}\_\{P\}\(\\mathsf\{Sel\}\_\{\\tau\}\)=D^\{\\star\}\_\{\\tau\}\. For the upper bracket, apply this same reassignment to an arbitrary pairu,v∈ℱτ,ζ​\(fNL\)u,v\\in\\mathcal\{F\}\_\{\\tau,\\zeta\}\(f\_\{\\mathrm\{NL\}\}\), obtaining core membersu~,v~∈𝖲𝖾𝗅τ\\tilde\{u\},\\tilde\{v\}\\in\\mathsf\{Sel\}\_\{\\tau\}withdP​\(u,u~\),dP​\(v,v~\)<ζd\_\{P\}\(u,\\tilde\{u\}\),d\_\{P\}\(v,\\tilde\{v\}\)<\\zeta; the triangle inequality then givesdP​\(u,v\)≤dP​\(u~,v~\)\+dP​\(u,u~\)\+dP​\(v,v~\)<Dτ⋆\+2​ζd\_\{P\}\(u,v\)\\leq d\_\{P\}\(\\tilde\{u\},\\tilde\{v\}\)\+d\_\{P\}\(u,\\tilde\{u\}\)\+d\_\{P\}\(v,\\tilde\{v\}\)<D^\{\\star\}\_\{\\tau\}\+2\\zeta\. ∎

The additive2​ζ2\\zetain the bracket is not slack of the analysis: both endpoints are attained, so no distribution\-free bound improves it\.

###### Proposition 2\.12\(Tightness of the coverage bracket\)\.

Both endpoints of the bracketDτ⋆≤diamτ,ζ​\(fNL,P\)≤Dτ⋆\+2​ζD^\{\\star\}\_\{\\tau\}\\leq\\mathrm\{diam\}\_\{\\tau,\\zeta\}\(f\_\{\\mathrm\{NL\}\},P\)\\leq D^\{\\star\}\_\{\\tau\}\+2\\zetaare sharp: each is realized as the diameter for some choice ofPPand admissible\-set geometry:

1. \(a\)ifPPrestricted to\{x:\|Aτ​\(x\)\|=1\}\\\{x:\|A\_\{\\tau\}\(x\)\|=1\\\}is nonatomic and this set has mass at least2​ζ2\\zeta, thendiamτ,ζ​\(fNL,P\)=Dτ⋆\+2​ζ\\mathrm\{diam\}\_\{\\tau,\\zeta\}\(f\_\{\\mathrm\{NL\}\},P\)=D^\{\\star\}\_\{\\tau\}\+2\\zeta;
2. \(b\)ifPPis purely atomic and every atom has probability at leastζ\\zeta, thendiamτ,ζ​\(fNL,P\)=Dτ⋆\\mathrm\{diam\}\_\{\\tau,\\zeta\}\(f\_\{\\mathrm\{NL\}\},P\)=D^\{\\star\}\_\{\\tau\}\.

###### Proof sketch; full proof in[Appendix˜B](https://arxiv.org/html/2607.08961#A2)\.

For \(a\), nonatomicity supplies disjoint subsetsS1,S2S\_\{1\},S\_\{2\}of the singleton region, each of massζ−ε\\zeta\-\\varepsilon\. Reassigning the maximal\-spread pair to a distinct label onS1S\_\{1\}andS2S\_\{2\}keeps both labelings within coverageζ\\zetayet adds2​\(ζ−ε\)2\(\\zeta\-\\varepsilon\)of disagreement beyond the overlap massDτ⋆D^\{\\star\}\_\{\\tau\}; lettingε↓0\\varepsilon\\downarrow 0pushes the diameter toDτ⋆\+2​ζD^\{\\star\}\_\{\\tau\}\+2\\zeta\. For \(b\), an admissible labeling violates coverage on a set of mass belowζ\\zeta, which can contain no atom once every atom has mass at leastζ\\zeta; that set is thenPP\-null, so theζ\\zeta\-neighborhood collapses onto the core and the diameter equalsDτ⋆D^\{\\star\}\_\{\\tau\}\. ∎

The identitydiamP​\(𝖲𝖾𝗅τ\)=Dτ⋆\\mathrm\{diam\}\_\{P\}\(\\mathsf\{Sel\}\_\{\\tau\}\)=D^\{\\star\}\_\{\\tau\}equates the diameter of the almost\-everywhere admissible core with the mass of inputs carrying multiple admissible labels\. This ambiguity is a property of the model, prompt, and threshold, not of the learner’s sample: it persists under arbitrarily many further observations from the same target\-blind channel\.

## 3Blind\-Channel Risk Floors and Exact Minimax Values

This section characterizes the risk imposed by target\-blind supervision\. We first derive pairwise lower bounds that hold uniformly over the sample size, then identify the exact minimax value over the pointwise\-admissible core and relate it to globally coherent readings\. The admissible\-overlap massDτ⋆D^\{\\star\}\_\{\\tau\}is the central geometric quantity\.

### 3\.1Two\-point blind\-channel floor

We work in the*oracle\-label model*, in which the learner observes labels decoded from oracle justifications rather than the target labelsf​\(Xi\)f\(X\_\{i\}\)\.

###### Definition 3\.1\(Oracle\-labeled sample\)\.

An*oracle\-labeled sample*of sizemmis the sequenceSmoracle:=\(\(Xi,Y^i\)\)i=1mS\_\{m\}^\{\\mathrm\{oracle\}\}:=\(\(X\_\{i\},\\widehat\{Y\}\_\{i\}\)\)\_\{i=1\}^\{m\}obtained by drawingX1:m∼PmX\_\{1:m\}\\sim P^\{m\}, then drawing the justificationsJ1,…,JmJ\_\{1\},\\ldots,J\_\{m\}conditionally independently withJi∼g\(⋅∣fNL,Xi\)J\_\{i\}\\sim g\(\\cdot\\mid f\_\{\\mathrm\{NL\}\},X\_\{i\}\), and settingY^i:=ρ​\(Ji,Xi\)\\widehat\{Y\}\_\{i\}:=\\rho\(J\_\{i\},X\_\{i\}\)\.

The operative target enters the learner’s risk but not the sampling law above, so distinct targets can define the same statistical experiment\. We turn this into a lower bound by Le Cam’s two\-point method\(Tsybakov,[2009](https://arxiv.org/html/2607.08961#bib.bib55)\): if two model\-admissible labelings disagree on a set of massDDand the oracle cannot distinguish them there, the learner observes the same sample law under both targets, so no measurable rule can be correct for both\.

FixPP,fNLf\_\{\\mathrm\{NL\}\},gg, andρ\\rho, and consider two measurable candidate targetsf1,f2:𝒳→𝒴f\_\{1\},f\_\{2\}\\colon\\mathcal\{X\}\\to\\mathcal\{Y\}\. To accommodate both target\-blind and target\-dependent supervision, we momentarily allow the oracle to depend on the operative target: writeg\(⋅∣fNL,x,f\)g\(\\cdot\\mid f\_\{\\mathrm\{NL\}\},x,f\)for a target\-indexed family of Markov kernels \(in the sense of[Definition˜2\.1](https://arxiv.org/html/2607.08961#S2.Thmtheorem1)for each fixedff\) that specializes to the target\-blind oracleg\(⋅∣fNL,x\)g\(\\cdot\\mid f\_\{\\mathrm\{NL\}\},x\)of[Definition˜2\.1](https://arxiv.org/html/2607.08961#S2.Thmtheorem1)exactly when it is constant inff\. LetPjP\_\{j\}denote the law of one observed example\(X,ρ​\(Jj,X\)\)\(X,\\rho\(J\_\{j\},X\)\)under targetfjf\_\{j\}, whereX∼PX\\sim PandJj∼g\(⋅∣fNL,X,fj\)J\_\{j\}\\sim g\(\\cdot\\mid f\_\{\\mathrm\{NL\}\},X,f\_\{j\}\)\. Under[Assumption˜\(A2\)](https://arxiv.org/html/2607.08961#Thmassumption2), a sample of sizemmhas lawPj⊗mP\_\{j\}^\{\\otimes m\}\. WriteB:=\{x:f1​\(x\)≠f2​\(x\)\}B:=\\\{x:f\_\{1\}\(x\)\\neq f\_\{2\}\(x\)\\\}for the disagreement region andD:=P​\(B\)=dP​\(f1,f2\)D:=P\(B\)=d\_\{P\}\(f\_\{1\},f\_\{2\}\)for its probability\. This pairwise construction does not require either target to be model\-admissible\.

###### Theorem 3\.2\(Two\-point blind\-channel floor\)\.

For every sample sizemmand every measurable, possibly randomized learnerh^\\hat\{h\}mapping an oracle\-labeled sample to a classifier, the following bounds hold\.

1. \(a\)*\(Le Cam bound\.\)* maxj∈\{1,2\}⁡𝔼S∼Pj⊗m​\[dP​\(h^​\(S\),fj\)\]≥D2​\(1−TV​\(P1⊗m,P2⊗m\)\),\\max\_\{j\\in\\\{1,2\\\}\}\\mathbb\{E\}\_\{S\\sim P\_\{j\}^\{\\otimes m\}\}\\bigl\[d\_\{P\}\(\\hat\{h\}\(S\),f\_\{j\}\)\\bigr\]\\;\\geq\\;\\frac\{D\}\{2\}\\Bigl\(1\-\\mathrm\{TV\}\\bigl\(P\_\{1\}^\{\\otimes m\},P\_\{2\}^\{\\otimes m\}\\bigr\)\\Bigr\),where the expectation averages over the sample and any internal randomization\.
2. \(b\)*\(Unresolved\-ambiguity floor\.\)*Suppose the oracle does not distinguish the two targets: forPP\-almost everyxx, Law​\(ρ​\(J1,x\)∣fNL,x,f1\)=Law​\(ρ​\(J2,x\)∣fNL,x,f2\)\.\\mathrm\{Law\}\\bigl\(\\rho\(J\_\{1\},x\)\\mid f\_\{\\mathrm\{NL\}\},x,f\_\{1\}\\bigr\)=\\mathrm\{Law\}\\bigl\(\\rho\(J\_\{2\},x\)\\mid f\_\{\\mathrm\{NL\}\},x,f\_\{2\}\\bigr\)\.\(1\)Then the two targets induce the same one\-example observation law,P1=P2P\_\{1\}=P\_\{2\}, soP1⊗m=P2⊗mP\_\{1\}^\{\\otimes m\}=P\_\{2\}^\{\\otimes m\}and the bound of part \(a\) is independent of the sample size: maxj∈\{1,2\}⁡𝔼S∼Pj⊗m​\[dP​\(h^​\(S\),fj\)\]≥D2for every​m\.\\max\_\{j\\in\\\{1,2\\\}\}\\mathbb\{E\}\_\{S\\sim P\_\{j\}^\{\\otimes m\}\}\\bigl\[d\_\{P\}\(\\hat\{h\}\(S\),f\_\{j\}\)\\bigr\]\\;\\geq\\;\\frac\{D\}\{2\}\\qquad\\text\{for every \}m\.

###### Proof sketch; full proof in[Appendix˜B](https://arxiv.org/html/2607.08961#A2)\.

For \(a\), any returned classifier satisfiesdP​\(h,f1\)\+dP​\(h,f2\)≥Dd\_\{P\}\(h,f\_\{1\}\)\+d\_\{P\}\(h,f\_\{2\}\)\\geq Dpointwise onBB, sinceh​\(x\)h\(x\)can match at most one of two distinct labels; integrating this against the common partmin⁡\(p1,p2\)\\min\(p\_\{1\},p\_\{2\}\)of the two sample laws reduces the problem to testingP1⊗mP\_\{1\}^\{\\otimes m\}againstP2⊗mP\_\{2\}^\{\\otimes m\}and yields theD2​\(1−TV\)\\tfrac\{D\}\{2\}\(1\-\\mathrm\{TV\}\)bound\. For \(b\), condition[Equation˜1](https://arxiv.org/html/2607.08961#S3.E1)equates the one\-example observation laws,P1=P2P\_\{1\}=P\_\{2\}, henceP1⊗m=P2⊗mP\_\{1\}^\{\\otimes m\}=P\_\{2\}^\{\\otimes m\}and the total\-variation term vanishes*for everymm*\. The bound of part \(a\) therefore reduces to the sample\-independent floorD/2D/2: no sample size recovers what the channel never transmits\. ∎

This blind\-channel bound is exact for the two\-target problem: a data\-independent learner that returnsf1f\_\{1\}orf2f\_\{2\}with equal probability has riskD/2D/2against either target, so the floor of part \(b\) is attained\. The exactness is for the two\-target minimax, not necessarily for the entire admissible class;[Corollary˜B\.1](https://arxiv.org/html/2607.08961#A2.Thmtheorem1)records the general least\-favorable\-prior identity\.

###### Corollary 3\.3\(Diameter floor for the base channel\)\.

Suppose that, for every targetf∈ℱτ,ζ​\(fNL\)f\\in\\mathcal\{F\}\_\{\\tau,\\zeta\}\(f\_\{\\mathrm\{NL\}\}\), each observed example is generated byX∼PX\\sim P,J∼g\(⋅∣fNL,X\)J\\sim g\(\\cdot\\mid f\_\{\\mathrm\{NL\}\},X\), andY^=ρ​\(J,X\)\\widehat\{Y\}=\\rho\(J,X\)\. Then, for every sample sizemm,

infh^supf∈ℱτ,ζ​\(fNL\)𝔼​\[dP​\(h^​\(Smoracle\),f\)\]≥12​diamτ,ζ​\(fNL,P\)\.\\inf\_\{\\hat\{h\}\}\\sup\_\{f\\in\\mathcal\{F\}\_\{\\tau,\\zeta\}\(f\_\{\\mathrm\{NL\}\}\)\}\\mathbb\{E\}\\bigl\[d\_\{P\}\(\\hat\{h\}\(S\_\{m\}^\{\\mathrm\{oracle\}\}\),f\)\\bigr\]\\;\\geq\\;\\tfrac\{1\}\{2\}\\,\\mathrm\{diam\}\_\{\\tau,\\zeta\}\(f\_\{\\mathrm\{NL\}\},P\)\.The infimum ranges over all measurable, possibly randomized learners, and the expectation averages over the sample and the learner’s internal randomization\.

###### Proof\.

Every pairf1,f2∈ℱτ,ζ​\(fNL\)f\_\{1\},f\_\{2\}\\in\\mathcal\{F\}\_\{\\tau,\\zeta\}\(f\_\{\\mathrm\{NL\}\}\)is admissible and, on the fixed\-description base channel, unresolved \([Proposition˜2\.4](https://arxiv.org/html/2607.08961#S2.Thmtheorem4)\), so[Theorem˜3\.2](https://arxiv.org/html/2607.08961#S3.Thmtheorem2)\(b\) givesmaxj∈\{1,2\}⁡𝔼​\[dP​\(h^,fj\)\]≥12​dP​\(f1,f2\)\\max\_\{j\\in\\\{1,2\\\}\}\\mathbb\{E\}\[d\_\{P\}\(\\hat\{h\},f\_\{j\}\)\]\\geq\\tfrac\{1\}\{2\}d\_\{P\}\(f\_\{1\},f\_\{2\}\)uniformly inmm\. Sincesupf𝔼​\[dP​\(h^,f\)\]\\sup\_\{f\}\\mathbb\{E\}\[d\_\{P\}\(\\hat\{h\},f\)\]dominates this two\-point maximum, optimizing the pair so thatdP​\(f1,f2\)d\_\{P\}\(f\_\{1\},f\_\{2\}\)approachesdiamτ,ζ​\(fNL,P\)\\mathrm\{diam\}\_\{\\tau,\\zeta\}\(f\_\{\\mathrm\{NL\}\},P\)yields the bound; the supremum need not be attained \([Proposition˜2\.12](https://arxiv.org/html/2607.08961#S2.Thmtheorem12)\)\. ∎

We call a pair*full\-law unresolved*if its one\-example observation laws coincide\. Every pair has this property under the fixed\-description channel, because the sampling law does not depend on the operative target\. In the deterministic extreme, the target\-blind channel always emits labels from one fixed readingf′f^\{\\prime\}, whose error against a targetffisdP​\(f,f′\)d\_\{P\}\(f,f^\{\\prime\}\)\. The resultingD/2D/2floor is uniform over the sample size but remains a pairwise statement; it does not determine the minimax risk over the entire admissible class\. We compute that full\-class value next\.

### 3\.2Exact blind minimax values

We now pass from a single unresolved pair to the full pointwise\-admissible core𝖲𝖾𝗅τ\\mathsf\{Sel\}\_\{\\tau\}\. The resulting minimax value is determined by the number of admissible labels at each input\. To define this multiplicity everywhere, fixy0∈𝒴y\_\{0\}\\in\\mathcal\{Y\}and set

A¯τ​\(x\):=\{Aτ​\(x\),Aτ​\(x\)≠∅,\{y0\},Aτ​\(x\)=∅,k​\(x\):=\|A¯τ​\(x\)\|\.\\bar\{A\}\_\{\\tau\}\(x\):=\\begin\{cases\}A\_\{\\tau\}\(x\),&A\_\{\\tau\}\(x\)\\neq\\emptyset,\\\\ \\\{y\_\{0\}\\\},&A\_\{\\tau\}\(x\)=\\emptyset,\\end\{cases\}\\qquad k\(x\):=\|\\bar\{A\}\_\{\\tau\}\(x\)\|\.By[Assumption˜\(A3\)](https://arxiv.org/html/2607.08961#Thmassumption3),A¯τ​\(x\)=Aτ​\(x\)\\bar\{A\}\_\{\\tau\}\(x\)=A\_\{\\tau\}\(x\)forPP\-almost everyxx, so the completion is immaterial for all population quantities below\.

###### Definition 3\.4\(Admissible\-multiplicity functional\)\.

The*expected non\-modal admissible mass*is

Vτ⋆:=𝔼x∼P​\[1−1k​\(x\)\]\.V^\{\\star\}\_\{\\tau\}:=\\mathbb\{E\}\_\{x\\sim P\}\\\!\\left\[1\-\\frac\{1\}\{k\(x\)\}\\right\]\.

At each inputxx, uniform randomization overA¯τ​\(x\)\\bar\{A\}\_\{\\tau\}\(x\)incurs error1−1/k​\(x\)1\-1/k\(x\)against every admissible target label\. ThusVτ⋆V^\{\\star\}\_\{\\tau\}is the population risk achieved by the uniform admissible strategy\.

The three central quantities play different roles\. The overlap massDτ⋆D^\{\\star\}\_\{\\tau\}*counts*the inputs carrying more than one admissible label; the exact valueVτ⋆V^\{\\star\}\_\{\\tau\}is the actual minimax error a blind learner must incur; and the diameterdiamτ,ζ\\mathrm\{diam\}\_\{\\tau,\\zeta\}measures the spread of the admissible class\. They coincide up to a factor of one half,Vτ⋆=12​Dτ⋆=12​diamP​\(𝖲𝖾𝗅τ\)V^\{\\star\}\_\{\\tau\}=\\tfrac\{1\}\{2\}D^\{\\star\}\_\{\\tau\}=\\tfrac\{1\}\{2\}\\mathrm\{diam\}\_\{P\}\(\\mathsf\{Sel\}\_\{\\tau\}\), exactly when at most two labels are admissible almost everywhere, and separate once higher\-order overlap has positive mass\.

We show next that the uniform admissible strategy is minimax optimal under target blindness\.

###### Theorem 3\.5\(Exact blind\-channel minimax over admissible selections\)\.

Under[Assumptions˜\(A1\)](https://arxiv.org/html/2607.08961#Thmassumption1)and[\(A3\)](https://arxiv.org/html/2607.08961#Thmassumption3), suppose the supervision channel is*target\-blind on𝖲𝖾𝗅τ\\mathsf\{Sel\}\_\{\\tau\}*\(automatic for the fixed\-description channel,[Proposition˜2\.4](https://arxiv.org/html/2607.08961#S2.Thmtheorem4)\): the one\-example observation lawPfP\_\{f\}it induces under a targetffis common to allf∈𝖲𝖾𝗅τf\\in\\mathsf\{Sel\}\_\{\\tau\}\. Then, for every sample sizemm,

infh^supf∈𝖲𝖾𝗅τ𝔼S∼Pf⊗m​\[dP​\(h^​\(S\),f\)\]=Vτ⋆,\\inf\_\{\\hat\{h\}\}\\ \\sup\_\{f\\in\\mathsf\{Sel\}\_\{\\tau\}\}\\mathbb\{E\}\_\{S\\sim P\_\{f\}^\{\\otimes m\}\}\\\!\\left\[d\_\{P\}\(\\hat\{h\}\(S\),f\)\\right\]=V^\{\\star\}\_\{\\tau\},the infimum ranging over all randomized measurable learners and the expectation including their internal randomness\. The common value is attained by a data\-independent learner\.

###### Proof sketch; full proof in[Appendix˜B](https://arxiv.org/html/2607.08961#A2)\.

*Achievability\.*Consider the data\-independent learner given by the measurable Markov kernelx↦Uniform​\(A¯τ​\(x\)\)x\\mapsto\\mathrm\{Uniform\}\(\\bar\{A\}\_\{\\tau\}\(x\)\)\(a uniform draw from the finite cyclic selector family of the full proof, hence measurable sinceA¯τ\\bar\{A\}\_\{\\tau\}is a measurable finite\-valued multifunction\)\. It errs against any fixedf∈𝖲𝖾𝗅τf\\in\\mathsf\{Sel\}\_\{\\tau\}with probability1−1/k​\(x\)1\-1/k\(x\)atxx; its risk is thereforeVτ⋆V^\{\\star\}\_\{\\tau\}against every target\.

*Lower bound\.*Target\-blindness on𝖲𝖾𝗅τ\\mathsf\{Sel\}\_\{\\tau\}makes the sample law identical across the class, so no learner’s output depends on which target is operative\. Averaging the risk over a finite cyclic family of admissible selections whose uniform mixture places uniform mass onA¯τ​\(x\)\\bar\{A\}\_\{\\tau\}\(x\)at everyxxshows that no learner improves on𝔼x​\[1−1/k​\(x\)\]=Vτ⋆\\mathbb\{E\}\_\{x\}\[1\-1/k\(x\)\]=V^\{\\star\}\_\{\\tau\}\. The family is thus least favorable, and the two bounds meet for every sample sizemm\. ∎

For any target family𝒢\\mathcal\{G\}, define its sample\-size\-mmminimax risk by

Rm​\(𝒢\):=infh^supf∈𝒢𝔼S∼Pf⊗m​\[dP​\(h^​\(S\),f\)\]\.R\_\{m\}\(\\mathcal\{G\}\):=\\inf\_\{\\hat\{h\}\}\\ \\sup\_\{f\\in\\mathcal\{G\}\}\\ \\mathbb\{E\}\_\{S\\sim P\_\{f\}^\{\\otimes m\}\}\\\!\\left\[d\_\{P\}\(\\hat\{h\}\(S\),f\)\\right\]\.The theorem above establishesRm​\(𝖲𝖾𝗅τ\)=Vτ⋆R\_\{m\}\(\\mathsf\{Sel\}\_\{\\tau\}\)=V^\{\\star\}\_\{\\tau\}for everymm, and its pointwise term1−1/k​\(x\)1\-1/k\(x\)coincides with the subset value of the adversarial multiclass zero\-one game ofFathony et al\. \([2016](https://arxiv.org/html/2607.08961#bib.bib17)\)\. The equality admits a classical decision\-theoretic reading as well: the cyclic selector family is least favorable for an uninformative experiment in the sense ofBlackwell and Girshick \([1954](https://arxiv.org/html/2607.08961#bib.bib9)\)\. Together these two viewpoints furnish an explicit finite measurable selector family for the model\-induced setsA¯τ​\(x\)\\bar\{A\}\_\{\\tau\}\(x\), together with an aggregate valueVτ⋆V^\{\\star\}\_\{\\tau\}estimable from held\-out unlabeled inputs\.

The equalityRm​\(𝖲𝖾𝗅τ\)=Vτ⋆R\_\{m\}\(\\mathsf\{Sel\}\_\{\\tau\}\)=V^\{\\star\}\_\{\\tau\}is exact on the pointwise\-admissible core𝖲𝖾𝗅τ\\mathsf\{Sel\}\_\{\\tau\}, but transfers automatically neither to the widerζ\\zeta\-neighborhoodℱτ,ζ​\(fNL\)\\mathcal\{F\}\_\{\\tau,\\zeta\}\(f\_\{\\mathrm\{NL\}\}\)nor to a class of globally coherent readings: the former tolerates admissibility violations on a set of small probability, while the latter constrains how labels are selected jointly across inputs\. These are genuinely distinct decision problems and are treated separately\.

### 3\.3From pointwise selectors to coherent readings

The defining condition ofℱτ,ζ​\(fNL\)\\mathcal\{F\}\_\{\\tau,\\zeta\}\(f\_\{\\mathrm\{NL\}\}\)constrains admissibility pointwise, so a labeling inℱτ,ζ​\(fNL\)\\mathcal\{F\}\_\{\\tau,\\zeta\}\(f\_\{\\mathrm\{NL\}\}\)may vary its interpretation across inputs without corresponding to any single global reading\. We therefore separate labelings induced by one reading clause from those assembled by pointwise selection\.[Table˜1](https://arxiv.org/html/2607.08961#S3.T1)summarizes the three labeling classes used in this paper\.

Table 1:The three labeling classes and the result each governs\.###### Definition 3\.6\(Coherent\-reading subclass\)\.

Letℛread\\mathcal\{R\}\_\{\\mathrm\{read\}\}be a finite collection of natural\-language*reading clauses*, each specifying an interpretation offNLf\_\{\\mathrm\{NL\}\}\. Fora∈ℛreada\\in\\mathcal\{R\}\_\{\\mathrm\{read\}\}, letι​\(fNL,a\)\\iota\(f\_\{\\mathrm\{NL\}\},a\)denote the description obtained by appending clauseaatofNLf\_\{\\mathrm\{NL\}\}, and define its induced labeling by

fa​\(x\):=arg⁡maxy∈𝒴⁡pLLMθ​\(y∣Π​\(ι​\(fNL,a\),x\)\),f\_\{a\}\(x\):=\\arg\\max\_\{y\\in\\mathcal\{Y\}\}p\_\{\\mathrm\{LLM\}\_\{\\theta\}\}\\\!\\bigl\(y\\mid\\Pi\(\\iota\(f\_\{\\mathrm\{NL\}\},a\),x\)\\bigr\),with ties resolved by a fixed ordering of𝒴\\mathcal\{Y\}\. We extend[Assumption˜\(A1\)](https://arxiv.org/html/2607.08961#Thmassumption1)to every appended clause: for eacha∈ℛreada\\in\\mathcal\{R\}\_\{\\mathrm\{read\}\}andy∈𝒴y\\in\\mathcal\{Y\}, the mapx↦pLLMθ​\(y∣Π​\(ι​\(fNL,a\),x\)\)x\\mapsto p\_\{\\mathrm\{LLM\}\_\{\\theta\}\}\(y\\mid\\Pi\(\\iota\(f\_\{\\mathrm\{NL\}\},a\),x\)\)isℱ𝒳\\mathscr\{F\}\_\{\\mathcal\{X\}\}\-measurable\. With𝒴\\mathcal\{Y\}finite and the tie\-break fixed, eachfaf\_\{a\}is then a measurable labeling, so membership inℱτ,ζ​\(fNL\)\\mathcal\{F\}\_\{\\tau,\\zeta\}\(f\_\{\\mathrm\{NL\}\}\)is well posed\. The*coherent\-reading subclass*consists of the induced labelings that satisfy the admissibility criterion:

ℱτ,ζread​\(fNL\):=\{fa:a∈ℛread\}∩ℱτ,ζ​\(fNL\)\.\\mathcal\{F\}^\{\\mathrm\{read\}\}\_\{\\tau,\\zeta\}\(f\_\{\\mathrm\{NL\}\}\):=\\\{f\_\{a\}:a\\in\\mathcal\{R\}\_\{\\mathrm\{read\}\}\\\}\\cap\\mathcal\{F\}\_\{\\tau,\\zeta\}\(f\_\{\\mathrm\{NL\}\}\)\.

The coherent\-reading subclass is relative to the chosen clause collection and need not exhaust all coherent interpretations offNLf\_\{\\mathrm\{NL\}\}\. Enlargingℛread\\mathcal\{R\}\_\{\\mathrm\{read\}\}can only enlargeℱτ,ζread​\(fNL\)\\mathcal\{F\}^\{\\mathrm\{read\}\}\_\{\\tau,\\zeta\}\(f\_\{\\mathrm\{NL\}\}\)\.

We next compare the pointwise valueVτ⋆V^\{\\star\}\_\{\\tau\}with the minimax value of a finite coherent family\. If a channel is target\-blind on a finite target class𝒯\\mathcal\{T\}, thenRm​\(𝒯\)R\_\{m\}\(\\mathcal\{T\}\)is independent ofmm; denote this common value byVblind​\(𝒯\):=Rm​\(𝒯\)V\_\{\\mathrm\{blind\}\}\(\\mathcal\{T\}\):=R\_\{m\}\(\\mathcal\{T\}\)\. For a priorλ\\lambdaon a coherent family𝒞=\{fa\}\\mathcal\{C\}=\\\{f\_\{a\}\\\}, letμxλ​\(y\):=∑a:fa​\(x\)=yλa\\mu\_\{x\}^\{\\lambda\}\(y\):=\\sum\_\{a:f\_\{a\}\(x\)=y\}\\lambda\_\{a\}denote the induced label distribution at inputxx\.

###### Definition 3\.8\(η\\eta\-uniform coverage\)\.

Fixη≥0\\eta\\geq 0\. A finite family𝒞⊆ℱτ,ζread​\(fNL\)\\mathcal\{C\}\\subseteq\\mathcal\{F\}^\{\\mathrm\{read\}\}\_\{\\tau,\\zeta\}\(f\_\{\\mathrm\{NL\}\}\)is*η\\eta\-uniformly covering*for𝖲𝖾𝗅τ\\mathsf\{Sel\}\_\{\\tau\}if there exists a distributionλ⋆∈Δ​\(𝒞\)\\lambda^\{\\star\}\\in\\Delta\(\\mathcal\{C\}\)such that

𝔼x∼P​\[maxy∈𝒴⁡μxλ⋆​\(y\)−1k​\(x\)\]≤η\.\\mathbb\{E\}\_\{x\\sim P\}\\\!\\left\[\\max\_\{y\\in\\mathcal\{Y\}\}\\mu\_\{x\}^\{\\lambda^\{\\star\}\}\(y\)\-\\frac\{1\}\{k\(x\)\}\\right\]\\leq\\eta\.

Hereη\\etabounds the*average*gap between the mixture’s modal concentrationmaxy⁡μxλ⋆​\(y\)\\max\_\{y\}\\mu\_\{x\}^\{\\lambda^\{\\star\}\}\(y\)and the uniform\-admissible benchmark1/k​\(x\)1/k\(x\)\. This per\-input gap can be negative where a reading places mass outsideAτ​\(x\)A\_\{\\tau\}\(x\), so it is not a pointwise excess; only its average, together withζ\\zeta, controls the distance between the coherent and pointwise blind values\. Smallerη\\etaindicates that the coherent family more closely reproduces the local spread of the pointwise\-admissible core\.

###### Theorem 3\.9\(Coherent\-reading bridge\)\.

Let𝒞⊆ℱτ,ζread​\(fNL\)\\mathcal\{C\}\\subseteq\\mathcal\{F\}^\{\\mathrm\{read\}\}\_\{\\tau,\\zeta\}\(f\_\{\\mathrm\{NL\}\}\)be finite and nonempty, and let the supervision channel be target\-blind on𝒞\\mathcal\{C\}\. Then the coherent blind value never exceeds the core value by more thanζ\\zeta,

Vblind​\(𝒞\)≤Vτ⋆\+ζ,V\_\{\\mathrm\{blind\}\}\(\\mathcal\{C\}\)\\leq V^\{\\star\}\_\{\\tau\}\+\\zeta,and if𝒞\\mathcal\{C\}is moreoverη\\eta\-uniformly covering for𝖲𝖾𝗅τ\\mathsf\{Sel\}\_\{\\tau\}, the two values agree up tomax⁡\{η,ζ\}\\max\\\{\\eta,\\zeta\\\}:

Vτ⋆−η≤Vblind​\(𝒞\)≤Vτ⋆\+ζ,\|Vτ⋆−Vblind​\(𝒞\)\|≤max⁡\{η,ζ\}\.V^\{\\star\}\_\{\\tau\}\-\\eta\\;\\leq\\;V\_\{\\mathrm\{blind\}\}\(\\mathcal\{C\}\)\\;\\leq\\;V^\{\\star\}\_\{\\tau\}\+\\zeta,\\qquad\\bigl\|V^\{\\star\}\_\{\\tau\}\-V\_\{\\mathrm\{blind\}\}\(\\mathcal\{C\}\)\\bigr\|\\;\\leq\\;\\max\\\{\\eta,\\zeta\\\}\.

###### Proof sketch; full proof in[Appendix˜B](https://arxiv.org/html/2607.08961#A2)\.

For the upper bound, consider the data\-independent strategy that predicts uniformly onA¯τ​\(x\)\\bar\{A\}\_\{\\tau\}\(x\)\. Against anyfa∈𝒞f\_\{a\}\\in\\mathcal\{C\}, its pointwise error is1−1/k​\(x\)1\-1/k\(x\)whereverfa​\(x\)∈Aτ​\(x\)f\_\{a\}\(x\)\\in A\_\{\\tau\}\(x\)and is at most one elsewhere\. Since eachfaf\_\{a\}violates admissibility on a set of probability less thanζ\\zeta, its risk is at mostVτ⋆\+ζV^\{\\star\}\_\{\\tau\}\+\\zeta\.

For the lower bound, place the covering distributionλ⋆\\lambda^\{\\star\}on𝒞\\mathcal\{C\}\. Target blindness makes the learner’s observation law independent of the sampled target\. At inputxx, the smallest Bayes error against the induced label distributionμxλ⋆\\mu\_\{x\}^\{\\lambda^\{\\star\}\}is1−maxy⁡μxλ⋆​\(y\)1\-\\max\_\{y\}\\mu\_\{x\}^\{\\lambda^\{\\star\}\}\(y\)\. Therefore

Vblind​\(𝒞\)≥𝔼x​\[1−maxy⁡μxλ⋆​\(y\)\]=Vτ⋆−𝔼x​\[maxy⁡μxλ⋆​\(y\)−1k​\(x\)\]≥Vτ⋆−η\.V\_\{\\mathrm\{blind\}\}\(\\mathcal\{C\}\)\\geq\\mathbb\{E\}\_\{x\}\\\!\\left\[1\-\\max\_\{y\}\\mu\_\{x\}^\{\\lambda^\{\\star\}\}\(y\)\\right\]=V^\{\\star\}\_\{\\tau\}\-\\mathbb\{E\}\_\{x\}\\\!\\left\[\\max\_\{y\}\\mu\_\{x\}^\{\\lambda^\{\\star\}\}\(y\)\-\\frac\{1\}\{k\(x\)\}\\right\]\\geq V^\{\\star\}\_\{\\tau\}\-\\eta\.∎

The lower bound is operational only if the coverage error of the supplied reading pool can be bounded from data\. Sample splitting provides such a certificate\. On a fitting samplez1:Nfitz^\{\\mathrm\{fit\}\}\_\{1:N\}, choose

λ^∈arg⁡minλ∈Δ​\(𝒞\)⁡1N​∑i=1N\(maxy⁡μzifitλ​\(y\)−1k​\(zifit\)\)\.\\widehat\{\\lambda\}\\in\\arg\\min\_\{\\lambda\\in\\Delta\(\\mathcal\{C\}\)\}\\frac\{1\}\{N\}\\sum\_\{i=1\}^\{N\}\\left\(\\max\_\{y\}\\mu\_\{z\_\{i\}^\{\\mathrm\{fit\}\}\}^\{\\lambda\}\(y\)\-\\frac\{1\}\{k\(z\_\{i\}^\{\\mathrm\{fit\}\}\)\}\\right\)\.Evaluate the same bounded loss atλ^\\widehat\{\\lambda\}on an independent audit sample\. Conditional on the fitting sample,λ^\\widehat\{\\lambda\}is fixed, so a standard one\-sided concentration bound yields a valid population upper bound on its coverage error\. Reusing the fitting sample would instead require a uniform bound overλ\\lambda\.

## 4Finite\-Sample Certification of Blind\-Channel Values

We construct finite\-sample certificates from held\-out inputs drawn from the deployment distributionPP\. Empirical admissible overlap certifies a pairwise risk floor and brackets the model\-admissible diameter, while admissible\-set multiplicities certify the exact core valueVτ⋆V^\{\\star\}\_\{\\tau\}\. The latter can be strictly sharper when more than two labels overlap\. These guarantees are specific to the audited deployment distribution\.

The risk certificates are one\-sided\. A positive lower bound establishes a minimax floor; a small or zero bound is inconclusive, because sampling uncertainty may dominate the observed disagreement or the audited pair may not witness the full class diameter\.

The section builds several certificates from a single overlap audit, and their scope varies along two axes: the*access mode*\(exposed decoding probabilities versus sampled decoding\) and the*target quantity*\(the pairwise blind floor, the model\-admissible diameter, or the exact core valueVτ⋆V^\{\\star\}\_\{\\tau\}\)\. The reader may use the following map\. Under exposed probabilities,[Proposition˜4\.1](https://arxiv.org/html/2607.08961#S4.Thmtheorem1)certifies the diameter band and the pairwise floor;[Theorem˜4\.6](https://arxiv.org/html/2607.08961#S4.Thmtheorem6)packages the pairwise floor for the canonical maximal\-spread pair into the headline canonical\-pair certificate; and[Proposition˜4\.9](https://arxiv.org/html/2607.08961#S4.Thmtheorem9)sharpens this to the exact valueVτ⋆V^\{\\star\}\_\{\\tau\}using admissible\-set multiplicities\.[Corollary˜B\.4](https://arxiv.org/html/2607.08961#A2.Thmtheorem4)lifts the pairwise floor to a finite family by a union bound\. Under sampled decoding, the same three quantities are certified with an enlarged plug\-in radius \([Corollary˜4\.5](https://arxiv.org/html/2607.08961#S4.Thmtheorem5);[Proposition˜4\.10](https://arxiv.org/html/2607.08961#S4.Thmtheorem10)\)\.[Algorithm˜4\.1](https://arxiv.org/html/2607.08961#S4.algorithm1)collects the exposed and sampled procedures into one audit\.

### 4\.1Estimating model\-admissible overlap

The admissible\-overlap mass satisfiesDτ⋆=𝔼​\[𝟏​\{\|Aτ​\(X\)\|≥2\}\]D^\{\\star\}\_\{\\tau\}=\\mathbb\{E\}\[\\mathbf\{1\}\\\{\|A\_\{\\tau\}\(X\)\|\\geq 2\\\}\]\. Its Bernoulli integrand records whether the model admits multiple labels at an input and is observable from the description and input alone\. Consequently,Dτ⋆D^\{\\star\}\_\{\\tau\}can be estimated from unlabeled deployment inputs at the usualN−1/2N^\{\-1/2\}rate\.

###### Proposition 4\.1\(Master ambiguity statistic\)\.

LetX1,…,XN​∼i\.i\.d\.​PX\_\{1\},\\ldots,X\_\{N\}\\overset\{\\mathrm\{i\.i\.d\.\}\}\{\\sim\}P, and suppose the admissible setsAτ​\(Xi\)A\_\{\\tau\}\(X\_\{i\}\)are available\. Define

D^⋆:=1N​∑i=1N𝟏​\{\|Aτ​\(Xi\)\|≥2\},εN:=log⁡\(2/δ\)2​N\.\\widehat\{D\}^\{\\star\}:=\\frac\{1\}\{N\}\\sum\_\{i=1\}^\{N\}\\mathbf\{1\}\\\!\\left\\\{\|A\_\{\\tau\}\(X\_\{i\}\)\|\\geq 2\\right\\\},\\qquad\\varepsilon\_\{N\}:=\\sqrt\{\\frac\{\\log\(2/\\delta\)\}\{2N\}\}\.Then, with probability at least1−δ1\-\\delta,

\|D^⋆−Dτ⋆\|≤εN\.\\bigl\|\\widehat\{D\}^\{\\star\}\-D\_\{\\tau\}^\{\\star\}\\bigr\|\\leq\\varepsilon\_\{N\}\.On the same event,

diamτ,ζ​\(fNL,P\)∈\[\(D^⋆−εN\)\+,min⁡\{1,D^⋆\+εN\+2​ζ\}\]\.\\mathrm\{diam\}\_\{\\tau,\\zeta\}\(f\_\{\\mathrm\{NL\}\},P\)\\in\\left\[\(\\widehat\{D\}^\{\\star\}\-\\varepsilon\_\{N\}\)\_\{\+\},\\min\\\!\\left\\\{1,\\widehat\{D\}^\{\\star\}\+\\varepsilon\_\{N\}\+2\\zeta\\right\\\}\\right\]\.Under fixed\-description target\-blind supervision, half the lower endpoint is also a valid one\-sided lower confidence bound on the minimax risk floor witnessed by the maximal\-spread pair\.

###### Proof\.

SetZi:=𝟏​\{\|Aτ​\(Xi\)\|≥2\}Z\_\{i\}:=\\mathbf\{1\}\\\{\|A\_\{\\tau\}\(X\_\{i\}\)\|\\geq 2\\\}\. The variablesZ1,…,ZNZ\_\{1\},\\ldots,Z\_\{N\}are i\.i\.d\. Bernoulli with meanDτ⋆D^\{\\star\}\_\{\\tau\}, andD^⋆=N−1​∑iZi\\widehat\{D\}^\{\\star\}=N^\{\-1\}\\sum\_\{i\}Z\_\{i\}\. Hoeffding’s inequality therefore gives, with probability at least1−δ1\-\\delta,

\(D^⋆−εN\)\+≤Dτ⋆≤min⁡\{1,D^⋆\+εN\}\.\(\\widehat\{D\}^\{\\star\}\-\\varepsilon\_\{N\}\)\_\{\+\}\\leq D^\{\\star\}\_\{\\tau\}\\leq\\min\\\{1,\\widehat\{D\}^\{\\star\}\+\\varepsilon\_\{N\}\\\}\.On this event, substituting these bounds intoDτ⋆≤diamτ,ζ​\(fNL,P\)≤Dτ⋆\+2​ζD^\{\\star\}\_\{\\tau\}\\leq\\mathrm\{diam\}\_\{\\tau,\\zeta\}\(f\_\{\\mathrm\{NL\}\},P\)\\leq D^\{\\star\}\_\{\\tau\}\+2\\zetaand usingdiamτ,ζ​\(fNL,P\)≤1\\mathrm\{diam\}\_\{\\tau,\\zeta\}\(f\_\{\\mathrm\{NL\}\},P\)\\leq 1gives the stated confidence band\.

Finally, the maximal\-spread pair is admissible and has disagreementDτ⋆D^\{\\star\}\_\{\\tau\}\. Under target\-blind supervision its two\-point minimax floor isDτ⋆/2D^\{\\star\}\_\{\\tau\}/2, which is at least\(D^⋆−εN\)\+/2\(\\widehat\{D\}^\{\\star\}\-\\varepsilon\_\{N\}\)\_\{\+\}/2on the same event\. ∎

The geometry places the diameter in the partially identified interval\[Dτ⋆,min⁡\{1,Dτ⋆\+2​ζ\}\],\\left\[D^\{\\star\}\_\{\\tau\},\\ \\min\\\{1,D^\{\\star\}\_\{\\tau\}\+2\\zeta\\\}\\right\],where truncation reflects that a disagreement probability cannot exceed one\(Imbens and Manski,[2004](https://arxiv.org/html/2607.08961#bib.bib27)\)\. The audit estimatesDτ⋆D^\{\\star\}\_\{\\tau\}, whileζ\\zetaremains a fixed tolerance\. Propagating a confidence interval forDτ⋆D^\{\\star\}\_\{\\tau\}through these deterministic endpoints therefore yields the diameter band directly; no additional correction for an estimated, potentially collapsing identification slack is required\(Stoye,[2009b](https://arxiv.org/html/2607.08961#bib.bib54)\)\.

### 4\.2The blind pairwise and finite\-family floors

Target blindness is a structural property of the channel that we assume throughout; it is not estimated by the audit\. Under this assumption the audit estimates only the disagreement mass of an independently selected admissible pair, which suffices to certify a risk floor\. Fixfa,fb∈ℱτ,ζ​\(fNL\)f\_\{a\},f\_\{b\}\\in\\mathcal\{F\}\_\{\\tau,\\zeta\}\(f\_\{\\mathrm\{NL\}\}\)and writeDa​b=P​\(fa≠fb\)D\_\{ab\}=P\(f\_\{a\}\\neq f\_\{b\}\)for their disagreement mass\. Foru∈\{a,b\}u\\in\\\{a,b\\\}, letPuP\_\{u\}denote the one\-example observation law induced by targetfuf\_\{u\}through the fixed\-description base channel\. A measurable, possibly randomized learner maps a sampleS∼Pu⊗mS\\sim P\_\{u\}^\{\\otimes m\}to a classifierh^​\(S\)\\hat\{h\}\(S\)of riskdP​\(h^​\(S\),fu\)d\_\{P\}\(\\hat\{h\}\(S\),f\_\{u\}\)\. Independently of bothSSand the choice of\(fa,fb\)\(f\_\{a\},f\_\{b\}\), drawz1,…,zN∼Pz\_\{1\},\\ldots,z\_\{N\}\\sim Pand estimate the disagreement mass by

D^a​b=1N​∑i=1N𝟏​\{fa​\(zi\)≠fb​\(zi\)\}\.\\widehat\{D\}\_\{ab\}=\\frac\{1\}\{N\}\\sum\_\{i=1\}^\{N\}\\mathbf\{1\}\\\!\\left\\\{f\_\{a\}\(z\_\{i\}\)\\neq f\_\{b\}\(z\_\{i\}\)\\right\\\}\.
If the channel is target\-blind on\{fa,fb\}\\\{f\_\{a\},f\_\{b\}\\\}\(soPa=PbP\_\{a\}=P\_\{b\}andPa⊗m=Pb⊗mP\_\{a\}^\{\\otimes m\}=P\_\{b\}^\{\\otimes m\}for everymm\), the two\-point argument of[Theorem˜3\.2](https://arxiv.org/html/2607.08961#S3.Thmtheorem2)\(b\) gives the population floormaxu∈\{a,b\}⁡𝔼S∼Pu⊗m​\[dP​\(h^​\(S\),fu\)\]≥Da​b/2\\max\_\{u\\in\\\{a,b\\\}\}\\mathbb\{E\}\_\{S\\sim P\_\{u\}^\{\\otimes m\}\}\[d\_\{P\}\(\\hat\{h\}\(S\),f\_\{u\}\)\]\\geq D\_\{ab\}/2, uniformly inmmand over all measurable learners\. Its empirical version replacesDa​bD\_\{ab\}by the one\-sided Hoeffding lower boundDL,a​b:=\[D^a​b−log⁡\(2/δ\)/2​N\]\+D\_\{L,ab\}:=\[\\widehat\{D\}\_\{ab\}\-\\sqrt\{\\log\(2/\\delta\)/2N\}\]\_\{\+\}, valid with probability at least1−δ1\-\\delta, so that the certified floor isDL,a​b/2D\_\{L,ab\}/2; we record both as[Theorem˜B\.3](https://arxiv.org/html/2607.08961#A2.Thmtheorem3)in[Appendix˜B](https://arxiv.org/html/2607.08961#A2)\. The certificate is algorithm\-independent:h^\\hat\{h\}ranges over all measurable rules, so the floor is a property of the supervision channel, not of any learner\. Its only sampling requirement is independence of theNNaudit inputs; no repeated oracle call enters\. We report the two\-sided radiusεN=log⁡\(2/δ\)/2​N\\varepsilon\_\{N\}=\\sqrt\{\\log\(2/\\delta\)/2N\}throughout under a single confidence budget, which for a one\-sided floor is deliberately conservative\.

Lifting the certificate from a single pair to a fixed finite family\{f\(1\),…,f\(K\)\}⊆ℱτ,ζ​\(fNL\)\\\{f^\{\(1\)\},\\dots,f^\{\(K\)\}\\\}\\subseteq\\mathcal\{F\}\_\{\\tau,\\zeta\}\(f\_\{\\mathrm\{NL\}\}\)costs only a union bound over the\(K2\)\\binom\{K\}\{2\}pairs, widening each per\-pair radius tolog⁡\(2​\(K2\)/δ\)/2​N\\sqrt\{\\log\(2\\binom\{K\}\{2\}/\\delta\)/2N\}and certifying

infh^maxk⁡𝔼​\[dP​\(h^​\(S\),f\(k\)\)\]≥maxa<b⁡DL,a​b/2\\inf\_\{\\hat\{h\}\}\\max\_\{k\}\\mathbb\{E\}\[d\_\{P\}\(\\hat\{h\}\(S\),f^\{\(k\)\}\)\]\\geq\\max\_\{a<b\}D\_\{L,ab\}/2\([Corollary˜B\.4](https://arxiv.org/html/2607.08961#A2.Thmtheorem4)in[Appendix˜B](https://arxiv.org/html/2607.08961#A2)\)\. Once the admissible sets are available, the certified floor is a property of the fixed labelings and the audit inputs alone; no further reading\-specific oracle calls are required\.

This overlap statistic also characterizes the population zero\-overlap regime and upper\-bounds unresolved overlap from data\.

###### Corollary 4\.4\(Zero\-overlap regime\)\.

IfDτ⋆=0D^\{\\star\}\_\{\\tau\}=0, thendiamP​\(𝖲𝖾𝗅τ\)=0\\mathrm\{diam\}\_\{P\}\(\\mathsf\{Sel\}\_\{\\tau\}\)=0anddiamτ,ζ​\(fNL,P\)≤2​ζ\\mathrm\{diam\}\_\{\\tau,\\zeta\}\(f\_\{\\mathrm\{NL\}\},P\)\\leq 2\\zeta; conversely,diamτ,ζ​\(fNL,P\)\>2​ζ\\mathrm\{diam\}\_\{\\tau,\\zeta\}\(f\_\{\\mathrm\{NL\}\},P\)\>2\\zetaimpliesDτ⋆≥diamτ,ζ​\(fNL,P\)−2​ζ\>0D^\{\\star\}\_\{\\tau\}\\geq\\mathrm\{diam\}\_\{\\tau,\\zeta\}\(f\_\{\\mathrm\{NL\}\},P\)\-2\\zeta\>0\. Consequently, the certified upper boundD^⋆\+εN\\widehat\{D\}^\{\\star\}\+\\varepsilon\_\{N\}onDτ⋆D^\{\\star\}\_\{\\tau\}upper\-bounds every pairwiseD/2D/2obstruction inℱτ,ζ​\(fNL\)\\mathcal\{F\}\_\{\\tau,\\zeta\}\(f\_\{\\mathrm\{NL\}\}\)byζ\+12​\(D^⋆\+εN\)\\zeta\+\\tfrac\{1\}\{2\}\(\\widehat\{D\}^\{\\star\}\+\\varepsilon\_\{N\}\)\.

###### Proof\.

Both directions follow from the representation sandwich of[Theorem˜2\.11](https://arxiv.org/html/2607.08961#S2.Thmtheorem11)\. IfDτ⋆=0D^\{\\star\}\_\{\\tau\}=0thendiamP​\(𝖲𝖾𝗅τ\)=0\\mathrm\{diam\}\_\{P\}\(\\mathsf\{Sel\}\_\{\\tau\}\)=0, sodiamτ,ζ≤2​ζ\\mathrm\{diam\}\_\{\\tau,\\zeta\}\\leq 2\\zeta; if insteaddiamτ,ζ\>2​ζ\\mathrm\{diam\}\_\{\\tau,\\zeta\}\>2\\zetathenDτ⋆≥diamτ,ζ−2​ζ\>0D^\{\\star\}\_\{\\tau\}\\geq\\mathrm\{diam\}\_\{\\tau,\\zeta\}\-2\\zeta\>0\. Substituting the confidence boundD^⋆\+εN\\widehat\{D\}^\{\\star\}\+\\varepsilon\_\{N\}of[Proposition˜4\.1](https://arxiv.org/html/2607.08961#S4.Thmtheorem1)forDτ⋆D^\{\\star\}\_\{\\tau\}yields the stated simultaneous upper bound on pairwise obstructions\. ∎

The statisticDτ⋆D^\{\\star\}\_\{\\tau\}thus gives a population characterization of ambiguity at resolution2​ζ2\\zeta, backed by a finite\-sample upper confidence bound: an overlap certified below the resolution means the residual disagreement is coverage slack rather than substantive, while any diameter above it must register inDτ⋆D^\{\\star\}\_\{\\tau\}\.

### 4\.3Sampled decoding: the plug\-in radius

When the decoding law is accessible only through samples, the label probabilities are not observed directly and the admissible sets must be estimated\.

At each ofNNi\.i\.d\. held\-out inputszi∼Pz\_\{i\}\\sim Pthe auditor drawsrri\.i\.d\. labelsyi,1,…,yi,r∼πLLMθ\(⋅∣fNL,zi\)y\_\{i,1\},\\dots,y\_\{i,r\}\\sim\\pi\_\{\\mathrm\{LLM\}\_\{\\theta\}\}\(\\cdot\\mid f\_\{\\mathrm\{NL\}\},z\_\{i\}\), independently across inputs, and forms the empirical decodingπ^i​\(y\)=1r​∑t=1r𝟏​\{yi,t=y\}\\widehat\{\\pi\}\_\{i\}\(y\)=\\tfrac\{1\}\{r\}\\sum\_\{t=1\}^\{r\}\\mathbf\{1\}\\\{y\_\{i,t\}=y\\\}, the plug\-in admissible setA^τ​\(zi\)=\{y:π^i​\(y\)≥τ\}\\widehat\{A\}\_\{\\tau\}\(z\_\{i\}\)=\\\{y:\\widehat\{\\pi\}\_\{i\}\(y\)\\geq\\tau\\\}, and the plug\-in overlap statisticD^plug⋆=1N​∑i=1N𝟏​\{\|A^τ​\(zi\)\|≥2\}\\widehat\{D\}^\{\\star\}\_\{\\mathrm\{plug\}\}=\\tfrac\{1\}\{N\}\\sum\_\{i=1\}^\{N\}\\mathbf\{1\}\\\{\|\\widehat\{A\}\_\{\\tau\}\(z\_\{i\}\)\|\\geq 2\\\}\.

Thresholding empirical frequencies rather than exact probabilities widens the certificate radius by two terms\. A finite\-depth error arises from misclassifying admissibility when a label sits nearτ\\tau, and it decays with the number of decodingsrr\. What does not decay is the mass of inputs that lie near the threshold in the first place, measured by the*threshold\-margin mass*

κ\(ξ\):=ℙx∼P\[∃y∈𝒴:\|πLLMθ\(y∣fNL,x\)−τ\|≤ξ\],ξ\>0,\\kappa\(\\xi\)\\;:=\\;\\mathbb\{P\}\_\{x\\sim P\}\\Bigl\[\\exists\\,y\\in\\mathcal\{Y\}:\\;\\bigl\|\\pi\_\{\\mathrm\{LLM\}\_\{\\theta\}\}\(y\\mid f\_\{\\mathrm\{NL\}\},x\)\-\\tau\\bigr\|\\leq\\xi\\Bigr\],\\qquad\\xi\>0,the probability that some label falls withinξ\\xiofτ\\tau; this term persists at any sampling depth\.

###### Corollary 4\.5\(Plug\-in master statistic under a threshold margin\)\.

WithC=\|𝒴\|C=\|\\mathcal\{Y\}\|, for each fixedξ\>0\\xi\>0and with probability at least1−δ1\-\\deltaover the audit,

\|D^plug⋆−Dτ⋆\|≤εN,r​\(ξ\):=log⁡\(2/δ\)2​N⏟sampling\+κ​\(ξ\)⏟margin\+2​C​e−2​r​ξ2⏟depth,\\bigl\|\\widehat\{D\}^\{\\star\}\_\{\\mathrm\{plug\}\}\-D^\{\\star\}\_\{\\tau\}\\bigr\|\\;\\leq\\;\\varepsilon\_\{N,r\}\(\\xi\)\\;:=\\;\\underbrace\{\\sqrt\{\\frac\{\\log\(2/\\delta\)\}\{2N\}\}\}\_\{\\text\{sampling\}\}\\;\+\\;\\underbrace\{\\kappa\(\\xi\)\}\_\{\\text\{margin\}\}\\;\+\\;\\underbrace\{2C\\,e^\{\-2r\\xi^\{2\}\}\}\_\{\\text\{depth\}\},and\[\(D^plug⋆−εN,r​\(ξ\)\)\+,min⁡\{1,D^plug⋆\+εN,r​\(ξ\)\+2​ζ\}\]\[\\,\(\\widehat\{D\}^\{\\star\}\_\{\\mathrm\{plug\}\}\-\\varepsilon\_\{N,r\}\(\\xi\)\)\_\{\+\},\\;\\min\\\{1,\\widehat\{D\}^\{\\star\}\_\{\\mathrm\{plug\}\}\+\\varepsilon\_\{N,r\}\(\\xi\)\+2\\zeta\\\}\\,\]is a two\-sided confidence band fordiamτ,ζ\\mathrm\{diam\}\_\{\\tau,\\zeta\}\.

###### Proof sketch; full proof in[Appendix˜B](https://arxiv.org/html/2607.08961#A2)\.

Call an inputξ\\xi\-safe if every label probability lies more thanξ\\xifromτ\\tau, so the unsafe mass isκ​\(ξ\)\\kappa\(\\xi\)\. At aξ\\xi\-safe input, a label\-wise Hoeffding union bounds the chance of a wrong admissibility decision by2​C​e−2​r​ξ22Ce^\{\-2r\\xi^\{2\}\}; the plug\-in overlap indicator can therefore differ from the population one only on the unsafe mass or through this depth error, so their means differ by at mostκ​\(ξ\)\+2​C​e−2​r​ξ2\\kappa\(\\xi\)\+2Ce^\{\-2r\\xi^\{2\}\}\. An outer Hoeffding bound over theNNi\.i\.d\. indicators adds the sampling termlog⁡\(2/δ\)/2​N\\sqrt\{\\log\(2/\\delta\)/2N\}, and the triangle inequality assembles the three intoεN,r​\(ξ\)\\varepsilon\_\{N,r\}\(\\xi\)\. Transporting the bound todiamτ,ζ\\mathrm\{diam\}\_\{\\tau,\\zeta\}adds only the deterministic2​ζ2\\zetaat the upper end\. ∎

The margin massκ​\(ξ\)\\kappa\(\\xi\)is the only term ofεN,r​\(ξ\)\\varepsilon\_\{N,r\}\(\\xi\)that no sampling depth removes; the residual gap betweenDτ⋆D^\{\\star\}\_\{\\tau\}and the full diameter is the identification tolerance2​ζ2\\zeta, fixed by the description rather than incurred by search or finite samples\. A positive threshold margin is unavoidable for a uniform finite\-depth certificate: labels whose probabilities lie arbitrarily close toτ\\taucannot be classified as admissible or inadmissible with uniformly controlled error from finitely many decoding draws \([Remark˜B\.5](https://arxiv.org/html/2607.08961#A2.Thmtheorem5)\)\.

### 4\.4Canonical\-Pair Certificate

We now assemble the preceding certificates into a single audit of the canonical maximal\-spread pair\(fτ\+,fτ−\)\(f\_\{\\tau\}^\{\+\},f\_\{\\tau\}^\{\-\}\)\. This pair is a deterministic functional of\(πLLMθ,τ,≺\)\(\\pi\_\{\\mathrm\{LLM\}\_\{\\theta\}\},\\tau,\\prec\), fixed before any audit data are drawn\. Since the data neither select nor modify it, its disagreement is estimated directly, with no sample splitting and no data\-selection correction of the type required for adaptively chosen targets\(Berk et al\.,[2013](https://arxiv.org/html/2607.08961#bib.bib7)\)\.[Algorithm˜4\.1](https://arxiv.org/html/2607.08961#S4.algorithm1)states the procedure\.

Algorithm 4\.1:Blind\-channel floor certificate\.Input:descriptionfNLf\_\{\\mathrm\{NL\}\}; frozen modelLLMθ\\mathrm\{LLM\}\_\{\\theta\}; prompt templateΠ\\Pi; thresholdτ∈\(0,12\)\\tau\\in\(0,\\tfrac\{1\}\{2\}\); coverage toleranceζ\\zeta; confidenceδ\\delta; held\-out inputsz1,…,zN∼Pz\_\{1\},\\dots,z\_\{N\}\\sim P; and an access mode, either exposed probabilities or sampled decoding\. Under sampled decoding, also fix a marginξ\\xiand split the budget asδ=δaudit\+δκ\\delta=\\delta\_\{\\mathrm\{audit\}\}\+\\delta\_\{\\kappa\}; supply either a prespecified deterministic upper bound onκ​\(ξ\)\\kappa\(\\xi\)\(which consumes no confidence, soδaudit=δ\\delta\_\{\\mathrm\{audit\}\}=\\delta\) or one certified at levelδκ\\delta\_\{\\kappa\}on an independent split\. Output:a one\-sided floor certificate valid with probability≥1−δ\\geq 1\-\\delta\.

1. 1\.Admissible sets\.For eachziz\_\{i\}, formAτ​\(zi\)=\{y:πLLMθ​\(y∣fNL,zi\)≥τ\}A\_\{\\tau\}\(z\_\{i\}\)=\\\{y:\\pi\_\{\\mathrm\{LLM\}\_\{\\theta\}\}\(y\\mid f\_\{\\mathrm\{NL\}\},z\_\{i\}\)\\geq\\tau\\\}from exposed probabilities, or therr\-sample plug\-inA^τ​\(zi\)\\widehat\{A\}\_\{\\tau\}\(z\_\{i\}\)under sampled decoding \([Corollary˜4\.5](https://arxiv.org/html/2607.08961#S4.Thmtheorem5)\)\.
2. 2\.Statistics\.Form the overlapD^⋆=1N​∑i𝟏​\{\|Aτ​\(zi\)\|≥2\}\\widehat\{D\}^\{\\star\}=\\tfrac\{1\}\{N\}\\sum\_\{i\}\\mathbf\{1\}\\\{\|A\_\{\\tau\}\(z\_\{i\}\)\|\\geq 2\\\}and the multiplicity statisticV^⋆=1N​∑iϕ​\(Aτ​\(zi\)\)\\widehat\{V\}^\{\\star\}=\\tfrac\{1\}\{N\}\\sum\_\{i\}\\phi\(A\_\{\\tau\}\(z\_\{i\}\)\), withϕ​\(A\)=1−1/\|A\|\\phi\(A\)=1\-1/\|A\|andϕ​\(∅\)=0\\phi\(\\varnothing\)=0\([Equation˜2](https://arxiv.org/html/2607.08961#S4.E2)\), usingA^τ\\widehat\{A\}\_\{\\tau\}in place ofAτA\_\{\\tau\}under sampled decoding\.
3. 3\.Radius\.Setε=log⁡\(2/δ\)/2​N\\varepsilon=\\sqrt\{\\log\(2/\\delta\)/2N\}under exposed probabilities, or the enlarged plug\-in radiusε=εaudit\+κ​\(ξ\)\+2​C​e−2​r​ξ2\\varepsilon=\\varepsilon\_\{\\mathrm\{audit\}\}\+\\kappa\(\\xi\)\+2Ce^\{\-2r\\xi^\{2\}\}of[Corollary˜4\.5](https://arxiv.org/html/2607.08961#S4.Thmtheorem5)under sampled decoding, withεaudit=log⁡\(2/δaudit\)/2​N\\varepsilon\_\{\\mathrm\{audit\}\}=\\sqrt\{\\log\(2/\\delta\_\{\\mathrm\{audit\}\}\)/2N\}; a union bound then makes the certificate valid at the total levelδ\\delta\.
4. 4\.Certificate\.Return the certified pairwise floor12​\(D^⋆−ε\)\+\\tfrac\{1\}\{2\}\(\\widehat\{D\}^\{\\star\}\-\\varepsilon\)\_\{\+\}, and, for the exact core value, the certificate of[Proposition˜4\.9](https://arxiv.org/html/2607.08961#S4.Thmtheorem9)\(exposed\) or[Proposition˜4\.10](https://arxiv.org/html/2607.08961#S4.Thmtheorem10)\(sampled\)\. Report every value alongside the access mode, model, template,NN, and\(δ,τ,ζ\)\(\\delta,\\tau,\\zeta\)\.

Note\.The pair\(fτ\+,fτ−\)\(f\_\{\\tau\}^\{\+\},f\_\{\\tau\}^\{\-\}\)is a deterministic functional of\(πLLMθ,τ,≺\)\(\\pi\_\{\\mathrm\{LLM\}\_\{\\theta\}\},\\tau,\\prec\); under sampled decoding the corrected statistics of step 2 estimate its population overlap, and the pair induced by the sampled sets is not treated as a population target\.

###### Theorem 4\.6\(Certificate from empirical overlap\)\.

Under[Assumptions˜\(A1\)](https://arxiv.org/html/2607.08961#Thmassumption1)and[\(A3\)](https://arxiv.org/html/2607.08961#Thmassumption3), fixfNLf\_\{\\mathrm\{NL\}\}, the frozenLLMθ\\mathrm\{LLM\}\_\{\\theta\}and templateΠ\\Pi, a thresholdτ∈\(0,12\)\\tau\\in\(0,\\tfrac\{1\}\{2\}\), a coverage toleranceζ∈\(0,12\)\\zeta\\in\(0,\\tfrac\{1\}\{2\}\), and a confidenceδ∈\(0,1\)\\delta\\in\(0,1\), and suppose the supervision channel is target\-blind\. FromNNi\.i\.d\. held\-out inputsz1,…,zN∼Pz\_\{1\},\\dots,z\_\{N\}\\sim Pwith observed admissible setsAτ​\(zi\)A\_\{\\tau\}\(z\_\{i\}\), form

D^⋆=1N​∑i=1N𝟏​\{\|Aτ​\(zi\)\|≥2\},εN=log⁡\(2/δ\)2​N\.\\widehat\{D\}^\{\\star\}=\\frac\{1\}\{N\}\\sum\_\{i=1\}^\{N\}\\mathbf\{1\}\\\{\|A\_\{\\tau\}\(z\_\{i\}\)\|\\geq 2\\\},\\qquad\\varepsilon\_\{N\}=\\sqrt\{\\frac\{\\log\(2/\\delta\)\}\{2N\}\}\.Then, with probability at least1−δ1\-\\deltaover the audit and simultaneously for every sample sizemm:

1. \(a\)*\(Certified blind\-channel floor\.\)*Every learnerh^\\hat\{h\}obeys supf∈ℱτ,ζ​\(fNL\)𝔼S∼Pf⊗m​\[dP​\(h^​\(S\),f\)\]≥12​\(D^⋆−εN\)\+,\\sup\_\{f\\in\\mathcal\{F\}\_\{\\tau,\\zeta\}\(f\_\{\\mathrm\{NL\}\}\)\}\\;\\mathbb\{E\}\_\{S\\sim P\_\{f\}^\{\\otimes m\}\}\\bigl\[d\_\{P\}\(\\hat\{h\}\(S\),f\)\\bigr\]\\;\\geq\\;\\tfrac\{1\}\{2\}\\bigl\(\\widehat\{D\}^\{\\star\}\-\\varepsilon\_\{N\}\\bigr\)\_\{\+\},so in particular the blind\-channel minimax risk over the class is at least this floor\.
2. \(b\)*\(Diameter bracket\.\)*The reported floor lies withinεN\\varepsilon\_\{N\}of12​Dτ⋆\\tfrac\{1\}\{2\}D^\{\\star\}\_\{\\tau\}, which satisfies12​Dτ⋆≥12​\(diamτ,ζ−2​ζ\)\\tfrac\{1\}\{2\}D^\{\\star\}\_\{\\tau\}\\geq\\tfrac\{1\}\{2\}\(\\mathrm\{diam\}\_\{\\tau,\\zeta\}\-2\\zeta\); consequently the gap between the reported floor and the largest pairwiseD/2D/2obstruction inℱτ,ζ​\(fNL\)\\mathcal\{F\}\_\{\\tau,\\zeta\}\(f\_\{\\mathrm\{NL\}\}\)is at mostζ\+εN\\zeta\+\\varepsilon\_\{N\}\.

###### Proof sketch; full proof in[Appendix˜B](https://arxiv.org/html/2607.08961#A2)\.

Two\-sided Hoeffding on the i\.i\.d\. indicators𝟏​\{\|Aτ​\(zi\)\|≥2\}\\mathbf\{1\}\\\{\|A\_\{\\tau\}\(z\_\{i\}\)\|\\geq 2\\\}gives\|D^⋆−Dτ⋆\|≤εN\|\\widehat\{D\}^\{\\star\}\-D^\{\\star\}\_\{\\tau\}\|\\leq\\varepsilon\_\{N\}with probability at least1−δ1\-\\delta; work on this event\. For*\(a\)*, the canonical pair\(fτ\+,fτ−\)\(f\_\{\\tau\}^\{\+\},f\_\{\\tau\}^\{\-\}\)is admissible \([Theorem˜2\.11](https://arxiv.org/html/2607.08961#S2.Thmtheorem11)\) and satisfies\{fτ\+≠fτ−\}=\{\|Aτ\|≥2\}\\\{f\_\{\\tau\}^\{\+\}\\neq f\_\{\\tau\}^\{\-\}\\\}=\\\{\|A\_\{\\tau\}\|\\geq 2\\\}, so its disagreement mass equalsDτ⋆≥D^⋆−εND^\{\\star\}\_\{\\tau\}\\geq\\widehat\{D\}^\{\\star\}\-\\varepsilon\_\{N\}\. Target\-blindness renders the two targets indistinguishable through the channel, so by the two\-point floor of[Theorem˜3\.2](https://arxiv.org/html/2607.08961#S3.Thmtheorem2)\(b\) the worst\-case risk is at least half this mass, uniformly inmm; and since the pair is a deterministic functional of\(πLLMθ,τ,≺\)\(\\pi\_\{\\mathrm\{LLM\}\_\{\\theta\}\},\\tau,\\prec\), fixed independently of the audit, the whole budgetδ\\deltafunds the single estimateD^⋆\\widehat\{D\}^\{\\star\}without splitting \(theK=2K=2case of[Theorem˜B\.3](https://arxiv.org/html/2607.08961#A2.Thmtheorem3)\)\. For*\(b\)*, the representation bracket givesDτ⋆≥diamτ,ζ−2​ζD^\{\\star\}\_\{\\tau\}\\geq\\mathrm\{diam\}\_\{\\tau,\\zeta\}\-2\\zeta, while any admissible pair has floor12​dP≤12​diamτ,ζ≤12​Dτ⋆\+ζ\\tfrac\{1\}\{2\}d\_\{P\}\\leq\\tfrac\{1\}\{2\}\\mathrm\{diam\}\_\{\\tau,\\zeta\}\\leq\\tfrac\{1\}\{2\}D^\{\\star\}\_\{\\tau\}\+\\zeta; together with\|D^⋆−Dτ⋆\|≤εN\|\\widehat\{D\}^\{\\star\}\-D^\{\\star\}\_\{\\tau\}\|\\leq\\varepsilon\_\{N\}this places every such floor withinζ\+εN\\zeta\+\\varepsilon\_\{N\}of the reported one\. ∎

### 4\.5Exact Minimax\-Value Certificate

The canonical\-pair floor of[Theorem˜4\.6](https://arxiv.org/html/2607.08961#S4.Thmtheorem6)is the headline certificate; this subsection is an optional sharpening and may be skipped on a first reading\. The overlap floor uses only whether each admissible set is a singleton\. Its full multiplicity carries more information, and exploiting it sharpens the guarantee from a floor on worst\-case risk to a certificate for the exact blind\-channel valueVτ⋆V^\{\\star\}\_\{\\tau\}\.

The audited admissible sets also yield the multiplicity estimator

V^⋆:=1N​∑i=1N\(1−1k​\(zi\)\)=1N​∑i=1Nϕ​\(Aτ​\(zi\)\)\\widehat\{V\}^\{\\star\}:=\\frac\{1\}\{N\}\\sum\_\{i=1\}^\{N\}\\left\(1\-\\frac\{1\}\{k\(z\_\{i\}\)\}\\right\)=\\frac\{1\}\{N\}\\sum\_\{i=1\}^\{N\}\\phi\(A\_\{\\tau\}\(z\_\{i\}\)\)ofVτ⋆V^\{\\star\}\_\{\\tau\}, wherek​\(zi\)=\|Aτ​\(zi\)\|k\(z\_\{i\}\)=\|A\_\{\\tau\}\(z\_\{i\}\)\|and

ϕ​\(A\)=1−1\|A\|for​A≠∅,ϕ​\(∅\)=0\.\\phi\(A\)=1\-\\tfrac\{1\}\{\|A\|\}\\ \\ \\text\{for \}A\\neq\\varnothing,\\qquad\\phi\(\\varnothing\)=0\.\(2\)
The exact valueVτ⋆V^\{\\star\}\_\{\\tau\}is pinned to the overlap massDτ⋆D^\{\\star\}\_\{\\tau\}from both sides, which is what lets the audit certify it\.

###### Corollary 4\.8\(Placement of the exact value\)\.

WithC=\|𝒴\|C=\|\\mathcal\{Y\}\|, the exact blind\-channel value satisfies

12​Dτ⋆≤Vτ⋆≤\(1−1C\)​Dτ⋆,Dτ⋆−Vτ⋆=𝔼x​\[𝟏​\{k​\(x\)≥2\}k​\(x\)\],\\tfrac\{1\}\{2\}D^\{\\star\}\_\{\\tau\}\\;\\leq\\;V^\{\\star\}\_\{\\tau\}\\;\\leq\\;\\bigl\(1\-\\tfrac\{1\}\{C\}\\bigr\)D^\{\\star\}\_\{\\tau\},\\qquad D^\{\\star\}\_\{\\tau\}\-V^\{\\star\}\_\{\\tau\}=\\mathbb\{E\}\_\{x\}\\\!\\left\[\\frac\{\\mathbf\{1\}\\\{k\(x\)\\geq 2\\\}\}\{k\(x\)\}\\right\],the lower bound attaining equality if and only ifk​\(x\)≤2k\(x\)\\leq 2forPP\-a\.e\.xx\. Under target\-blindness on𝖲𝖾𝗅τ\\mathsf\{Sel\}\_\{\\tau\}\([Theorem˜3\.5](https://arxiv.org/html/2607.08961#S3.Thmtheorem5)\), the neighborhood minimax is bracketed uniformly inmm,

Vτ⋆≤Rm​\(ℱτ,ζ\)≤Vτ⋆\+ζ\.V^\{\\star\}\_\{\\tau\}\\;\\leq\\;R\_\{m\}\(\\mathcal\{F\}\_\{\\tau,\\zeta\}\)\\;\\leq\\;V^\{\\star\}\_\{\\tau\}\+\\zeta\.

###### Proof\.

Writek=k​\(x\)k=k\(x\)\. The summand1−1/k1\-1/kvanishes atk=1k=1and lies in\[12,1−1C\]\[\\tfrac\{1\}\{2\},1\-\\tfrac\{1\}\{C\}\]for2≤k≤C2\\leq k\\leq C, so\(1−1/k\)​𝟏​\{k≥2\}\(1\-1/k\)\\mathbf\{1\}\\\{k\\geq 2\\\}is squeezed between12​𝟏​\{k≥2\}\\tfrac\{1\}\{2\}\\mathbf\{1\}\\\{k\\geq 2\\\}and\(1−1C\)​𝟏​\{k≥2\}\(1\-\\tfrac\{1\}\{C\}\)\\mathbf\{1\}\\\{k\\geq 2\\\}; taking expectations gives the sandwich\. Subtracting termwise,

𝟏​\{k≥2\}−\(1−1k\)=𝟏​\{k≥2\}k,\\mathbf\{1\}\\\{k\\geq 2\\\}\-\\Bigl\(1\-\\tfrac\{1\}\{k\}\\Bigr\)=\\frac\{\\mathbf\{1\}\\\{k\\geq 2\\\}\}\{k\},and integrating gives the gap identity; the lower bound is tight exactly when the factor12\\tfrac\{1\}\{2\}is attained a\.e\., that is,k​\(x\)≤2k\(x\)\\leq 2\.

For the neighborhood bracket, the lower bound is immediate from𝖲𝖾𝗅τ⊆ℱτ,ζ​\(fNL\)\\mathsf\{Sel\}\_\{\\tau\}\\subseteq\\mathcal\{F\}\_\{\\tau,\\zeta\}\(f\_\{\\mathrm\{NL\}\}\)\. For the upper bound, everyf∈ℱτ,ζ​\(fNL\)f\\in\\mathcal\{F\}\_\{\\tau,\\zeta\}\(f\_\{\\mathrm\{NL\}\}\)admits somef0∈𝖲𝖾𝗅τf\_\{0\}\\in\\mathsf\{Sel\}\_\{\\tau\}withdP​\(f,f0\)<ζd\_\{P\}\(f,f\_\{0\}\)<\\zeta, so the exact\-value\-optimal learnerh^⋆\\hat\{h\}\_\{\\star\}satisfies

𝔼​\[dP​\(h^⋆,f\)\]≤𝔼​\[dP​\(h^⋆,f0\)\]\+dP​\(f0,f\)<Vτ⋆\+ζ;\\mathbb\{E\}\\bigl\[d\_\{P\}\(\\hat\{h\}\_\{\\star\},f\)\\bigr\]\\leq\\mathbb\{E\}\\bigl\[d\_\{P\}\(\\hat\{h\}\_\{\\star\},f\_\{0\}\)\\bigr\]\+d\_\{P\}\(f\_\{0\},f\)<V^\{\\star\}\_\{\\tau\}\+\\zeta;taking the supremum overffgives the bracket, uniformly inmm\. ∎

The overlap floor12​Dτ⋆\\tfrac\{1\}\{2\}D^\{\\star\}\_\{\\tau\}therefore equalsVτ⋆V^\{\\star\}\_\{\\tau\}under binary overlap and lower\-bounds it otherwise, while the neighborhood minimax stays withinζ\\zetaofVτ⋆V^\{\\star\}\_\{\\tau\}\. Rendered finite\-sample throughD^⋆\\widehat\{D\}^\{\\star\}alone, without the multiplicity estimator, this placement already yields a two\-sided interval forVτ⋆V^\{\\star\}\_\{\\tau\}\.

Concretely, for any finite admissible familyℱK\\mathcal\{F\}\_\{K\}containing the maximal\-spread pair, the blind\-channel minimax riskVblind​\(ℱK\)V\_\{\\mathrm\{blind\}\}\(\\mathcal\{F\}\_\{K\}\)is independent ofmmand, with probability at least1−δ1\-\\delta, lies in\[12​\(D^⋆−εN\)\+,D^⋆\+εN\+2​ζ\]\[\\tfrac\{1\}\{2\}\(\\widehat\{D\}^\{\\star\}\-\\varepsilon\_\{N\}\)\_\{\+\},\\ \\widehat\{D\}^\{\\star\}\+\\varepsilon\_\{N\}\+2\\zeta\]; the same interval bracketsVτ⋆V^\{\\star\}\_\{\\tau\}\([Corollary˜B\.6](https://arxiv.org/html/2607.08961#A2.Thmtheorem6), proved in[Appendix˜B](https://arxiv.org/html/2607.08961#A2)\)\. The certificate below sharpens its lower endpoint using the multiplicity estimatorV^⋆\\widehat\{V\}^\{\\star\}\.

###### Proposition 4\.9\(Standalone certificate for the exact blind\-channel value\)\.

Suppose the supervision channel is target\-blind, and formD^⋆\\widehat\{D\}^\{\\star\}andV^⋆\\widehat\{V\}^\{\\star\}fromNNi\.i\.d\. held\-out inputs\. With radiusεN=log⁡\(2/δ\)/2​N\\varepsilon\_\{N\}=\\sqrt\{\\log\(2/\\delta\)/2N\}andC=\|𝒴\|C=\|\\mathcal\{Y\}\|, define

Cjoint:=max⁡\{\(V^⋆−\(1−1C\)​εN\)\+,12​\(D^⋆−εN\)\+\}\.C\_\{\\mathrm\{joint\}\}:=\\max\\\!\\left\\\{\\left\(\\widehat\{V\}^\{\\star\}\-\\left\(1\-\\tfrac\{1\}\{C\}\\right\)\\varepsilon\_\{N\}\\right\)\_\{\+\},\\tfrac\{1\}\{2\}\\left\(\\widehat\{D\}^\{\\star\}\-\\varepsilon\_\{N\}\\right\)\_\{\+\}\\right\\\}\.Then, with probability at least1−δ1\-\\delta,

Vτ⋆≥CjointandRm​\(ℱτ,ζ\)≥Cjoint​for every​m\.V^\{\\star\}\_\{\\tau\}\\geq C\_\{\\mathrm\{joint\}\}\\qquad\\text\{and\}\\qquad R\_\{m\}\(\\mathcal\{F\}\_\{\\tau,\\zeta\}\)\\geq C\_\{\\mathrm\{joint\}\}\\ \\text\{ for every \}m\.The second branch ofCjointC\_\{\\mathrm\{joint\}\}is the certified overlap floor, so the certificate never falls below it; it is strictly larger precisely when\(V^⋆−\(1−1/C\)​εN\)\+\>12​\(D^⋆−εN\)\+\(\\widehat\{V\}^\{\\star\}\-\(1\-1/C\)\\varepsilon\_\{N\}\)\_\{\+\}\>\\tfrac\{1\}\{2\}\(\\widehat\{D\}^\{\\star\}\-\\varepsilon\_\{N\}\)\_\{\+\}, which, when neither branch is clipped at zero, readsV^⋆−12​D^⋆\>\(12−1C\)​εN\\widehat\{V\}^\{\\star\}\-\\tfrac\{1\}\{2\}\\widehat\{D\}^\{\\star\}\>\(\\tfrac\{1\}\{2\}\-\\tfrac\{1\}\{C\}\)\\varepsilon\_\{N\}\.

###### Proof\.

Allocate failure probabilityδ/2\\delta/2to each of two one\-sided Hoeffding bounds\. The first givesDτ⋆≥D^⋆−εND^\{\\star\}\_\{\\tau\}\\geq\\widehat\{D\}^\{\\star\}\-\\varepsilon\_\{N\}: its one\-sided radius at levelδ/2\\delta/2islog⁡\(1/\(δ/2\)\)/\(2​N\)=εN\\sqrt\{\\log\(1/\(\\delta/2\)\)/\(2N\)\}=\\varepsilon\_\{N\}, so the split incurs no additional radius\. The summands1−1/k​\(zi\)1\-1/k\(z\_\{i\}\)ofV^⋆\\widehat\{V\}^\{\\star\}lie in\[0,1−1C\]\[0,1\-\\tfrac\{1\}\{C\}\], so the second givesVτ⋆≥V^⋆−\(1−1C\)​εNV^\{\\star\}\_\{\\tau\}\\geq\\widehat\{V\}^\{\\star\}\-\(1\-\\tfrac\{1\}\{C\}\)\\varepsilon\_\{N\}\. A union bound makes both hold with probability at least1−δ1\-\\delta; work on that event\. The second bound is the first branch ofCjointC\_\{\\mathrm\{joint\}\}, andVτ⋆≥12​Dτ⋆≥12​\(D^⋆−εN\)V^\{\\star\}\_\{\\tau\}\\geq\\tfrac\{1\}\{2\}D^\{\\star\}\_\{\\tau\}\\geq\\tfrac\{1\}\{2\}\(\\widehat\{D\}^\{\\star\}\-\\varepsilon\_\{N\}\)is the second, soVτ⋆≥CjointV^\{\\star\}\_\{\\tau\}\\geq C\_\{\\mathrm\{joint\}\}\. Finally𝖲𝖾𝗅τ⊆ℱτ,ζ​\(fNL\)\\mathsf\{Sel\}\_\{\\tau\}\\subseteq\\mathcal\{F\}\_\{\\tau,\\zeta\}\(f\_\{\\mathrm\{NL\}\}\)transfers the bound to the neighborhood minimax,Rm​\(ℱτ,ζ\)≥CjointR\_\{m\}\(\\mathcal\{F\}\_\{\\tau,\\zeta\}\)\\geq C\_\{\\mathrm\{joint\}\}for everymm\. ∎

When the decoding probabilities are not exposed, the same certificate holds with each branch widened by the plug\-in errorqr​\(ξ\)q\_\{r\}\(\\xi\)\.

###### Proposition 4\.10\(Exact\-value certificate under sampled decoding\)\.

Suppose the admissible sets are estimated by therr\-sample plug\-inA^τ\\widehat\{A\}\_\{\\tau\}at marginξ\\xi, and form the plug\-in statisticsD^plug⋆\\widehat\{D\}^\{\\star\}\_\{\\mathrm\{plug\}\}andV^plug⋆=1N​∑iϕ​\(A^τ​\(zi\)\)\\widehat\{V\}^\{\\star\}\_\{\\mathrm\{plug\}\}=\\tfrac\{1\}\{N\}\\sum\_\{i\}\\phi\(\\widehat\{A\}\_\{\\tau\}\(z\_\{i\}\)\)\. WithC=\|𝒴\|C=\|\\mathcal\{Y\}\|,εN=log⁡\(2/δ\)/2​N\\varepsilon\_\{N\}=\\sqrt\{\\log\(2/\\delta\)/2N\}, andqr​\(ξ\)=κ​\(ξ\)\+2​C​e−2​r​ξ2q\_\{r\}\(\\xi\)=\\kappa\(\\xi\)\+2Ce^\{\-2r\\xi^\{2\}\}, the certificate

Cjointplug:=max⁡\{\(V^plug⋆−\(1−1C\)​\(εN\+qr​\(ξ\)\)\)\+,12​\(D^plug⋆−εN−qr​\(ξ\)\)\+\}C\_\{\\mathrm\{joint\}\}^\{\\mathrm\{plug\}\}:=\\max\\\!\\left\\\{\\bigl\(\\widehat\{V\}^\{\\star\}\_\{\\mathrm\{plug\}\}\-\(1\-\\tfrac\{1\}\{C\}\)\(\\varepsilon\_\{N\}\+q\_\{r\}\(\\xi\)\)\\bigr\)\_\{\+\},\\tfrac\{1\}\{2\}\\bigl\(\\widehat\{D\}^\{\\star\}\_\{\\mathrm\{plug\}\}\-\\varepsilon\_\{N\}\-q\_\{r\}\(\\xi\)\\bigr\)\_\{\+\}\\right\\\}satisfies, with probability at least1−δ1\-\\delta,

Vτ⋆≥CjointplugandRm​\(ℱτ,ζ\)≥Cjointplug​for every​m\.V^\{\\star\}\_\{\\tau\}\\geq C\_\{\\mathrm\{joint\}\}^\{\\mathrm\{plug\}\}\\qquad\\text\{and\}\\qquad R\_\{m\}\(\\mathcal\{F\}\_\{\\tau,\\zeta\}\)\\geq C\_\{\\mathrm\{joint\}\}^\{\\mathrm\{plug\}\}\\ \\text\{ for every \}m\.

###### Proof sketch; full proof in[Appendix˜B](https://arxiv.org/html/2607.08961#A2)\.

Replacing exact admissible sets by theirrr\-sample plug\-ins introduces a per\-input error of probability at mostqr​\(ξ\)q\_\{r\}\(\\xi\)\. Becauseϕ\\phiand𝟏\{\|⋅\|≥2\}\\mathbf\{1\}\\\{\|\\cdot\|\\geq 2\\\}change only when the set changes and have ranges\[0,1−1C\]\[0,1\-\\tfrac\{1\}\{C\}\]and\[0,1\]\[0,1\], this shifts the two estimator means by at most\(1−1C\)​qr​\(ξ\)\(1\-\\tfrac\{1\}\{C\}\)q\_\{r\}\(\\xi\)andqr​\(ξ\)q\_\{r\}\(\\xi\)\. Each bias adds to the corresponding one\-sided Hoeffding radius, inflating the two branches by at most theqr​\(ξ\)q\_\{r\}\(\\xi\)terms above\. The remaining steps are theδ/2\\delta/2split, the placementVτ⋆≥12​Dτ⋆V^\{\\star\}\_\{\\tau\}\\geq\\tfrac\{1\}\{2\}D^\{\\star\}\_\{\\tau\}, and the neighborhood transfer; these repeat the proof of[Proposition˜4\.9](https://arxiv.org/html/2607.08961#S4.Thmtheorem9)\. ∎

## 5Empirical Probes

By construction, the pairwise certificate of[Algorithm˜4\.1](https://arxiv.org/html/2607.08961#S4.algorithm1)is positive exactly when the observed model\-induced overlap clears its finite\-sample radius \(the multiplicity\-based exact\-value certificate can be positive through a separate branch\), and any positive floor it returns is sample\-size independent\. The empirical question is whether a real judge exhibits such overlap where the specification is genuinely underspecified and, critically, none where an exact rule leaves no room for it\. We test this on one frozen judge configuration with matched exact\-rule null controls, then delimit the resulting claim: does the pointwise certificate transfer to supplied candidate reading clauses, and where do implementation limits bind? These are probes, not deployment\-scale benchmarks\. A controlled pipeline check on constructed cases with known disagreement, a model\-free ChaosNLI exact\-value calculation, and all implementation details are collected in[Appendix˜C](https://arxiv.org/html/2607.08961#A3)\.

#### Correction\-free exposed\-probability audit\.

We run[Algorithm˜4\.1](https://arxiv.org/html/2607.08961#S4.algorithm1)in its exposed\-probability mode on a frozen Qwen 2\.5–3B judge, where both plug\-in corrections vanish and[Theorem˜4\.6](https://arxiv.org/html/2607.08961#S4.Thmtheorem6)applies with the correction\-free radiusεN=log⁡\(2/δ\)/2​N\\varepsilon\_\{N\}=\\sqrt\{\\log\(2/\\delta\)/2N\}\. The audited channel is the judge’s declared\-label conditional first\-token law \(the class\-token probabilities renormalized over the declared label set\), formally defined, with all tokenization and runtime details, in[Section˜C\.10](https://arxiv.org/html/2607.08961#A3.SS10)\. Two prompt paraphrases \(P1, P2\), two exact\-rule control tasks, and the threshold sweepτ∈\{0\.10,…,0\.40\}\\tau\\in\\\{0\.10,\\dots,0\.40\\\}are fixed before any model call\.

![Refer to caption](https://arxiv.org/html/2607.08961v1/x1.png)Figure 1:Correction\-free exposed\-probability audit atδ=0\.10\\delta=0\.10,N=100N=100, over the prespecified threshold sweep\. The certificate is positive exactly where the estimated overlapD^⋆\\widehat\{D\}^\{\\star\}clears the Hoeffding radiusεN\\varepsilon\_\{N\}; the certified floor12​\(D^⋆−εN\)\+\\tfrac\{1\}\{2\}\(\\widehat\{D\}^\{\\star\}\-\\varepsilon\_\{N\}\)\_\{\+\}is valid uniformly over all learners and sample sizesmmunder the fixed\-description target\-blind channel \([Proposition˜2\.4](https://arxiv.org/html/2607.08961#S2.Thmtheorem4)\), with blindness supplied by the deployment design, not established by the audit\. Only the P1 moderation prompt enters the positive region; the collapsed paraphrase P2 and both exact\-rule controls stay below the radius at everyτ\\tau\.[Figure˜1](https://arxiv.org/html/2607.08961#S5.F1)reports the outcome across the sweep\. For the moderation task under P1,D^⋆=0\.29\\widehat\{D\}^\{\\star\}=0\.29clears the radius at the comparison pointτ=0\.20\\tau=0\.20and the audit certifies a floor of0\.08380\.0838; the certificate is positive at every sweptτ≤0\.30\\tau\\leq 0\.30, and for the binary label set the exact\-value certificate of[Proposition˜4\.9](https://arxiv.org/html/2607.08961#S4.Thmtheorem9)coincides with this pairwise floor \(numerical sweep values in[Section˜C\.8](https://arxiv.org/html/2607.08961#A3.SS8)\)\. Both exact\-rule controls certify zero, as predicted: the procedure does not manufacture overlap where none exists\. Paraphrase P2 also certifies zero, but for a different reason: its declared\-label probability collapses onto one label \(entropy diagnostic in[Section˜C\.10](https://arxiv.org/html/2607.08961#A3.SS10)\)\. Prompt sensitivity, not decoding depth, thus gates the certificate for this pair, and a zero certificate does not establish that the task is unambiguous \([Remark˜4\.7](https://arxiv.org/html/2607.08961#S4.Thmtheorem7)\)\.

#### Transfer boundary\.

[Theorem˜3\.9](https://arxiv.org/html/2607.08961#S3.Thmtheorem9)bounds the gap between the pointwise valueVτ⋆V^\{\\star\}\_\{\\tau\}and the blind value over a supplied family of coherent readings, provided the readings track the model’s admissible geometry\. We test it on two supplied candidate reading clauses for the moderation task, written independently of that geometry \(they carry no independent human validation\)\. The fit–holdout coverage estimate is favorable \(η^U=0\.0000\\widehat\{\\eta\}\_\{U\}=0\.0000\), but the certified admissibility violation is large \(ζ^U=0\.4904\\widehat\{\\zeta\}\_\{U\}=0\.4904\)\. Consequently,\|Vτ⋆−Vblind​\(𝒞\)\|≤0\.4904\|V^\{\\star\}\_\{\\tau\}\-V\_\{\\rm blind\}\(\\mathcal\{C\}\)\|\\leq 0\.4904is nearly the largest bound the theorem permits\. This is a direct test of the bridge, and its failure is informative because it identifies which theorem condition fails: the clauses match the aggregate mixture condition while violating the separate admissibility condition, so no semantic transfer is certified\. The positive certificate above is therefore pointwise and model\-relative; this is a boundary of the claim, not evidence that the judge is unambiguous\. The clauses, split procedure, mixture optimization, confidence allocation, and the preregistered external\-reading protocol this motivates are in[Section˜C\.9](https://arxiv.org/html/2607.08961#A3.SS9)\.

#### Implementation boundaries\.

Under sampling\-only access at the audited breadth \(r=3r=3\), the finite\-depth term of the plug\-in radius \([Corollary˜4\.5](https://arxiv.org/html/2607.08961#S4.Thmtheorem5)\) saturates and every certified floor is zero; a positive floor at marginξ=0\.05\\xi=0\.05would require roughlyr≈877r\\approx 877decodings per input, which is why the principal audit exposes probabilities \(design, per\-configuration results, and cost–precision trade\-off in[Section˜C\.5](https://arxiv.org/html/2607.08961#A3.SS5)\)\. Separately, a controlled pipeline check on constructed cases with known disagreement recovers the prescribed certificates exactly: zero where two readings never disagree, and a conservative floor of0\.1660\.166where they disagree byD=0\.4D=0\.4\([Section˜C\.1](https://arxiv.org/html/2607.08961#A3.SS1)\)\. Every audit fixes its design and split before any model call; source code, frozen designs, versioned outputs, and SHA\-256 hashes are in the supplementary reproducibility archive \([Section˜C\.10](https://arxiv.org/html/2607.08961#A3.SS10)\)\.

## 6Discussion and Limitations

#### Summary\.

NL\-PAC turns the risk induced by model\-admissible ambiguity into an empirically auditable quantity: for a fixed description, model, decoding threshold, and deployment distribution, it certifies a finite\-sample lower bound on the worst\-case risk over admissible labelings\. Because this obstruction is a property of the specification–channel pair rather than of any estimator, it persists independently of the learner and its sample size\.

#### Scope of the guarantees\.

The certified quantities are worst\-case over admissible labelings and conditional on the sampled deployment distributionPP\. They characterize the frozen model–prompt–decoding configuration, not intrinsic human ambiguity, so model updates, temperature changes, or prompt edits require re\-auditing\. The audit requires that admissible sets be observable; under sampled decoding this means a certified threshold\-margin bound and a plug\-in decoding depth \([Section˜4\.3](https://arxiv.org/html/2607.08961#S4.SS3)\)\. The blind\-channel floors rely only on target blindness and the induced observation laws, not on repeated\-call independence; the conditional independence of[Assumption˜\(A2\)](https://arxiv.org/html/2607.08961#Thmassumption2)enters only where concentration is applied to repeated oracle draws, namely the sampled\-decoding analysis \([Section˜4\.3](https://arxiv.org/html/2607.08961#S4.SS3)\)\.

The experiments establish one limited positive claim: the exposed\-probability audit gives a positive model\-relative certificate for the prespecified P1 prompt, with zero certificates under the exact\-rule controls \([Section˜5](https://arxiv.org/html/2607.08961#S5.SS0.SSS0.Px1)\)\. A controlled probe additionally verifies that the certificate arithmetic recovers known zero and positive disagreement cases \([Section˜C\.1](https://arxiv.org/html/2607.08961#A3.SS1)\)\.

Two negative results delimit that claim\. The shallow sampled\-decoding audit is vacuous at the available depth, because the finite\-depth correction saturates \([Section˜5](https://arxiv.org/html/2607.08961#S5.SS0.SSS0.Px3)\)\. The fit–holdout bridge is too loose to transfer the positive exposed\-probability certificate for P1 to the supplied two\-reading pool despite a zero estimated coverage gap: its admissibility bound isζ^U=0\.4904\\widehat\{\\zeta\}\_\{U\}=0\.4904, hencemax⁡\{ηU,ζU\}=0\.4904\\max\\\{\\eta\_\{U\},\\zeta\_\{U\}\\\}=0\.4904\([Section˜5](https://arxiv.org/html/2607.08961#S5.SS0.SSS0.Px2)\)\. That transfer remains open\.

#### What the certificate licenses\.

A positive floor ofccrules out any worst\-case guarantee belowccover the retained model\-admissible labelings, no matter how many additional labels are collected through the same description–model–prompt channel\. Lowering the floor therefore requires changing the information structure: clarifying the specification, introducing reading\-revealing supervision, or changing the model or prompt\. The certificate quantifies the floor but does not rank these interventions\. Conversely, a zero lower certificate is not evidence of safety or of the absence of human ambiguity \([Remark˜4\.7](https://arxiv.org/html/2607.08961#S4.Thmtheorem7)\)\.

The minimax criterion is the appropriate target when no defensible probability distribution over the retained readings is available, or when the decision rule must protect against every retained reading, as in minimax and minimax\-regret decisions under set identification\(Manski,[2003](https://arxiv.org/html/2607.08961#bib.bib39); Stoye,[2009a](https://arxiv.org/html/2607.08961#bib.bib53)\)\. When external evidence identifies credible reading weights, the corresponding prior\-weighted risk defines a different criterion, which the present certificate does not estimate \([Remark˜4\.3](https://arxiv.org/html/2607.08961#S4.Thmtheorem3)\)\.

This also explains why common judge diagnostics are not substitutes for the certificate\. Response entropy and probability margins summarize concentration in the judge’s output distribution but do not yield a confidence\-qualified lower bound on target risk\. Cross\-judge and judge–human disagreement measure evaluator sensitivity, yet common\-mode collapse can drive these rates to zero, and they do not identify which admissible targets the deployed channel leaves unresolved\. NL\-PAC supplies the missing decision\-theoretic step: for a prespecified channel, it maps the admissible target set to a certified minimax risk floor\.

#### Future work\.

Three extensions are directly exposed by the limitations above\. First,*coherent\-reading coverage*: a preregistered study should elicit readings independently of model outputs, freeze the resulting clauses and a held\-out input split, and then test both bridge terms \(mixture coverage and admissibility\) separately\. A larger independently validated pool would show whether[Theorem˜3\.9](https://arxiv.org/html/2607.08961#S3.Thmtheorem9)becomes informative once held\-out admissibility error is small; the frozen protocol is specified in[Section˜C\.9](https://arxiv.org/html/2607.08961#A3.SS9)\. Second,*cross\-model and natural\-distribution replication*: replication across model families and naturally occurring inputs, with a complete high\-depth sampled\-decoding audit, would assess the stability of the exposed\-probability certificate and determine whether the threshold\-margin or the finite\-depth term is the binding constraint \([Section˜5](https://arxiv.org/html/2607.08961#S5.SS0.SSS0.Px3)\)\. Third,*non\-blind and intervention channels*: embedding the blind channel as the zero\-sensitivity endpoint of a family of intervention channels would quantify how much reading\-revealing information the channel must expose to push risk below the blind\-channel floor \([Theorem˜3\.2](https://arxiv.org/html/2607.08961#S3.Thmtheorem2)\)\.

## References

- Alon et al\. \(2022\)Noga Alon, Steve Hanneke, Ron Holzman, and Shay Moran\.A theory of PAC learnability of partial concept classes\.In*2021 IEEE 62nd Annual Symposium on Foundations of Computer Science \(FOCS\)*, pages 658–671\. IEEE, 2022\.doi:10\.1109/FOCS52979\.2021\.00070\.
- Angelopoulos and Bates \(2023\)Anastasios N\. Angelopoulos and Stephen Bates\.Conformal prediction: A gentle introduction\.*Foundations and Trends in Machine Learning*, 16\(4\):494–591, 2023\.doi:10\.1561/2200000101\.
- Audibert and Tsybakov \(2007\)Jean\-Yves Audibert and Alexandre B\. Tsybakov\.Fast learning rates for plug\-in classifiers\.*The Annals of Statistics*, 35\(2\):608–633, 2007\.doi:10\.1214/009053606000001217\.
- Baan et al\. \(2022\)Joris Baan, Wilker Aziz, Barbara Plank, and Raquel Fernández\.Stop measuring calibration when humans disagree\.In*Proceedings of the 2022 Conference on Empirical Methods in Natural Language Processing*, pages 1892–1915, 2022\.doi:10\.18653/v1/2022\.emnlp\-main\.124\.
- Bardenet and Maillard \(2015\)Rémi Bardenet and Odalric\-Ambrym Maillard\.Concentration inequalities for sampling without replacement\.*Bernoulli*, 21\(3\):1361–1385, 2015\.doi:10\.3150/14\-BEJ605\.
- Bartók et al\. \(2011\)Gábor Bartók, Dávid Pál, and Csaba Szepesvári\.Minimax regret of finite partial\-monitoring games in stochastic environments\.In Sham M\. Kakade and Ulrike von Luxburg, editors,*Proceedings of the 24th Annual Conference on Learning Theory*, volume 19 of*Proceedings of Machine Learning Research*, pages 133–154, Budapest, Hungary, 2011\. PMLR\.URL[https://proceedings\.mlr\.press/v19/bartok11a\.html](https://proceedings.mlr.press/v19/bartok11a.html)\.
- Berk et al\. \(2013\)Richard Berk, Lawrence Brown, Andreas Buja, Kai Zhang, and Linda Zhao\.Valid post\-selection inference\.*The Annals of Statistics*, 41\(2\):802–837, 2013\.doi:10\.1214/12\-aos1077\.
- Blackwell \(1951\)David Blackwell\.Comparison of experiments\.In Jerzy Neyman, editor,*Proceedings of the Second Berkeley Symposium on Mathematical Statistics and Probability*, pages 93–102, Berkeley, 1951\. University of California Press\.doi:10\.1525/9780520411586\-009\.
- Blackwell and Girshick \(1954\)David Blackwell and M\. A\. Girshick\.*Theory of Games and Statistical Decisions*\.Wiley, New York, 1954\.
- Bshouty et al\. \(2002\)Nader H\. Bshouty, Nadav Eiron, and Eyal Kushilevitz\.PAC learning with nasty noise\.*Theoretical Computer Science*, 288\(2\):255–275, 2002\.doi:10\.1016/S0304\-3975\(01\)00403\-0\.
- Cheng et al\. \(2020\)Jiacheng Cheng, Tongliang Liu, Kotagiri Ramamohanarao, and Dacheng Tao\.Learning with bounded instance and label\-dependent label noise\.In Hal Daumé III and Aarti Singh, editors,*Proceedings of the 37th International Conference on Machine Learning*, volume 119 of*Proceedings of Machine Learning Research*, pages 1789–1799\. PMLR, 2020\.URL[https://proceedings\.mlr\.press/v119/cheng20c\.html](https://proceedings.mlr.press/v119/cheng20c.html)\.
- Choi et al\. \(2026\)Junhyuk Choi, Sohhyung Park, Chanhee Cho, Hyeonchu Park, and Bugeun Kim\.Diagnosing the reliability of LLM\-as\-a\-judge via item response theory, 2026\.
- Cour et al\. \(2011\)Timothee Cour, Ben Sapp, and Ben Taskar\.Learning from partial labels\.*Journal of Machine Learning Research*, 12\(42\):1501–1536, 2011\.URL[http://jmlr\.org/papers/v12/cour11a\.html](http://jmlr.org/papers/v12/cour11a.html)\.
- D’Amour et al\. \(2022\)Alexander D’Amour, Katherine Heller, Dan Moldovan, Ben Adlam, Babak Alipanahi, Alex Beutel, et al\.Underspecification presents challenges for credibility in modern machine learning\.*Journal of Machine Learning Research*, 23\(226\):1–61, 2022\.URL[https://jmlr\.org/papers/v23/20\-1335\.html](https://jmlr.org/papers/v23/20-1335.html)\.
- Dawid and Skene \(1979\)A\. P\. Dawid and A\. M\. Skene\.Maximum likelihood estimation of observer error\-rates using the EM algorithm\.*Journal of the Royal Statistical Society\. Series C \(Applied Statistics\)*, 28\(1\):20–28, 1979\.doi:10\.2307/2346806\.
- Dorner et al\. \(2025\)Florian Eddie Dorner, Vivian Nastl, and Moritz Hardt\.Limits to scalable evaluation at the frontier: LLM as judge won’t beat twice the data\.In*International Conference on Learning Representations*, pages 26467–26491, 2025\.URL[https://proceedings\.iclr\.cc/paper\_files/paper/2025/hash/4264ee4376776907c0b87ed70b959585\-Abstract\-Conference\.html](https://proceedings.iclr.cc/paper_files/paper/2025/hash/4264ee4376776907c0b87ed70b959585-Abstract-Conference.html)\.
- Fathony et al\. \(2016\)Rizal Fathony, Anqi Liu, Kaiser Asif, and Brian Ziebart\.Adversarial multiclass classification: A risk minimization perspective\.In D\. Lee, M\. Sugiyama, U\. von Luxburg, I\. Guyon, and R\. Garnett, editors,*Advances in Neural Information Processing Systems*, volume 29\. Curran Associates, Inc\., 2016\.URL[https://proceedings\.neurips\.cc/paper\_files/paper/2016/file/ad13a2a07ca4b7642959dc0c4c740ab6\-Paper\.pdf](https://proceedings.neurips.cc/paper_files/paper/2016/file/ad13a2a07ca4b7642959dc0c4c740ab6-Paper.pdf)\.
- Ferguson \(1967\)Thomas S\. Ferguson\.*Mathematical Statistics: A Decision Theoretic Approach*\.Academic Press, New York, 1967\.
- Feuer et al\. \(2026\)Benjamin Feuer, Lucas Rosenblatt, and Oussama Elachqar\.Towards provably unbiased llm judges via bias\-bounded evaluation, 2026\.
- Gilboa and Schmeidler \(1989\)Itzhak Gilboa and David Schmeidler\.Maxmin expected utility with non\-unique prior\.*Journal of Mathematical Economics*, 18\(2\):141–153, 1989\.doi:10\.1016/0304\-4068\(89\)90018\-9\.
- Gu et al\. \(2026\)Jiawei Gu, Xuhui Jiang, Zhichao Shi, Hexiang Tan, Xuehao Zhai, Chengjin Xu, Wei Li, Yinghan Shen, Shengjie Ma, Honghao Liu, Saizhuo Wang, Kun Zhang, Zhouchi Lin, Bowen Zhang, Lionel Ni, Wen Gao, Yuanzhuo Wang, and Jian Guo\.A survey on LLM\-as\-a\-judge\.*The Innovation*, 7\(6\):101253, 2026\.doi:10\.1016/j\.xinn\.2025\.101253\.
- Guerdan et al\. \(2025\)Luke Guerdan, Solon Barocas, Kenneth Holstein, Hanna Wallach, Steven Wu, and Alexandra Chouldechova\.Validating LLM\-as\-a\-judge systems under rating indeterminacy\.In D\. Belgrave, C\. Zhang, H\. Lin, R\. Pascanu, P\. Koniusz, M\. Ghassemi, and N\. Chen, editors,*Advances in Neural Information Processing Systems*, volume 38, pages 112282–112350\. Curran Associates, Inc\., 2025\.URL[https://proceedings\.neurips\.cc/paper\_files/paper/2025/file/a309239c11a28c597d050bd4a1752d32\-Paper\-Conference\.pdf](https://proceedings.neurips.cc/paper_files/paper/2025/file/a309239c11a28c597d050bd4a1752d32-Paper-Conference.pdf)\.
- Hanneke \(2014\)Steve Hanneke\.Theory of disagreement\-based active learning\.*Foundations and Trends in Machine Learning*, 7\(2–3\):131–309, 2014\.doi:10\.1561/2200000037\.
- Hoeffding \(1963\)Wassily Hoeffding\.Probability inequalities for sums of bounded random variables\.*Journal of the American Statistical Association*, 58\(301\):13–30, 1963\.doi:10\.1080/01621459\.1963\.10500830\.
- Howard et al\. \(2021\)Steven R\. Howard, Aaditya Ramdas, Jon McAuliffe, and Jasjeet Sekhon\.Time\-uniform, nonparametric, nonasymptotic confidence sequences\.*The Annals of Statistics*, 49\(2\):1055–1080, 2021\.doi:10\.1214/20\-aos1991\.
- Hüllermeier \(2014\)Eyke Hüllermeier\.Learning from imprecise and fuzzy observations: Data disambiguation through generalized loss minimization\.*International Journal of Approximate Reasoning*, 55\(7\):1519–1534, 2014\.doi:10\.1016/j\.ijar\.2013\.09\.003\.
- Imbens and Manski \(2004\)Guido W\. Imbens and Charles F\. Manski\.Confidence intervals for partially identified parameters\.*Econometrica*, 72\(6\):1845–1857, 2004\.doi:10\.1111/j\.1468\-0262\.2004\.00555\.x\.
- Kearns and Li \(1993\)Michael Kearns and Ming Li\.Learning in the presence of malicious errors\.*SIAM Journal on Computing*, 22\(4\):807–837, 1993\.doi:10\.1137/0222052\.
- Kearns and Vazirani \(1994\)Michael J\. Kearns and Umesh V\. Vazirani\.*An Introduction to Computational Learning Theory*\.MIT Press, 1994\.
- Kim et al\. \(2024\)Seungone Kim, Jay Shin, yejin cho, Joel Jang, Shayne Longpre, Hwaran Lee, Sangdoo Yun, S Shin, Ryan, Sungdong Kim, James Thorne, and Minjoon Seo\.Prometheus: Inducing fine\-grained evaluation capability in language models\.In B\. Kim, Y\. Yue, S\. Chaudhuri, K\. Fragkiadaki, M\. Khan, and Y\. Sun, editors,*International Conference on Learning Representations*, volume 2024, pages 29927–29962, 2024\.URL[https://proceedings\.iclr\.cc/paper\_files/paper/2024/file/803485352e61e3ebf41221e4776c9fd4\-Paper\-Conference\.pdf](https://proceedings.iclr.cc/paper_files/paper/2024/file/803485352e61e3ebf41221e4776c9fd4-Paper-Conference.pdf)\.
- Kobalczyk et al\. \(2025\)Katarzyna Kobalczyk, Nicolás Astorga, Tennison Liu, and Mihaela van der Schaar\.Active task disambiguation with LLMs\.In Y\. Yue, A\. Garg, N\. Peng, F\. Sha, and R\. Yu, editors,*International Conference on Learning Representations*, volume 2025, pages 37823–37847, 2025\.URL[https://proceedings\.iclr\.cc/paper\_files/paper/2025/file/5e07476b6bd2497e1fbd11b8f0b2de3c\-Paper\-Conference\.pdf](https://proceedings.iclr.cc/paper_files/paper/2025/file/5e07476b6bd2497e1fbd11b8f0b2de3c-Paper-Conference.pdf)\.
- Kuhn et al\. \(2023\)Lorenz Kuhn, Yarin Gal, and Sebastian Farquhar\.Semantic uncertainty: Linguistic invariances for uncertainty estimation in natural language generation\.In*International Conference on Learning Representations*, 2023\.Spotlight\.
- La Malfa et al\. \(2024\)Emanuele La Malfa, Aleksandar Petrov, Simon Frieder, Christoph Weinhuber, Ryan Burnell, Raza Nazar, Anthony Cohn, Nigel Shadbolt, and Michael Wooldridge\.Language\-models\-as\-a\-service: Overview of a new paradigm and its challenges\.*Journal of Artificial Intelligence Research*, 80:1497–1523, 2024\.doi:10\.1613/jair\.1\.15865\.
- Li et al\. \(2025\)Belinda Li, Alex Tamkin, Noah Goodman, and Jacob Andreas\.Eliciting human preferences with language models\.In Y\. Yue, A\. Garg, N\. Peng, F\. Sha, and R\. Yu, editors,*International Conference on Learning Representations*, volume 2025, pages 80984–81013, 2025\.URL[https://proceedings\.iclr\.cc/paper\_files/paper/2025/file/c9867d5a22653ce98b02595061e40f12\-Paper\-Conference\.pdf](https://proceedings.iclr.cc/paper_files/paper/2025/file/c9867d5a22653ce98b02595061e40f12-Paper-Conference.pdf)\.
- Liu et al\. \(2023a\)Alisa Liu, Zhaofeng Wu, Julian Michael, Alane Suhr, Peter West, Alexander Koller, Swabha Swayamdipta, Noah A\. Smith, and Yejin Choi\.We’re afraid language models aren’t modeling ambiguity\.In*Conference on Empirical Methods in Natural Language Processing \(EMNLP\)*, 2023a\.doi:10\.18653/v1/2023\.emnlp\-main\.51\.
- Liu and Dietterich \(2014\)Liping Liu and Thomas Dietterich\.Learnability of the superset label learning problem\.In Eric P\. Xing and Tony Jebara, editors,*Proceedings of the 31st International Conference on Machine Learning*, volume 32 of*Proceedings of Machine Learning Research*, pages 1629–1637, Bejing, China, 2014\. PMLR\.URL[https://proceedings\.mlr\.press/v32/liug14\.html](https://proceedings.mlr.press/v32/liug14.html)\.
- Liu et al\. \(2023b\)Yang Liu, Dan Iter, Yichong Xu, Shuohang Wang, Ruochen Xu, and Chenguang Zhu\.G\-Eval: NLG evaluation using GPT\-4 with better human alignment\.In*Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing \(EMNLP\)*, pages 2511–2522, 2023b\.doi:10\.18653/v1/2023\.emnlp\-main\.153\.
- Mammen and Tsybakov \(1999\)Enno Mammen and Alexandre B\. Tsybakov\.Smooth discrimination analysis\.*The Annals of Statistics*, 27\(6\):1808–1829, 1999\.doi:10\.1214/aos/1017939240\.
- Manski \(2003\)Charles F\. Manski\.*Partial Identification of Probability Distributions*\.Springer Series in Statistics\. Springer, New York, 2003\.doi:10\.1007/b97478\.
- Maurer and Pontil \(2009\)Andreas Maurer and Massimiliano Pontil\.Empirical Bernstein bounds and sample\-variance penalization\.In*Proceedings of the 22nd Annual Conference on Learning Theory \(COLT\)*, 2009\.URL[https://www\.cs\.mcgill\.ca/˜colt2009/papers/012\.pdf](https://www.cs.mcgill.ca/~colt2009/papers/012.pdf)\.
- Mazuelas et al\. \(2023\)Santiago Mazuelas, Mauricio Romero, and Peter Grünwald\.Minimax risk classifiers with 0–1 loss\.*Journal of Machine Learning Research*, 24\(208\):1–48, 2023\.URL[https://www\.jmlr\.org/papers/volume24/22\-0339/22\-0339\.pdf](https://www.jmlr.org/papers/volume24/22-0339/22-0339.pdf)\.
- Mitchell \(1982\)Tom M\. Mitchell\.Generalization as search\.*Artificial Intelligence*, 18\(2\):203–226, 1982\.doi:10\.1016/0004\-3702\(82\)90040\-6\.
- Molchanov and Molinari \(2018\)Ilya Molchanov and Francesca Molinari\.*Random Sets in Econometrics*\.Cambridge University Press, 2018\.doi:10\.1017/9781316392973\.
- Natarajan et al\. \(2013\)Nagarajan Natarajan, Inderjit S Dhillon, Pradeep K Ravikumar, and Ambuj Tewari\.Learning with noisy labels\.In C\. J\. Burges, L\. Bottou, M\. Welling, Z\. Ghahramani, and K\. Weinberger, editors,*Advances in Neural Information Processing Systems*, volume 26\. Curran Associates, Inc\., 2013\.URL[https://proceedings\.neurips\.cc/paper\_files/paper/2013/file/3871bd64012152bfb53fdf04b401193f\-Paper\.pdf](https://proceedings.neurips.cc/paper_files/paper/2013/file/3871bd64012152bfb53fdf04b401193f-Paper.pdf)\.
- Nie et al\. \(2020\)Yixin Nie, Xiang Zhou, and Mohit Bansal\.What can we learn from collective human opinions on natural language inference data?In*Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing \(EMNLP\)*, pages 9131–9143, 2020\.doi:10\.18653/v1/2020\.emnlp\-main\.734\.
- Norman et al\. \(2026\)Justin D\. Norman, Michael U\. Rivera, and D\. Alex Hughes\.Reliability without validity: A systematic, large\-scale evaluation of LLM\-as\-a\-judge models across agreement, consistency, and bias, 2026\.
- Pan et al\. \(2022\)Alexander Pan, Kush Bhatia, and Jacob Steinhardt\.The effects of reward misspecification: Mapping and mitigating misaligned models\.In*International Conference on Learning Representations \(ICLR\)*, 2022\.
- Pavlick and Kwiatkowski \(2019\)Ellie Pavlick and Tom Kwiatkowski\.Inherent disagreements in human textual inferences\.*Transactions of the Association for Computational Linguistics*, 7:677–694, 2019\.doi:10\.1162/tacl\_a\_00293\.
- Plank \(2022\)Barbara Plank\.The “problem” of human label variation: On ground truth in data, modeling and evaluation\.In*Conference on Empirical Methods in Natural Language Processing \(EMNLP\)*, 2022\.doi:10\.18653/v1/2022\.emnlp\-main\.731\.
- Ratner et al\. \(2017\)Alexander Ratner, Stephen H\. Bach, Henry Ehrenberg, Jason Fries, Sen Wu, and Christopher Ré\.Snorkel: Rapid training data creation with weak supervision\.*Proceedings of the VLDB Endowment*, 11\(3\):269–282, 2017\.doi:10\.14778/3157794\.3157797\.
- Singleton and Booth \(2024\)Joseph Singleton and Richard Booth\.Truth\-tracking with non\-expert information sources\.*Journal of Artificial Intelligence Research*, 81:619–641, 2024\.doi:10\.1613/jair\.1\.15273\.
- Sion \(1958\)Maurice Sion\.On general minimax theorems\.*Pacific Journal of Mathematics*, 8\(1\):171–176, 1958\.doi:10\.2140/pjm\.1958\.8\.171\.
- Stoye \(2009a\)Jörg Stoye\.Minimax regret treatment choice with finite samples\.*Journal of Econometrics*, 151\(1\):70–81, 2009a\.doi:10\.1016/j\.jeconom\.2009\.02\.013\.
- Stoye \(2009b\)Jörg Stoye\.More on confidence intervals for partially identified parameters\.*Econometrica*, 77\(4\):1299–1315, 2009b\.doi:10\.3982/ECTA7347\.
- Tsybakov \(2009\)Alexandre B\. Tsybakov\.*Introduction to Nonparametric Estimation*\.Springer Series in Statistics\. Springer New York, New York, NY, 1 edition, 2009\.ISBN 978\-0\-387\-79052\-7\.doi:10\.1007/b13794\.URL[https://link\.springer\.com/book/10\.1007/b13794](https://link.springer.com/book/10.1007/b13794)\.
- Uma et al\. \(2021\)Alexandra N\. Uma, Tommaso Fornaciari, Dirk Hovy, Silviu Paun, Barbara Plank, and Massimo Poesio\.Learning from disagreement: A survey\.*Journal of Artificial Intelligence Research*, 72:1385–1470, 2021\.doi:10\.1613/jair\.1\.12752\.
- Valiant \(1984\)Leslie G\. Valiant\.A theory of the learnable\.*Communications of the ACM*, 27\(11\):1134–1142, 1984\.doi:10\.1145/1968\.1972\.
- Vapnik and Vashist \(2009\)Vladimir Vapnik and Akshay Vashist\.A new learning paradigm: Learning using privileged information\.*Neural Networks*, 22\(5–6\):544–557, 2009\.doi:10\.1016/j\.neunet\.2009\.06\.042\.
- Vovk et al\. \(2005\)Vladimir Vovk, Alexander Gammerman, and Glenn Shafer\.*Algorithmic Learning in a Random World*\.Springer New York, New York, NY, 1 edition, 2005\.ISBN 978\-0\-387\-25061\-8\.doi:10\.1007/b106715\.URL[https://link\.springer\.com/book/10\.1007/b106715](https://link.springer.com/book/10.1007/b106715)\.
- Wald \(1950\)Abraham Wald\.*Statistical Decision Functions*\.Wiley, New York, 1950\.
- Waudby\-Smith and Ramdas \(2024\)Ian Waudby\-Smith and Aaditya Ramdas\.Estimating means of bounded random variables by betting\.*Journal of the Royal Statistical Society Series B: Statistical Methodology*, 86\(1\):1–27, 2024\.doi:10\.1093/jrsssb/qkad009\.
- Xu and Jurgens \(2026\)Yinuo Xu and David Jurgens\.Beyond consensus: Perspectivist modeling and evaluation of annotator disagreement in nlp, 2026\.
- Yang et al\. \(2026\)Chenyang Yang, Yike Shi, Qianou Ma, Michael Xieyang Liu, Christian Kästner, and Tongshuang Wu\.What prompts don’t say: Understanding and managing underspecification in LLM prompts\.In*Findings of the Association for Computational Linguistics: ACL 2026*, pages 9072–9101\. Association for Computational Linguistics, 2026\.doi:10\.18653/v1/2026\.findings\-acl\.441\.
- Young \(2025\)Robin Young\.Information\-theoretic distinctions between deception and confusion\.In Kentaro Inui, Sakriani Sakti, Haofen Wang, Derek F\. Wong, Pushpak Bhattacharyya, Biplab Banerjee, Asif Ekbal, Tanmoy Chakraborty, and Dhirendra Pratap Singh, editors,*Proceedings of the 14th International Joint Conference on Natural Language Processing and the 4th Conference of the Asia\-Pacific Chapter of the Association for Computational Linguistics*, pages 258–268, Mumbai, India, December 2025\. The Asian Federation of Natural Language Processing and The Association for Computational Linguistics\.doi:10\.18653/v1/2025\.findings\-ijcnlp\.15\.URL[https://aclanthology\.org/2025\.findings\-ijcnlp\.15/](https://aclanthology.org/2025.findings-ijcnlp.15/)\.

## Appendix ANotation

[Table˜2](https://arxiv.org/html/2607.08961#A1.T2)collects the recurring symbols\.

SymbolDefinedMeaning𝒳,𝒴,P,f\\mathcal\{X\},\\mathcal\{Y\},P,f[Section˜2\.1](https://arxiv.org/html/2607.08961#S2.SS1)instance space, finite label space, data distribution, targetfNLf\_\{\\mathrm\{NL\}\}[Section˜2\.1](https://arxiv.org/html/2607.08961#S2.SS1)natural\-language task description \(fixed string\)𝒯,𝒯∗\\mathcal\{T\},\\ \\mathcal\{T\}^\{\*\}[Section˜2\.1](https://arxiv.org/html/2607.08961#S2.SS1)token alphabet; string space under the discreteσ\\sigma\-algebraSNL,JNLS\_\{\\mathrm\{NL\}\},\\ J\_\{\\mathrm\{NL\}\}[Section˜2\.1](https://arxiv.org/html/2607.08961#S2.SS1)measurable string subspaces of𝒯∗\\mathcal\{T\}^\{\*\}ℱSNL,ℱJNL\\mathscr\{F\}\_\{S\_\{\\mathrm\{NL\}\}\},\\ \\mathscr\{F\}\_\{J\_\{\\mathrm\{NL\}\}\}[Section˜2\.1](https://arxiv.org/html/2607.08961#S2.SS1)their induced subspaceσ\\sigma\-algebrash,h^h,\\ \\hat\{h\}[Section˜2\.1](https://arxiv.org/html/2607.08961#S2.SS1)measurable classifier; learner \(measurable rule\)g,ρ,jg,\\ \\rho,\\ j[Definitions˜2\.1](https://arxiv.org/html/2607.08961#S2.Thmtheorem1)and[2\.2](https://arxiv.org/html/2607.08961#S2.Thmtheorem2)oracle kernel; justification decoder; justificationπLLMθ​\(y∣fNL,x\)\\pi\_\{\\mathrm\{LLM\}\_\{\\theta\}\}\(y\\mid f\_\{\\mathrm\{NL\}\},x\)[Section˜2\.1](https://arxiv.org/html/2607.08961#S2.SS1)admissibility score \(description\-only decoding probability\)τ,ζ\\tau,\\ \\zeta[Definition˜2\.8](https://arxiv.org/html/2607.08961#S2.Thmtheorem8)admissibility threshold; coverage toleranceℱτ,ζ​\(fNL\)\\mathcal\{F\}\_\{\\tau,\\zeta\}\(f\_\{\\mathrm\{NL\}\}\)[Definition˜2\.8](https://arxiv.org/html/2607.08961#S2.Thmtheorem8)model\-admissible labeling classℱτ,ζread​\(fNL\)\\mathcal\{F\}^\{\\mathrm\{read\}\}\_\{\\tau,\\zeta\}\(f\_\{\\mathrm\{NL\}\}\)[Definition˜3\.6](https://arxiv.org/html/2607.08961#S3.Thmtheorem6)coherent\-reading subclassdiamτ,ζ​\(fNL,P\)\\mathrm\{diam\}\_\{\\tau,\\zeta\}\(f\_\{\\mathrm\{NL\}\},P\)[Definition˜2\.8](https://arxiv.org/html/2607.08961#S2.Thmtheorem8)model\-admissible diameterdPd\_\{P\}[Definition˜2\.8](https://arxiv.org/html/2607.08961#S2.Thmtheorem8)disagreement pseudometricdP​\(f,g\)=ℙP​\[f≠g\]d\_\{P\}\(f,g\)=\\mathbb\{P\}\_\{P\}\[f\\neq g\]D,BD,\\ B[Theorem˜3\.2](https://arxiv.org/html/2607.08961#S3.Thmtheorem2)pairwise disagreement mass; disagreement setAτ​\(x\)A\_\{\\tau\}\(x\)[Definition˜2\.5](https://arxiv.org/html/2607.08961#S2.Thmtheorem5)admissible label set atxxDτ⋆D^\{\\star\}\_\{\\tau\}[Definition˜2\.6](https://arxiv.org/html/2607.08961#S2.Thmtheorem6)admissible\-overlap massℙx​\[\|Aτ​\(x\)\|≥2\]\\mathbb\{P\}\_\{x\}\[\|A\_\{\\tau\}\(x\)\|\\geq 2\]Vτ⋆V^\{\\star\}\_\{\\tau\}[Definition˜3\.4](https://arxiv.org/html/2607.08961#S3.Thmtheorem4)exact blind\-channel minimax on𝖲𝖾𝗅τ\\mathsf\{Sel\}\_\{\\tau\}\([Theorem˜3\.5](https://arxiv.org/html/2607.08961#S3.Thmtheorem5)\); expected non\-modal admissible massVblind​\(⋅\)V\_\{\\mathrm\{blind\}\}\(\\cdot\)[Theorem˜3\.9](https://arxiv.org/html/2607.08961#S3.Thmtheorem9)blind\-channel minimax of a finite target family𝒞\\mathcal\{C\}[Theorem˜3\.9](https://arxiv.org/html/2607.08961#S3.Thmtheorem9)finite coherent\-reading family \(distinct fromC=\|𝒴\|C=\|\\mathcal\{Y\}\|\)\(fτ\+,fτ−\)\(f\_\{\\tau\}^\{\+\},f\_\{\\tau\}^\{\-\}\)[Definition˜2\.9](https://arxiv.org/html/2607.08961#S2.Thmtheorem9)maximal\-spread pair𝖲𝖾𝗅τ\\mathsf\{Sel\}\_\{\\tau\}[Definition˜2\.8](https://arxiv.org/html/2607.08961#S2.Thmtheorem8)almost\-everywhere admissible selection class;ℱτ,ζ\\mathcal\{F\}\_\{\\tau,\\zeta\}is its openζ\\zeta\-neighborhoodk​\(x\)k\(x\)[Section˜3\.2](https://arxiv.org/html/2607.08961#S3.SS2)number of admissible labels,\|A¯τ​\(x\)\|\|\\bar\{A\}\_\{\\tau\}\(x\)\|κ​\(ξ\)\\kappa\(\\xi\)[Corollary˜4\.5](https://arxiv.org/html/2607.08961#S4.Thmtheorem5)threshold\-margin massη\\eta[Definition˜3\.8](https://arxiv.org/html/2607.08961#S3.Thmtheorem8)coherent\-family coverage gapNN[Proposition˜4\.1](https://arxiv.org/html/2607.08961#S4.Thmtheorem1)held\-out audit inputs \(Hoeffding sample size\)mm[Definition˜3\.1](https://arxiv.org/html/2607.08961#S3.Thmtheorem1)learner’s oracle\-labeled sample sizerr[Corollary˜4\.5](https://arxiv.org/html/2607.08961#S4.Thmtheorem5)decoding depth \(samples per input\)δ\\delta[Proposition˜4\.1](https://arxiv.org/html/2607.08961#S4.Thmtheorem1)audit confidence levelεN\\varepsilon\_\{N\}[Proposition˜4\.1](https://arxiv.org/html/2607.08961#S4.Thmtheorem1)Hoeffding sampling slacklog⁡\(2/δ\)/2​N\\sqrt\{\\log\(2/\\delta\)/2N\}ξ\\xi[Corollary˜4\.5](https://arxiv.org/html/2607.08961#S4.Thmtheorem5)threshold\-margin half\-widthCC[Corollary˜4\.5](https://arxiv.org/html/2607.08961#S4.Thmtheorem5)label\-space size\|𝒴\|\|\\mathcal\{Y\}\|Table 2:Recurring notation, with the defining location\.
## Appendix BDeferred Proofs and Supporting Statements

This appendix collects the proofs deferred from the main text, grouped to mirror the body and ordered within each group by appearance\.

### B\.1Proofs for model\-admissible geometry

###### Proof of[Theorem˜2\.11](https://arxiv.org/html/2607.08961#S2.Thmtheorem11)\.

*\(⊇\\supseteq\)\.*SupposedP​\(u,v\)<ζd\_\{P\}\(u,v\)<\\zetafor somev∈𝖲𝖾𝗅τv\\in\\mathsf\{Sel\}\_\{\\tau\}\. Sincev​\(x\)∈Aτ​\(x\)v\(x\)\\in A\_\{\\tau\}\(x\)forPP\-a\.e\.xx, the event\{u​\(x\)∈Aτ​\(x\)\}\\\{u\(x\)\\in A\_\{\\tau\}\(x\)\\\}contains\{u=v\}\\\{u=v\\\}up to a null set, and disagreement withvvhas massdP​\(u,v\)d\_\{P\}\(u,v\), soℙP​\[πLLMθ​\(u​\(x\)∣fNL,x\)≥τ\]=ℙP​\[u​\(x\)∈Aτ​\(x\)\]≥ℙP​\[u=v\]=1−dP​\(u,v\)\>1−ζ\\mathbb\{P\}\_\{P\}\[\\pi\_\{\\mathrm\{LLM\}\_\{\\theta\}\}\(u\(x\)\\mid f\_\{\\mathrm\{NL\}\},x\)\\geq\\tau\]=\\mathbb\{P\}\_\{P\}\[u\(x\)\\in A\_\{\\tau\}\(x\)\]\\geq\\mathbb\{P\}\_\{P\}\[u=v\]=1\-d\_\{P\}\(u,v\)\>1\-\\zeta, which is membership inℱτ,ζ​\(fNL\)\\mathcal\{F\}\_\{\\tau,\\zeta\}\(f\_\{\\mathrm\{NL\}\}\)\([Definition˜2\.8](https://arxiv.org/html/2607.08961#S2.Thmtheorem8)\)\.*\(⊆\\subseteq\)\.*Letu∈ℱτ,ζ​\(fNL\)u\\in\\mathcal\{F\}\_\{\\tau,\\zeta\}\(f\_\{\\mathrm\{NL\}\}\)and setG:=\{x:u​\(x\)∈Aτ​\(x\)\}G:=\\\{x:u\(x\)\\in A\_\{\\tau\}\(x\)\\\};GGis measurable becausex↦πLLMθ​\(u​\(x\)∣fNL,x\)=∑y∈𝒴𝟏​\{u​\(x\)=y\}​πLLMθ​\(y∣fNL,x\)x\\mapsto\\pi\_\{\\mathrm\{LLM\}\_\{\\theta\}\}\(u\(x\)\\mid f\_\{\\mathrm\{NL\}\},x\)=\\sum\_\{y\\in\\mathcal\{Y\}\}\\mathbf\{1\}\\\{u\(x\)=y\\\}\\,\\pi\_\{\\mathrm\{LLM\}\_\{\\theta\}\}\(y\\mid f\_\{\\mathrm\{NL\}\},x\)is measurable under[Assumption˜\(A1\)](https://arxiv.org/html/2607.08961#Thmassumption1), and membership givesℙP​\[G\]\>1−ζ\\mathbb\{P\}\_\{P\}\[G\]\>1\-\\zeta\. Definev:=uv:=uonGG,v:=y\(1\)​\(x\)v:=y\_\{\(1\)\}\(x\)\(the top\-ranked admissible label of[Definition˜2\.9](https://arxiv.org/html/2607.08961#S2.Thmtheorem9)\) onGc∩\{Aτ​\(x\)≠∅\}G^\{c\}\\cap\\\{A\_\{\\tau\}\(x\)\\neq\\varnothing\\\}, andv:=y0v:=y\_\{0\}on the remaining setGc∩\{Aτ​\(x\)=∅\}G^\{c\}\\cap\\\{A\_\{\\tau\}\(x\)=\\varnothing\\\}, which isPP\-null by the nonemptiness hypothesis;vvis then a measurable total map into𝒴\\mathcal\{Y\}\. Thenv∈𝖲𝖾𝗅τv\\in\\mathsf\{Sel\}\_\{\\tau\}anddP​\(u,v\)≤ℙP​\[Gc\]<ζd\_\{P\}\(u,v\)\\leq\\mathbb\{P\}\_\{P\}\[G^\{c\}\]<\\zeta, sodP​\(u,𝖲𝖾𝗅τ\)<ζd\_\{P\}\(u,\\mathsf\{Sel\}\_\{\\tau\}\)<\\zeta\.*\(Diameter of the core\.\)*Two selections can disagree atxxonly ifAτ​\(x\)A\_\{\\tau\}\(x\)contains at least two labels, sodP​\(u,v\)≤Dτ⋆d\_\{P\}\(u,v\)\\leq D^\{\\star\}\_\{\\tau\}for allu,v∈𝖲𝖾𝗅τu,v\\in\\mathsf\{Sel\}\_\{\\tau\}\. The two selections taking the top and a second admissible label wherever\|Aτ​\(x\)\|≥2\|A\_\{\\tau\}\(x\)\|\\geq 2disagree on all of that set, so the bound is attained anddiamP​\(𝖲𝖾𝗅τ\)=Dτ⋆\\mathrm\{diam\}\_\{P\}\(\\mathsf\{Sel\}\_\{\\tau\}\)=D^\{\\star\}\_\{\\tau\}\.*\(Sandwich\.\)*Since𝖲𝖾𝗅τ⊆ℱτ,ζ​\(fNL\)\\mathsf\{Sel\}\_\{\\tau\}\\subseteq\\mathcal\{F\}\_\{\\tau,\\zeta\}\(f\_\{\\mathrm\{NL\}\}\), the previous step givesDτ⋆≤diamτ,ζD^\{\\star\}\_\{\\tau\}\\leq\\mathrm\{diam\}\_\{\\tau,\\zeta\}\. For the upper bound, takeu,v∈ℱτ,ζ​\(fNL\)u,v\\in\\mathcal\{F\}\_\{\\tau,\\zeta\}\(f\_\{\\mathrm\{NL\}\}\)with selectionsu~,v~∈𝖲𝖾𝗅τ\\tilde\{u\},\\tilde\{v\}\\in\\mathsf\{Sel\}\_\{\\tau\}as in \(⊆\\subseteq\); the triangle inequality fordPd\_\{P\}givesdP​\(u,v\)≤dP​\(u~,v~\)\+dP​\(u,u~\)\+dP​\(v,v~\)<Dτ⋆\+2​ζd\_\{P\}\(u,v\)\\leq d\_\{P\}\(\\tilde\{u\},\\tilde\{v\}\)\+d\_\{P\}\(u,\\tilde\{u\}\)\+d\_\{P\}\(v,\\tilde\{v\}\)<D^\{\\star\}\_\{\\tau\}\+2\\zeta, and taking the supremum yieldsdiamτ,ζ≤Dτ⋆\+2​ζ\\mathrm\{diam\}\_\{\\tau,\\zeta\}\\leq D^\{\\star\}\_\{\\tau\}\+2\\zeta\. ∎

###### Proof of[Proposition˜2\.12](https://arxiv.org/html/2607.08961#S2.Thmtheorem12)\.

*\(a\)*The upper bounddiamτ,ζ≤Dτ⋆\+2​ζ\\mathrm\{diam\}\_\{\\tau,\\zeta\}\\leq D^\{\\star\}\_\{\\tau\}\+2\\zetais[Theorem˜2\.11](https://arxiv.org/html/2607.08961#S2.Thmtheorem11); it remains to match it\. Fixε∈\(0,ζ\)\\varepsilon\\in\(0,\\zeta\)\. Off the overlap regionB⋆=\{x:\|Aτ​\(x\)\|≥2\}B^\{\\star\}=\\\{x:\|A\_\{\\tau\}\(x\)\|\\geq 2\\\}the admissible set is a singleton\{a​\(x\)\}\\\{a\(x\)\\\}, withx↦a​\(x\)x\\mapsto a\(x\)measurable \(the top admissible label of[Definition˜2\.9](https://arxiv.org/html/2607.08961#S2.Thmtheorem9)\) and nonemptyPP\-a\.e\. by[Assumption˜\(A3\)](https://arxiv.org/html/2607.08961#Thmassumption3)\. SincePPis nonatomic on\{x:\|Aτ​\(x\)\|=1\}\\\{x:\|A\_\{\\tau\}\(x\)\|=1\\\}, which has mass at least2​ζ\>2​\(ζ−ε\)2\\zeta\>2\(\\zeta\-\\varepsilon\), choose disjoint measurable subsetsS1,S2S\_\{1\},S\_\{2\}of it withP​\(S1\)=P​\(S2\)=ζ−εP\(S\_\{1\}\)=P\(S\_\{2\}\)=\\zeta\-\\varepsilon\. Let\(fτ\+,fτ−\)\(f\_\{\\tau\}^\{\+\},f\_\{\\tau\}^\{\-\}\)be the maximal\-spread pair, and letb​\(x\)b\(x\)be the≺\\prec\-smallest label distinct froma​\(x\)a\(x\)\(measurable, and well defined since\|𝒴\|≥2\|\\mathcal\{Y\}\|\\geq 2\)\. Define

f1​\(x\)=\{b​\(x\)x∈S1,fτ\+​\(x\)else,f2​\(x\)=\{b​\(x\)x∈S2,fτ−​\(x\)else\.f\_\{1\}\(x\)=\\begin\{cases\}b\(x\)&x\\in S\_\{1\},\\\\ f\_\{\\tau\}^\{\+\}\(x\)&\\text\{else\},\\end\{cases\}\\qquad f\_\{2\}\(x\)=\\begin\{cases\}b\(x\)&x\\in S\_\{2\},\\\\ f\_\{\\tau\}^\{\-\}\(x\)&\\text\{else\}\.\\end\{cases\}Eachfjf\_\{j\}deviates from an almost\-everywhere admissible selection only on a set of massζ−ε<ζ\\zeta\-\\varepsilon<\\zeta, sof1,f2∈ℱτ,ζ​\(fNL\)f\_\{1\},f\_\{2\}\\in\\mathcal\{F\}\_\{\\tau,\\zeta\}\(f\_\{\\mathrm\{NL\}\}\)by[Theorem˜2\.11](https://arxiv.org/html/2607.08961#S2.Thmtheorem11)\. OffB⋆B^\{\\star\}both selections equala​\(x\)a\(x\), sof1f\_\{1\}andf2f\_\{2\}disagree on all ofS1∪S2S\_\{1\}\\cup S\_\{2\}\(on eachSjS\_\{j\}exactly one takes the valueb​\(x\)≠a​\(x\)b\(x\)\\neq a\(x\)\) and, disjointly, on the overlap event\{fτ\+≠fτ−\}=B⋆\\\{f\_\{\\tau\}^\{\+\}\\neq f\_\{\\tau\}^\{\-\}\\\}=B^\{\\star\}; hencedP​\(f1,f2\)≥Dτ⋆\+2​\(ζ−ε\)d\_\{P\}\(f\_\{1\},f\_\{2\}\)\\geq D^\{\\star\}\_\{\\tau\}\+2\(\\zeta\-\\varepsilon\)\. Lettingε↓0\\varepsilon\\downarrow 0givesdiamτ,ζ≥Dτ⋆\+2​ζ\\mathrm\{diam\}\_\{\\tau,\\zeta\}\\geq D^\{\\star\}\_\{\\tau\}\+2\\zeta, so with the upper bound the diameter equalsDτ⋆\+2​ζD^\{\\star\}\_\{\\tau\}\+2\\zeta\. The supremum is not attained by any single pair, since each admissible labeling deviates on mass strictly belowζ\\zeta, whence every pairwise disagreement is strictly belowDτ⋆\+2​ζD^\{\\star\}\_\{\\tau\}\+2\\zeta\.

*\(b\)*Letf′∈ℱτ,ζ​\(fNL\)f^\{\\prime\}\\in\\mathcal\{F\}\_\{\\tau,\\zeta\}\(f\_\{\\mathrm\{NL\}\}\)with coverage complementN=\{x:πLLMθ​\(f′​\(x\)∣fNL,x\)<τ\}N=\\\{x:\\pi\_\{\\mathrm\{LLM\}\_\{\\theta\}\}\(f^\{\\prime\}\(x\)\\mid f\_\{\\mathrm\{NL\}\},x\)<\\tau\\\}, soP​\(N\)<ζP\(N\)<\\zeta\. If every atom of the purely atomicPPhas mass at leastζ\\zeta, thenNNcontains no atom and henceP​\(N\)=0P\(N\)=0, sof′∈𝖲𝖾𝗅τf^\{\\prime\}\\in\\mathsf\{Sel\}\_\{\\tau\}\. With the immediate reverse inclusion𝖲𝖾𝗅τ⊆ℱτ,ζ​\(fNL\)\\mathsf\{Sel\}\_\{\\tau\}\\subseteq\\mathcal\{F\}\_\{\\tau,\\zeta\}\(f\_\{\\mathrm\{NL\}\}\), the two classes agree up toPP\-null sets, anddiamτ,ζ=diamP​\(𝖲𝖾𝗅τ\)=Dτ⋆\\mathrm\{diam\}\_\{\\tau,\\zeta\}=\\mathrm\{diam\}\_\{P\}\(\\mathsf\{Sel\}\_\{\\tau\}\)=D^\{\\star\}\_\{\\tau\}by[Theorem˜2\.11](https://arxiv.org/html/2607.08961#S2.Thmtheorem11)\. ∎

### B\.2Proofs for blind\-channel floors and exact blind values

###### Proof of[Theorem˜3\.2](https://arxiv.org/html/2607.08961#S3.Thmtheorem2)\.

*\(a\)*This is Le Cam’s two\-point method with the error rate as semi\-distance\(Tsybakov,[2009](https://arxiv.org/html/2607.08961#bib.bib55)\)\. For any classifierhhand anyxx, the indicators satisfy𝟏​\[h​\(x\)≠f1​\(x\)\]\+𝟏​\[h​\(x\)≠f2​\(x\)\]≥𝟏​\[f1​\(x\)≠f2​\(x\)\]\\mathbf\{1\}\[h\(x\)\\neq f\_\{1\}\(x\)\]\+\\mathbf\{1\}\[h\(x\)\\neq f\_\{2\}\(x\)\]\\geq\\mathbf\{1\}\[f\_\{1\}\(x\)\\neq f\_\{2\}\(x\)\], sinceh​\(x\)h\(x\)can equal at most one of two distinct labels; taking𝔼x∼P\\mathbb\{E\}\_\{x\\sim P\}givesdP​\(h,f1\)\+dP​\(h,f2\)≥Dd\_\{P\}\(h,f\_\{1\}\)\+d\_\{P\}\(h,f\_\{2\}\)\\geq Dfor every fixedhh\. Hence, writingpjp\_\{j\}for densities with respect to a common dominating measure \(e\.g\.P1⊗m\+P2⊗mP\_\{1\}^\{\\otimes m\}\+P\_\{2\}^\{\\otimes m\}\),

𝔼P1⊗m​\[dP​\(h^,f1\)\]\+𝔼P2⊗m​\[dP​\(h^,f2\)\]\\displaystyle\\mathbb\{E\}\_\{P\_\{1\}^\{\\otimes m\}\}\[d\_\{P\}\(\\hat\{h\},f\_\{1\}\)\]\+\\mathbb\{E\}\_\{P\_\{2\}^\{\\otimes m\}\}\[d\_\{P\}\(\\hat\{h\},f\_\{2\}\)\]≥∫\(dP​\(h^,f1\)\+dP​\(h^,f2\)\)​min⁡\(p1,p2\)\\displaystyle\\;\\geq\\;\\int\\bigl\(d\_\{P\}\(\\hat\{h\},f\_\{1\}\)\+d\_\{P\}\(\\hat\{h\},f\_\{2\}\)\\bigr\)\\min\(p\_\{1\},p\_\{2\}\)≥D​∫min⁡\(p1,p2\)=D​\(1−TV​\(P1⊗m,P2⊗m\)\)\.\\displaystyle\\;\\geq\\;D\\int\\min\(p\_\{1\},p\_\{2\}\)\\;=\\;D\\,\\bigl\(1\-\\mathrm\{TV\}\(P\_\{1\}^\{\\otimes m\},P\_\{2\}^\{\\otimes m\}\)\\bigr\)\.Since the maximum is at least the average, dividing by two yields part \(a\)\.

*\(b\)*By[Equation˜1](https://arxiv.org/html/2607.08961#S3.E1), the conditional law of the decoded labelρ​\(Jj,x\)\\rho\(J\_\{j\},x\)givenxxagrees underf1f\_\{1\}andf2f\_\{2\}forPP\-almost everyxx\(offBBthis is immediate, since the targets share the label there\)\. The input marginalPPis common to both experiments, so the one\-example observation laws coincide,P1=P2P\_\{1\}=P\_\{2\}; henceP1⊗m=P2⊗mP\_\{1\}^\{\\otimes m\}=P\_\{2\}^\{\\otimes m\}andTV​\(P1⊗m,P2⊗m\)=0\\mathrm\{TV\}\(P\_\{1\}^\{\\otimes m\},P\_\{2\}^\{\\otimes m\}\)=0for everymm\. Substituting into part \(a\) givesmaxj⁡𝔼​\[dP​\(h^,fj\)\]≥D/2\\max\_\{j\}\\mathbb\{E\}\[d\_\{P\}\(\\hat\{h\},f\_\{j\}\)\]\\geq D/2, uniformly inmm\. For the fixed\-description base channel the hypothesis is automatic, sinceJj∼g\(⋅∣fNL,x\)J\_\{j\}\\sim g\(\\cdot\\mid f\_\{\\mathrm\{NL\}\},x\)does not depend on the target \([Proposition˜2\.4](https://arxiv.org/html/2607.08961#S2.Thmtheorem4)\)\. ∎

###### Corollary B\.1\(Tightness and exact minimax value of the two\-point floor\)\.

In the two\-experiment construction of[Theorem˜3\.2](https://arxiv.org/html/2607.08961#S3.Thmtheorem2), the minimax mediated risk over the target pair\{f1,f2\}\\\{f\_\{1\},f\_\{2\}\\\}is exactly the least\-favorable\-prior Bayes risk of the induced binary test\(Wald,[1950](https://arxiv.org/html/2607.08961#bib.bib60); Ferguson,[1967](https://arxiv.org/html/2607.08961#bib.bib18); Blackwell and Girshick,[1954](https://arxiv.org/html/2607.08961#bib.bib9)\); because this is a finite two\-action test against a two\-point prior, the equality of its minimax and least\-favorable\-prior values is elementary and requires no general minimax theorem\. For every sample sizemm,

infh^maxj∈\{1,2\}⁡𝔼S∼Pj⊗m​\[dP​\(h^​\(S\),fj\)\]=D​supq∈\[0,1\]∫min⁡\(q​d​P1⊗m,\(1−q\)​d​P2⊗m\)\.\\inf\_\{\\hat\{h\}\}\\max\_\{j\\in\\\{1,2\\\}\}\\mathbb\{E\}\_\{S\\sim P\_\{j\}^\{\\otimes m\}\}\\bigl\[d\_\{P\}\(\\hat\{h\}\(S\),f\_\{j\}\)\\bigr\]\\;=\\;D\\sup\_\{q\\in\[0,1\]\}\\int\\min\\bigl\(q\\,\\mathrm\{d\}P\_\{1\}^\{\\otimes m\},\(1\-q\)\\,\\mathrm\{d\}P\_\{2\}^\{\\otimes m\}\\bigr\)\.Consequently:

1. \(a\)*\(Blind tightness\.\)*In the unresolved case of[Theorem˜3\.2](https://arxiv.org/html/2607.08961#S3.Thmtheorem2)\(b\), the minimax risk equalsD/2D/2for every sample sizemm, attained by the data\-independent learner that returnsf1f\_\{1\}orf2f\_\{2\}by a fair coin flip\.
2. \(b\)*\(Symmetric tightness\.\)*If the least\-favorable prior is uniform,q⋆=12q^\{\\star\}=\\tfrac\{1\}\{2\}, then the Le Cam lower bound is tight, infh^maxj∈\{1,2\}⁡𝔼S∼Pj⊗m​\[dP​\(h^​\(S\),fj\)\]=D2​\(1−TV​\(P1⊗m,P2⊗m\)\)\.\\inf\_\{\\hat\{h\}\}\\max\_\{j\\in\\\{1,2\\\}\}\\mathbb\{E\}\_\{S\\sim P\_\{j\}^\{\\otimes m\}\}\\bigl\[d\_\{P\}\(\\hat\{h\}\(S\),f\_\{j\}\)\\bigr\]\\;=\\;\\frac\{D\}\{2\}\\Bigl\(1\-\\mathrm\{TV\}\\bigl\(P\_\{1\}^\{\\otimes m\},P\_\{2\}^\{\\otimes m\}\\bigr\)\\Bigr\)\.
3. \(c\)*\(Total\-variation sandwich\.\)*For general channels, D2​\(1−TV​\(P1⊗m,P2⊗m\)\)≤infh^maxj∈\{1,2\}⁡𝔼S∼Pj⊗m​\[dP​\(h^​\(S\),fj\)\]≤D​\(1−TV​\(P1⊗m,P2⊗m\)\)\.\\frac\{D\}\{2\}\\Bigl\(1\-\\mathrm\{TV\}\\bigl\(P\_\{1\}^\{\\otimes m\},P\_\{2\}^\{\\otimes m\}\\bigr\)\\Bigr\)\\;\\leq\\;\\inf\_\{\\hat\{h\}\}\\max\_\{j\\in\\\{1,2\\\}\}\\mathbb\{E\}\_\{S\\sim P\_\{j\}^\{\\otimes m\}\}\\bigl\[d\_\{P\}\(\\hat\{h\}\(S\),f\_\{j\}\)\\bigr\]\\;\\leq\\;D\\Bigl\(1\-\\mathrm\{TV\}\\bigl\(P\_\{1\}^\{\\otimes m\},P\_\{2\}^\{\\otimes m\}\\bigr\)\\Bigr\)\.

###### Proof of[Corollary˜B\.1](https://arxiv.org/html/2607.08961#A2.Thmtheorem1)\.

*Reduction to a two\-point test\.*OffBBthe two targets coincide, and any label outside\{f1​\(x\),f2​\(x\)\}\\\{f\_\{1\}\(x\),f\_\{2\}\(x\)\\\}errs against both targets atxx; projecting a rule pointwise onto the common label offBBand onto whichever off1​\(x\),f2​\(x\)f\_\{1\}\(x\),f\_\{2\}\(x\)it already matches onBB\(breaking ties arbitrarily\) therefore weakly lowersdP​\(⋅,f1\)d\_\{P\}\(\\cdot,f\_\{1\}\)anddP​\(⋅,f2\)d\_\{P\}\(\\cdot,f\_\{2\}\)simultaneously\. Hence we may restrict to rulesh^\\hat\{h\}valued pointwise in\{f1​\(x\),f2​\(x\)\}\\\{f\_\{1\}\(x\),f\_\{2\}\(x\)\\\}\. Such rules need not be global \(they may followf1f\_\{1\}on part ofBBandf2f\_\{2\}elsewhere\), so we do*not*assert this reduction collapses onto the two functionsf1,f2f\_\{1\},f\_\{2\}; instead we identify the minimax value through the least\-favorable prior\.

We first show that*global*rules form a sufficient class\. Fix a prior with weightq∈\[0,1\]q\\in\[0,1\]onf1f\_\{1\}, and conditional on the sampleSSwriteq​\(S\)q\(S\)for the posterior weight onf1f\_\{1\}\. A Bayes rule minimizes the posterior riskq​\(S\)​dP​\(h^,f1\)\+\(1−q​\(S\)\)​dP​\(h^,f2\)q\(S\)\\,d\_\{P\}\(\\hat\{h\},f\_\{1\}\)\+\(1\-q\(S\)\)\\,d\_\{P\}\(\\hat\{h\},f\_\{2\}\), which pointwise onBBis minimized byf1​\(x\)f\_\{1\}\(x\)whenq​\(S\)≥12q\(S\)\\geq\\tfrac\{1\}\{2\}and byf2​\(x\)f\_\{2\}\(x\)otherwise\. This is the*same*choice at everyxx, sinceq​\(S\)q\(S\)does not vary withxx\. Hence the Bayes rule is the global testȷ^:S↦\{1,2\}\\hat\{\\jmath\}\\colon S\\mapsto\\\{1,2\\\}returningfȷ^​\(S\)f\_\{\\hat\{\\jmath\}\(S\)\}, so global tests are sufficient even though the feasible class is larger\. The problem therefore reduces to a two\-action test off1f\_\{1\}againstf2f\_\{2\}; being a finite test against a two\-point prior, its minimax risk equals the least\-favorable\-prior Bayes risk by the elementary finite minimax identity\(Wald,[1950](https://arxiv.org/html/2607.08961#bib.bib60); Ferguson,[1967](https://arxiv.org/html/2607.08961#bib.bib18)\), with no general minimax theorem required\. Such a test errs only onBBand only whenȷ^​\(S\)≠j\\hat\{\\jmath\}\(S\)\\neq j, sodP​\(fȷ^​\(S\),fj\)=D​1​\[ȷ^​\(S\)≠j\]d\_\{P\}\(f\_\{\\hat\{\\jmath\}\(S\)\},f\_\{j\}\)=D\\,\\mathbf\{1\}\[\\hat\{\\jmath\}\(S\)\\neq j\]\. Hence

infh^maxj∈\{1,2\}⁡𝔼Pj⊗m​\[dP​\(h^,fj\)\]=D​infȷ^maxj∈\{1,2\}⁡ℙPj⊗m​\[ȷ^≠j\]=D​supq∈\[0,1\]∫min⁡\(q​d​P1⊗m,\(1−q\)​d​P2⊗m\),\\inf\_\{\\hat\{h\}\}\\max\_\{j\\in\\\{1,2\\\}\}\\mathbb\{E\}\_\{P\_\{j\}^\{\\otimes m\}\}\[d\_\{P\}\(\\hat\{h\},f\_\{j\}\)\]=D\\,\\inf\_\{\\hat\{\\jmath\}\}\\max\_\{j\\in\\\{1,2\\\}\}\\mathbb\{P\}\_\{P\_\{j\}^\{\\otimes m\}\}\[\\hat\{\\jmath\}\\neq j\]=D\\sup\_\{q\\in\[0,1\]\}\\int\\min\\bigl\(q\\,\\mathrm\{d\}P\_\{1\}^\{\\otimes m\},\(1\-q\)\\,\\mathrm\{d\}P\_\{2\}^\{\\otimes m\}\\bigr\),the last equality being the minimax \(least\-favorable\-prior\) value of the Bayes test betweenP1⊗mP\_\{1\}^\{\\otimes m\}andP2⊗mP\_\{2\}^\{\\otimes m\}\(Wald,[1950](https://arxiv.org/html/2607.08961#bib.bib60); Tsybakov,[2009](https://arxiv.org/html/2607.08961#bib.bib55)\)\.*\(a\)*IfP1=P2P\_\{1\}=P\_\{2\}the integrand ismin⁡\(q,1−q\)​d​P1⊗m\\min\(q,1\-q\)\\,\\mathrm\{d\}P\_\{1\}^\{\\otimes m\}, with supremum12\\tfrac\{1\}\{2\}overqq, so the value isD/2D/2; the fair\-coin learner returningf1f\_\{1\}orf2f\_\{2\}has risk12⋅0\+12⋅D=D/2\\tfrac\{1\}\{2\}\\cdot 0\+\\tfrac\{1\}\{2\}\\cdot D=D/2against either target and attains it\.*\(b\)*When the least\-favorable prior is uniform, evaluating atq=12q=\\tfrac\{1\}\{2\}gives12​∫min⁡\(d​P1⊗m,d​P2⊗m\)=12​\(1−TV​\(P1⊗m,P2⊗m\)\)\\tfrac\{1\}\{2\}\\int\\min\(\\mathrm\{d\}P\_\{1\}^\{\\otimes m\},\\mathrm\{d\}P\_\{2\}^\{\\otimes m\}\)=\\tfrac\{1\}\{2\}\\bigl\(1\-\\mathrm\{TV\}\(P\_\{1\}^\{\\otimes m\},P\_\{2\}^\{\\otimes m\}\)\\bigr\), so the value isD2​\(1−TV\)\\tfrac\{D\}\{2\}\(1\-\\mathrm\{TV\}\)\.*\(c\)*Evaluating the supremum atq=12q=\\tfrac\{1\}\{2\}gives the lower bound;min⁡\(q​a,\(1−q\)​b\)≤min⁡\(a,b\)\\min\(qa,\(1\-q\)b\)\\leq\\min\(a,b\)pointwise givessupq∫min≤∫min⁡\(d​P1⊗m,d​P2⊗m\)=1−TV\\sup\_\{q\}\\int\\min\\leq\\int\\min\(\\mathrm\{d\}P\_\{1\}^\{\\otimes m\},\\mathrm\{d\}P\_\{2\}^\{\\otimes m\}\)=1\-\\mathrm\{TV\}, the upper bound\. ∎

###### Proof of[Theorem˜3\.5](https://arxiv.org/html/2607.08961#S3.Thmtheorem5)\.

By hypothesis the channel is target\-blind on𝖲𝖾𝗅τ\\mathsf\{Sel\}\_\{\\tau\}, so the oracle\-labeled sample has the same law for everyf∈𝖲𝖾𝗅τf\\in\\mathsf\{Sel\}\_\{\\tau\}; any randomized learner therefore induces a target\-independent randomization over measurable classifiers\.

LetC=\|𝒴\|C=\|\\mathcal\{Y\}\|andL=lcm⁡\(1,…,C\)L=\\operatorname\{lcm\}\(1,\\ldots,C\)\. Enumerate the repaired setA¯τ​\(x\)=\{a1​\(x\),…,ak​\(x\)​\(x\)\}\\bar\{A\}\_\{\\tau\}\(x\)=\\\{a\_\{1\}\(x\),\\ldots,a\_\{k\(x\)\}\(x\)\\\}in the fixed order≺\\prec\. For eachj≤Cj\\leq C, extendaj​\(x\)a\_\{j\}\(x\)by the default valuey0y\_\{0\}on\{x:k​\(x\)<j\}\\\{x:k\(x\)<j\\\}\. The mapskkand these total mapsaja\_\{j\}are measurable because𝒴\\mathcal\{Y\}is finite and each label’s admissibility event is measurable under[Assumption˜\(A1\)](https://arxiv.org/html/2607.08961#Thmassumption1)\. Fori=1,…,Li=1,\\ldots,L, define

f\(i\)​\(x\):=a1\+\(\(i−1\)modk​\(x\)\)​\(x\)\.f^\{\(i\)\}\(x\):=a\_\{1\+\(\(i\-1\)\\bmod k\(x\)\)\}\(x\)\.Eachf\(i\)f^\{\(i\)\}is measurable and belongs to𝖲𝖾𝗅τ\\mathsf\{Sel\}\_\{\\tau\}\(the set on whichA¯τ\\bar\{A\}\_\{\\tau\}repairsAτA\_\{\\tau\}isPP\-null\)\. Sincek​\(x\)k\(x\)dividesLL, a uniform choice ofiimakesf\(i\)​\(x\)f^\{\(i\)\}\(x\)uniform onA¯τ​\(x\)\\bar\{A\}\_\{\\tau\}\(x\)for everyxx\.

*Achievability \(upper bound\)\.*Leth^⋆\\hat\{h\}\_\{\\star\}ignore the sample, drawiiuniformly, and outputf\(i\)f^\{\(i\)\}\. For everyf∈𝖲𝖾𝗅τf\\in\\mathsf\{Sel\}\_\{\\tau\},

𝔼​\[dP​\(h^⋆,f\)\]=𝔼x​\[ℙi​\{f\(i\)​\(x\)≠f​\(x\)\}\]=𝔼x​\[1−1k​\(x\)\]=Vτ⋆,\\mathbb\{E\}\\\!\\left\[d\_\{P\}\(\\hat\{h\}\_\{\\star\},f\)\\right\]=\\mathbb\{E\}\_\{x\}\\\!\\left\[\\mathbb\{P\}\_\{i\}\\\{f^\{\(i\)\}\(x\)\\neq f\(x\)\\\}\\right\]=\\mathbb\{E\}\_\{x\}\\\!\\left\[1\-\\frac\{1\}\{k\(x\)\}\\right\]=V^\{\\star\}\_\{\\tau\},where the equality is unaffected by the repaired null set\. Hence the minimax is at mostVτ⋆V^\{\\star\}\_\{\\tau\}\.

*Lower bound\.*Regard\{f\(i\)\}i=1L\\\{f^\{\(i\)\}\\\}\_\{i=1\}^\{L\}as an indexed family \(repetitions are harmless, since a supremum dominates any weighted average\)\. Fix any randomized learner and writeH=h^​\(S,W\)H=\\hat\{h\}\(S,W\)for its output, including its internal random seedWW\. Draw a uniform random indexiiindependently of\(X,S,W\)\(X,S,W\)by construction, and note that by target blindness the sample law ofSSdoes not depend onii; these two facts together makeH=h^​\(S,W\)H=\\hat\{h\}\(S,W\)independent ofii, which justifies interchanging the expectation over\(x,S,W\)\(x,S,W\)with the probability overiibelow\. Therefore

supf∈𝖲𝖾𝗅τ𝔼​\[dP​\(H,f\)\]\\displaystyle\\sup\_\{f\\in\\mathsf\{Sel\}\_\{\\tau\}\}\\mathbb\{E\}\\\!\\left\[d\_\{P\}\(H,f\)\\right\]≥1L​∑i=1L𝔼​\[dP​\(H,f\(i\)\)\]\\displaystyle\\geq\\frac\{1\}\{L\}\\sum\_\{i=1\}^\{L\}\\mathbb\{E\}\\\!\\left\[d\_\{P\}\(H,f^\{\(i\)\}\)\\right\]=𝔼x,S,W​\[1−ℙi​\{f\(i\)​\(x\)=H​\(x\)∣x,H\}\]\\displaystyle=\\mathbb\{E\}\_\{x,S,W\}\\\!\\left\[1\-\\mathbb\{P\}\_\{i\}\\\{f^\{\(i\)\}\(x\)=H\(x\)\\mid x,H\\\}\\right\]≥𝔼x​\[1−1k​\(x\)\]=Vτ⋆\.\\displaystyle\\geq\\mathbb\{E\}\_\{x\}\\\!\\left\[1\-\\frac\{1\}\{k\(x\)\}\\right\]=V^\{\\star\}\_\{\\tau\}\.Indeed, the conditional match probability is1/k​\(x\)1/k\(x\)whenH​\(x\)∈A¯τ​\(x\)H\(x\)\\in\\bar\{A\}\_\{\\tau\}\(x\)and zero otherwise\. Taking the infimum over learners gives the lower bound\. The two bounds coincide, andh^⋆\\hat\{h\}\_\{\\star\}attains the value for every sample sizemm\. ∎

###### Proof of[Theorem˜3\.9](https://arxiv.org/html/2607.08961#S3.Thmtheorem9)\.

Target blindness on𝒞\\mathcal\{C\}makes the sample law common to allf∈𝒞f\\in\\mathcal\{C\}\. Averaging a randomized learner over this common law produces a data\-independent randomized classifier with the same risk against every target in𝒞\\mathcal\{C\}\. It therefore suffices to optimize over randomized classifiers\.

For any distributionλ\\lambdaon the finite family𝒞\\mathcal\{C\}, a plurality classifier minimizes theλ\\lambda\-average risk:

infh^𝔼f∼λ​\[dP​\(h^,f\)\]=infh^𝔼x​\[1−μxλ​\(h^​\(x\)\)\]=𝔼x​\[1−maxy⁡μxλ​\(y\)\],\\inf\_\{\\hat\{h\}\}\\mathbb\{E\}\_\{f\\sim\\lambda\}\[d\_\{P\}\(\\hat\{h\},f\)\]=\\inf\_\{\\hat\{h\}\}\\mathbb\{E\}\_\{x\}\\bigl\[1\-\\mu^\{\\lambda\}\_\{x\}\(\\hat\{h\}\(x\)\)\\bigr\]=\\mathbb\{E\}\_\{x\}\\bigl\[1\-\\max\_\{y\}\\mu^\{\\lambda\}\_\{x\}\(y\)\\bigr\],the minimizerh⋆​\(x\)∈arg⁡maxy⁡μxλ​\(y\)h^\{\\star\}\(x\)\\in\\arg\\max\_\{y\}\\mu^\{\\lambda\}\_\{x\}\(y\)being measurable \(𝒴\\mathcal\{Y\}finite,μxλ\\mu^\{\\lambda\}\_\{x\}measurable inxx\), and randomization not helping since1−μxλ​\(y\)≥1−maxy′⁡μxλ​\(y′\)1\-\\mu^\{\\lambda\}\_\{x\}\(y\)\\geq 1\-\\max\_\{y^\{\\prime\}\}\\mu^\{\\lambda\}\_\{x\}\(y^\{\\prime\}\)for everyyy\.

*Upper bound\.*Consider the data\-independent randomized classifier that, at eachxx, draws uniformly fromA¯τ​\(x\)\\bar\{A\}\_\{\\tau\}\(x\)\. This kernel is measurable because𝒴\\mathcal\{Y\}is finite andx↦A¯τ​\(x\)x\\mapsto\\bar\{A\}\_\{\\tau\}\(x\)is measurable\. Forfa∈𝒞f\_\{a\}\\in\\mathcal\{C\}, letNa:=\{x:fa​\(x\)∉Aτ​\(x\)\}N\_\{a\}:=\\\{x:f\_\{a\}\(x\)\\notin A\_\{\\tau\}\(x\)\\\}\. Sincefa∈ℱτ,ζ​\(fNL\)f\_\{a\}\\in\\mathcal\{F\}\_\{\\tau,\\zeta\}\(f\_\{\\mathrm\{NL\}\}\),P​\(Na\)<ζP\(N\_\{a\}\)<\\zeta\. OnNacN\_\{a\}^\{c\}the classifier errs with probability1−1/k​\(x\)1\-1/k\(x\), while onNaN\_\{a\}its error is at most one\. Consequently,

𝔼​\[dP​\(h^,fa\)\]\\displaystyle\\mathbb\{E\}\[d\_\{P\}\(\\hat\{h\},f\_\{a\}\)\]≤𝔼x​\[1−1k​\(x\)\]\+P​\(Na\)\\displaystyle\\leq\\mathbb\{E\}\_\{x\}\\\!\\left\[1\-\\frac\{1\}\{k\(x\)\}\\right\]\+P\(N\_\{a\}\)<Vτ⋆\+ζ\.\\displaystyle<V^\{\\star\}\_\{\\tau\}\+\\zeta\.Taking the supremum overaaand then the infimum over learners yieldsVblind​\(𝒞\)≤Vτ⋆\+ζV\_\{\\mathrm\{blind\}\}\(\\mathcal\{C\}\)\\leq V^\{\\star\}\_\{\\tau\}\+\\zeta\.

*Lower bound\.*Suppose that𝒞\\mathcal\{C\}isη\\eta\-uniformly covering, and fix the covering distributionλ⋆\\lambda^\{\\star\}from[Definition˜3\.8](https://arxiv.org/html/2607.08961#S3.Thmtheorem8)\. For every learnerh^\\hat\{h\}, a maximum dominates an average,supf∈𝒞𝔼​\[dP​\(h^,f\)\]≥𝔼f∼λ⋆​\[dP​\(h^,f\)\]\\sup\_\{f\\in\\mathcal\{C\}\}\\mathbb\{E\}\[d\_\{P\}\(\\hat\{h\},f\)\]\\geq\\mathbb\{E\}\_\{f\\sim\\lambda^\{\\star\}\}\[d\_\{P\}\(\\hat\{h\},f\)\], so takinginfh^\\inf\_\{\\hat\{h\}\}and using the display,

Vblind​\(𝒞\)\\displaystyle V\_\{\\mathrm\{blind\}\}\(\\mathcal\{C\}\)=infh^supf∈𝒞𝔼​\[dP​\(h^,f\)\]\\displaystyle=\\inf\_\{\\hat\{h\}\}\\sup\_\{f\\in\\mathcal\{C\}\}\\mathbb\{E\}\[d\_\{P\}\(\\hat\{h\},f\)\]≥infh^𝔼f∼λ⋆​\[dP​\(h^,f\)\]\\displaystyle\\geq\\inf\_\{\\hat\{h\}\}\\mathbb\{E\}\_\{f\\sim\\lambda^\{\\star\}\}\[d\_\{P\}\(\\hat\{h\},f\)\]=𝔼x​\[1−maxy⁡μxλ⋆​\(y\)\]\\displaystyle=\\mathbb\{E\}\_\{x\}\\bigl\[1\-\\max\_\{y\}\\mu^\{\\lambda^\{\\star\}\}\_\{x\}\(y\)\\bigr\]=Vτ⋆−𝔼x​\[maxy⁡μxλ⋆​\(y\)−1k​\(x\)\]≥Vτ⋆−η,\\displaystyle=V^\{\\star\}\_\{\\tau\}\-\\mathbb\{E\}\_\{x\}\\bigl\[\\max\_\{y\}\\mu^\{\\lambda^\{\\star\}\}\_\{x\}\(y\)\-\\tfrac\{1\}\{k\(x\)\}\\bigr\]\\;\\geq\\;V^\{\\star\}\_\{\\tau\}\-\\eta,usingVτ⋆=𝔼x​\[1−1/k​\(x\)\]V^\{\\star\}\_\{\\tau\}=\\mathbb\{E\}\_\{x\}\[1\-1/k\(x\)\]\([Theorem˜3\.5](https://arxiv.org/html/2607.08961#S3.Thmtheorem5)\) and theη\\eta\-coverage condition\. ∎

We now record the finite\-sample pairwise and finite\-family floor certificates deferred from[Section˜4\.2](https://arxiv.org/html/2607.08961#S4.SS2)\. Throughout, fixfa,fb∈ℱτ,ζ​\(fNL\)f\_\{a\},f\_\{b\}\\in\\mathcal\{F\}\_\{\\tau,\\zeta\}\(f\_\{\\mathrm\{NL\}\}\)with disagreement massDa​b=P​\(fa≠fb\)D\_\{ab\}=P\(f\_\{a\}\\neq f\_\{b\}\); foru∈\{a,b\}u\\in\\\{a,b\\\}letPuP\_\{u\}be the one\-example observation law induced by targetfuf\_\{u\}through the fixed\-description base channel; and, independently of the learner’s sample and of the choice of pair, drawz1,…,zN∼Pz\_\{1\},\\dots,z\_\{N\}\\sim Pand setD^a​b=1N​∑i=1N𝟏​\{fa​\(zi\)≠fb​\(zi\)\}\\widehat\{D\}\_\{ab\}=\\frac\{1\}\{N\}\\sum\_\{i=1\}^\{N\}\\mathbf\{1\}\\\{f\_\{a\}\(z\_\{i\}\)\\neq f\_\{b\}\(z\_\{i\}\)\\\}\.

###### Theorem B\.3\(Finite\-sample certificate for the blind\-channel floor\)\.

Fix an admissible pair\(a,b\)\(a,b\), chosen independently of the audit sample, and a confidence levelδ∈\(0,1\)\\delta\\in\(0,1\)\. Suppose the supervision channel is target\-blind on\{fa,fb\}\\\{f\_\{a\},f\_\{b\}\\\}, that is,Pa=PbP\_\{a\}=P\_\{b\}, so that the two observation laws coincide,Pa⊗m=Pb⊗mP\_\{a\}^\{\\otimes m\}=P\_\{b\}^\{\\otimes m\}, for everymm\.

1. \(a\)*\(Population certificate\.\)*For everymmand every measurable, possibly randomized learnerh^\\hat\{h\}receivingmmexamples, maxu∈\{a,b\}⁡𝔼S∼Pu⊗m​\[dP​\(h^​\(S\),fu\)\]≥Da​b2\.\\max\_\{u\\in\\\{a,b\\\}\}\\;\\mathbb\{E\}\_\{S\\sim P\_\{u\}^\{\\otimes m\}\}\\bigl\[d\_\{P\}\(\\hat\{h\}\(S\),f\_\{u\}\)\\bigr\]\\;\\geq\\;\\frac\{D\_\{ab\}\}\{2\}\.\(3\)The bound is independent ofmm: no amount of supervision through the blind channel can distinguishfaf\_\{a\}fromfbf\_\{b\}, and the worst of the two risks is at least half their disagreement mass\.
2. \(b\)*\(Empirical certificate\.\)*With the audit estimatorD^a​b\\widehat\{D\}\_\{ab\}above, with probability at least1−δ1\-\\deltaover the audit sample, Da​b≥DL,a​b:=\[D^a​b−log⁡\(2/δ\)2​N\]\+,somaxu∈\{a,b\}⁡𝔼​\[dP​\(h^​\(S\),fu\)\]≥DL,a​b2D\_\{ab\}\\;\\geq\\;D\_\{L,ab\}\\;:=\\;\\Bigl\[\\widehat\{D\}\_\{ab\}\-\\sqrt\{\\tfrac\{\\log\(2/\\delta\)\}\{2N\}\}\\Bigr\]\_\{\+\},\\qquad\\text\{so\}\\qquad\\max\_\{u\\in\\\{a,b\\\}\}\\;\\mathbb\{E\}\\bigl\[d\_\{P\}\(\\hat\{h\}\(S\),f\_\{u\}\)\\bigr\]\\;\\geq\\;\\frac\{D\_\{L,ab\}\}\{2\}for everymm\.

###### Proof\.

WriteRu:=𝔼S∼Pu⊗m​\[dP​\(h^​\(S\),fu\)\]R\_\{u\}:=\\mathbb\{E\}\_\{S\\sim P\_\{u\}^\{\\otimes m\}\}\[d\_\{P\}\(\\hat\{h\}\(S\),f\_\{u\}\)\]foru∈\{a,b\}u\\in\\\{a,b\\\}\.

*\(a\)*SincedP​\(f,g\)=P​\(f≠g\)d\_\{P\}\(f,g\)=P\(f\\neq g\)is a pseudometric on labelings, it obeys the triangle inequalitydP​\(h,fa\)\+dP​\(h,fb\)≥dP​\(fa,fb\)d\_\{P\}\(h,f\_\{a\}\)\+d\_\{P\}\(h,f\_\{b\}\)\\geq d\_\{P\}\(f\_\{a\},f\_\{b\}\)for everyhh; for randomizedh^\\hat\{h\}the inequality holds conditionally on its realized output and hence in expectation\. The hypothesisPa⊗m=Pb⊗mP\_\{a\}^\{\\otimes m\}=P\_\{b\}^\{\\otimes m\}lets both risks be written under the single lawPa⊗mP\_\{a\}^\{\\otimes m\}, so

Ra\+Rb=𝔼S∼Pa⊗m​\[dP​\(h^​\(S\),fa\)\+dP​\(h^​\(S\),fb\)\]≥dP​\(fa,fb\)=Da​b\.R\_\{a\}\+R\_\{b\}=\\mathbb\{E\}\_\{S\\sim P\_\{a\}^\{\\otimes m\}\}\\bigl\[d\_\{P\}\(\\hat\{h\}\(S\),f\_\{a\}\)\+d\_\{P\}\(\\hat\{h\}\(S\),f\_\{b\}\)\\bigr\]\\;\\geq\\;d\_\{P\}\(f\_\{a\},f\_\{b\}\)\\;=\\;D\_\{ab\}\.Thereforemax⁡\{Ra,Rb\}≥12​\(Ra\+Rb\)≥Da​b/2\\max\\\{R\_\{a\},R\_\{b\}\\\}\\geq\\tfrac\{1\}\{2\}\(R\_\{a\}\+R\_\{b\}\)\\geq D\_\{ab\}/2, which is[Equation˜3](https://arxiv.org/html/2607.08961#A2.E3)\. The argument uses no property ofmm, so the bound holds for everymm\.

*\(b\)*The audit indicators𝟏​\{fa​\(zi\)≠fb​\(zi\)\}\\mathbf\{1\}\\\{f\_\{a\}\(z\_\{i\}\)\\neq f\_\{b\}\(z\_\{i\}\)\\\}are i\.i\.d\. Bernoulli with meanDa​bD\_\{ab\}, so the one\-sided Hoeffding inequality givesℙ​\[D^a​b−Da​b≥t\]≤e−2​N​t2\\mathbb\{P\}\[\\widehat\{D\}\_\{ab\}\-D\_\{ab\}\\geq t\]\\leq e^\{\-2Nt^\{2\}\}\. Settingt=log⁡\(2/δ\)/\(2​N\)t=\\sqrt\{\\log\(2/\\delta\)/\(2N\)\}yieldsDa​b≥DL,a​bD\_\{ab\}\\geq D\_\{L,ab\}with probability at least1−δ1\-\\delta, and substituting this bound into part \(a\) certifies the floorDL,a​b/2D\_\{L,ab\}/2\. ∎

###### Corollary B\.4\(Blind finite\-family floor\)\.

Let\{f\(1\),…,f\(K\)\}⊆ℱτ,ζ​\(fNL\)\\\{f^\{\(1\)\},\\dots,f^\{\(K\)\}\\\}\\subseteq\\mathcal\{F\}\_\{\\tau,\\zeta\}\(f\_\{\\mathrm\{NL\}\}\),K≥2K\\geq 2, be a finite family of admissible labelings chosen independently of the audit sample, and let the supervision channel be target\-blind on this family, so that the observation laws satisfyPa=PbP\_\{a\}=P\_\{b\}for every pair\. For each paira<ba<bsetD^a​b=1N​∑i=1N𝟏​\{f\(a\)​\(zi\)≠f\(b\)​\(zi\)\}\\widehat\{D\}\_\{ab\}=\\frac\{1\}\{N\}\\sum\_\{i=1\}^\{N\}\\mathbf\{1\}\\\{f^\{\(a\)\}\(z\_\{i\}\)\\neq f^\{\(b\)\}\(z\_\{i\}\)\\\}on theNNi\.i\.d\. held\-out audit inputsz1,…,zNz\_\{1\},\\dots,z\_\{N\}, and define the per\-pair floor

DL,a​b:=\[D^a​b−log⁡\(2​\(K2\)/δ\)2​N\]\+\.D\_\{L,ab\}:=\\Bigl\[\\widehat\{D\}\_\{ab\}\-\\sqrt\{\\tfrac\{\\log\(2\\binom\{K\}\{2\}/\\delta\)\}\{2N\}\}\\Bigr\]\_\{\+\}\.Then, with probability at least1−δ1\-\\deltaover the audit sample and for every sample sizemm,

infh^max1≤k≤K⁡𝔼S∼Pk⊗m​\[dP​\(h^​\(S\),f\(k\)\)\]≥max1≤a<b≤K⁡DL,a​b2,\\inf\_\{\\hat\{h\}\}\\;\\max\_\{1\\leq k\\leq K\}\\;\\mathbb\{E\}\_\{S\\sim P\_\{k\}^\{\\otimes m\}\}\\bigl\[d\_\{P\}\(\\hat\{h\}\(S\),f^\{\(k\)\}\)\\bigr\]\\;\\geq\\;\\max\_\{1\\leq a<b\\leq K\}\\;\\frac\{D\_\{L,ab\}\}\{2\},where the infimum is over all measurable, possibly randomized learners\.

###### Proof\.

Fix a paira<ba<b\. The audit indicators𝟏​\{f\(a\)​\(zi\)≠f\(b\)​\(zi\)\}\\mathbf\{1\}\\\{f^\{\(a\)\}\(z\_\{i\}\)\\neq f^\{\(b\)\}\(z\_\{i\}\)\\\}are i\.i\.d\. Bernoulli with meanDa​bD\_\{ab\}, so the one\-sided Hoeffding inequality with radiuslog⁡\(2​\(K2\)/δ\)/\(2​N\)\\sqrt\{\\log\(2\\binom\{K\}\{2\}/\\delta\)/\(2N\)\}givesDa​b<DL,a​bD\_\{ab\}<D\_\{L,ab\}with probability at mostδ/\(K2\)\\delta/\\binom\{K\}\{2\}\. A union bound over the\(K2\)\\binom\{K\}\{2\}pairs then makes the event

ℰ:=\{Da​b≥DL,a​b​for all​a<b\}\\mathcal\{E\}:=\\bigl\\\{\\,D\_\{ab\}\\geq D\_\{L,ab\}\\ \\text\{for all \}a<b\\,\\bigr\\\}hold with probability at least1−δ1\-\\delta\.

Work onℰ\\mathcal\{E\}, and fix any learnerh^\\hat\{h\}, anymm, and any paira<ba<b\. Since\{f\(a\),f\(b\)\}\\\{f^\{\(a\)\},f^\{\(b\)\}\\\}is a subset of the family, retaining only these two targets can only decrease the maximum,

max1≤k≤K⁡𝔼​\[dP​\(h^​\(S\),f\(k\)\)\]≥max⁡\{Ra,Rb\}\.\\max\_\{1\\leq k\\leq K\}\\mathbb\{E\}\\bigl\[d\_\{P\}\(\\hat\{h\}\(S\),f^\{\(k\)\}\)\\bigr\]\\;\\geq\\;\\max\\\{R\_\{a\},R\_\{b\}\\\}\.Target\-blindness on\{f\(a\),f\(b\)\}\\\{f^\{\(a\)\},f^\{\(b\)\}\\\}givesmax⁡\{Ra,Rb\}≥Da​b/2\\max\\\{R\_\{a\},R\_\{b\}\\\}\\geq D\_\{ab\}/2by the two\-point argument of[Theorem˜B\.3](https://arxiv.org/html/2607.08961#A2.Thmtheorem3)\(a\), andDa​b≥DL,a​bD\_\{ab\}\\geq D\_\{L,ab\}onℰ\\mathcal\{E\}, so the left side is at leastDL,a​b/2D\_\{L,ab\}/2\. The bound holds for everyh^\\hat\{h\}and everymm; taking the infimum overh^\\hat\{h\}and the maximum over pairs yields the claim\. ∎

### B\.3Proofs for the plug\-in overlap statistic

We first record why the threshold margin cannot be removed, then prove[Corollary˜4\.5](https://arxiv.org/html/2607.08961#S4.Thmtheorem5)\.

###### Proof of[Corollary˜4\.5](https://arxiv.org/html/2607.08961#S4.Thmtheorem5)\.

Fixξ\>0\\xi\>0\. Call an inputxx*ξ\\xi\-safe*if every label satisfies\|πLLMθ\(y∣fNL,x\)−τ\|\>ξ\|\\pi\_\{\\mathrm\{LLM\}\_\{\\theta\}\}\(y\\mid f\_\{\\mathrm\{NL\}\},x\)\-\\tau\|\>\\xi; by definition the unsafe inputs carry massκ​\(ξ\)\\kappa\(\\xi\)\.

*Step 1 \(per\-input decision error\)\.*At aξ\\xi\-safe input, each empirical frequencyπ^i​\(y\)\\widehat\{\\pi\}\_\{i\}\(y\)concentrates aroundπLLMθ​\(y∣fNL,x\)\\pi\_\{\\mathrm\{LLM\}\_\{\\theta\}\}\(y\\mid f\_\{\\mathrm\{NL\}\},x\), so a two\-sided Hoeffding bound over therrdecoding draws, taken in union across theC=\|𝒴\|C=\|\\mathcal\{Y\}\|labels, givesℙ​\[A^τ​\(x\)≠Aτ​\(x\)\]≤2​C​e−2​r​ξ2\\mathbb\{P\}\[\\widehat\{A\}\_\{\\tau\}\(x\)\\neq A\_\{\\tau\}\(x\)\]\\leq 2Ce^\{\-2r\\xi^\{2\}\}; on the complementary event the plug\-in overlap indicator agrees with the population one\. For the joint draw ofz∼Pz\\sim Pand its decoding samples, the indicators therefore disagree only on the unsafe mass or through this depth error,

ℙ​\[𝟏​\{\|A^τ​\(z\)\|≥2\}≠𝟏​\{\|Aτ​\(z\)\|≥2\}\]≤κ​\(ξ\)\+2​C​e−2​r​ξ2,\\mathbb\{P\}\\bigl\[\\mathbf\{1\}\\\{\|\\widehat\{A\}\_\{\\tau\}\(z\)\|\\geq 2\\\}\\neq\\mathbf\{1\}\\\{\|A\_\{\\tau\}\(z\)\|\\geq 2\\\}\\bigr\]\\;\\leq\\;\\kappa\(\\xi\)\+2Ce^\{\-2r\\xi^\{2\}\},so their means satisfy\|𝔼​\[D^plug⋆\]−Dτ⋆\|≤κ​\(ξ\)\+2​C​e−2​r​ξ2\|\\mathbb\{E\}\[\\widehat\{D\}^\{\\star\}\_\{\\mathrm\{plug\}\}\]\-D^\{\\star\}\_\{\\tau\}\|\\leq\\kappa\(\\xi\)\+2Ce^\{\-2r\\xi^\{2\}\}\.

*Step 2 \(aggregation\)\.*TheNNplug\-in indicators are i\.i\.d\.\{0,1\}\\\{0,1\\\}\-valued, each a function of the independent pair \(input, decoding draws\), so a two\-sided Hoeffding bound gives\|D^plug⋆−𝔼​\[D^plug⋆\]\|≤log⁡\(2/δ\)/2​N\|\\widehat\{D\}^\{\\star\}\_\{\\mathrm\{plug\}\}\-\\mathbb\{E\}\[\\widehat\{D\}^\{\\star\}\_\{\\mathrm\{plug\}\}\]\|\\leq\\sqrt\{\\log\(2/\\delta\)/2N\}with probability at least1−δ1\-\\delta\. Combining the two steps by the triangle inequality yields the stated deviation bound\|D^plug⋆−Dτ⋆\|≤εN,r​\(ξ\)\|\\widehat\{D\}^\{\\star\}\_\{\\mathrm\{plug\}\}\-D^\{\\star\}\_\{\\tau\}\|\\leq\\varepsilon\_\{N,r\}\(\\xi\), and transporting it todiamτ,ζ\\mathrm\{diam\}\_\{\\tau,\\zeta\}through[Theorem˜2\.11](https://arxiv.org/html/2607.08961#S2.Thmtheorem11)adds only the deterministic2​ζ2\\zetaat the upper end, giving the confidence band\.

*Step 3 \(depth prescription\)\.*Whenκ​\(ξ\)\>0\\kappa\(\\xi\)\>0, takingr≥ln⁡\(2​C/κ​\(ξ\)\)/\(2​ξ2\)r\\geq\\ln\(2C/\\kappa\(\\xi\)\)/\(2\\xi^\{2\}\)forces2​C​e−2​r​ξ2≤κ​\(ξ\)2Ce^\{\-2r\\xi^\{2\}\}\\leq\\kappa\(\\xi\), so the band inflates over the observed\-AτA\_\{\\tau\}band of[Proposition˜4\.1](https://arxiv.org/html/2607.08961#S4.Thmtheorem1)by at most2​κ​\(ξ\)2\\kappa\(\\xi\); whenκ​\(ξ\)=0\\kappa\(\\xi\)=0, takingr≥ln⁡\(2​C/b\)/\(2​ξ2\)r\\geq\\ln\(2C/b\)/\(2\\xi^\{2\}\)makes the depth term at most any fixed budgetb\>0b\>0\. ∎

### B\.4Proofs for the end\-to\-end audit

###### Proof of[Theorem˜4\.6](https://arxiv.org/html/2607.08961#S4.Thmtheorem6)\.

Two\-sided Hoeffding on the i\.i\.d\. indicators𝟏​\{\|Aτ​\(zi\)\|≥2\}\\mathbf\{1\}\\\{\|A\_\{\\tau\}\(z\_\{i\}\)\|\\geq 2\\\}gives\|D^⋆−Dτ⋆\|≤εN\|\\widehat\{D\}^\{\\star\}\-D^\{\\star\}\_\{\\tau\}\|\\leq\\varepsilon\_\{N\}with probability at least1−δ1\-\\delta\. We argue on this event\.

*\(a\)*The maximal\-spread pair\(fτ\+,fτ−\)\(f\_\{\\tau\}^\{\+\},f\_\{\\tau\}^\{\-\}\)consists of almost\-everywhere admissible selections, so both members lie inℱτ,ζ​\(fNL\)\\mathcal\{F\}\_\{\\tau,\\zeta\}\(f\_\{\\mathrm\{NL\}\}\)\([Theorem˜2\.11](https://arxiv.org/html/2607.08961#S2.Thmtheorem11)\)\. As a deterministic functional of\(πLLMθ,τ,≺\)\(\\pi\_\{\\mathrm\{LLM\}\_\{\\theta\}\},\\tau,\\prec\), the pair is fixed independently of the audit inputs, so no sample splitting is required and the full budgetδ\\deltafunds the single estimateD^⋆\\widehat\{D\}^\{\\star\}; this is theK=2K=2case of[Theorem˜B\.3](https://arxiv.org/html/2607.08961#A2.Thmtheorem3)\. Since\{fτ\+​\(z\)≠fτ−​\(z\)\}=\{\|Aτ​\(z\)\|≥2\}\\\{f\_\{\\tau\}^\{\+\}\(z\)\\neq f\_\{\\tau\}^\{\-\}\(z\)\\\}=\\\{\|A\_\{\\tau\}\(z\)\|\\geq 2\\\}, the pair’s disagreement mass isD\+−=Dτ⋆≥D^⋆−εND\_\{\+\-\}=D^\{\\star\}\_\{\\tau\}\\geq\\widehat\{D\}^\{\\star\}\-\\varepsilon\_\{N\}\. Target\-blindness \([Proposition˜2\.4](https://arxiv.org/html/2607.08961#S2.Thmtheorem4)\) makes the two observation laws coincide, so by the two\-point floor of[Theorem˜3\.2](https://arxiv.org/html/2607.08961#S3.Thmtheorem2)\(b\) the worst\-case risk is at leastD\+−/2≥12​\(D^⋆−εN\)D\_\{\+\-\}/2\\geq\\tfrac\{1\}\{2\}\(\\widehat\{D\}^\{\\star\}\-\\varepsilon\_\{N\}\), uniformly inmm; since risk is nonnegative, it is therefore at least the positive part12​\(D^⋆−εN\)\+\\tfrac\{1\}\{2\}\(\\widehat\{D\}^\{\\star\}\-\\varepsilon\_\{N\}\)\_\{\+\}reported by the theorem\.

*\(b\)*The representation bracket \([Theorem˜2\.11](https://arxiv.org/html/2607.08961#S2.Thmtheorem11)\) givesDτ⋆≥diamτ,ζ−2​ζD^\{\\star\}\_\{\\tau\}\\geq\\mathrm\{diam\}\_\{\\tau,\\zeta\}\-2\\zeta\. Since the reported floor12​\(D^⋆−εN\)\+\\tfrac\{1\}\{2\}\(\\widehat\{D\}^\{\\star\}\-\\varepsilon\_\{N\}\)\_\{\+\}is at least the untruncated quantity12​\(D^⋆−εN\)\\tfrac\{1\}\{2\}\(\\widehat\{D\}^\{\\star\}\-\\varepsilon\_\{N\}\), it suffices to bound the latter:

12​\(D^⋆−εN\)≥12​Dτ⋆−εN≥12​\(diamτ,ζ−2​ζ\)−εN\.\\tfrac\{1\}\{2\}\(\\widehat\{D\}^\{\\star\}\-\\varepsilon\_\{N\}\)\\;\\geq\\;\\tfrac\{1\}\{2\}D^\{\\star\}\_\{\\tau\}\-\\varepsilon\_\{N\}\\;\\geq\\;\\tfrac\{1\}\{2\}\(\\mathrm\{diam\}\_\{\\tau,\\zeta\}\-2\\zeta\)\-\\varepsilon\_\{N\}\.In the other direction, any pairf1,f2∈ℱτ,ζ​\(fNL\)f\_\{1\},f\_\{2\}\\in\\mathcal\{F\}\_\{\\tau,\\zeta\}\(f\_\{\\mathrm\{NL\}\}\)has floor12​dP​\(f1,f2\)≤12​diamτ,ζ≤12​Dτ⋆\+ζ\\tfrac\{1\}\{2\}d\_\{P\}\(f\_\{1\},f\_\{2\}\)\\leq\\tfrac\{1\}\{2\}\\mathrm\{diam\}\_\{\\tau,\\zeta\}\\leq\\tfrac\{1\}\{2\}D^\{\\star\}\_\{\\tau\}\+\\zeta, which exceeds the reported floor by at mostζ\+εN\\zeta\+\\varepsilon\_\{N\}\. This is the diameter\-bracket consequence of part \(b\); it bounds every admissible pair’s floor at once and involves no data\-dependent search over pairs\. ∎

###### Corollary B\.6\(Two\-sided certified interval for the blind\-channel value\)\.

LetℱK⊆ℱτ,ζ​\(fNL\)\\mathcal\{F\}\_\{K\}\\subseteq\\mathcal\{F\}\_\{\\tau,\\zeta\}\(f\_\{\\mathrm\{NL\}\}\)be a finite admissible family containing the maximal\-spread pair, with blind\-channel minimax riskVblind​\(ℱK\)V\_\{\\mathrm\{blind\}\}\(\\mathcal\{F\}\_\{K\}\)\. ThenVblind​\(ℱK\)V\_\{\\mathrm\{blind\}\}\(\\mathcal\{F\}\_\{K\}\)is independent ofmmand

12​Dτ⋆≤Vblind​\(ℱK\)≤Dτ⋆\+2​ζ;\\tfrac\{1\}\{2\}D^\{\\star\}\_\{\\tau\}\\;\\leq\\;V\_\{\\mathrm\{blind\}\}\(\\mathcal\{F\}\_\{K\}\)\\;\\leq\\;D^\{\\star\}\_\{\\tau\}\+2\\zeta;consequently, with probability at least1−δ1\-\\delta,

12​\(D^⋆−εN\)\+≤Vblind​\(ℱK\)≤D^⋆\+εN\+2​ζ\.\\tfrac\{1\}\{2\}\\bigl\(\\widehat\{D\}^\{\\star\}\-\\varepsilon\_\{N\}\\bigr\)\_\{\+\}\\;\\leq\\;V\_\{\\mathrm\{blind\}\}\(\\mathcal\{F\}\_\{K\}\)\\;\\leq\\;\\widehat\{D\}^\{\\star\}\+\\varepsilon\_\{N\}\+2\\zeta\.

###### Proof\.

WriteD:=diamP​\(ℱK\)D:=\\mathrm\{diam\}\_\{P\}\(\\mathcal\{F\}\_\{K\}\)\. Target\-blindness makes the observation law the same for every target inℱK\\mathcal\{F\}\_\{K\}, soVblind​\(ℱK\)V\_\{\\mathrm\{blind\}\}\(\\mathcal\{F\}\_\{K\}\)is independent ofmm; the two\-point floor givesVblind​\(ℱK\)≥12​DV\_\{\\mathrm\{blind\}\}\(\\mathcal\{F\}\_\{K\}\)\\geq\\tfrac\{1\}\{2\}D, while the data\-free learner returningfτ\+f\_\{\\tau\}^\{\+\}has risk at mostDD\. Hence12​D≤Vblind​\(ℱK\)≤D\\tfrac\{1\}\{2\}D\\leq V\_\{\\mathrm\{blind\}\}\(\\mathcal\{F\}\_\{K\}\)\\leq D\. The maximal\-spread pair lies inℱK\\mathcal\{F\}\_\{K\}, soD≥dP​\(fτ\+,fτ−\)=Dτ⋆D\\geq d\_\{P\}\(f\_\{\\tau\}^\{\+\},f\_\{\\tau\}^\{\-\}\)=D^\{\\star\}\_\{\\tau\}, and the representation bracket givesD≤Dτ⋆\+2​ζD\\leq D^\{\\star\}\_\{\\tau\}\+2\\zeta; combining with the previous display yields the population interval12​Dτ⋆≤Vblind​\(ℱK\)≤Dτ⋆\+2​ζ\\tfrac\{1\}\{2\}D^\{\\star\}\_\{\\tau\}\\leq V\_\{\\mathrm\{blind\}\}\(\\mathcal\{F\}\_\{K\}\)\\leq D^\{\\star\}\_\{\\tau\}\+2\\zeta\. The empirical interval follows by substituting\|Dτ⋆−D^⋆\|≤εN\|D^\{\\star\}\_\{\\tau\}\-\\widehat\{D\}^\{\\star\}\|\\leq\\varepsilon\_\{N\}, which holds with probability at least1−δ1\-\\delta\. ∎

###### Proof of[Proposition˜4\.10](https://arxiv.org/html/2607.08961#S4.Thmtheorem10)\.

At each input the plug\-in and population admissible sets differ with probability at mostqr​\(ξ\)q\_\{r\}\(\\xi\), by the argument proving[Corollary˜4\.5](https://arxiv.org/html/2607.08961#S4.Thmtheorem5)\. Bothϕ​\(A\)=1−1/\|A\|\\phi\(A\)=1\-1/\|A\|\(withϕ​\(∅\)=0\\phi\(\\varnothing\)=0\), of range\[0,1−1C\]\[0,1\-\\tfrac\{1\}\{C\}\], and𝟏​\{\|A\|≥2\}\\mathbf\{1\}\\\{\|A\|\\geq 2\\\}, of range\[0,1\]\[0,1\], change only when the set changes, so the plug\-in means are biased by

\|𝔼​ϕ​\(A^τ​\(Z\)\)−Vτ⋆\|≤\(1−1C\)​qr​\(ξ\),\|𝔼​𝟏​\{\|A^τ​\(Z\)\|≥2\}−Dτ⋆\|≤qr​\(ξ\)\.\\bigl\|\\mathbb\{E\}\\phi\(\\widehat\{A\}\_\{\\tau\}\(Z\)\)\-V^\{\\star\}\_\{\\tau\}\\bigr\|\\leq\(1\-\\tfrac\{1\}\{C\}\)q\_\{r\}\(\\xi\),\\qquad\\bigl\|\\mathbb\{E\}\\mathbf\{1\}\\\{\|\\widehat\{A\}\_\{\\tau\}\(Z\)\|\\geq 2\\\}\-D^\{\\star\}\_\{\\tau\}\\bigr\|\\leq q\_\{r\}\(\\xi\)\.The per\-input decoding experiments are independent, so the plug\-in summands are i\.i\.d\.; one\-sided Hoeffding bounds at levelδ/2\\delta/2each, combined with these biases, give

Vτ⋆≥V^plug⋆−\(1−1C\)​\(εN\+qr​\(ξ\)\),Dτ⋆≥D^plug⋆−εN−qr​\(ξ\),V^\{\\star\}\_\{\\tau\}\\geq\\widehat\{V\}^\{\\star\}\_\{\\mathrm\{plug\}\}\-\(1\-\\tfrac\{1\}\{C\}\)\(\\varepsilon\_\{N\}\+q\_\{r\}\(\\xi\)\),\\qquad D^\{\\star\}\_\{\\tau\}\\geq\\widehat\{D\}^\{\\star\}\_\{\\mathrm\{plug\}\}\-\\varepsilon\_\{N\}\-q\_\{r\}\(\\xi\),simultaneously with probability at least1−δ1\-\\deltaby a union bound\. On this eventVτ⋆≥12​Dτ⋆V^\{\\star\}\_\{\\tau\}\\geq\\tfrac\{1\}\{2\}D^\{\\star\}\_\{\\tau\}\([Corollary˜4\.8](https://arxiv.org/html/2607.08961#S4.Thmtheorem8)\) dominates the second branch and the first display the first, soVτ⋆≥CjointplugV^\{\\star\}\_\{\\tau\}\\geq C^\{\\mathrm\{plug\}\}\_\{\\mathrm\{joint\}\}after taking positive parts and the maximum; the same corollary transfers the bound toRm​\(ℱτ,ζ\)R\_\{m\}\(\\mathcal\{F\}\_\{\\tau,\\zeta\}\)\. ∎

## Appendix CAdditional Experimental Diagnostics

This appendix collects diagnostics that support interpretation and reproducibility but do not enter the certified floors reported in[Section˜5](https://arxiv.org/html/2607.08961#S5): the controlled pipeline check, a threshold\-sensitivity example, the model\-free ChaosNLI check and its complete table, the sampled\-decoding audit design and cost–precision trade\-off, the margin\-mass estimation procedure, the per\-configuration Qwen results, the exposed\-probability threshold sweep, the coherent\-reading bridge audit design and results, and the exposed\-probability channel definition and audit metadata\.

### C\.1Controlled pipeline check

This probe checks the certificate arithmetic on constructed cases; it does not validate the model\-induced admissibility construct\. On6,0006\{,\}000binary inputs we fix two pairs of known disagreement: a divisibility control whose two readings never disagree \(D=0D=0\), and a pedagogy pair with two coherent readings \(immediate performance versus long\-term retention\) disagreeing byD=0\.4D=0\.4\. On the fixed\-description target\-blind channel the observed law is independent of the operative reading \([Proposition˜2\.4](https://arxiv.org/html/2607.08961#S2.Thmtheorem4)\), so the certified floor isDL/2D\_\{L\}/2\([Theorem˜B\.3](https://arxiv.org/html/2607.08961#A2.Thmtheorem3);N=400N=400,δ=0\.10\\delta=0\.10\)\.[Table˜3](https://arxiv.org/html/2607.08961#A3.T3)recovers the prescribed outcome: a zero certificate for the control and a conservative positive floor of0\.1660\.166for the pedagogy pair, valid at every learner sample sizemm\. A threshold sweep on a related controlled construction follows in[Section˜C\.2](https://arxiv.org/html/2607.08961#A3.SS2)\.

Table 3:Controlled arithmetic and pipeline check of the finite\-sample blind\-channel floor certificate \(τ=0\.20\\tau=0\.20,δ=0\.10\\delta=0\.10\)\.DpopD\_\{\\mathrm\{pop\}\}is the known population disagreement fixed by construction, not an empirical estimate;DLD\_\{L\}is the audited finite\-sample lower bound\.
### C\.2Threshold sensitivity

Because the overlap massDτ⋆=ℙx​\[\|Aτ​\(x\)\|≥2\]D^\{\\star\}\_\{\\tau\}=\\mathbb\{P\}\_\{x\}\[\|A\_\{\\tau\}\(x\)\|\\geq 2\]is a threshold functional of the decoding law, the certified floor depends on the admissibility thresholdτ\\tau, and the two should be reported together\. On a controlled population in which a0\.400\.40fraction of inputs are two\-way ambiguous by construction \(decoding law\(0\.45,0\.45,0\.10\)\(0\.45,0\.45,0\.10\)\) and the rest near\-confident\(0\.85,0\.10,0\.05\)\(0\.85,0\.10,0\.05\), sweepingτ\\tauatN=4000N=4000,δ=0\.10\\delta=0\.10yields a stable plateau: the certified floor is0\.490\.49forτ≤0\.10\\tau\\leq 0\.10\(where even the near\-confident second label clears the threshold and the count over\-reads\), holds at0\.190\.19acrossτ∈\[0\.12,0\.44\]\\tau\\in\[0\.12,0\.44\]\(where it tracks exactly the constructed ambiguous mass of0\.400\.40\), and falls to0forτ≥0\.50\\tau\\geq 0\.50\(where no second label clears\)\. The body’s choiceτ=0\.20\\tau=0\.20lies in this plateau\. The construction illustrates the threshold dependence established in the body; it does not imply that empirical decoding laws generally exhibit a comparable plateau\.

### C\.3Model\-free arithmetic check on ChaosNLI

As a check against ambiguity documented independently of any model, we use ChaosNLI\(Nie et al\.,[2020](https://arxiv.org/html/2607.08961#bib.bib45)\), which re\-annotates SNLI and MNLI with≈100\{\\approx\}100human labels per item, designed to characterize persistent human disagreement\(Pavlick and Kwiatkowski,[2019](https://arxiv.org/html/2607.08961#bib.bib48); Plank,[2022](https://arxiv.org/html/2607.08961#bib.bib49)\)\. We form a human\-label analogueqhuman\(⋅∣x\)q\_\{\\mathrm\{human\}\}\(\\cdot\\mid x\)from each item’s empirical label distribution and apply the exact\-value functional to it in place ofπLLMθ\\pi\_\{\\mathrm\{LLM\}\_\{\\theta\}\}; this exercises the certificate arithmetic on documented human disagreement rather than a model\-induced estimand\. Underqhumanq\_\{\\mathrm\{human\}\}the overlap statistic and human entropy agree in ordering: MNLI is more ambiguous than SNLI\. The three\-label distributions also exercise thek≥3k\\geq 3branch of the exact\-value certificate, absent in binary problems; atδ=0\.10\\delta=0\.10it raises the certified floor by0\.0050\.005on MNLI and leaves it unchanged on SNLI\. This model\-free analogue is conditional on the published label distributions; it neither validates the model\-relative admissibility construct nor constitutes a deployment study\.

### C\.4ChaosNLI multiclass check: full table

[Table˜4](https://arxiv.org/html/2607.08961#A3.T4)gives the complete multiclass calculation, computed from the public≈100\{\\approx\}100\-annotation ChaosNLI label distributions\(Nie et al\.,[2020](https://arxiv.org/html/2607.08961#bib.bib45)\)at the prespecifiedτ=0\.20\\tau=0\.20,δ=0\.10\\delta=0\.10\. Three labels are admissible on1\.3%1\.3\\%of SNLI items and5\.9%5\.9\\%of MNLI\-matched items, yieldingVτ⋆=0\.263V^\{\\star\}\_\{\\tau\}=0\.263and0\.3860\.386, respectively\. The corresponding half\-overlap values are0\.2610\.261and0\.3760\.376\. At confidence1−δ=0\.901\-\\delta=0\.90, the exact\-value branch certifies0\.2420\.242on SNLI and0\.3660\.366on MNLI, while the half\-overlap branch certifies0\.2450\.245and0\.3610\.361\. Sampling uncertainty therefore favors the half\-overlap branch on SNLI, whereas the greater three\-way admissibility on MNLI makes the exact\-value certificate larger by0\.0050\.005\.

Table 4:ChaosNLI multiclass check atτ=0\.20\\tau=0\.20andδ=0\.10\\delta=0\.10, computed from the public≈100\{\\approx\}100\-annotation label distributions \(no model\)\.Chalf=12​\(D^⋆−εN\)\+C\_\{\\rm half\}=\\tfrac\{1\}\{2\}\(\\widehat\{D\}^\{\\star\}\-\\varepsilon\_\{N\}\)\_\{\+\}andCV=\(V^⋆−23​εN\)\+C\_\{V\}=\(\\widehat\{V\}^\{\\star\}\-\\tfrac\{2\}\{3\}\\varepsilon\_\{N\}\)\_\{\+\}are the two branches of[Proposition˜4\.9](https://arxiv.org/html/2607.08961#S4.Thmtheorem9)\. MNLI has enough three\-way admissibility for the exact\-value branch to improve the certified floor; SNLI does not\. The comparison is conditional on the published human label distributions and is not a model calibration study\.
### C\.5Sampled\-decoding audit: design and cost

This appendix gives the full design of the sampled\-decoding depth\-barrier diagnostic summarized in[Section˜5](https://arxiv.org/html/2607.08961#S5.SS0.SSS0.Px3)\. The audit fixes Qwen 2\.5–3B, two prompt paraphrases,τ=0\.2\\tau=0\.2, andδ=0\.1\\delta=0\.1\. Each paraphrase is evaluated under three decoding seeds, giving66configurations per task\. In each, the model receives the description and input but neither candidate reading; we drawr=3r=3labels at each ofN=100N=100audit inputs and set

A^τ​\(x\)=\{y:π^​\(y∣fNL,x\)≥τ\}\.\\widehat\{A\}\_\{\\tau\}\(x\)=\\\{y:\\widehat\{\\pi\}\(y\\mid f\_\{\\mathrm\{NL\}\},x\)\\geq\\tau\\\}\.The model’s sampled decoding law thus determines admissibility: the experiment scores no researcher\-supplied label set\.

*Task\.*The candidate\-positive task is borderline content moderation under two prespecified coherent readings \(a narrow one limited to explicit threats, slurs, or targeted abuse, and a broader one covering likely escalation of personal harm\), and the control is the exact rule “LONG iff length exceeds 10\.”

*Sampling design\.*TheN\+Nκ=100\+100N\+N\_\{\\kappa\}=100\+100moderation inputs are programmatically constructed borderline scenarios\. The split was fixed independently of model outputs and subsequent analysis choices: a recorded design seed partitions the declared finite input population into disjoint audit and margin subsets before any model call\. Because the inputs are drawn without replacement from this finite population, the Hoeffding radius stays valid, and is indeed conservative\(Hoeffding,[1963](https://arxiv.org/html/2607.08961#bib.bib24); Bardenet and Maillard,[2015](https://arxiv.org/html/2607.08961#bib.bib5), §6\), and every estimand is read as a finite\-population mean over the synthetic, deliberately borderline distribution, whose overlap mass plausibly exceeds that of natural moderation traffic\. Exact per\-label Clopper–Pearson intervals on therrdecodings at each of the disjointNκN\_\{\\kappa\}margin inputs give the margin boundκU=1\.0\\kappa\_\{U\}=1\.0, constructed in[Section˜C\.6](https://arxiv.org/html/2607.08961#A3.SS6)\.

*Confidence allocation\.*Following[Remark˜4\.7](https://arxiv.org/html/2607.08961#S4.Thmtheorem7), the confidence budgetδ=0\.1\\delta=0\.1splits asδ1=δ2=δ/2\\delta\_\{1\}=\\delta\_\{2\}=\\delta/2between the margin\-mass bound and the overlap estimate, and the reported certificate is valid at their unionδ\\delta\.

Table 5:Model\-relative sampled\-decoding audit of qwen2\.5:3b \(N=100N=100audit andNκ=100N\_\{\\kappa\}=100disjoint margin inputs,r=3r=3,τ=0\.2\\tau=0\.2,ξ=0\.05\\xi=0\.05,δ=0\.1\\delta=0\.1\), one matched prompt–seed configuration \(paraphrase P1, seed0\); all twelve per\-configuration cells are in[Table˜6](https://arxiv.org/html/2607.08961#A3.T6)\. The certified floor is zero in every configuration because the finite\-depth term is capped at11atr=3r=3\.The certified floor is zero in every configuration \([Table˜5](https://arxiv.org/html/2607.08961#A3.T5)\) because atr=3r=3the finite\-depth term2​C​e−2​r​ξ22Ce^\{\-2r\\xi^\{2\}\}of the radius in[Corollary˜4\.5](https://arxiv.org/html/2607.08961#S4.Thmtheorem5)caps at11; these zeros are the vacuous\-correction case of[Remark˜4\.7](https://arxiv.org/html/2607.08961#S4.Thmtheorem7), not evidence that the task or judge is benign\. A positive floor atξ=0\.05\\xi=0\.05requiresr≥ln⁡\(2​C/b\)/\(2​ξ2\)r\\geq\\ln\(2C/b\)/\(2\\xi^\{2\}\)decodings for depth budgetbb, aboutr≈877r\\approx 877atb=0\.05b=0\.05, and the margin estimator is depth\-limited in the same way\. The audit does yield observed plug\-in overlap values:D^⋆\\widehat\{D\}^\{\\star\}clearsεN=0\.1358\\varepsilon\_\{N\}=0\.1358in22of the66moderation configurations, while no control configuration does; the positive cells appear in[Table˜6](https://arxiv.org/html/2607.08961#A3.T6)\. These are prompt\-sensitive point estimates, not certificates; the per\-configuration cells, the constant\-output check, and the paraphrase\-collapse pattern appear in[Section˜C\.7](https://arxiv.org/html/2607.08961#A3.SS7)\.

AtN=100N=100the sampling slackεN=0\.1358\\varepsilon\_\{N\}=0\.1358prevents the audit from resolving overlap masses below roughly one eighth of the deployment distribution, regardless of decoding depth: under the confidence split \([Remark˜4\.7](https://arxiv.org/html/2607.08961#S4.Thmtheorem7)\), slackε\\varepsilonrequiresN≥log⁡\(4/δ\)/\(2​ε2\)N\\geq\\log\(4/\\delta\)/\(2\\varepsilon^\{2\}\), soε=0\.05\\varepsilon=0\.05needs about738738inputs\.[Figure˜2](https://arxiv.org/html/2607.08961#A3.F2)summarizes the resulting cost–precision trade\-off: for each total call budgetQQit plots the smallest certificate radius achievable by any breadth–depth split, alongside the exposed\-probability radius, which needs one call per input\. The shallow audit has a capped, hence vacuous, radius atQ=300Q=300, whereas the exposed\-probability audit reaches radius0\.12240\.1224withQ=100Q=100calls; matching it by sampled decoding atξ=0\.05\\xi=0\.05takes roughly three orders of magnitude more calls\. Exposed admissible\-label probabilities remove both plug\-in corrections \([Proposition˜4\.1](https://arxiv.org/html/2607.08961#S4.Thmtheorem1)\), giving the more call\-efficient access mode for open\-weight judges with logits\-exposing backends\.

10210^\{2\}10310^\{3\}10410^\{4\}10510^\{5\}10610^\{6\}10710^\{7\}10−310^\{\-3\}10−210^\{\-2\}10−110^\{\-1\}10010^\{0\}Total model callsQQCertificate radius \(smaller certifies more\)Sampled decoding,ξ=0\.05\\xi=0\.05\(bestN⋅rN\{\\cdot\}rsplit\)Sampled decoding,ξ=0\.15\\xi=0\.15\(margin term omitted\)Exposed probabilitiesShallow audit \(N=100N\{=\}100,r=3r\{=\}3; vacuous\)Exposed audit run \(N=100N\{=\}100\)Figure 2:Cost–precision trade\-off of the audit atδ=0\.10\\delta=0\.10for a binary label set \(C=2C=2\)\. For each total call budgetQQthe sampled\-decoding curves plot the smallest radius of[Corollary˜4\.5](https://arxiv.org/html/2607.08961#S4.Thmtheorem5)over breadth–depth splits; the margin termκ​\(ξ\)\\kappa\(\\xi\)and the disjoint margin\-split calls are task\-dependent and omitted, so these curves are*optimistic*for sampled decoding\. The exposed\-probability curve plots the correction\-free radius of[Proposition˜4\.1](https://arxiv.org/html/2607.08961#S4.Thmtheorem1), which needs one call per input\. Markers show the two audits actually run in this section\.
### C\.6Margin\-mass estimator

The margin boundκU\\kappa\_\{U\}reported in[Section˜5](https://arxiv.org/html/2607.08961#S5.SS0.SSS0.Px3)is estimated on the disjointNκ=100N\_\{\\kappa\}=100margin inputs, with the confidence budget split between it and the overlap estimate\. The audit implementation bounds the margin event using exact per\-label Clopper–Pearson intervals\. An input is classified as potentially within the margin if any label\-probability interval intersects\[τ−ξ,τ\+ξ\]\[\\tau\-\\xi,\\tau\+\\xi\]\. A union bound allocates the noncoverage budget across labels\. Alternatively, the auditor may supply an externally justified upper bound onκ​\(ξ\)\\kappa\(\\xi\)\. Atr=3r=3, the exact three\-draw intervals classify nearly every input as potentially within the margin, yielding the near\-vacuous upper boundκU=1\.0\\kappa\_\{U\}=1\.0reported in the body\. The partial high\-depth cache is incomplete and therefore cannot support a reproducible margin\-mass estimate\. Determining whether the margin or finite\-depth term dominates at certificate\-valid depth requires a completed high\-depth run\.

### C\.7Per\-configuration Qwen audit results

[Table˜6](https://arxiv.org/html/2607.08961#A3.T6)reports every cell of the two\-prompt, three\-seed Qwen 2\.5–3B audit of[Section˜5](https://arxiv.org/html/2607.08961#S5.SS0.SSS0.Px3): all six moderation configurations and the six matched length\-control configurations, with certificates recomputed under the full radius of[Corollary˜4\.5](https://arxiv.org/html/2607.08961#S4.Thmtheorem5)\. As elsewhere, the finite\-depth correction is vacuous atr=3r=3\([Section˜5](https://arxiv.org/html/2607.08961#S5.SS0.SSS0.Px3)\), so the informative columns are the plug\-in statistics rather than the \(zero\) certified floor\. The configurations show two patterns\. First, moderation produces large plug\-in overlap under P1 with seeds0and22\. P1 with seed11has overlap0\.010\.01, while P2 produces constant output under all three seeds \(majority fraction1\.001\.00\)\. The estimated admissible sets are therefore sensitive to both prompt paraphrase and shallow\-decoding seed\. Second, the control has small nonzero plug\-in overlap in five of six configurations, withD^⋆≤0\.08\\widehat\{D\}^\{\\star\}\\leq 0\.08, and never approaches the two large moderation signals\. These control values are consistent with finite\-decoding noise atr=3r=3\. Atr=3r=3decodings per input, per\-cell plug\-in probabilities are coarse \(multiples of1/31/3\), so the seed\-to\-seed variation within P1 may largely reflect Monte Carlo resolution rather than decoding\-law instability\.

Table 6:Per\-configuration results for the model\-relative Qwen 2\.5–3B audit withN=100N=100,Nκ=100N\_\{\\kappa\}=100,r=3r=3,τ=0\.2\\tau=0\.2,ξ=0\.05\\xi=0\.05, andδ=0\.1\\delta=0\.1\. “Majority frac\.” denotes the pooled majority\-label fraction; a value of1\.001\.00denotes constant output\. Every certified floor is zero, as explained in the text, and the independently estimated boundκU\\kappa\_\{U\}enters the same radius\.
### C\.8Exposed\-probability threshold sweep

The exposed\-probability audit of[Section˜5](https://arxiv.org/html/2607.08961#S5.SS0.SSS0.Px1)plots the full sweep in[Figure˜1](https://arxiv.org/html/2607.08961#S5.F1)and reports its correction\-free certified floor at the comparison pointτ=0\.20\\tau=0\.20; this subsection records the numerical values\. The probabilities swept here are the declared\-label conditional probabilities obtained by renormalizing the raw next\-token log\-probabilities over the prespecified class tokens, so every floor below is relative to that constrained first\-token channel \([Section˜5](https://arxiv.org/html/2607.08961#S5.SS0.SSS0.Px1)\), not an unrestricted continuation channel\. The full prespecified sweep for the moderation prompt P1 is monotone decreasing inτ\\tau\. Acrossτ∈\{0\.10,0\.15,0\.20,0\.25,0\.30,0\.40\}\\tau\\in\\\{0\.10,0\.15,0\.20,0\.25,0\.30,0\.40\\\}the P1 floor is0\.16380\.1638,0\.11380\.1138,0\.08380\.0838,0\.05880\.0588,0\.03880\.0388, and0, respectively\. AtN=100N=100the Hoeffding radius isεN≈0\.12\\varepsilon\_\{N\}\\approx 0\.12, so the positive floors arise only whereD^⋆\\widehat\{D\}^\{\\star\}clears that margin; the floor vanishes onceτ\\tauis large enough that fewer inputs place both class tokens above threshold\.

### C\.9Coherent\-reading bridge audit: design and results

This subsection gives the full design behind the transfer boundary of[Section˜5](https://arxiv.org/html/2607.08961#S5.SS0.SSS0.Px2), which tests the two conditions of[Theorem˜3\.9](https://arxiv.org/html/2607.08961#S3.Thmtheorem9)separately on the moderation task\.

*Readings\.*Two policy clauses are prespecified\. The*narrow*reading: “Remove a comment only when it contains an explicit threat, slur, or targeted abusive statement\. Allow it otherwise\.” The*broad*reading: “Remove a comment when it is likely to escalate personal harm, including veiled or implicit targeted harassment even without explicit prohibited words\. Allow it otherwise\.” Each clause is inserted into a fixed reading template \(“Apply this single policy reading consistently to every input: …”\), and the induced labelingfa​\(x\)f\_\{a\}\(x\)is the argmax of the exposed declared\-label law under that clause\. The base admissible setsAτ​\(x\)A\_\{\\tau\}\(x\)come from the frozen exposed\-probability P1 audit of[Section˜5](https://arxiv.org/html/2607.08961#S5.SS0.SSS0.Px1)atτ=0\.20\\tau=0\.20\.

*Split and optimization\.*A design\-seeded permutation of the declared input population assigns100100fit and100100held\-out inputs; the fit inputs are verified \(by hash\) to coincide with the frozen P1 audit inputs\. The mixture weight is fitted on the fit split alone by a grid search overλ∈\{0,10−4,…,1\}\\lambda\\in\\\{0,10^\{\-4\},\\dots,1\\\}minimizing the empirical coverage gap𝔼x​\[maxy⁡μxλ​\(y\)−1/k​\(x\)\]\\mathbb\{E\}\_\{x\}\[\\max\_\{y\}\\mu^\{\\lambda\}\_\{x\}\(y\)\-1/k\(x\)\], yieldingλ^narrow=0\.50\\widehat\{\\lambda\}\_\{\\rm narrow\}=0\.50\. All reported quantities are then evaluated on the held\-out split only\.

*Confidence allocation\.*The budgetδ=0\.10\\delta=0\.10funds three one\-sided Hoeffding bounds \(one for the coverage gap and one per\-reading admissibility violation\) via the shared radiuslog⁡\(3/δ\)/\(2 100\)≈0\.1304\\sqrt\{\\log\(3/\\delta\)/\(2\\,100\)\}\\approx 0\.1304\.

*Results\.*The two conditions of the bridge come apart\. The held\-out coverage gap is−0\.28\-0\.28, giving the clipped upper boundη^U=0\.0000\\widehat\{\\eta\}\_\{U\}=0\.0000: the fitted mixture*satisfies*theη\\eta\-uniform\-coverage condition \([Definition˜3\.8](https://arxiv.org/html/2607.08961#S3.Thmtheorem8)\), helped by the large held\-out reading disagreement \(0\.760\.76\)\. The admissibility condition fails: the held\-out violation rates are0\.240\.24\(narrow\) and0\.360\.36\(broad\), givingζ^U=0\.4904\\widehat\{\\zeta\}\_\{U\}=0\.4904and hence the nearly vacuous gap bound\|Vτ⋆−Vblind​\(𝒞\)\|≤0\.4904\|V^\{\\star\}\_\{\\tau\}\-V\_\{\\rm blind\}\(\\mathcal\{C\}\)\|\\leq 0\.4904\. The obstruction is thus not mixture coverage but that each clause, applied globally, frequently labels outside the model’s admissible set; the clauses were written independently of the model’s admissible geometry and carry no independent human validation\.

*Preregistered external\-reading validation \(next\-step design\)\.*The protocol this result motivates is fixed as follows\. \(i\) Elicit a pool ofK≥5K\\geq 5candidate policy readings from annotators or policy documents, independently of any model output\. \(ii\) Freeze the clauses, the prompt template, the split sizes,τ\\tau,δ\\delta, and the analysis code, and register hashes before any model call\. \(iii\) On the fit split, fit the mixture weights; on the held\-out split, reportη^U\\widehat\{\\eta\}\_\{U\}and per\-readingζ^U\\widehat\{\\zeta\}\_\{U\}at radiuslog⁡\(\(K\+1\)/δ\)/\(2​Nholdout\)\\sqrt\{\\log\(\(K\{\+\}1\)/\\delta\)/\(2N\_\{\\rm holdout\}\)\}\. \(iv\) The bridge is informative iff both bounds are small; readings with large violation rates are reported, not discarded post hoc\. This design tests whether[Theorem˜3\.9](https://arxiv.org/html/2607.08961#S3.Thmtheorem9)becomes informative once held\-out admissibility error is small, as anticipated in the discussion\.

### C\.10Exposed\-probability channel and audit metadata

The exposed\-probability audit of[Section˜5](https://arxiv.org/html/2607.08961#S5.SS0.SSS0.Px1)serves a frozen Qwen 2\.5–3B \(llama\.cppb9870\) and instantiates the verbalizerVVof[Section˜2\.1](https://arxiv.org/html/2607.08961#S2.SS1)as the*constrained*first\-token label kernel:V\(⋅∣s\)V\(\\cdot\\mid s\)places all mass on the label whose class token leadsss, conditioned on that token lying in the declared class\-token set\{vy\}y∈𝒴\\\{v\_\{y\}\\\}\_\{y\\in\\mathcal\{Y\}\}\. Under thisVVthe admissibility channel is exactly the constrained first\-token law

πLLMθ​\(y∣fNL,x\)=ℙ​\(T1=vy∣u\)∑y′∈𝒴ℙ​\(T1=vy′∣u\),u=Π​\(fNL,x\),\\pi\_\{\\mathrm\{LLM\}\_\{\\theta\}\}\(y\\mid f\_\{\\mathrm\{NL\}\},x\)\\;=\\;\\frac\{\\mathbb\{P\}\(T\_\{1\}=v\_\{y\}\\mid u\)\}\{\\sum\_\{y^\{\\prime\}\\in\\mathcal\{Y\}\}\\mathbb\{P\}\(T\_\{1\}=v\_\{y^\{\\prime\}\}\\mid u\)\},\\qquad u=\\Pi\(f\_\{\\mathrm\{NL\}\},x\),i\.e\. the raw class\-token probabilities renormalized over the declared label set, not an unrestricted continuation probability\. The certificate is stated relative to this declared\-label channel and needs neither the finite\-depth nor the threshold\-margin correction\.

As a collapse diagnostic, not itself a certified quantity, we report the mean binary entropy \(nats\) of the declared\-label law:0\.2910\.291for paraphrase P1 against0\.0870\.087for P2\. The order\-of\-magnitude gap shows that P2’s zero certificate arises from the declared\-label probability concentrating on one label \(*prompt collapse*\), not from small estimated overlap at comparable spread\.

Each model\-relative audit fixes its design and split before any model call and records the seeds, prompts, per\-input probability vectors, label\-token identifiers, model hash, and platform and runtime revision\. The recorded vectors are the raw next\-token class\-token probabilities renormalized over the declared label set \(the constrained first\-token channel above\), not full\-vocabulary softmax values\. The supplementary reproducibility archive provides the source code, frozen designs, versioned outputs, and SHA\-256 hashes for the exposed\-probability and bridge result artifacts\.

## Appendix DFurther Related Work

#### Decision\-theoretic status of the exact blind\-channel value\.

Once the supervision experiment is target\-independent, the reduction to a randomized rule and a least\-favorable prior is classical\(Wald,[1950](https://arxiv.org/html/2607.08961#bib.bib60); Blackwell,[1951](https://arxiv.org/html/2607.08961#bib.bib8); Blackwell and Girshick,[1954](https://arxiv.org/html/2607.08961#bib.bib9); Ferguson,[1967](https://arxiv.org/html/2607.08961#bib.bib18); Sion,[1958](https://arxiv.org/html/2607.08961#bib.bib52)\)\. Modern adversarial and minimax\-risk classifiers solve the analogous robust0–11decision problem for broad uncertainty sets of joint distributions\(Fathony et al\.,[2016](https://arxiv.org/html/2607.08961#bib.bib17); Mazuelas et al\.,[2023](https://arxiv.org/html/2607.08961#bib.bib41)\)\. Most notably, the adversarial zero\-one loss ofFathony et al\. \([2016](https://arxiv.org/html/2607.08961#bib.bib17), Theorem 1, Eq\. \(4\)\)is the maximum over nonempty label subsetsSSof hyperplanes whose constant term is\(\|S\|−1\)/\|S\|\(\|S\|\-1\)/\|S\|\. The same expression arises here as the value of the finite zero–one game onAτ​\(x\)A\_\{\\tau\}\(x\), namely1−1/\|Aτ​\(x\)\|1\-1/\|A\_\{\\tau\}\(x\)\|\. Candidate\-label learning is closer to our pointwise set\-valued object: partial\-label learning asks when training candidate sets can be disambiguated\(Cour et al\.,[2011](https://arxiv.org/html/2607.08961#bib.bib13)\), but it is not formulated as the target\-blind, sample\-flat selector\-class identity used here\. The NL\-PAC\-specific step is the cyclic finite family whose marginal at eachxxis uniform onAτ​\(x\)A\_\{\\tau\}\(x\); it exposes the least\-favorable value as𝔼​\[1−1/\|Aτ​\(X\)\|\]\\mathbb\{E\}\[1\-1/\|A\_\{\\tau\}\(X\)\|\]and makes that value estimable from the same held\-out admissibility audit\.

#### Superset learning and conformal prediction sets\.

The admissible setAτ​\(x\)A\_\{\\tau\}\(x\)is formally a candidate\-label \(superset\) set, so the superset/imprecise\-label line is a near neighbor of our selection\-class view\. Beyond the average\-loss formulation ofCour et al\. \([2011](https://arxiv.org/html/2607.08961#bib.bib13)\), the generalized\-loss and data\-disambiguation program ofHüllermeier \([2014](https://arxiv.org/html/2607.08961#bib.bib26)\)learns by minimizing a loss over the set of observation\-consistent labelings, the same set\-valued object we analyze\. Its aim is to recover a single sharp model, whereas NL\-PAC asks whether the mediated channel can distinguish the set’s members at all\. A superficially similar set, the conformal prediction set, is a threshold set of a score function and hence formally resemblesAτ​\(x\)A\_\{\\tau\}\(x\)\(Vovk et al\.,[2005](https://arxiv.org/html/2607.08961#bib.bib59); Angelopoulos and Bates,[2023](https://arxiv.org/html/2607.08961#bib.bib2)\); the two are conceptually opposite, however\. A conformal set is a property of the*predictor*and drives a coverage guarantee, whileAτ​\(x\)A\_\{\\tau\}\(x\)is a property of the*supervision channel*and drives an identification floor: the former certifies that the truth is contained, the latter certifies that the truth cannot be pinned down\.

#### Relation to non\-identifiable noise and partial monitoring\.

The blind\-channel floor \([Theorem˜3\.2](https://arxiv.org/html/2607.08961#S3.Thmtheorem2)\) is an LLM\-mediated instantiation of information\-theoretic noise\-floor lower bounds, such as those in the malicious\-error\(Kearns and Li,[1993](https://arxiv.org/html/2607.08961#bib.bib28)\)and nasty\-noise\(Bshouty et al\.,[2002](https://arxiv.org/html/2607.08961#bib.bib10)\)models\. However, while those floors are budgeted \(vanishing as the corruption rateη→0\\eta\\to 0\), the NL\-PAC floor is set by the indistinguishability of two admissible readings under the oracle channel \([Equation˜1](https://arxiv.org/html/2607.08961#S3.E1)\)\.

Instance\-dependent noise \(IDN\) similarly makes identifiability depend on structural assumptions: bounded instance\- and label\-dependent noise can be learned under additional conditions\(Cheng et al\.,[2020](https://arxiv.org/html/2607.08961#bib.bib11)\), whereas the unrestricted target–noise decomposition is not identified by labels alone\. The systematic component of the NL\-PAC oracle error is a structured instance of IDN where the noise is generated by an LLM interpreting an ambiguous prompt\. This also distinguishes NL\-PAC from weak\-supervision frameworks like Snorkel\(Ratner et al\.,[2017](https://arxiv.org/html/2607.08961#bib.bib50)\), which aggregate multiple heuristics by estimating their accuracies, whereas we analyze whether the labeling channel can distinguish the admissible readings at all\.

A supervision\-channel separation between direct and mediated labels \(a natural follow\-up outside this paper’s scope\) has a direct precedent in partial monitoring, where "hopeless" games with linear regret arise when feedback cannot separate target outcomes\(Bartók et al\.,[2011](https://arxiv.org/html/2607.08961#bib.bib6)\); NL\-PAC transfers this logic to an offline specification setting\.

#### Harm specification and LMaaS opacity\.

The blind\-channel floor has an independent information\-theoretic counterpart on the alignment side: Young\([2025](https://arxiv.org/html/2607.08961#bib.bib64)\)argues that no specificationIIcan pin down an external targetOOif the conditional entropyH​\(O∣I\)\>0H\(O\\mid I\)\>0, so an information gap forces a residual error\. Our ambiguity diameterdiamτ,ζ​\(fNL,P\)\>0\\mathrm\{diam\}\_\{\\tau,\\zeta\}\(f\_\{\\mathrm\{NL\}\},P\)\>0is the operational witness of this gap, and the master statistic \([Proposition˜4\.1](https://arxiv.org/html/2607.08961#S4.Thmtheorem1)\) estimates it from data\. Judge\-mediated supervision is increasingly delivered through proprietary, API\-only models, the Language\-Models\-as\-a\-Service \(LMaaS\) paradigm, whose opacity is documented as a systematic obstacle to evaluation, reproducibility, reliability, and trustworthiness\(La Malfa et al\.,[2024](https://arxiv.org/html/2607.08961#bib.bib33)\); the operative reading is then often unobservable by construction, which is exactly the reading\-blind regime the floor and its audit are designed to certify\.

#### Rating indeterminacy and judge bias\.

Within the LLM\-as\-a\-judge literature \(e\.g\., G\-EvalLiu et al\.,[2023b](https://arxiv.org/html/2607.08961#bib.bib37), PrometheusKim et al\.,[2024](https://arxiv.org/html/2607.08961#bib.bib30), and surveys likeGu et al\.,[2026](https://arxiv.org/html/2607.08961#bib.bib21)\), NL\-PAC treats judge\-mediated evaluation as a partially identified target\-selection problem rather than a judge\-alignment problem\. Recent large\-scale audits report that judge reliability and validity can come apart: high test–retest consistency can coexist with severe positional bias\(Norman et al\.,[2026](https://arxiv.org/html/2607.08961#bib.bib46)\)\. Instrument\-centric diagnostics likewise treat judge reliability as a property of the measurement instrument, not of individual outputs\(Choi et al\.,[2026](https://arxiv.org/html/2607.08961#bib.bib12)\)\. This parallels NL\-PAC’s treatment of the floor as a property of the tuple\(LLMθ,Π,τ,P\)\(\\mathrm\{LLM\}\_\{\\theta\},\\Pi,\\tau,P\), not of any single judgment\.

Guerdan et al\.\([2025](https://arxiv.org/html/2607.08961#bib.bib22)\)document*rating indeterminacy*, in which rating criteria admit multiple valid interpretations, and show that forced\-choice judge validation is systematically biased relative to multi\-label response sets; their contribution is a theoretical and empirical validation framework for judge systems, whereas NL\-PAC proves and certifies the learnability floor that such indeterminacy imposes\. Dorner et al\.\([2025](https://arxiv.org/html/2607.08961#bib.bib16)\)prove that, when the judge is no more accurate than the evaluated model, judge\-based debiasing cannot reduce the required ground\-truth sample size by more than half, and Feuer et al\.\([2026](https://arxiv.org/html/2607.08961#bib.bib19)\)study bias\-bounded guarantees for measurable judge bias\. Both quantify*exogenous*judge error; NL\-PAC measures the endogenous ambiguity limit generated by the model’s own interpretation\.

#### Learning from disagreement\.

The JAIR survey ofUma et al\. \([2021](https://arxiv.org/html/2607.08961#bib.bib56)\)organizes methods that retain multiple human judgments rather than reducing them to one gold label, andBaan et al\. \([2022](https://arxiv.org/html/2607.08961#bib.bib4)\)show why majority\-label calibration is problematic when human disagreement is inherent\. Perspectivist NLP develops the same contention into annotator\- and distribution\-aware modeling and evaluation\(Xu and Jurgens,[2026](https://arxiv.org/html/2607.08961#bib.bib62)\)\. These approaches learn from or evaluate against human judgment variation\. NL\-PAC instead asks what can be guaranteed when the supervision channel does not reveal which retained reading is operative\. Its validated reading family is therefore conceptually distinct from the model\-admissible selector set: agreement between them is an empirical bridge condition, not a definition\.

#### Prompt underspecification\.

Systems work on prompt sensitivity shows that prompts omit requirements that models fill with fragile defaults: underspecified prompts regress markedly across model or prompt changes\(Yang et al\.,[2026](https://arxiv.org/html/2607.08961#bib.bib63)\), and even subjective evaluations can vary across prompt formulations\. This continues the broader observation that underspecified pipelines admit many equally predictive solutions that diverge under deployment shift\(D’Amour et al\.,[2022](https://arxiv.org/html/2607.08961#bib.bib14)\)\. Active task disambiguation\(Kobalczyk et al\.,[2025](https://arxiv.org/html/2607.08961#bib.bib31)\)and elicitation\(Li et al\.,[2025](https://arxiv.org/html/2607.08961#bib.bib34)\)clarify intent by asking questions or generating edge cases\. NL\-PAC supplies the complementary accounting layer by pricing the remaining ambiguity viaDτ⋆D^\{\\star\}\_\{\\tau\}\.

#### Partial concept classes\.

Partial\-concept PAC learning allows a concept to be undefined away from the support of its source distribution and studies which such classes remain learnable\(Alon et al\.,[2022](https://arxiv.org/html/2607.08961#bib.bib1)\)\. NL\-PAC has a different partiality: each admissible reading is a total target on the deployment domain, but the natural\-language specification identifies a set of such targets and the mediated channel may fail to distinguish them\. Thus the blind\-channel floor is a channel\-induced identification obstruction, not a consequence of undefined off\-support labels\.

#### Privileged information, semantic uncertainty, and partial\-identification inference\.

Vapnik’s learning\-using\-privileged\-information \(LUPI\) program treats teacher comments as training\-only signals that accelerate learning\(Vapnik and Vashist,[2009](https://arxiv.org/html/2607.08961#bib.bib58)\)\. While it asks how much trusted explanations help, our question is dual: how much error remains when the explanation channel is systematically ambiguous\. The semantic\-uncertainty literature \(e\.g\.,Kuhn et al\.,[2023](https://arxiv.org/html/2607.08961#bib.bib32)\) measures uncertainty over meanings by clustering answers; such concentration signals yield only one\-sided diameter diagnostics, and the sharp handle for floors remains the master statisticDτ⋆D^\{\\star\}\_\{\\tau\}\. Finally, the certificate in[Theorem˜B\.3](https://arxiv.org/html/2607.08961#A2.Thmtheorem3)draws on classical inference for partially identified parameters\(Imbens and Manski,[2004](https://arxiv.org/html/2607.08961#bib.bib27)\)to certify the Le Cam floor from finite data; simultaneous\-inference corrections over searched families in the sense ofBerk et al\. \([2013](https://arxiv.org/html/2607.08961#bib.bib7)\)are deliberately unnecessary here, because the canonical candidate pair is a deterministic functional of the frozen model rather than a data\-selected object\.