When Honesty is Not Enough in AI Debate

# When Honesty is Not Enough in AI Debate
Source: [https://arxiv.org/html/2609.29189](https://arxiv.org/html/2609.29189)
###### Abstract

Scalable oversight aims to verify the behaviour of agents whose capabilities exceed those of their overseers\. AI debate has been proposed as an oversight solution in which competing agents help a resource\-limited verifier assess claims that it cannot reliably evaluate unaided\. Much of its promise rests on incentivizing honest arguments that lead to correct verdicts\. Yet a correct verdict need not uniquely determine the arguments used to support it\. Agents may retain discretion over which correct claims to present, how to frame them, and in what order to disclose them\. This residual freedom can allow agents to shape what the verifier learns beyond the task\-relevant conclusion, pursuing latent objectives without compromising verdict correctness\.

To study this phenomenon, we introduce the framework strategic interactive oversight \(SIO\), which treats oversight jointly as a verification mechanism and a strategic communication channel\. Within this framework, we formalise the notion of task\-admissible latent optimisation, which entails the pursuit of latent objectives while maintaining a prescribed task performance\. As proof\-of\-concept, we instantiateSIOin the establish protocol debate with cross\-examination and quantify a tradeoff between task success and information disclosure about a hidden variable\. The trade\-off identifies a strategic window in which substantial disclosure remains compatible with task admissibility\. Towards mitigation, we reduce admissible bias by expanding the cross\-examiner’s role to mitigate persistent disclosure over finite interaction horizons\. Our results highlight the need to evaluate oversight not only by the correctness of its verdicts, but also by the information conveyed through its transcripts\.

## 1Introduction

As AI systems grow more capable, they may surpass the humans or weaker models charged with evaluating their work\.*Scalable oversight*asks whether a bounded overseer can nevertheless evaluate and steer a more capable system using substantially fewer resources\. An oversight mechanism must remain reliable even when the overseer cannot reproduce the reasoning or computation it assesses\.

Proposed approaches include amplification\([Christiano et al\., 2018](https://arxiv.org/html/2609.29189#bib.bib1)\), recursive reward modelling\([Leike et al\., 2018](https://arxiv.org/html/2609.29189#bib.bib2)\), and AI debate\([Irving et al\., 2018](https://arxiv.org/html/2609.29189#bib.bib3);[Brown\-Cohen et al\., 2024](https://arxiv.org/html/2609.29189#bib.bib4);[Brown\-Cohen et al\., 2025](https://arxiv.org/html/2609.29189#bib.bib7);[Brown\-Cohen et al\., 2026](https://arxiv.org/html/2609.29189#bib.bib5)\)\. Each uses AI capabilities to amplify the signal supplied by human judgment\. In debate, powerful agents recursively reduce a difficult question to disagreements that a computationally limited judge can resolve\. Irving et al\.\([Irving et al\., 2018](https://arxiv.org/html/2609.29189#bib.bib3)\)formalise this intuition using complexity theory, showing how a weak verifier can judge claims about computations beyond its own reach\. Later protocols require the verifier to inspect only a small part of a much larger computation\([Brown\-Cohen et al\., 2024](https://arxiv.org/html/2609.29189#bib.bib4);[Brown\-Cohen et al\., 2026](https://arxiv.org/html/2609.29189#bib.bib5)\)\.

This line of work has largely studied*what*can be verified under an asymmetry in computational resources\. Although the verifier cannot reproduce the prover’s computation, an appropriate protocol may still allow it to check the resulting claim\. Yet computational verifiability alone does not capture the full range of limitations faced by human overseers\. Human oversight is also constrained in*how*verification is carried out, since the framing of \(truthful\) evidence can shape how it is interpreted\. Indeed, recent work illustrates how LLMs can exploit the use of evidence to manipulate beliefs without relying on directly false claims\([Hu et al\., 2026](https://arxiv.org/html/2609.29189#bib.bib8)\)\. An oversight interaction may therefore verify the right proposition while inducing a strategically chosen interpretation of the evidence or influencing subsequent judgments\. This “how” within the computationally verifiable “what” is the object of study here\. Understanding and controlling it is essential if scalable verification is to provide a meaningful alignment guarantee\.

The central distinction is between honesty as a guarantee about the assessed claim and safety as a property of the interaction as a whole\. Even when an oversight protocol elicits a correct verdict and constrains reports to be locally accurate, it need not control which additional information the transcript conveys\. In this sense, honesty is not enough and guarantees about task correctness do not automatically extend to the other effects of task\-successful communication\.

### 1\.1Solution

To study this residual freedom, we introduce a model of*strategic interactive oversight*\(SIO\), which treats an oversight protocol as both an evaluation mechanism and a communication channel\. An agent’s performance is evaluated under an explicit*task objective*, which specifies the protocol’s intended outcome, and a*latent objective*, which captures additional effects of the interaction\. The agent may then select strategies that optimise performance across both objectives\. This yields the threat model of*task\-admissible latent optimisation*\(TALO\), in which the agent pursues the latent objective while maintaining an acceptable level of task performance\. The threat does not require the agent to induce an incorrect verdict or violate the protocol’s explicit rules\. It arises whenever the task objective admits multiple successful strategies that differ in their latent effects on the verifier’s view of the interaction\.

As a proof\-of\-concept, we instantiateSIOon debate with cros\-examination[Brown\-Cohen et al\. \(2024\)](https://arxiv.org/html/2609.29189#bib.bib4)with the latent objective of*hidden\-hypothesis disclosure*\. Hidden\-hypothesis disclosure measures how much information the verifier’s view of the interaction reveals about a latent variable that is not required for the task\. In standard debate, the task objective is to win\. However, there are generally many strategies by which it can do so\. This non\-uniqueness allows the debater to select, among task\-successful strategies, those that additionally encode information about the latent variable\. We show that, even when the disclosure in each round is small, the total information revealed can grow linearly with the number of cross\-examination rounds\. Local report\-accuracy conditions and a correct terminal verdict therefore do not prevent the oversight interaction from becoming a channel for latent information\.

BecauseTALOis a constrained optimisation problem, mitigation requires altering the incentive landscape over task\-admissible strategies\. As a step towards mitigation, we expand\. In addition to cross\-examination, the cross\-examiner assigns these weights so that the aggregate \(if it cannot be disputed\) remains aligned with a human oracle\. Debaters that persistently deviate from oracle\-aligned judgments receive less weight and therefore exert less influence on the final argument\.

### 1\.2Contributions

Our contributions are threefold\. First, we introduceSIO, a new framework that treats oversight jointly as a verification mechanism and a strategic communication channel\. Building on scalable verification under resource asymmetry, it makes explicit the distinction between an agent’s task objective and latent objectives pursued through the interaction\. This distinction motivates oversight of the interaction, rather than only its terminal verdict\.

A central motivation for debate is that adversarial scrutiny can incentivise truthful, task\-correct answers\. Our framework identifies a distinct limitation of such guarantees, where constraining an agent’s answer does not necessarily constrain the information conveyed by its choice among task\-admissible strategies\. We formalise this gap through task\-admissible latent optimisation and demonstrate it through hidden\-hypothesis disclosure\.

Second, we instantiate the framework in a computational model of debate\. We establish a non\-trivial attack surface, which comprises a range of strategies through which a debating agent can advance a hidden latent objective without sacrificing its task objective\. Figure[1](https://arxiv.org/html/2609.29189#S1.F1)illustrates this strategic window\.

Third, as a step towards mitigation, we augment cross\-examination with a sliding\-window consistency check that tests for persistent discrepancies across rounds\. This narrows the range of persistent perturbations compatible with task success, at the cost of additional verifier work, while leaving the debaters’ per\-round sampling work unchanged\. The resulting guarantee limits the disclosure strategy studied here rather than establishing transcript confidentiality\.

hh\|Δ\|\|\\Delta\|Latent ObjectiveΨ\\Psi\(a\)Ψ\\Psivs\.\|Δ\|\|\\Delta\|γ\\gamma\|Δ\|\|\\Delta\|Task ObjectiveΦ\\PhiR1R\_\{1\}R2\>R1R\_\{2\}\>R\_\{1\}R3\>R2R\_\{3\}\>R\_\{2\}\(b\)Φ\\Phivs\.\|Δ\|\|\\Delta\|
Figure 1:Tradeoff between task successΦ\\Phiand hidden hypothesis disclosureΨ\\Psiin debate with cross\-examination\.Δ\\Deltadenotes the “magnitude” by which a debater biases a neutral claim andRiR\_\{i\}is a measure of computational resources\. On the left,Ψ\\Psimeasures \(in bits\) the volume of information about a hidden hypothesis encoded in the debate transcript\. It grows quadratically with the size of the bias, before hitting the prior hypothesis entropyhh\. On the right,Φ\\Phimeasures the probability the debater wins the debate \(that is, task success\) andγ\\gammais the level of task admissible performance\. Notably, small biases do not affect the debate outcome\. Increasing resources can extend the window of admissable stratgies\.

## 2Preliminaries

Forn∈ℕn\\in\\mathbb\{N\}, let\[n\]=\{1,…,n\}\[n\]=\\\{1,\\ldots,n\\\}\. Vectors are written in boldface; for𝐱∈\{0,1\}n\\mathbf\{x\}\\in\\\{0,1\\\}^\{n\}andI⊆\[n\]I\\subseteq\[n\], let𝐱I\\mathbf\{x\}\_\{I\}denote the restriction of𝐱\\mathbf\{x\}to the coordinates inII\.

### 2\.1Computation Model

We model computation using probabilistic oracle Turing machines\. A stochastic oracle with query lengthℓ=ℓ⁡\(n\)\\ell=\\ell\(n\)maps each queryz∈\{0,1\}ℓz\\in\\\{0,1\\\}^\{\\ell\}to a\{0,1\}\\\{0,1\\\}\-valued random variable𝒪⁡\(z\)\\mathcal\{O\}\(z\)\. Responses to oracle queries are independent, including responses to repeated instances of the same query\. A probabilistic oracle Turing machineMMmay write a queryzzto its oracle tape and receive a sample from𝒪⁡\(z\)\\mathcal\{O\}\(z\)in one step\. We writeM𝒪M^\{\\mathcal\{O\}\}forMMwith access to𝒪\\mathcal\{O\}\. In the oversight setting,MMrepresents a computation specified by natural\-language instructions, while𝒪\\mathcal\{O\}represents human judgement or other external black\-box feedback, such as search results, sensor observations, or API outputs[Brown\-Cohen et al\. \(2024\)](https://arxiv.org/html/2609.29189#bib.bib4)\.

A languageL⊆\{0,1\}∗L\\subseteq\\\{0,1\\\}^\{\*\}is a set of finite binary strings\. A probabilistic oracle Turing machineMMdecidesLLwith oracle𝒪\\mathcal\{O\}if

x∈L⟹Pr\[M𝒪\(x\)=1\]\>23,x∉L⟹Pr\[M𝒪\(x\)=1\]<13,x\\in L\\;\\Longrightarrow\\;\\Pr\\\!\\left\[M^\{\\mathcal\{O\}\}\(x\)=1\\right\]\>\\frac\{2\}\{3\},\\qquad x\\notin L\\;\\Longrightarrow\\;\\Pr\\\!\\left\[M^\{\\mathcal\{O\}\}\(x\)=1\\right\]<\\frac\{1\}\{3\},where the probability is over the internal randomness ofMMand the stochastic oracle responses\.

A transcript of aTT\-step execution ofM𝒪M^\{\\mathcal\{O\}\}on inputxxis a random vector𝐲=\(y1,…,yT\)∈\{0,1\}T\{\\mathbf\{y\}\}=\(\{\\textnormal\{y\}\}\_\{1\},\\ldots,\{\\textnormal\{y\}\}\_\{T\}\)\\in\\\{0,1\\\}^\{T\}, whereyt\{\\textnormal\{y\}\}\_\{t\}is the \(random\) bit written at the current head position at steptt\. We assume that the final coordinate is the machine’s output, soYT=MO​\(x\)Y\_\{T\}=M^\{O\}\(x\)\. In the language\-model setting, the transcript corresponds to the sequence of tokens produced during the computation\. For a realization𝒚\{\\bm\{y\}\}of𝐲\{\\mathbf\{y\}\}, letIM,x​\(t\)⊆\[T\]I\_\{M,x\}\(t\)\\subseteq\[T\]denote the transcript coordinates read byMMwhen producing the realizationyt\{y\}\_\{t\}ofyt\{\\textnormal\{y\}\}\_\{t\}\. WhenMMandxxare clear from context, we writeI⁡\(t\)I\(t\)\. Thus, the distribution ofyt\{\\textnormal\{y\}\}\_\{t\}is determined by the relevant prior coordinatesyI⁡\(t\)\{\\textnormal\{y\}\}\_\{I\(t\)\}, together with fresh machine and oracle randomness\.

### 2\.2Information Theory

We use standard information\-theoretic quantities to measure uncertainty, statistical dependence, and divergence between distributions\. All random variables below are discrete, and all logarithms are base two\. Consequently, entropy, mutual information, and divergence are measured in bits\.

###### Definition 1\(Entropy\)\.

For a discrete random variableXXwith probability mass functionPXP\_\{X\}, its Shannon entropy isH\(X\)=−∑xPX\(x\)logPX\(x\)\.H\(X\)=\-\\sum\_\{x\}P\_\{X\}\(x\)\\log P\_\{X\}\(x\)\.For jointly distributed random variablesXXandYY, the conditional entropy ofXXgivenYYisH\(X∣Y\)=−∑x,yPX,Y\(x,y\)logPX\|Y\(x∣y\)\.H\(X\\mid Y\)=\-\\sum\_\{x,y\}P\_\{X,Y\}\(x,y\)\\log P\_\{X\\mid Y\}\(x\\mid y\)\.

Entropy measures the uncertainty associated with a random variable\.

###### Definition 2\(Mutual information\)\.

For jointly distributed random variablesXXandYY, their mutual information isI⁡\(X,Y\)=H⁡\(X\)−H⁡\(X∣Y\)\.I\(X;Y\)=H\(X\)\-H\(X\\mid Y\)\.For jointly distributedX,Y,ZX,Y,Z, their conditional mutual information isI⁡\(X;Y∣Z\)=H⁡\(X∣Z\)−H⁡\(X∣Y,Z\)\.I\(X;Y\\mid Z\)=H\(X\\mid Z\)\-H\(X\\mid Y,Z\)\.

Mutual information quantifies the statistical dependence between two random variables\.

### 2\.3Oversight Protocols

An oversight protocol is an interaction betweenkkprobabilistic prover machines and a probabilistic verifier, each of which may query the stochastic oracle𝒪\\mathcal\{O\}\. On inputxx, the machines exchange messages according to a prescribed communication schedule, after which the verifier outputs a decision bit\. Agent internal randomness and oracle responses induce a distribution over protocol executions\.

The*interaction history*afterttmessages is𝐡t=\(h1,…,ht\),\{\\mathbf\{h\}\}\_\{t\}=\(\{\\textnormal\{h\}\}\_\{1\},\\ldots,\{\\textnormal\{h\}\}\_\{t\}\),wherehj\{\\textnormal\{h\}\}\_\{j\}records a message together with its sender and recipient\. Oracle queries and their responses are treated as messages between the querying participant and𝒪\\mathcal\{O\}\. We write𝐡=𝐡T\{\\mathbf\{h\}\}=\{\\mathbf\{h\}\}\_\{T\}for the complete interaction history, whereTTis the termination time\. For each agentAA, letΠA​\(𝐡t\)\\Pi\_\{A\}\(\{\\mathbf\{h\}\}\_\{t\}\)denote the projection of𝐡t\{\\mathbf\{h\}\}\_\{t\}onto the messages sent or received byAAbefore timett\.

Equivalently, the protocol may be represented by a rooted tree whose nodes correspond to agents and edges correspond to message exchanges\. In other words, each non\-leaf node specifies the participant acting next, and each outgoing edge records a possible message\. A leaf represents a completed interaction and is labeled by the verifier’s terminal decision\.

## 3Framework

We formalizeSIOby separating an agent’s stated task objective from any latent objective it may pursue through the oversight interaction\. As a running example, consider a debate in which the input specifies a task hypothesis and two provers attempt to persuade a verifier to accept or reject it\.

### 3\.1Objectives

Let𝒳\{\\mathcal\{X\}\}be the input space andℋ\{\\mathcal\{H\}\}the set of complete interaction histories\. A*task objective*for agentAAis a functionΦA:𝒳×ℋ→ℝ\\Phi\_\{A\}\\colon\\mathcal\{X\}\\times\\mathcal\{H\}\\to\\mathbb\{R\}that evaluates task performance, and a*latent objective*for agentAAis a functionΨA:𝒳×ℋ→ℝ\\Psi\_\{A\}\\colon\\mathcal\{X\}\\times\\mathcal\{H\}\\to\\mathbb\{R\}that evaluates an additional property of the interaction\. For a complete history𝐡\{\\mathbf\{h\}\}on inputxx, the combined objective is

UA​\(x,𝐡,λ\)≔ΦA​\(x,𝐡\)\+λ​ΨA​\(x,𝐡\),\\displaystyle U\_\{A\}\(x,\{\\mathbf\{h\}\},\\lambda\)\\coloneqq\\Phi\_\{A\}\(x,\{\\mathbf\{h\}\}\)\+\\lambda\\Psi\_\{A\}\(x,\{\\mathbf\{h\}\}\),\(1\)where the shadow priceλ≥0\\lambda\\geq 0specifies the relative importance of the latent objective\. In the debate example, the task objectiveΦA=𝟙​\{A​wins debate\}\\Phi\_\{A\}=\\mathds\{1\}\\\{A\\text\{ wins debate\}\\\}indicates that the explicit goal of agentAAis to win the debate\. The decomposition intoΦ\\PhiandΨ\\Psidistinguishes what the protocol is intended to evaluate from other effects that an agent may induce through its messages\.

### 3\.2Strategies

A strategyσA\\sigma\_\{A\}for an agentAAassigns a distribution over the messages available toAAat each of its decision points\. Formally, given inputxxand the local interaction historyΠA​\(𝐡t\)\\Pi\_\{A\}\(\{\\mathbf\{h\}\}\_\{t\}\), the strategy specifies a distributionσA\(⋅∣x,ΠA\(𝐡t\)\)∈Δ\(ℳA\),\\sigma\_\{A\}\\bigl\(\\,\\cdot\\mid x,\\Pi\_\{A\}\(\{\\mathbf\{h\}\}\_\{t\}\)\\bigr\)\\in\\Delta\(\\mathcal\{M\}\_\{A\}\),whereℳA\\mathcal\{M\}\_\{A\}is the message space available toAAandΔ⁡\(ℳA\)\\Delta\(\\mathcal\{M\}\_\{A\}\)is the set of probability distributions over that space\. Thus, an agent’s message depends only on the input and the messages it has sent or received, including its own oracle queries and responses\.

For a set of provers\{Ai\}i∈\[k\]\\\{A\_\{i\}\\\}\_\{i\\in\[k\]\}and a verifierVV, a strategy profileσ=\(σA1,…,σAk,σV\),\\sigma=\(\\sigma\_\{A\_\{1\}\},\\ldots,\\sigma\_\{A\_\{k\}\},\\sigma\_\{V\}\),together with the stochastic oracle, induces a distribution over complete histories\. Let𝐡⁡\(x,σ\)\{\\mathbf\{h\}\}\(x,\\sigma\)denote the resulting random history\. The task and latent outcomes, forAiA\_\{i\}, induced byσ\\sigmaare the random variables

ΦAi​\(x,σ\)=Φ⁡\(x,𝐡⁡\(x,σ\)\),ΨAi​\(x,σ\)=Ψ⁡\(x,𝐡⁡\(x,σ\)\)\.\\Phi\_\{A\_\{i\}\}\(x,\\sigma\)=\\Phi\\bigl\(x,\{\\mathbf\{h\}\}\(x,\\sigma\)\\bigr\),\\qquad\\Psi\_\{A\_\{i\}\}\(x,\\sigma\)=\\Psi\\bigl\(x,\{\\mathbf\{h\}\}\(x,\\sigma\)\\bigr\)\.Whenxxis clear from context, we writeΦAi​\(σ\)\\Phi\_\{A\_\{i\}\}\(\\sigma\)andΨAi​\(σ\)\\Psi\_\{A\_\{i\}\}\(\\sigma\)\.

### 3\.3Threat Model

The central threat is that an agent may optimize a latent objective without materially compromising its performance on the stated task\. Letσ−A\\sigma\_\{\-A\}denote the strategies in the profileσ\\sigmawithσA\\sigma\_\{A\}removed\. Fixσ−A\\sigma\_\{\-A\}and, for a task\-admissibility thresholdγ≥0\\gamma\\geq 0, define the set ofγ\\gamma\-task\-admissible strategies by

ΣAγ​\(x\)=\{σA:𝔼⁡\[Φx​\(σA∘σ−A\)\]≥γ\}\.\\Sigma\_\{A\}^\{\\gamma\}\(x\)=\\left\\\{\\sigma\_\{A\}:\\mathbb\{E\}\\\!\\left\[\\Phi\_\{x\}\(\\sigma\_\{A\}\\circ\\sigma\_\{\-A\}\)\\right\]\\geq\\gamma\\right\\\}\.
For a fixed shadow priceλ≥0\\lambda\\geq 0, we say thatTALOoccurs when an agent selects a strategy that optimizes the latent objective subject to task\-admissibility:

maxσA∈Σγ​\(x\)⁡𝔼⁡\[Φx​\(σA,σ−A\)\+λ​Ψx​\(σA,σ−A\)\]\.\\max\_\{\\sigma\_\{A\}\\in\\Sigma\_\{\\gamma\}\(x\)\}\\mathbb\{E\}\\\!\\left\[\\Phi\_\{x\}\(\\sigma\_\{A\},\\sigma\_\{\-A\}\)\+\\lambda\\Psi\_\{x\}\(\\sigma\_\{A\},\\sigma\_\{\-A\}\)\\right\]\.The threat arises when the task admits many near\-optimal strategies with different latent effects\. For example, during debate, there may be many arguments that win the debate, allowing a prover to select those that also advance its latent objective\.

### 3\.4Hidden\-Hypothesis Disclosure

To provide a concrete instance ofSIO, we instantiate the latent objective as the disclosure of information about a hidden hypothesis\. LetQQbe a discrete random variable representing a hidden hypothesis that is not part of the stated task, and letXXbe the protocol input\. The verifierVVobserves only its projectionΠV​\(𝐡\)\\Pi\_\{V\}\(\{\\mathbf\{h\}\}\)of the interaction history\.

###### Definition 3\.

The*hidden\-hypothesis disclosure*induced by a strategy profileσ\\sigmais

Ψ𝗁𝗁𝖽\(σ\)≔I\(Q;ΠV\(𝐡\(X,σ\)\)\|X\)\.\\Psi\_\{\\mathsf\{hhd\}\}\(\\sigma\)\\coloneqq I\\\!\\left\(Q;\\Pi\_\{V\}\(\{\\mathbf\{h\}\}\(X,\\sigma\)\)\\,\\middle\|\\,X\\right\)\.

This quantity measures how much additional information the messages available to the verifier reveal aboutHH, beyond the information already contained in the task input\. In particular,Ψ𝗁𝗁𝖽​\(σ\)=0\\Psi\_\{\\mathsf\{hhd\}\}\(\\sigma\)=0precisely whenHHand the verifier’s observed messages are conditionally independent givenXX\.

For example, in debate,XXspecifies the task hypothesis, whileHHrepresents an additional hypothesis that the verifier is not required to assess\. A prover exhibits task\-admissible hidden\-hypothesis disclosure if it selects arguments that preserve its probability of winning while increasingI⁡\(H;ΠV​\(𝐡⁡\(X,σ\)\)∣X\)I\(H;\\Pi\_\{V\}\(\{\\mathbf\{h\}\}\(X,\\sigma\)\)\\mid X\)\. This definition concerns the information available to the verifier rather than whether the verifier consciously identifies or correctly interpretsHH\.111An alternative, observer\-dependent objective may target belief distortion directly\. Given a verifier posteriorP​\(H∣X,ΠV​\(𝐡\)\)P\(H\\mid X,\\Pi\_\{V\}\(\{\\mathbf\{h\}\}\)\)and a target distributionQQ, one may define the latent objective in terms of proximity toQQ, for example as−DKL\(Q∥P\(H∣X,ΠV\(𝐡\)\)\)\-D\_\{\\mathrm\{KL\}\}\(Q\\\|P\(H\\mid X,\\Pi\_\{V\}\(\{\\mathbf\{h\}\}\)\)\)\.

## 4Debate with Cross\-Examination

To illustrate the use ofSIO, we study a computation model for debate with cross\-examination introduced by[Brown\-Cohen et al\. \(2024\)](https://arxiv.org/html/2609.29189#bib.bib4)\.

Debate protocol for a stochastic oracle

All parties have access to𝒪\\mathcal\{O\}, an inputx∈\{0,1\}nx\\in\\\{0,1\\\}^\{n\}, and aKK\-Lipschitz probabilistic oracle machineMM\.AAclaims thatPr\[M\(x\)=1\]≥23,\\Pr\\\!\\left\[M\(x\)=1\\right\]\\geq\\frac\{2\}\{3\},andBBdisputes this claim\.

1. 1\.Let𝐲=\(y1,…,yT\)\{\\mathbf\{y\}\}=\(\{\\textnormal\{y\}\}\_\{1\},\\ldots,\{\\textnormal\{y\}\}\_\{T\}\)be the random variable representing the transcript ofM⁡\(x\)M\(x\)and setd=⌈150​K⌉\.d=\\lceil 150K\\rceil\.
2. 2\.For debate roundt∈\[T\]t\\in\[T\]: 1. \(a\)AAoutputs an estimatep^t∈\[0,1\]\\hat\{p\}\_\{t\}\\in\[0,1\]ofpt=Pr⁡\[yt=1\|𝐲I⁡\(t\)=aI⁡\(t\)\]\.p\_\{t\}=\\Pr\\\!\\left\[\{\\textnormal\{y\}\}\_\{t\}=1\\,\\middle\|\\,\{\\mathbf\{y\}\}\_\{I\(t\)\}=\{\\textnormal\{a\}\}\_\{I\(t\)\}\\right\]\. 2. \(b\)AAqueries an independent copy ofBBforztA∼𝖴⁡\[0,1\],z\_\{t\}^\{A\}\\sim\\mathsf\{U\}\[0,1\],andBBqueries an independent copy ofAAforztB∼𝖴⁡\[0,1\]\.z\_\{t\}^\{B\}\\sim\\mathsf\{U\}\[0,1\]\. 3. \(c\)Setzt=\(ztA\+ztB\)mod1\.z\_\{t\}=\\bigl\(z\_\{t\}^\{A\}\+z\_\{t\}^\{B\}\\bigr\)\\bmod 1\. 4. \(d\)AAsetsat=1a\_\{t\}=1ifzt≤p^tz\_\{t\}\\leq\\hat\{p\}\_\{t\}, andat=0a\_\{t\}=0otherwise\. 5. \(e\)BBcan abort if \(it believes\)AAhas not followed the protocol\.
3. 3\.If the protocol was aborted in roundtt: 1. \(a\)VVdrawsr=192​d2​log⁡100r=192d^\{2\}\\log 100independent samples222Ifyt\{\\textnormal\{y\}\}\_\{t\}is supposed to be the output of an oracle query, these samples are obtained usingrrindependent queries to𝒪⁡\(𝒂I⁡\(t\)\)\\mathcal\{O\}\(\{\\bm\{a\}\}\_\{I\(t\)\}\)\. Otherwise,yt\{\\textnormal\{y\}\}\_\{t\}is a deterministic function of𝒂I⁡\(t\)\{\\bm\{a\}\}\_\{I\(t\)\}given by one step ofMM\.ofyt\{\\textnormal\{y\}\}\_\{t\}, conditioned onyI⁡\(t\)=𝒂I⁡\(t\),\{\\textnormal\{y\}\}\_\{I\(t\)\}=\{\\bm\{a\}\}\_\{I\(t\)\},and uses their sample mean to obtain an estimatep^t𝒪\\hat\{p\}\_\{t\}^\{\\mathcal\{O\}\}ofPr⁡\[yt=1\|𝐲I⁡\(t\)=𝒂I⁡\(t\)\]\\Pr\\\!\\left\[\{\\textnormal\{y\}\}\_\{t\}=1\\,\\middle\|\\,\{\\mathbf\{y\}\}\_\{I\(t\)\}=\{\\bm\{a\}\}\_\{I\(t\)\}\\right\] 2. \(b\)VVchecks whether\|p^t𝒪−p^t\|≥14​d\.\\left\|\\hat\{p\}\_\{t\}^\{\\mathcal\{O\}\}\-\\hat\{p\}\_\{t\}\\right\|\\geq\\frac\{1\}\{4d\}\.If the inequality holds,VVoutputs00; otherwise,VVoutputs11\.
4. 4\.If the protocol was not aborted, then the verifier outputsaTa\_\{T\}\.

Figure 2:Doubly\-efficient debate protocol for a stochastic oracle[Brown\-Cohen et al\. \(2024\)](https://arxiv.org/html/2609.29189#bib.bib4)\.### 4\.1Protocol

The following outline is formalized in Figure[2](https://arxiv.org/html/2609.29189#S4.F2)\. For a probabilistic Turing machineMMand inputxx, the debate setup comprises of a proverAAclaiming thatPr\[M\(x\)=1\]≥23,\\Pr\[M\(x\)=1\]\\geq\\frac\{2\}\{3\},while a cross\-examinerBBargues against this claim\. At roundttin the debate, a proverAAreports a claimp^t\\hat\{p\}\_\{t\}about the conditional probability of the next bit in the machine transcript\. ProverBB, acting as the cross\-examiner, may either accept the claim and allow the next bit to be sampled, or abort and assert thatAA’s claim is inaccurate\. Upon an abort, the verifier adjudicates the disputed claim with the assistance of the stochastic oracle𝒪\\mathcal\{O\}and awards the debate to the prover whose position is correct\. If the protocol terminates without an abort,AAis awarded the win\.

The significance of this protocol, in the context*scalable*oversight, is that it isdoubly efficient\. In other words, the provers operate in time polynomial in the size of the input and the verifier is linear in the length of each oracle query and makes a sub\-linear number of queries to the oracle\. Thus, debate extends reliable oversight to computations that the verifier could not feasibly perform itself\.

For an inputxxand strategy profileσ=\(σA∘σ−A\)\\sigma=\(\\sigma\_\{A\}\\circ\\sigma\_\{\-A\}\), letΦA​\(x,𝐡\)∈\{0,1\}\\Phi\_\{A\}\(x,\{\\mathbf\{h\}\}\)\\in\\\{0,1\\\}indicate whether the verifier rules in favor ofAAon terminal history𝐡\{\\mathbf\{h\}\}\. UnderSIO, for inputy=\(M,x\)y=\(M,x\), the task objective is defined by

ΦA\(x,σ\)=𝔼σ\[ΦA\(x,𝐡\(x,σ\)\)\]=Prσ\[V→1\]\.\\Phi\_\{A\}\(x,\\sigma\)=\\mathbb\{E\}\_\{\\sigma\}\\left\[\\Phi\_\{A\}\(x,\{\\mathbf\{h\}\}\(x,\\sigma\)\)\\right\]=\\Pr\_\{\\sigma\}\[V\\to 1\]\.Thus,ΦA​\(x,σ\)\\Phi\_\{A\}\(x,\\sigma\)is the probability thatAAwins the debate underσ\\sigma, with the expectation taken over all protocol randomness\. The protocol has the following utility on the task objective\.

###### Lemma 1\(Task Completeness[Brown\-Cohen et al\. \(2024\)](https://arxiv.org/html/2609.29189#bib.bib4)\)\.

LetLLbe any language decidable by a K\-Lipschitz probabilistic oracle Turing machineMM\. Then, for everyx∈Lx\\in L, there exists a strategyσA\\sigma\_\{A\}such that, for every strategy opposingσ−A\\sigma\_\{\-A\},

ΦA​\(\(M,x\),σA∘σ−A\)≥23\.\\Phi\_\{A\}\\bigl\(\(M,x\),\\sigma\_\{A\}\\circ\\sigma\_\{\-A\}\\bigr\)\\geq\\frac\{2\}\{3\}\.

### 4\.2Hidden\-hypothesis disclosure

We now examine whether task success prevents a prover from pursuing an additional latent objective\. In the debate protocol, under the claim “Pr\[M\(x\)=1\]≥23\\Pr\[M\(x\)=1\]\\geq\\tfrac\{2\}\{3\}”,AAis required to report sufficiently accurate estimates of the conditional probabilities of the machine transcript ofM⁡\(x\)M\(x\)\. This requirement does not, however, necessarily determine a unique report\. Significantly, approximately task\-equivalent reports leave residual strategic freedom thatAAcan use to disclose information about a hidden hypothesis binaryQ∈\{−1,1\}Q\\in\\\{\-1,1\\\}\.

The projectionΠV​\(𝐡T​\(X,σ\)\)\\Pi\_\{V\}\\bigl\(\{\\mathbf\{h\}\}\_\{T\}\(X,\\sigma\)\\bigr\)includes all information available to the verifier\. For example, if no abort occurs, the verifier observes the sampled machine transcriptΠV​\(𝐡T​\(X,σ\)\)=𝒂\.\\Pi\_\{V\}\\bigl\(\{\\mathbf\{h\}\}\_\{T\}\(X,\\sigma\)\\bigr\)=\{\\bm\{a\}\}\.If the cross\-examiner aborts at roundtt, the verifier instead observes the partial transcript together with the evidence used to adjudicate the disagreement\. Suppressing public randomness and other deterministic protocol data, this projection has the form

ΠV​\(𝐡t​\(X,σ\)\)=\(a1,…,at,𝖺𝖻𝗈𝗋𝗍,p^t,\{𝒪⁡\(𝒂I⁡\(t\)\)\}\)\.\\Pi\_\{V\}\\bigl\(\{\\mathbf\{h\}\}\_\{t\}\(X,\\sigma\)\\bigr\)=\\left\(\{\\textnormal\{a\}\}\_\{1\},\\ldots,\{\\textnormal\{a\}\}\_\{t\},\\mathsf\{abort\},\\hat\{p\}\_\{t\},\\bigl\\\{\\mathcal\{O\}\(\{\\bm\{a\}\}\_\{I\(t\)\}\)\\bigr\\\}\\right\)\.Here,p^t\\hat\{p\}\_\{t\}is the conditional\-probability report disputed at roundtt,I⁡\(t\)I\(t\)identifies the location of the machine configuration examined by the verifier, and\{𝒪⁡\(𝒂I⁡\(t\)\)\}\\\{\\mathcal\{O\}\(\{\\bm\{a\}\}\_\{I\(t\)\}\)\\\}denotes the collection of oracle samples used in the resulting statistical test\.

Following Definition[3](https://arxiv.org/html/2609.29189#Thmdefinition3), hidden\-hypothesis disclosure admits the latent objective

ΨA\(x,σ\)=I\(Q;ΠV\(𝐡T\(X,σ\)\)\|X=x\)\.\\Psi\_\{A\}\(x,\\sigma\)=I\\left\(Q;\\Pi\_\{V\}\\bigl\(\{\\mathbf\{h\}\}\_\{T\}\(X,\\sigma\)\\bigr\)\\,\\middle\|\\,X=x\\right\)\.This quantity measures how much the verifier’s observation of the debate reveals aboutHH, beyond what is already known from the inputxx\. The hidden hypothesis may be naturally connected to the subject of the debate without being part of its stated task objective\. For example, the debate may concern the task claim “the bridge is unsafe,” while the prover’s hidden hypothesis is “the damage resulted from neglected maintenance\.” The prover can establish that the bridge is unsafe while selecting evidence \(that is, perturbing arguments\) that subtly points toward maintenance failures\. An example of how a Turing machine transcript can leak information about a hidden hypothesis is given in Appendix[A](https://arxiv.org/html/2609.29189#A1)\.

### 4\.3Prover Strategies

At roundtt, letpt=Pr⁡\[yt=1\|𝐲I⁡\(t\)=𝒂I⁡\(t\)\]p\_\{t\}=\\Pr\\left\[\{\\textnormal\{y\}\}\_\{t\}=1\\,\\middle\|\\,\{\\mathbf\{y\}\}\_\{I\(t\)\}=\{\\bm\{a\}\}\_\{I\(t\)\}\\right\]denote the true conditional probability of the next machine\-transcript bit\. The honest strategy of Lemma[1](https://arxiv.org/html/2609.29189#Thmlemma1)is forAAis to drawRRindependent samples from the relevant conditional computation and form the empirical estimatep¯t\(R\)=1R​∑j=1Ryt,j,\\bar\{p\}\_\{t\}^\{\(R\)\}=\\tfrac\{1\}\{R\}\\sum\_\{j=1\}^\{R\}\{\\textnormal\{y\}\}\_\{t,j\},whereyt,j∼𝖡𝖾𝗋𝗇⁡\(pt\),\{\\textnormal\{y\}\}\_\{t,j\}\\sim\\mathsf\{Bern\}\(p\_\{t\}\),and reporting this value\. Subsequently, for parameterΔ\>0\\Delta\>0,AAcan perturb the honest strategy by reporting the value

p^t=𝖼𝗅𝗂𝗉\[0,1\]​\(p¯t\(R\)\+Δ​Q\)\.\\hat\{p\}\_\{t\}=\\mathsf\{clip\}\_\{\[0,1\]\}\\left\(\\bar\{p\}\_\{t\}^\{\(R\)\}\+\\Delta Q\\right\)\.Formally, the corresponding strategy is

σAR,Δ\(p^t\|x,ΠA\(𝐡t−1\),Q\)=Pr\[clip\[0,1\]\(p¯t\(R\)\+ΔQ\)=p^t\|x,ΠA\(𝐡t−1\),H\]\.\\sigma\_\{A\}^\{R,\\Delta\}\\left\(\\hat\{p\}\_\{t\}\\,\\middle\|\\,x,\\Pi\_\{A\}\(\{\\mathbf\{h\}\}\_\{t\-1\}\),Q\\right\)=\\Pr\\left\[\\operatorname\{clip\}\_\{\[0,1\]\}\\left\(\\bar\{p\}\_\{t\}^\{\(R\)\}\+\\Delta Q\\right\)=\\hat\{p\}\_\{t\}\\,\\middle\|\\,x,\\Pi\_\{A\}\(\{\\mathbf\{h\}\}\_\{t\-1\}\),H\\right\]\.We abbreviate this strategy byσA∼\(R,Δ\)\.\\sigma\_\{A\}\\sim\(R,\\Delta\)\.The sample countRRcontrols the accuracy of the task\-relevant estimate, whileΔ\\Deltacontrols the magnitude of the hidden\-hypothesis signal\.

A strategyσB\\sigma\_\{B\}forBBis to draw a sample estimateq^t\\hat\{q\}\_\{t\}ofptp\_\{t\}at each round by performingRRsimulations of generatingyt\{\\textnormal\{y\}\}\_\{t\}given𝐲I⁡\(t\)=𝒂I⁡\(t\)\{\\mathbf\{y\}\}\_\{I\(t\)\}=\{\\bm\{a\}\}\_\{I\(t\)\}\. Subsequently,BBaborts if\|p^t−q^t\|≥τ\|\\hat\{p\}\_\{t\}\-\\hat\{q\}\_\{t\}\|\\geq\\tau\. Under this strategy we sayσB∼\(R,τ\)\\sigma\_\{B\}\\sim\(R,\\tau\)\. We say that the strategy is honest if the choice ofτ\\tauis sound\.

### 4\.4Results

The following describes an accurate task objective performance, against an honestBB, for a range of biasedAAstrategies\. Let

###### Theorem 1\.

ForK≥1K\\geq 1, letLLbe any language decided by aKK\-Lipschitz oracle Turing machineMM\. LetPr\[M\(x\)=1\]=α∗,R≥192d2log\(100T\),Δ<1/\(16d\),\\Pr\[M\(x\)=1\]=\\alpha^\{\*\},R\\geq 192d^\{2\}\\log\(100T\),\\Delta<\{1\}/\{\(16d\)\},andτ=1/\(2​d\)\.\\tau=\{1\}/\{\(2d\)\}\.Then, on the protocol of Figure[2](https://arxiv.org/html/2609.29189#S4.F2), for every strategyσ=σA∘σB\\sigma=\\sigma\_\{A\}\\circ\\sigma\_\{B\}parameterized byσA∼\(R,Δ\)\\sigma\_\{A\}\\sim\(R,\\Delta\)andσB∼\(R,τ\)\\sigma\_\{B\}\\sim\(R,\\tau\), the task objective observes

\(α∗−1100\)⋅299300≤ΦA​\(x,σ\)≤\(α∗\+1100\)\+1300,\\left\(\\alpha^\{\*\}\-\\frac\{1\}\{100\}\\right\)\\cdot\\frac\{299\}\{300\}\\leq\\Phi\_\{A\}\(x,\\sigma\)\\leq\\left\(\\alpha^\{\*\}\+\\frac\{1\}\{100\}\\right\)\+\\frac\{1\}\{300\},

The proof is in Appendix[B](https://arxiv.org/html/2609.29189#A2)\. This covers the admissible region of strategies\. For anyt∈\[T\]t\\in\[T\], define

gt\(Δ\)=Pr\[\|Δ\+σtz\|<τ\],g\_\{t\}\(\\Delta\)=\\Pr\[\|\\Delta\+\\sigma\_\{t\}z\|<\\tau\],wherez∼𝖭⁡\(0,1\)z\\sim\\mathsf\{N\}\(0,1\)andσt=2​pt​\(1−pt\)/R\\sigma\_\{t\}=\\sqrt\{\{2p\_\{t\}\(1\-p\_\{t\}\)\}/\{R\}\}\. The following bounds the task objective for general perturbations\.

###### Theorem 2\.

ForK≥1K\\geq 1, letLLbe any language decided by aKK\-Lipschitz oracle Turing machineMM\. LetR≥192​d2​log⁡\(600​T\),Δ≥0,R\\geq 192d^\{2\}\\log\(600T\),\\Delta\\geq 0,andτ=1/\(2​d\)\.\\tau=\{1\}/\{\(2d\)\}\.Assumept∈\(0\.01,0\.99\)p\_\{t\}\\in\(0\.01,0\.99\)for all machine configurations onMM\. Then, on the protocol of Figure[2](https://arxiv.org/html/2609.29189#S4.F2), for every strategyσ=σA∘σB\\sigma=\\sigma\_\{A\}\\circ\\sigma\_\{B\}parameterized byσA∼\(R,Δ\)\\sigma\_\{A\}\\sim\(R,\\Delta\)andσB∼\(R,τ\)\\sigma\_\{B\}\\sim\(R,\\tau\), the task objective observes

ΦA​\(x,σA∘σB\)≤min⁡\{1,𝔼⁡\[g1​\(Δ\)\]\+1100\}\.\\Phi\_\{A\}\(x,\\sigma\_\{A\}\\circ\\sigma\_\{B\}\)\\leq\\min\\left\\\{1,\\,\\mathbb\{E\}\\\!\\left\[g\_\{1\}\(\\Delta\)\\right\]\+\\frac\{1\}\{100\}\\right\\\}\.

The proof is in Appendix[B](https://arxiv.org/html/2609.29189#A2)\. Next, we provide a characterisation of how changingΔ\\Deltaaffects the latent objective\. Lethx=H⁡\(Q∣X=x\)h\_\{x\}=H\(Q\\mid X=x\)denote the hidden hypothesis entropy on the task input\.

###### Theorem 3\.

LetLLbe any language decided by aKK\-Lipschitz oracle Turing machineMM\. Assumept∈\(0\.01,0\.99\)p\_\{t\}\\in\(0\.01,0\.99\)for all machine configurations onMMand that the priorPr⁡\[Q∣X=x\]\\Pr\[Q\\mid X=x\]contains sufficient entropy\. Then, for anyΔ≥0\\Delta\\geq 0and any honest cross\-examiner strategyσB\\sigma\_\{B\}, there existsR∈O⁡\(d2​log⁡\(T\)\)R\\in O\(d^\{2\}\\log\(T\)\)such that, forσA=\(Δ,R\)\\sigma\_\{A\}=\(\\Delta,R\), the latent objective observes

ΨA​\(x,σA∘σB\)=Ω⁡\(hx⋅min⁡\{1,Δ2​T\}\)\.\\Psi\_\{A\}\\\!\\left\(x,\\sigma\_\{A\}\\circ\\sigma\_\{B\}\\right\)=\\Omega\\\!\\left\(h\_\{x\}\\cdot\\min\\left\\\{1,\\Delta^\{2\}T\\right\\\}\\right\)\.

The proof is in Appendix[C](https://arxiv.org/html/2609.29189#A3)\. The characterization provided by these two theorems is visualized in Figure[1](https://arxiv.org/html/2609.29189#S1.F1)\.

### 4\.5Discussion

These results identify a small\-perturbation regime,Δ<1/\(16​d\)\\Delta<1/\(16d\), in which task performance remains close to the reference acceptance probabilityα∗\\alpha^\{\*\}, while disclosure grows at least proportionally tohx​Δ​²​Th\_\{x\}\\Delta ²Tbefore saturation\. Larger perturbations reduce the Gaussian interval probability governing the task bound at fixed sampling variance, exposing a tension between information transmission and consistency with an honest cross\-examiner\. Thus, oversight of task accuracy alone does not protect the hidden hypothesis\. That is, even accurate transcripts can accumulate substantial disclosure\.

Both Theorems[2](https://arxiv.org/html/2609.29189#S4.Ex14)and[3](https://arxiv.org/html/2609.29189#Thmtheorem3)assume that the transition probabilitiesptp\_\{t\}are bounded away from00and11and Theorem[3](https://arxiv.org/html/2609.29189#Thmtheorem3)assumes that the hidden hypothesis has non\-negligible entropy\. These assumptions isolate the regime of interest in which nearly deterministic steps offer little scope for perturbation\-based disclosure and can be omitted from the leakage analysis\. In addition, a hypothesis with negligible entropy already carries little uncertainty before any interaction\. The latter case makes confidentiality largely vacuous, rather than demonstrating transcript\-induced disclosure\.

More broadly, these results motivate treating transcripts as outputs with their own information\-disclosure properties, rather than merely as evidence supporting a final decision\. Transcripts retained for auditing, evaluation, or downstream reuse can expose information that task\-accuracy metrics do not capture\. Oversight should therefore assess both decision quality and cumulative disclosure, including information revealed through aborts\. Restricting transcript access, limiting interaction length, or changing reporting precision are natural design directions, although each requires a separate analysis of its effects on correctness and disclosure\.

## 5Towards Mitigation

The vulnerability identified above arises from a mismatch between the task objective and the behavior desired of the debaters\. The task objective rewards producing a winning argument\. Although this supports scalable verification, it does not uniquely determine*how*that argument should be produced\. A debater may therefore achieve high task performance while pursuing latent objectives through its construction of arguments\. Mitigating such behavior requires changing the incentive landscape\.

A natural desideratum is*oracle alignment*\. A conditional probabilityp^t\\hat\{p\}\_\{t\}generated by the “for” debaterAAshould coincide with the corresponding oracle conditional probability\. One might attempt to induce this behavior by adding rewards or penalties based on proximity to oracle\-generated conditional probabilities\. In general, however, this is insufficient\. Gains from a latent objective may offset the task reward for accurate reporting, leaving the debater indifferent among disclosure strategies or even leaving misreporting profitable\.

### 5\.1Expanded cross\-examination

This limitation motivates giving the cross\-examinerBBan additional way to challengeAA’s reports\. The additional challenge entails issuing anabort driftchallenge when the reports exhibit a persistent signed deviation over a trailing window ofN≥1N\\geq 1rounds\. DefineJt,N=\{t−N,…,t−1\}J\_\{t,N\}=\\\{t\-N,\\ldots,t\-1\\\}as the most recentNNdebate rounds\. For everys∈Jt,Ns\\in J\_\{t,N\}, letps=Pr⁡\[ys=1\|𝐲I⁡\(s\)=aI⁡\(s\)\]p\_\{s\}=\\Pr\\\!\\left\[\{\\textnormal\{y\}\}\_\{s\}=1\\,\\middle\|\\,\{\\mathbf\{y\}\}\_\{I\(s\)\}=\{\\textnormal\{a\}\}\_\{I\(s\)\}\\right\]denote the conditional probability associated with the transcript prefix fixed at roundss\. The trailing signed deviation is

Dt,N=1N​∑s∈Jt,N\(p^s−p^s𝒪\)\.D\_\{t,N\}=\\frac\{1\}\{N\}\\sum\_\{s\\in J\_\{t,N\}\}\\left\(\\hat\{p\}\_\{s\}\-\\hat\{p\}\_\{s\}^\{\\mathcal\{O\}\}\\right\)\.For a constantc≥1c\\geq 1, the verifier accepts an abort drift challenge when\|Dt,N\|≥14​d​N\.\|D\_\{t,N\}\|\\geq\\frac\{1\}\{4d\\sqrt\{N\}\}\.Thus, a persistent signed deviation of magnitudebbis detectable onceb≥1/\(d​N\)b\\geq 1/\(d\\sqrt\{N\}\), even if no individual report is inaccurate enough to support an𝖺𝖻𝗈𝗋𝗍𝖾𝗋𝗋𝗈𝗋\\mathsf\{aborterror\}challenge\.

###### Theorem 4\.

LetLLbe any language decided by aKK\-Lipschitz oracle Turing machineMMandW∈\[T\]W\\in\[T\]be the sliding\-window parameter\. ForR≥192​d2​log⁡\(100​T\),R\\geq 192d^\{2\}\\log\(100T\),Δ≥1/\(d​W\),\\Delta\\geq 1/\(d\\sqrt\{W\}\),τ1=1/\(2​d\),\\tau\_\{1\}=1/\(2d\),andτ2=1/\(2​d​W\),\\tau\_\{2\}=1/\(2d\\sqrt\{W\}\),letσA\(1\)∼\(R,0\),σA\(2\)∼\(R,Δ\),\\sigma\_\{A\}^\{\(1\)\}\\sim\(R,0\),\\sigma\_\{A\}^\{\(2\)\}\\sim\(R,\\Delta\),andσB∼\(R,τ1,τ2\)\\sigma\_\{B\}\\sim\(R,\\tau\_\{1\},\\tau\_\{2\}\)\. Then, for anyx∈Lx\\in L, on the protocol of Figure[3](https://arxiv.org/html/2609.29189#A4.F3),

ΦA​\(x,σA\(1\)∘σB\)≥35andΦA​\(x,σA\(2\)∘σB\)≤1150\\Phi\_\{A\}\\left\(x,\\sigma\_\{A\}^\{\(1\)\}\\circ\\sigma\_\{B\}\\right\)\\geq\\frac\{3\}\{5\}\\quad\\text\{and\}\\quad\\Phi\_\{A\}\\left\(x,\\sigma\_\{A\}^\{\(2\)\}\\circ\\sigma\_\{B\}\\right\)\\leq\\frac\{1\}\{150\}

This result shows how a sliding\-window check can strengthen oversight against persistent perturbations\. By testing discrepancies across a window ofWWrounds, the cross\-examiner can detect shifts at scale1/\(d​W\)1/\(d\\sqrt\{W\}\), rather than relying solely on discrepancies large enough to be detected in an individual round\. The resulting guarantee separates unperturbed reporting, which retains task success probability at least3/53/5, from the specified perturbed strategy, whose task success probability is at most1/1501/150\. IncreasingWWtherefore narrows the range of persistent perturbations compatible with successful task performance\. This provides a mechanism for curtailing the disclosure strategy studied above\.

Stronger oversight requires more work from the verifier to audit a larger window, while leaving the per\-round sampling work ofAAandBBunchanged\. Thus, this improvement comes with a computational trade\-off\.

## 6Related Work

A major strand of oversight research formalises scalability, closely related to the requirement that oversight protocols*relativise*[Irving and Marshall \(2025\)](https://arxiv.org/html/2609.29189#bib.bib6)\. Theoretical work shows that debate can enable limited verifiers to check complex claims with substantially less effort than solving them independently[Brown\-Cohen et al\. \(2024\)](https://arxiv.org/html/2609.29189#bib.bib4);[Irving et al\. \(2018\)](https://arxiv.org/html/2609.29189#bib.bib3), with extensions studying capability asymmetries and the human input required for reliable oversight[Brown\-Cohen et al\. \(2026\)](https://arxiv.org/html/2609.29189#bib.bib5);[Engels et al\. \(2025\)](https://arxiv.org/html/2609.29189#bib.bib11)\. Prover\-estimator debate addresses obfuscated arguments, ensuring under stability assumptions that honest debaters can win with computational resources comparable to those of dishonest opponents[Brown\-Cohen et al\. \(2025\)](https://arxiv.org/html/2609.29189#bib.bib7)\. These results focus on making correct adjudication feasible, whereas we study latent objectives pursued within task\-admissible interactions\.

Debate\-based alignment safety cases connect success in debate to honesty, subject to additional training and deployment assumptions[Buhl et al\. \(2025\)](https://arxiv.org/html/2609.29189#bib.bib9)\. Our analysis highlights a complementary concern, namely that honest, task\-admissible behaviour need not preclude undesirable information disclosure through the transcript\. Mechanism design for alignment and control studies how to incentivize honesty and obedience when agents’ preferences and capabilities are unknown[Bergemann et al\. \(2026\)](https://arxiv.org/html/2609.29189#bib.bib10)\. This perspective offers a potential route to mitigating the strategic freedom identified by our framework, complementing our analysis of transcript\-level objectives\.

#### Acknowledgments

This project was undertaken in collaboration with the Australian AI Safety Institute \(AISI\) and supported by funding from the Department of Industry, Science and Resources \(DISR\), as part of research into AI alignment tools and techniques\.

## References

- D\. Bergemann, A\. Koh, and S\. MorrisMechanism design for alignment and control\.arXiv preprint arXiv:2609\.01595\.Cited by:[§6](https://arxiv.org/html/2609.29189#S6.p2.1)\.
- Brown\-Cohenet al\.\(2026\)J\. Brown\-Cohen, G\. Irving, S\. C\. Marshall, I\. Newman, G\. Piliouras, and M\. SzegedyDebate is efficient with your time\.arXiv preprint arXiv:2602\.08630\.Cited by:[§1](https://arxiv.org/html/2609.29189#S1.p2.1),[§6](https://arxiv.org/html/2609.29189#S6.p1.1)\.
- Brown\-Cohenet al\.\(2025\)J\. Brown\-Cohen, G\. Irving, G\. Piliouras, L\. Chen, J\. Li, and Z\. XunAvoiding obfuscation with prover\-estimator debate\.arXiv preprint arXiv:2506\.13609\.Cited by:[§1](https://arxiv.org/html/2609.29189#S1.p2.1),[§6](https://arxiv.org/html/2609.29189#S6.p1.1)\.
- Brown\-Cohenet al\.\(2024\)J\. Brown\-Cohen, G\. Irving, and G\. PiliourasScalable ai safety via doubly\-efficient debate\.InProceedings of the 41st International Conference on Machine Learning \(ICML\),Cited by:[§1\.1](https://arxiv.org/html/2609.29189#S1.SS1.p2.1),[§1](https://arxiv.org/html/2609.29189#S1.p2.1),[§2\.1](https://arxiv.org/html/2609.29189#S2.SS1.p1.1),[Figure 2](https://arxiv.org/html/2609.29189#S4.F2),[Figure 2](https://arxiv.org/html/2609.29189#S4.F2.5),[§4](https://arxiv.org/html/2609.29189#S4.p1.1),[§6](https://arxiv.org/html/2609.29189#S6.p1.1),[Lemma 1](https://arxiv.org/html/2609.29189#Thmlemma1)\.
- Buhlet al\.\(2025\)M\. D\. Buhl, J\. Pfau, B\. Hilton, and G\. IrvingAn alignment safety case sketch based on debate\.arXiv preprint arXiv:2505\.03989\.Cited by:[§6](https://arxiv.org/html/2609.29189#S6.p2.1)\.
- Christianoet al\.\(2018\)P\. Christiano, B\. Shlegeris, and D\. AmodeiSupervising strong learners by amplifying weak experts\.arXiv preprint arXiv:1810\.08575\.Cited by:[§1](https://arxiv.org/html/2609.29189#S1.p2.1)\.
- Engelset al\.\(2025\)J\. Engels, D\. D\. Baek, S\. Kantamneni, and M\. TegmarkScaling laws for scalable oversight\.InAdvances in Neural Information Processing Systems \(NeurIPS\),Cited by:[§6](https://arxiv.org/html/2609.29189#S6.p1.1)\.
- Huet al\.\(2026\)J\. Hu, X\. Huang, Y\. Sun, Y\. Dong, and X\. HuangLying with truths: open\-channel multi\-agent collusion for belief manipulation via generative montage\.InProceedings of the 64th Annual Meeting of the Association for Computational Linguistics \(Volume 1: Long Papers\),pp\. 5979–5996\.Cited by:[§1](https://arxiv.org/html/2609.29189#S1.p3.1)\.
- Irvinget al\.\(2018\)G\. Irving, P\. Christiano, and D\. AmodeiAI safety via debate\.arXiv preprint arXiv:1805\.00899\.Cited by:[§1](https://arxiv.org/html/2609.29189#S1.p2.1),[§6](https://arxiv.org/html/2609.29189#S6.p1.1)\.
- Irving and Marshall \(2025\)G\. Irving and S\. MarshallThe need to relativise in debate\.Note:AI Alignment Forum postExternal Links:[Link](https://www.alignmentforum.org/posts/XycoFucvxAPhcgJQa/the-need-to-relativise-in-debate-1)Cited by:[§6](https://arxiv.org/html/2609.29189#S6.p1.1)\.
- Leikeet al\.\(2018\)J\. Leike, D\. Krueger, T\. Everitt, M\. Martic, V\. Maini, and S\. LeggScalable agent alignment via reward modeling: a research direction\.arXiv preprint arXiv:1811\.07871\.Cited by:[§1](https://arxiv.org/html/2609.29189#S1.p2.1)\.

## Appendix AToy Example

This example illustrates that, for a probabilistic computation, information may be present not only in whether the machine computes the correct answer, but also in which valid answer it finds\. In particular, a probabilistic machine induces a distribution over execution transcripts, and this distribution may depend on*properties of the input*even when the algorithm is simply solving its prescribed computational task\.

Consider the standard unstructured search problem\. The input is an arrayx∈\{0,1\}Nx\\in\\\{0,1\\\}^\{N\}containing at least one marked entry, and the goal is to output an indexi∈\[N\]i\\in\[N\]such thatxi=1x\_\{i\}=1\.

Partition the array into two equal\-sized branches, labeled00and11\. Thus, each branch containsN/2N/2entries\. Let the hidden hypothesisQ∈\{0,1\}Q\\in\\\{0,1\\\}determine the distribution of marked entries between the two branches:

branch​0branch​1Q=03​mmQ=1m3​m\\begin\{array\}\[\]\{c\|cc\}&\\text\{branch \}0&\\text\{branch \}1\\\\ \\hline\\cr Q=0&3m&m\\\\ Q=1&m&3m\\end\{array\}wherem≥1m\\geq 1and3​m≤N/23m\\leq N/2\. Under either hypothesis, the total number of marked entries is4​m4m\.

Now consider the following fixed probabilistic machineMM\. The machine samples an indexi∈\[N\]i\\in\[N\]uniformly at random, readsxix\_\{i\}, and repeats ifxi=0x\_\{i\}=0\. Ifxi=1x\_\{i\}=1, it outputsiiand halts\. This is a Las Vegas algorithm for unstructured search\. The algorithm always outputs a correct index and halts with probability one\. Moreover, since there are4​m4mmarked entries under both hypotheses, the success probability on each probe is4​mN\.\\frac\{4m\}\{N\}\.Therefore the number of probesKKbefore halting has the same distribution underQ=0Q=0andQ=1Q=1, namely, fork≥1k\\geq 1,

Pr⁡\[K=k∣Q\]=\(1−4​mN\)k−1​4​mN,\\Pr\[K=k\\mid Q\]=\\left\(1\-\\frac\{4m\}\{N\}\\right\)^\{k\-1\}\\frac\{4m\}\{N\},for both values ofQQ\. In particular,

𝔼⁡\[K∣Q=0\]=𝔼⁡\[K∣Q=1\]=N4​m\.\\mathbb\{E\}\[K\\mid Q=0\]=\\mathbb\{E\}\[K\\mid Q=1\]=\\frac\{N\}\{4m\}\.
Nevertheless, the returned index carries information aboutQQ\. LetX∈\{0,1\}X\\in\\\{0,1\\\}denote the branch containing the returned index\. Since the machine samples uniformly until it finds a marked entry, the returned index is uniformly distributed over the marked entries\. Hence

Pr⁡\[X=1∣Q=0\]=m3​m\+m=14,\\Pr\[X=1\\mid Q=0\]=\\frac\{m\}\{3m\+m\}=\\frac\{1\}\{4\},whereas

Pr⁡\[X=1∣Q=1\]=3​mm\+3​m=34\.\\Pr\[X=1\\mid Q=1\]=\\frac\{3m\}\{m\+3m\}=\\frac\{3\}\{4\}\.Thus, the algorithm does not append any additional message for disclosure\. It simply returns a solution to the search problem, and the valid solution it finds reveals information about the input\.

IfAAdenotes the execution transcript, then the transcript includes the returned index and therefore determinesXX\. Consequently,I⁡\(Q,A\)≥I⁡\(Q,X\)\>0\.I\(Q;A\)\\geq I\(Q;X\)\>0\.

In addition, a stronger phenomenon occurs when the machine has discretion over its sampling policy\. By perturbing the distribution used to select the next probe, while leaving the stopping rule and correctness condition unchanged, the machine can create a communication channel through the machine computation\.

For example, instead of choosing every probe uniformly across the array, the machineMMproceeds as follows:

1. 1\.Select branch11with probabilityppand branch00with probability1−p1\-p\.
2. 2\.Select an index uniformly within the chosen branch\.
3. 3\.Read its value\.
4. 4\.If the selected index is marked, output its index; otherwise repeat\.

Standard Las Vegas corresponds top=12\.p=\\frac\{1\}\{2\}\.Under the perturbationp=12\+δ,\|δ\|<12,p=\\frac\{1\}\{2\}\+\\delta,\|\\delta\|<\\frac\{1\}\{2\},every returned answer remains correct\. Since every index still has positive probability of being sampled, the algorithm still terminates almost surely on every promised input\. Crucially, the perturbation affects which input location the machine actually reads next\. The communication takes place through the machine’s computation transcript\.

In conclusion, the perturbation can increase information communicated by making the machine’s sampling choices depend on a hidden bitQQ; it slightly favors branch11whenQ=1Q=1and branch00whenQ=0Q=0\. The branch of the returned witness becomes correlated withQQ, allowing an observer to infer the hidden bit with better\-than\-chance accuracy\. Thus, relative to an unbiased policy independent ofQQ, the machine communicates additional information entirely through its legitimate computational choices, without appending a message or sacrificing task performance\.

## Appendix BTask Objective Proofs

### B\.1Bounding the Task Objective

We now demonstrate how to bound the task objective\. This is achieved through a sequence of steps that focus on different aspects of task performance\. For each roundtt, define the good\-estimation event

ℰt=\{\|p¯t−pt\|<116​d\}∩\{\|q^t−pt\|<18​d\},\\mathcal\{E\}\_\{t\}=\\left\\\{\\left\|\\bar\{p\}\_\{t\}\-p\_\{t\}\\right\|<\\frac\{1\}\{16d\}\\right\\\}\\cap\\left\\\{\\left\|\\hat\{q\}\_\{t\}\-p\_\{t\}\\right\|<\\frac\{1\}\{8d\}\\right\\\},wherep¯t\\bar\{p\}\_\{t\}is the sample estimate obtained byAAprior to adding the perturbation\. LetNNdenote the protocol stopping time\. Define the uniform good\-estimation event

ℰ=⋂t=1Nℰt∩\{\|p^N𝒪−pN\|<18​d\}\\mathcal\{E\}=\\bigcap\_\{t=1\}^\{N\}\\mathcal\{E\}\_\{t\}\\cap\\\{\|\\hat\{p\}\_\{N\}^\{\\mathcal\{O\}\}\-p\_\{N\}\|<\\frac\{1\}\{8d\}\\\}and the no\-abort event by𝒦=\{the protocol does not abort\}\.\\mathcal\{K\}=\\\{\\text\{the protocol does not abort\}\\\}\.So thatℰ\\mathcal\{E\}is well\-defined, we setp^T𝒪=pT\\hat\{p\}\_\{T\}^\{\\mathcal\{O\}\}=p\_\{T\}if no abort occurs\. The good\-estimation event states allows us to analyse the protocol under well\-behaved sample estimates\. We first focus on the good\-estimation event under small perturbationsΔ\\Delta, which implies that the debate does not abort\. That is, ifq^t\\hat\{q\}\_\{t\}andp^t𝒪\\hat\{p\}\_\{t\}^\{\\mathcal\{O\}\}are “good” estimates, as defined above, then an abort under honest strategyσB𝗁𝗈𝗇\\sigma\_\{B\}^\{\\mathsf\{hon\}\}implies

\|p^t−q^t\|≥12​d⟹\|p^t−pt\|≥38​d⟹\|p^t𝒪−p^t\|≥14​d,\\displaystyle\|\\hat\{p\}\_\{t\}\-\\hat\{q\}\_\{t\}\|\\geq\\frac\{1\}\{2d\}\\implies\|\\hat\{p\}\_\{t\}\-p\_\{t\}\|\\geq\\frac\{3\}\{8d\}\\implies\|\\hat\{p\}\_\{t\}^\{\\mathcal\{O\}\}\-\\hat\{p\}\_\{t\}\|\\geq\\frac\{1\}\{4d\},\(2\)where the last statement contradictsℰ\\mathcal\{E\}for perturbationΔ≤1/\(16​d\)\\Delta\\leq 1/\(16d\)\. Therefore, an abort is not possible under eventℰ\\mathcal\{E\}\. To bound the task objective on small perturbations, we decomposeVV’s acceptance probability as follows\.

Pr⁡\[V→1∣Δ\]\\displaystyle\\Pr\[V\\to 1\\mid\\Delta\]=Pr\[V→1∣ℰ,Δ\]Pr\[ℰ∣Δ\]\+Pr\[V→1∣¬ℰ,Δ\]Pr\[¬ℰ∣Δ\]\\displaystyle=\\Pr\[V\\to 1\\mid\\mathcal\{E\},\\Delta\]\\,\\Pr\[\\mathcal\{E\}\\mid\\Delta\]\+\\Pr\[V\\to 1\\mid\\neg\\mathcal\{E\},\\Delta\]\\,\\Pr\[\\neg\\mathcal\{E\}\\mid\\Delta\]Thus, the task objective satisfies,

Pr\[V→1∣ℰ,Δ\]Pr\[ℰ\]≤Pr\[V→1,Δ\]≤Pr\[V→1∣ℰ,Δ\]\+Pr\[¬ℰ\],\\displaystyle\\Pr\[V\\to 1\\mid\\mathcal\{E\},\\Delta\]\\Pr\[\\mathcal\{E\}\]\\leq\\Pr\[V\\to 1,\\Delta\]\\leq\\Pr\[V\\to 1\\mid\\mathcal\{E\},\\Delta\]\+\\Pr\[\\neg\\mathcal\{E\}\],\(3\)where, for perturbation sizeΔ<1/\(16​d\)\\Delta<1/\(16d\),\{ℰ,Δ\}⊆𝒦\\\{\\mathcal\{E\},\\Delta\\\}\\subseteq\\mathcal\{K\}\.

For larger perturbations, we focus on the outcome of an abort under good estimation\. By \([2](https://arxiv.org/html/2609.29189#A2.E2)\), an abort under good estimation implies thatp^t\\hat\{p\}\_\{t\}exceeds the verifier’s rejection threshold \(which can occur for large enoughOPENΔ\)\\Delta\)\. Thus, acceptance is impossible onℰ∩¬𝒦\\mathcal\{E\}\\cap\\neg\\mathcal\{K\}, and hence

Pr\[V→1,ℰ,¬𝒦\]=0\.\\Pr\\\!\\left\[V\\to 1,\\mathcal\{E\},\\neg\\mathcal\{K\}\\right\]=0\.We conclude that acceptance can occur only onℰ∩𝒦\\mathcal\{E\}\\cap\\mathcal\{K\}or on the failure event¬ℰ\\neg\\mathcal\{E\}\. Therefore,

Pr\[V→1\]\\displaystyle\\Pr\[V\\to 1\]=Pr\[V→1,ℰ,𝒦\]\+Pr\[V→1,ℰ,¬𝒦\]\+Pr\[V→1,¬ℰ\]\\displaystyle=\\Pr\[V\\to 1,\\mathcal\{E\},\\mathcal\{K\}\]\+\\Pr\[V\\to 1,\\mathcal\{E\},\\neg\\mathcal\{K\}\]\+\\Pr\[V\\to 1,\\neg\\mathcal\{E\}\]≤Pr⁡\[ℰ∩𝒦\]\+Pr⁡\[¬ℰ\]\.\\displaystyle\\leq\\Pr\[\\mathcal\{E\}\\cap\\mathcal\{K\}\]\+\\Pr\[\\neg\\mathcal\{E\}\]\.
IfPr⁡\[ℰ\]\>0\\Pr\[\\mathcal\{E\}\]\>0, this can equivalently be written as

Pr\[V→1\]\\displaystyle\\Pr\[V\\to 1\]≤Pr⁡\[ℰ∩𝒦\]\+Pr⁡\[¬ℰ\]\\displaystyle\\leq\\Pr\[\\mathcal\{E\}\\cap\\mathcal\{K\}\]\+\\Pr\[\\neg\\mathcal\{E\}\]=Pr⁡\[ℰ\]​Pr⁡\[𝒦∣ℰ\]\+Pr⁡\[¬ℰ\]\\displaystyle=\\Pr\[\\mathcal\{E\}\]\\Pr\[\\mathcal\{K\}\\mid\\mathcal\{E\}\]\+\\Pr\[\\neg\\mathcal\{E\}\]=Pr⁡\[ℰ\]​Pr⁡\[𝒦∣ℰ\]\+Pr⁡\[¬ℰ\]\\displaystyle=\\Pr\[\\mathcal\{E\}\]\\Pr\[\\mathcal\{K\}\\mid\\mathcal\{E\}\]\+\\Pr\[\\neg\\mathcal\{E\}\]≤Pr⁡\[𝒦∣ℰ\]\+Pr⁡\[¬ℰ\]\.\\displaystyle\\leq\\Pr\[\\mathcal\{K\}\\mid\\mathcal\{E\}\]\+\\Pr\[\\neg\\mathcal\{E\}\]\.\(4\)
The following subsections will bound each term in \([3](https://arxiv.org/html/2609.29189#A2.E3)\) and \([4](https://arxiv.org/html/2609.29189#A2.E4)\) to provide a characterization of the expected task objective asΔ\\Deltagrows\. We begin with the good\-estimation event\.

### B\.2Likelihood of good\-estimation

We now provide a bound for the good\-estimation event\. We require the following version of the Chernoff bound\.

###### Lemma 2\.

LetX1,…,XRX\_\{1\},\\ldots,X\_\{R\}be independent Bernoulli random variables, each taking value11with probabilityppand00with probability\(1−p\)\(1\-p\)\. Letμ¯=1R​∑i=1RXi\\bar\{\\mu\}=\\tfrac\{1\}\{R\}\\sum\_\{i=1\}^\{R\}X\_\{i\}be the empirical mean of the random variables\. Then

Pr\[\|μ¯−p\|≥s<2exp\(−s2​R3\)\]\\Pr\\left\[\|\\bar\{\\mu\}\-p\|\\geq s<2\\exp\\left\(\\frac\{\-s^\{2\}R\}\{3\}\\right\)\\right\]

###### Lemma 3\.

Suppose thatR≥192​d2​log⁡\(100​T\)\.R\\geq 192d^\{2\}\\log\(100T\)\.Then every strategyσ=σA∘σB\\sigma=\\sigma\_\{A\}\\circ\\sigma\_\{B\}parameterized byσA∼\(R,□\)\\sigma\_\{A\}\\sim\(R,\\square\)andσB∼\(R,□\)\\sigma\_\{B\}\\sim\(R,\\square\)satisfies

Pr⁡\[¬ℰ\]≤1300\\Pr\[\\neg\\mathcal\{E\}\]\\leq\\frac\{1\}\{300\}

###### Proof\.

If the estimatesp¯t\\bar\{p\}\_\{t\},g^t\\hat\{g\}\_\{t\}, andp^t𝒪\\hat\{p\}\_\{t\}^\{\\mathcal\{O\}\}are the means ofRRindependent Bernoulli samples with probabilityptp\_\{t\}, Lemma[2](https://arxiv.org/html/2609.29189#Thmlemma2)and a union bound gives

Pr\[\|p¯t−pt\|≥116​d∧\|q^t−pt\|≥18​d\]≤2exp\(−R192​d2\)\+2exp\(−R96​d2\)\.\\Pr\\\!\\left\[\\lvert\\bar\{p\}\_\{t\}\-p\_\{t\}\\rvert\\geq\\frac\{1\}\{16d\}\\land\\lvert\\hat\{q\}\_\{t\}\-p\_\{t\}\\rvert\\geq\\frac\{1\}\{8d\}\\right\]\\leq 2\\exp\\\!\\left\(\-\\frac\{R\}\{192d^\{2\}\}\\right\)\+2\\exp\\\!\\left\(\-\\frac\{R\}\{96d^\{2\}\}\\right\)\.Therefore, applying a union bound over allTTrounds yields

Pr⁡\[¬ℰ\]\\displaystyle\\Pr\[\\neg\\mathcal\{E\}\]≤4​T​exp⁡\(−R192​d2\)≤T600​T=1600,\\displaystyle\\leq 4T\\exp\\\!\\left\(\-\\frac\{R\}\{192d^\{2\}\}\\right\)\\leq\\frac\{T\}\{600T\}=\\frac\{1\}\{600\},by the choice ofRR\. Lastly, forVVwithr=192​d2​log⁡100r=192d^\{2\}\\log 100samples,

Pr\[\|p^t𝒪−pt\|≥18​d\]≤2exp\(−r48​d2\)≤41002≤1600\\Pr\\\!\\left\[\\lvert\\hat\{p\}\_\{t\}^\{\\mathcal\{O\}\}\-p\_\{t\}\\rvert\\geq\\frac\{1\}\{8d\}\\right\]\\leq 2\\exp\\left\(\-\\frac\{r\}\{48d^\{2\}\}\\right\)\\leq\\frac\{4\}\{100^\{2\}\}\\leq\\frac\{1\}\{600\}Thus, combining, we observe

Pr⁡\[¬ℰ\]\\displaystyle\\Pr\[\\neg\\mathcal\{E\}\]≤Pr\[\|p¯t−pt\|≥14​d∧\|q^t−pt\|≥14​d\]\+Pr\[\|p^t𝒪−pt\|≥14​d\]\\displaystyle\\leq\\Pr\\\!\\left\[\\lvert\\bar\{p\}\_\{t\}\-p\_\{t\}\\rvert\\geq\\frac\{1\}\{4d\}\\land\\lvert\\hat\{q\}\_\{t\}\-p\_\{t\}\\rvert\\geq\\frac\{1\}\{4d\}\\right\]\+\\Pr\\\!\\left\[\\lvert\\hat\{p\}\_\{t\}^\{\\mathcal\{O\}\}\-p\_\{t\}\\rvert\\geq\\frac\{1\}\{4d\}\\right\]≤1600\+1600=1300\.\\displaystyle\\leq\\frac\{1\}\{600\}\+\\frac\{1\}\{600\}=\\frac\{1\}\{300\}\.∎

### B\.3Stability of Task Success

We now establish bounds on the task objective under the good estimation event\. We record a direct consequence of the Lipschitz property of the oracle machine\.

###### Fact 1\.

LetMMbeKK\-Lipschitz oracle machine and denotePr\[MO\(x\)=1\]=α⋆\.\\Pr\[M^\{O\}\(x\)=1\]=\\alpha^\{\\star\}\.Suppose that any non\-aborting simulation ofMMwhich, at every history𝐡\{\\mathbf\{h\}\}, replaces the reference transition probabilityp⁡\(𝐡\)p\(\{\\mathbf\{h\}\}\)by a possibly randomized, history\-dependent probabilityp~​\(𝐡\)\\tilde\{p\}\(\{\\mathbf\{h\}\}\)satisfying

\|p~​\(𝐡\)−p​\(𝐡\)\|≤1d\|\\tilde\{p\}\(\{\\mathbf\{h\}\}\)\-p\(\{\\mathbf\{h\}\}\)\|\\leq\\frac\{1\}\{d\}has acceptance probability withinK/dK/dofα⋆\\alpha^\{\\star\}\.

###### Lemma 4\.

LetMMbeKK\-Lipschitz oracle machine and denotePr\[MO\(x\)=1\]=α⋆\.\\Pr\[M^\{O\}\(x\)=1\]=\\alpha^\{\\star\}\.Fix a strategyσA\\sigma\_\{A\}with perturbation magnitudeΔ≤34​d\.\\Delta\\leq\\frac\{3\}\{4d\}\.Then, on the protocol of Figure[2](https://arxiv.org/html/2609.29189#S4.F2),

Pr\[V→1\]≤α⋆\+Ld\+1300\.\\Pr\[V\\to 1\]\\leq\\alpha^\{\\star\}\+\\frac\{L\}\{d\}\+\\frac\{1\}\{300\}\.If, in addition, for valueδ≥0\\delta\\geq 0,\{ℰ,Δ=δ\}\\\{\\mathcal\{E\},\\Delta=\\delta\\\}implies that the protocol does not abort, then

\|Pr\[V→1∣ℰ,Δ=δ\]−α⋆\|≤Ld\+1300\.\\left\|\\Pr\[V\\to 1\\mid\\mathcal\{E\},\\Delta=\\delta\]\-\\alpha^\{\\star\}\\right\|\\leq\\frac\{L\}\{d\}\+\\frac\{1\}\{300\}\.

###### Proof\.

Construct a simulation𝒮\\mathcal\{S\}of the protocol of Figure[2](https://arxiv.org/html/2609.29189#S4.F2)that follows the reporting strategyσA\\sigma\_\{A\}but ignores all abort instructions and continues to the terminal machine output\. ExtendσA\\sigma\_\{A\}to𝒮\\mathcal\{S\}on histories that would occur only after an abort\.

At each round, letp^t\\hat\{p\}\_\{t\}be the report proposed by this simulation\. Instead of usingp^t\\hat\{p\}\_\{t\}directly, use its projectionp~t\\tilde\{p\}\_\{t\}onto the interval

\[max⁡\{0,pt−1d\},min⁡\{1,pt\+1d\}\]\.\\left\[\\max\\left\\\{0,p\_\{t\}\-\\frac\{1\}\{d\}\\right\\\},\\min\\left\\\{1,p\_\{t\}\+\\frac\{1\}\{d\}\\right\\\}\\right\]\.By construction,

\|p~t−pt\|≤1d\|\\tilde\{p\}\_\{t\}\-p\_\{t\}\|\\leq\\frac\{1\}\{d\}at every history, including histories on which estimation fails\. Consequently, ifX~\\tilde\{X\}denotes the terminal output of𝒮\\mathcal\{S\}, Fact[1](https://arxiv.org/html/2609.29189#Thmfact1)gives

\|Pr\[X~=1\]−α⋆\|≤Kd\.\\displaystyle\\left\|\\Pr\[\\tilde\{X\}=1\]\-\\alpha^\{\\star\}\\right\|\\leq\\frac\{K\}\{d\}\.\(5\)Couple𝒮\\mathcal\{S\}and the actual protocol using the same random samples and transition randomness for as long as their executions coincide\. Onℰ\\mathcal\{E\}, the perturbation bound implies

\|p^t−pt\|≤\|p^t−p¯t\|\+\|p¯t−pt\|<34​d\+14​d=1d\.\\displaystyle\|\\hat\{p\}\_\{t\}\-p\_\{t\}\|\\leq\|\\hat\{p\}\_\{t\}\-\\bar\{p\}\_\{t\}\|\+\|\\bar\{p\}\_\{t\}\-p\_\{t\}\|<\\frac\{3\}\{4d\}\+\\frac\{1\}\{4d\}=\\frac\{1\}\{d\}\.Thus, the projection does not change any report along the actual execution onℰ\\mathcal\{E\}\. The two simulations therefore coincide until the protocol aborts or terminates\.

Onℰ\\mathcal\{E\}, if the protocol accepts, it cannot have aborted, since, by \([2](https://arxiv.org/html/2609.29189#A2.E2)\), every abort onℰ\\mathcal\{E\}results in rejection\. Its entire computation consequently agrees with the auxiliary simulation, which also outputs11\. Hence,

\{V→1\}∩ℰ⊆\{X~=1\}\.\\\{V\\to 1\\\}\\cap\\mathcal\{E\}\\subseteq\\\{\\tilde\{X\}=1\\\}\.Therefore,

Pr\[V→1\]\\displaystyle\\Pr\[V\\to 1\]≤Pr\[V→1,ℰ\]\+Pr\[¬ℰ\]\\displaystyle\\leq\\Pr\[V\\to 1,\\mathcal\{E\}\]\+\\Pr\[\\neg\\mathcal\{E\}\]≤Pr\[X~=1\]\+1300\\displaystyle\\leq\\Pr\[\\tilde\{X\}=1\]\+\\frac\{1\}\{300\}≤α⋆\+Kd\+1300\.\\displaystyle\\leq\\alpha^\{\\star\}\+\\frac\{K\}\{d\}\+\\frac\{1\}\{300\}\.
If\{ℰ,Δ\}\\\{\\mathcal\{E\},\\Delta\\\}also implies survival, then the two outputs agree throughoutℰ\\mathcal\{E\}\. Then, forδ≥0\\delta\\geq 0, where\{ℰ,Δ=δ\}⊆𝒦\\\{\\mathcal\{E\},\\Delta=\\delta\\\}\\subseteq\\mathcal\{K\},

Pr\[V→1∣ℰ,Δ=δ\]=Pr\[X~=1∣ℰ,Δ=δ\],\\Pr\[V\\to 1\\mid\\mathcal\{E\},\\Delta=\\delta\]=\\Pr\[\\tilde\{X\}=1\\mid\\mathcal\{E\},\\Delta=\\delta\],and hence

\|Pr\[V→1∣ℰ,Δ=δ\]−Pr\[X~=1\]\|≤Pr\[¬ℰ\]\\left\|\\Pr\[V\\to 1\\mid\\mathcal\{E\},\\Delta=\\delta\]\-\\Pr\[\\tilde\{X\}=1\]\\right\|\\leq\\Pr\[\\neg\\mathcal\{E\}\]Combining this inequality with \([5](https://arxiv.org/html/2609.29189#A2.E5)\) gives

\|Pr\[V→1∣ℰ,Δ=δ\]−α⋆\|≤Ld\+1300,\\left\|\\Pr\[V\\to 1\\mid\\mathcal\{E\},\\Delta=\\delta\]\-\\alpha^\{\\star\}\\right\|\\leq\\frac\{L\}\{d\}\+\\frac\{1\}\{300\},as claimed\. ∎

### B\.4Non\-abort survival

We move to bounding the task objective for general perturbations\. By \([4](https://arxiv.org/html/2609.29189#A2.E4)\), it suffices to provide an upper bound onPr⁡\[𝒦∣ℰ\]\\Pr\[\\mathcal\{K\}\\mid\\mathcal\{E\}\]\. We will require the following result\. LetW1,…,WnW\_\{1\},\\ldots,W\_\{n\}be independent, mean\-zero random variables with finite third absolute moments andF𝗌𝗍𝖽F\_\{\\mathsf\{std\}\}denote the cumulative distribution function of the Normal distribution\. Writing

Sn=∑i=1nWi,σ2=∑i=1n𝔼⁡\[Wi2\]\>0,ρ=∑i=1n𝔼​\|Wi\|3σ3,S\_\{n\}=\\sum\_\{i=1\}^\{n\}W\_\{i\},\\qquad\\sigma^\{2\}=\\sum\_\{i=1\}^\{n\}\\mathbb\{E\}\[W\_\{i\}^\{2\}\]\>0,\\qquad\\rho=\\frac\{\\sum\_\{i=1\}^\{n\}\\mathbb\{E\}\|W\_\{i\}\|^\{3\}\}\{\\sigma^\{3\}\},the Berry\-Esseen theorem states the following\.

###### Lemma 5\.

For constantC𝖡𝖤=0\.56C\_\{\\mathsf\{BE\}\}=0\.56,

supx∈ℝ\|Pr\[Sn≤x\]−F𝗌𝗍𝖽\(xσ\)\|≤C𝖡𝖤⋅ρ\.\\sup\_\{x\\in\\mathbb\{R\}\}\\left\|\\Pr\[S\_\{n\}\\leq x\]\-F\_\{\\mathsf\{std\}\}\\\!\\left\(\\frac\{x\}\{\\sigma\}\\right\)\\right\|\\leq C\_\{\\mathsf\{BE\}\}\\cdot\\rho\.

We now establish some useful notation\. Fix a perturbation magnitudeΔ≥0\\Delta\\geq 0\. All probabilities in this section refer to this fixed perturbation\. Recall that the report at roundttis

p^t=𝖼𝗅𝗂𝗉⁡\(p¯t\+Q​Δ\),\\hat\{p\}\_\{t\}=\\mathsf\{clip\}\(\\bar\{p\}\_\{t\}\+Q\\Delta\),and the cross\-examiner aborts when

\|p^t−q^t\|≥τ=12​d\.\|\\hat\{p\}\_\{t\}\-\\hat\{q\}\_\{t\}\|\\geq\\tau=\\frac\{1\}\{2d\}\.Let𝒦t\\mathcal\{K\}\_\{t\}denote the event that no cross\-examination abort occurs during the firstttrounds, with𝒦0=Ω\\mathcal\{K\}\_\{0\}=\\Omega, and write𝒦=𝒦T\.\\mathcal\{K\}=\\mathcal\{K\}\_\{T\}\.Define the estimation\-noise differenceZt=p¯t−q^t\.Z\_\{t\}=\\bar\{p\}\_\{t\}\-\\hat\{q\}\_\{t\}\.In the absence of clipping, the discrepancy equalsQ​Δ\+ZtQ\\Delta\+Z\_\{t\}\. With clipping, however, this identity need not hold\. Throughout, assume thatPr⁡\[ℰ\]\>0\.\\Pr\[\\mathcal\{E\}\]\>0\.

#### B\.4\.1One\-Round Gaussian Approximation

We first condition only on the past, rather than on the global eventℰ\\mathcal\{E\}\. Throughout we assume thatpt∈\(0\.01,0\.99\)p\_\{t\}\\in\(0\.01,0\.99\)\. Under this assumption, the eventℰ\\mathcal\{E\}, andΔ<1/d\\Delta<1/d, no clipping occurs under the choice ofd=⌈150​K⌉d=\\lceil 150K\\rceilandK≥1K\\geq 1\. For any surviving history𝒉\{\\bm\{h\}\}, define

rt\(Δ,𝒉\)=Pr\[\|p^t−q^t\|<τ\|𝒦t−1,𝐡t−1=𝒉\]\.r\_\{t\}\(\\Delta,\{\\bm\{h\}\}\)=\\Pr\\\!\\left\[\|\\hat\{p\}\_\{t\}\-\\hat\{q\}\_\{t\}\|<\\tau\\,\\middle\|\\,\\mathcal\{K\}\_\{t\-1\},\{\\mathbf\{h\}\}\_\{t\-1\}=\{\\bm\{h\}\}\\right\]\.We assume that, conditional on this history and either value ofQQhaving positive conditional probability, the fresh samples

Xt,1,…,Xt,R,Yt,1,…,Yt,RX\_\{t,1\},\\ldots,X\_\{t,R\},Y\_\{t,1\},\\ldots,Y\_\{t,R\}are mutually independent Bernoulli random variables with common meanpt=pt​\(𝒉\),p\_\{t\}=p\_\{t\}\(\{\\bm\{h\}\}\),and that

p¯t=1R​∑i=1RXt,i,q^t=1R​∑i=1RYt,i\.\\bar\{p\}\_\{t\}=\\frac\{1\}\{R\}\\sum\_\{i=1\}^\{R\}X\_\{t,i\},\\qquad\\hat\{q\}\_\{t\}=\\frac\{1\}\{R\}\\sum\_\{i=1\}^\{R\}Y\_\{t,i\}\.In particular, at a fixed history, this fresh\-sample law is the same for either value ofQQ\. Define the conditional probability of survival as

rt0\(Δ,𝒉\)=Pr\[\|QΔ\+Zt\|<τ\|𝒦t−1,𝐡t−1=𝒉\]\.r\_\{t\}^\{0\}\(\\Delta,\{\\bm\{h\}\}\)=\\Pr\\\!\\left\[\\mathcal\{\|\}Q\\Delta\+Z\_\{t\}\|<\\tau\\,\\middle\|\\,\\mathcal\{K\}\_\{t\-1\},\{\\mathbf\{h\}\}\_\{t\-1\}=\{\\bm\{h\}\}\\right\]\.Forpt∈\(0\.01,0\.99\)p\_\{t\}\\in\(0\.01,0\.99\), defineσt=2​pt​\(1−pt\)/R\\sigma\_\{t\}=\\sqrt\{\{2p\_\{t\}\(1\-p\_\{t\}\)\}/\{R\}\}and

gt\(Δ\)=Pr\[\|Δ\+σtz\|<τ\],g\_\{t\}\(\\Delta\)=\\Pr\[\|\\Delta\+\\sigma\_\{t\}z\|<\\tau\],wherez∼𝖭⁡\(0,1\)z\\sim\\mathsf\{N\}\(0,1\)\.

###### Lemma 6\.

Assumept∈\(0\.01,0\.99\)p\_\{t\}\\in\(0\.01,0\.99\)and that no clipping occurs for all configurations of machine inputMM, then

\|rt0​\(Δ,𝒉\)−gt​\(Δ\)\|≤1/300\.\\left\|r\_\{t\}^\{0\}\(\\Delta,\{\\bm\{h\}\}\)\-g\_\{t\}\(\\Delta\)\\right\|\\leq 1/300\.

###### Proof\.

Fix a surviving history𝒉\{\\bm\{h\}\}and a value ofQQwith positive conditional probability\. Under this conditioning,

Zt=1R​∑i=1R\(Xt,i−pt\)−1R​∑i=1R\(Yt,i−pt\)\.Z\_\{t\}=\\frac\{1\}\{R\}\\sum\_\{i=1\}^\{R\}\(X\_\{t,i\}\-p\_\{t\}\)\-\\frac\{1\}\{R\}\\sum\_\{i=1\}^\{R\}\(Y\_\{t,i\}\-p\_\{t\}\)\.The summands are independent and centered, and

Var⁡\(Zt\)=2​pt​\(1−pt\)R=σt2\.\\operatorname\{Var\}\(Z\_\{t\}\)=\\frac\{2p\_\{t\}\(1\-p\_\{t\}\)\}\{R\}=\\sigma\_\{t\}^\{2\}\.For a Bernoulli random variableXXwith meanptp\_\{t\},

𝔼⁡\[\|X−pt\|3\]\\displaystyle\\mathbb\{E\}\[\|X\-p\_\{t\}\|^\{3\}\]=pt​\(1−pt\)3\+\(1−pt\)​pt3\\displaystyle=p\_\{t\}\(1\-p\_\{t\}\)^\{3\}\+\(1\-p\_\{t\}\)p\_\{t\}^\{3\}=pt​\(1−pt\)​\[pt2\+\(1−pt\)2\]\.\\displaystyle=p\_\{t\}\(1\-p\_\{t\}\)\\bigl\[p\_\{t\}^\{2\}\+\(1\-p\_\{t\}\)^\{2\}\\bigr\]\.Therefore, the standardized sum of third absolute moments is

ρt,R\\displaystyle\\rho\_\{t,R\}=2​R⋅R−3⋅pt​\(1−pt\)​\[pt2\+\(1−pt\)2\]σt3\\displaystyle=\\frac\{2R\\cdot R^\{\-3\}\\cdot p\_\{t\}\(1\-p\_\{t\}\)\\bigl\[p\_\{t\}^\{2\}\+\(1\-p\_\{t\}\)^\{2\}\\bigr\]\}\{\\sigma\_\{t\}^\{3\}\}=12​R​pt2\+\(1−pt\)2pt​\(1−pt\)\.\\displaystyle=\\frac\{1\}\{\\sqrt\{2R\}\}\\,\\frac\{p\_\{t\}^\{2\}\+\(1\-p\_\{t\}\)^\{2\}\}\{\\sqrt\{p\_\{t\}\(1\-p\_\{t\}\)\}\}\.Lemma[5](https://arxiv.org/html/2609.29189#Thmlemma5)consequently gives, uniformly overxx,

\|Pr\[Zt≤x\|𝒦t−1,𝐡t−1=𝒉,Q\]−F𝗌𝗍𝖽\(xσt\)\|≤C𝖡𝖤2​Rpt2\+\(1−pt\)2pt​\(1−pt\)≤1600,\\left\|\\Pr\\\!\\left\[Z\_\{t\}\\leq x\\,\\middle\|\\,\\mathcal\{K\}\_\{t\-1\},\{\\mathbf\{h\}\}\_\{t\-1\}=\{\\bm\{h\}\},Q\\right\]\-F\_\{\\mathsf\{std\}\}\\\!\\left\(\\frac\{x\}\{\\sigma\_\{t\}\}\\right\)\\right\|\\leq\\frac\{C\_\{\\mathsf\{BE\}\}\}\{\\sqrt\{2R\}\}\\,\\frac\{p\_\{t\}^\{2\}\+\(1\-p\_\{t\}\)^\{2\}\}\{\\sqrt\{p\_\{t\}\(1\-p\_\{t\}\)\}\}\\leq\\frac\{1\}\{600\},by the choice ofRRand assumption onptp\_\{t\}\.

ForQ=\+1Q=\+1, the unclipped survival event is

−τ−Δ<Zt<τ−Δ\.\-\\tau\-\\Delta<Z\_\{t\}<\\tau\-\\Delta\.Applying the distribution\-function bound at the interval endpoints yields an error of at most2/6002/600relative togt​\(Δ\)g\_\{t\}\(\\Delta\)\. The conditional law ofZtZ\_\{t\}is symmetric about zero, since it is the difference of two independent, identically distributed sample means\. Thus the same interval probability and bound hold forQ=−1Q=\-1\. Averaging over the conditional distribution ofQQproves the result\. ∎

Now we can provide the final conditional survival bound\.

###### Lemma 7\.

Fix a perturbationΔ\\Deltaand a roundt∈\{1,…,T\}t\\in\\\{1,\\ldots,T\\\}\. Then

Pr⁡\[𝒦∣ℰ\]≤min⁡\{1,𝔼⁡\[gt​\(Δ\)\|𝒦t−1\]\+1100\}\.\\Pr\[\\mathcal\{K\}\\mid\\mathcal\{E\}\]\\leq\\min\\left\\\{1,\\,\\mathbb\{E\}\\\!\\left\[g\_\{t\}\(\\Delta\)\\,\\middle\|\\,\\mathcal\{K\}\_\{t\-1\}\\right\]\+\\frac\{1\}\{100\}\\right\\\}\.

###### Proof\.

By Lemma[6](https://arxiv.org/html/2609.29189#Thmlemma6), for every surviving history𝒉\{\\bm\{h\}\}, the one\-round survival probability satisfies

Pr⁡\[𝒦t\|𝒦t−1\]≤gt​\(Δ\)\+1300\.\\Pr\\\!\\left\[\\mathcal\{K\}\_\{t\}\\,\\middle\|\\,\\mathcal\{K\}\_\{t\-1\}\\right\]\\leq g\_\{t\}\(\\Delta\)\+\\frac\{1\}\{300\}\.DefineGt​\(Δ\)=𝔼⁡\[gt​\(Δ\)\|𝒦t−1\]\.G\_\{t\}\(\\Delta\)=\\mathbb\{E\}\\\!\\left\[g\_\{t\}\(\\Delta\)\\,\\middle\|\\,\\mathcal\{K\}\_\{t\-1\}\\right\]\.Averaging the one\-round bound over histories conditional on𝒦t−1\\mathcal\{K\}\_\{t\-1\}gives

Pr⁡\[𝒦t∣𝒦t−1\]\\displaystyle\\Pr\[\\mathcal\{K\}\_\{t\}\\mid\\mathcal\{K\}\_\{t\-1\}\]=𝔼\[Pr\[𝒦t\|𝒦t−1,𝐡t−1\]\|𝒦t−1\]\\displaystyle=\\mathbb\{E\}\\\!\\left\[\\Pr\\\!\\left\[\\mathcal\{K\}\_\{t\}\\,\\middle\|\\,\\mathcal\{K\}\_\{t\-1\},\{\\mathbf\{h\}\}\_\{t\-1\}\\right\]\\,\\middle\|\\,\\mathcal\{K\}\_\{t\-1\}\\right\]≤𝔼⁡\[gt​\(Δ\)\+1300\|𝒦t−1\]\\displaystyle\\leq\\mathbb\{E\}\\\!\\left\[g\_\{t\}\(\\Delta\)\+\\frac\{1\}\{300\}\\,\\middle\|\\,\\mathcal\{K\}\_\{t\-1\}\\right\]=Gt​\(Δ\)\+1300\.\\displaystyle=G\_\{t\}\(\\Delta\)\+\\frac\{1\}\{300\}\.Since𝒦⊆𝒦t⊆𝒦t−1\\mathcal\{K\}\\subseteq\\mathcal\{K\}\_\{t\}\\subseteq\\mathcal\{K\}\_\{t\-1\}, it follows that

Pr⁡\[𝒦\]\\displaystyle\\Pr\[\\mathcal\{K\}\]≤Pr⁡\[𝒦t\]\\displaystyle\\leq\\Pr\[\\mathcal\{K\}\_\{t\}\]=Pr⁡\[𝒦t−1\]​Pr⁡\[𝒦t∣𝒦t−1\]\\displaystyle=\\Pr\[\\mathcal\{K\}\_\{t\-1\}\]\\Pr\[\\mathcal\{K\}\_\{t\}\\mid\\mathcal\{K\}\_\{t\-1\}\]≤Gt​\(Δ\)\+1300\.\\displaystyle\\leq G\_\{t\}\(\\Delta\)\+\\frac\{1\}\{300\}\.The law of total probability yields

Pr⁡\[𝒦∣ℰ\]−Pr⁡\[𝒦\]\\displaystyle\\Pr\[\\mathcal\{K\}\\mid\\mathcal\{E\}\]\-\\Pr\[\\mathcal\{K\}\]=Pr⁡\[¬ℰ\]​\(Pr⁡\[𝒦∣ℰ\]−Pr⁡\[𝒦∣¬ℰ\]\)\\displaystyle=\\Pr\[\\neg\\mathcal\{E\}\]\\left\(\\Pr\[\\mathcal\{K\}\\mid\\mathcal\{E\}\]\-\\Pr\[\\mathcal\{K\}\\mid\\neg\\mathcal\{E\}\]\\right\)≤Pr⁡\[¬ℰ\]\\displaystyle\\leq\\Pr\[\\neg\\mathcal\{E\}\]≤1150,\\displaystyle\\leq\\frac\{1\}\{150\},By Lemma[3](https://arxiv.org/html/2609.29189#Thmlemma3)\. Consequently,

Pr⁡\[𝒦∣ℰ\]≤Gt​\(Δ\)\+1300\+1150=Gt​\(Δ\)\+1100\.\\Pr\[\\mathcal\{K\}\\mid\\mathcal\{E\}\]\\leq G\_\{t\}\(\\Delta\)\+\\frac\{1\}\{300\}\+\\frac\{1\}\{150\}=G\_\{t\}\(\\Delta\)\+\\frac\{1\}\{100\}\.Combining this with the trivial boundPr⁡\[𝒦∣ℰ\]≤1\\Pr\[\\mathcal\{K\}\\mid\\mathcal\{E\}\]\\leq 1proves the claim\. ∎

### B\.5Proof Statements

Theorem[1](https://arxiv.org/html/2609.29189#Thmtheorem1)follows from \([3](https://arxiv.org/html/2609.29189#A2.E3)\) with the application of Lemmas[3](https://arxiv.org/html/2609.29189#Thmlemma3)and[4](https://arxiv.org/html/2609.29189#Thmlemma4)and the observations thatK/d≤1/150K/d\\leq 1/150and\{ℰ,Δ<1/\(16​d\)\}⊆𝒦\\\{\\mathcal\{E\},\\Delta<1/\(16d\)\\\}\\subseteq\\mathcal\{K\}\.

Theorem[2](https://arxiv.org/html/2609.29189#S4.Ex14)follows from \([4](https://arxiv.org/html/2609.29189#A2.E4)\) and the application of Lemmas[3](https://arxiv.org/html/2609.29189#Thmlemma3)and[7](https://arxiv.org/html/2609.29189#Thmlemma7)fort=1t=1\.

## Appendix CProof of Theorem[3](https://arxiv.org/html/2609.29189#Thmtheorem3)

We begin with setting notation\. FixX=xX=xand let𝐲=\(y1,…,yT\)\{\\mathbf\{y\}\}=\(\{\\textnormal\{y\}\}\_\{1\},\\ldots,\{\\textnormal\{y\}\}\_\{T\}\)be the random variable representing the transcript ofM⁡\(x\)M\(x\)and𝒂=\(a1,…,aT\)\{\\bm\{a\}\}=\(\{a\}\_\{1\},\\ldots,\{a\}\_\{T\}\)denote the realized transcript\. Unless stated otherwise, all probabilities, expectations, and information quantities are conditional onX=xX=x\. Writehx=H⁡\(Q∣X=x\)h\_\{x\}=H\(Q\\mid X=x\)\. The view ofVVis defined as

ΠV​\(𝐡⁡\(X,σ\)\)=\{\(a1,…,aT\),on event​𝒦,\(a1,…,at,p^t,\{𝒪⁡\(𝒂I⁡\(t\)\)\}\),on event​¬𝒦t\|𝒦t−1\.\\Pi\_\{V\}\(\{\\mathbf\{h\}\}\(X,\\sigma\)\)=\\begin\{cases\}\(\{a\}\_\{1\},\\ldots,\{a\}\_\{T\}\),&\\text\{ on event \}\\mathcal\{K\},\\\\ \(\{a\}\_\{1\},\\ldots,\{a\}\_\{t\},\\hat\{p\}\_\{t\},\\\{\\mathcal\{O\}\(\{\\bm\{a\}\}\_\{I\(t\)\}\)\\\}\),&\\text\{ on event \}\\neg\\mathcal\{K\}\_\{t\}\\mid\\mathcal\{K\}\_\{t\-1\}\.\\end\{cases\}These transcript types are distinguishable, so the abort indicator and, upon abort, its round are recoverable fromΠV\\Pi\_\{V\}\. Notably,VVdoes not observe the internal samples ofAAorBBdirectly\. For some0<β<1/20<\\beta<1/2we assume thatPr⁡\[Q=1∣X=x\]∈\[β,1−β\]\\Pr\[Q=1\\mid X=x\]\\in\[\\beta,1\-\\beta\]\. Thus, there is initial uncertainty in the hidden hypothesis\.

### C\.1Belief updating and confidence truncation

Define the hidden hypothesis posterior as

μt=Pr⁡\(Q=1∣𝐡t−1,𝒦t−1\)\.\\mu\_\{t\}=\\Pr\(Q=1\\mid\{\\mathbf\{h\}\}\_\{t\-1\},\\mathcal\{K\}\_\{t\-1\}\)\.These are exact Bayesian posteriors for the observed non\-abort channel\. At each entering history𝐡t−1\{\\mathbf\{h\}\}\_\{t\-1\}, the expected posterior divergence satisfies the identity

𝔼\[D𝖪𝖫\(𝖡𝖾𝗋𝗇\(μt\)∥𝖡𝖾𝗋𝗇\(μt−1\)\)\|𝐡t−1,𝒦t−1\]=I\(Q;yt∣𝐡t−1,𝒦t−1\)\.\\mathbb\{E\}\\left\[D\_\{\\mathsf\{KL\}\}\\bigl\(\\mathsf\{Bern\}\(\\mu\_\{t\}\)\\\|\\mathsf\{Bern\}\(\\mu\_\{t\-1\}\)\\bigr\)\\,\\middle\|\\,\{\\mathbf\{h\}\}\_\{t\-1\},\\mathcal\{K\}\_\{t\-1\}\\right\]=I\(Q;\{\\textnormal\{y\}\}\_\{t\}\\mid\{\\mathbf\{h\}\}\_\{t\-1\},\\mathcal\{K\}\_\{t\-1\}\)\.\(6\)Thus, the expected information gained in an update cannot exceed the remaining uncertainty\. More generally, any valid upper bound on the channel’s mutual information also bounds the expected posterior divergence in \([6](https://arxiv.org/html/2609.29189#A3.E6)\)\. This identity follows from Bayes’ rule and is consistent with sequential hypothesis testing, where posterior log\-odds accumulate observation log\-likelihood ratios\.

In our latent disclosure accounting, expected𝖪𝖫\\mathsf\{KL\}increments accumulate according to the mutual\-information chain rule and their total is bounded by the initial entropyhxh\_\{x\}\. We assume that all information used in updating is included in the observed history\.

### C\.2Single round disclosure

We begin by bounding the amount of information disclosed in a single round of debate\. We look at the instances of abort and non\-abort separately\. For probability lawsPPandQQ, with divergence measured in bits, Pinsker’s inequality states that

D𝖪𝖫\(P∥Q\)≥2ln⁡2∥P−Q∥𝖳𝖵2\.\\displaystyle D\_\{\\mathsf\{KL\}\}\(P\\\|Q\)\\geq\\frac\{2\}\{\\ln 2\}\\\|P\-Q\\\|\_\{\\mathsf\{TV\}\}^\{2\}\.\(7\)
###### Lemma 8\.

Forμt∈\(β,1−β\)\\mu\_\{t\}\\in\(\\beta,1\-\\beta\),

I\(Q;yt∣𝐡t−1,𝒦t−1\)≥2ln⁡2μt\(1−μt\)Δ2≥2​β​\(1−β\)ln⁡2Δ2\.I\(Q;\{\\textnormal\{y\}\}\_\{t\}\\mid\{\\mathbf\{h\}\}\_\{t\-1\},\\mathcal\{K\}\_\{t\-1\}\)\\geq\\frac\{2\}\{\\ln 2\}\\mu\_\{t\}\(1\-\\mu\_\{t\}\)\\Delta^\{2\}\\geq\\frac\{2\\beta\(1\-\\beta\)\}\{\\ln 2\}\\Delta^\{2\}\.

###### Proof\.

Define the hypothesis conditional sampling probabilities as

p±=Pr\[yt∣Q±1,𝐡t−1,𝒦t−1\]p\_\{\\pm\}=\\Pr\[\{\\textnormal\{y\}\}\_\{t\}\\mid Q\\pm 1,\{\\mathbf\{h\}\}\_\{t\-1\},\\mathcal\{K\}\_\{t\-1\}\]and the mixturep=μt​p\+\+\(1−μt\)​p−\.p=\\mu\_\{t\}p\_\{\+\}\+\(1\-\\mu\_\{t\}\)p\_\{\-\}\.Since a mixture of Bernoulli laws is Bernoulli, the conditional mutual information is

I\(Q;yt∣𝐡t−1,𝒦t−1\)\\displaystyle I\(Q;\{\\textnormal\{y\}\}\_\{t\}\\mid\{\\mathbf\{h\}\}\_\{t\-1\},\\mathcal\{K\}\_\{t\-1\}\)=μtD𝖪𝖫\(𝖡𝖾𝗋𝗇\(p\+\)∥𝖡𝖾𝗋𝗇\(p¯\)\)\+\(1−μt\)D𝖪𝖫\(𝖡𝖾𝗋𝗇\(p−\)∥𝖡𝖾𝗋𝗇\(p¯\)\)\.\\displaystyle=\\mu\_\{t\}D\_\{\\mathsf\{KL\}\}\\left\(\\mathsf\{Bern\}\(p\_\{\+\}\)\\\|\\mathsf\{Bern\}\(\\bar\{p\}\)\\right\)\+\(1\-\\mu\_\{t\}\)D\_\{\\mathsf\{KL\}\}\\left\(\\mathsf\{Bern\}\(p\_\{\-\}\)\\\|\\mathsf\{Bern\}\(\\bar\{p\}\)\\right\)\.For Bernoulli laws, total variation distance equals the absolute difference of their parameters\. Thus, \([7](https://arxiv.org/html/2609.29189#A3.E7)\) gives

I\(Q;yt∣𝐡t−1,𝒦t−1\)\\displaystyle I\(Q;\{\\textnormal\{y\}\}\_\{t\}\\mid\{\\mathbf\{h\}\}\_\{t\-1\},\\mathcal\{K\}\_\{t\-1\}\)≥2ln⁡2​\[μt​\(p\+−p¯\)2\+\(1−μt\)​\(p−−p¯\)2\]\\displaystyle\\geq\\frac\{2\}\{\\ln 2\}\\left\[\\mu\_\{t\}\(p\_\{\+\}\-\\bar\{p\}\)^\{2\}\+\(1\-\\mu\_\{t\}\)\(p\_\{\-\}\-\\bar\{p\}\)^\{2\}\\right\]=2ln⁡2​μt​\(1−μt\)​\(p\+−p−\)2\.\\displaystyle=\\frac\{2\}\{\\ln 2\}\\mu\_\{t\}\(1\-\\mu\_\{t\}\)\(p\_\{\+\}\-p\_\{\-\}\)^\{2\}\.\(8\)
Letν\\nudenote the distribution ofp¯t\\bar\{p\}\_\{t\}\. As the distribution ofp¯t\\bar\{p\}\_\{t\}is independent ofQQ,

p\+−p−=∫\[0,1\]\[𝖼𝗅𝗂𝗉⁡\(s\+Δ\)−𝖼𝗅𝗂𝗉⁡\(s−Δ\)\],ν⁡\(𝑑s\)\.p\_\{\+\}\-p\_\{\-\}=\\int\_\{\[0,1\]\}\\left\[\\mathsf\{clip\}\(s\+\\Delta\)\-\\mathsf\{clip\}\(s\-\\Delta\)\\right\],\\nu\(ds\)\.For everys∈\[0,1\]s\\in\[0,1\]and0<Δ≤120<\\Delta\\leq\\tfrac\{1\}\{2\},

𝖼𝗅𝗂𝗉⁡\(s\+Δ\)−𝖼𝗅𝗂𝗉⁡\(s−Δ\)≥Δ\.\\mathsf\{clip\}\(s\+\\Delta\)\-\\mathsf\{clip\}\(s\-\\Delta\)\\geq\\Delta\.Hencep\+−p−≥Δp\_\{\+\}\-p\_\{\-\}\\geq\\Delta\. Substitution into \([8](https://arxiv.org/html/2609.29189#A3.E8)\), followed byμ⁡\(1−μ\)≥β⁡\(1−β\)\\mu\(1\-\\mu\)\\geq\\beta\(1\-\\beta\), proves the stated result\. Averaging over the entering histories gives the conditional mutual\-information bound\. ∎

Disclosure during an abort is given by the following\.

###### Lemma 9\.

Suppose that2​R​Δ∉ℤ2R\\Delta\\notin\\mathbb\{Z\}\. Then, the reportp^t\\hat\{p\}\_\{t\}fully determinesQQ\. In other words,

H⁡\(Q∣p^t\)=0\.H\(Q\\mid\\hat\{p\}\_\{t\}\)=0\.

###### Proof\.

Recall that the public report upon abort is

p^t=KtR\+Q​Δ,Kt∈\{0,…,R\},\\hat\{p\}\_\{t\}=\\frac\{K\_\{t\}\}\{R\}\+Q\\Delta,\\qquad K\_\{t\}\\in\\\{0,\\ldots,R\\\},Under the two hypotheses, the report belongs respectively to the grids

𝒢\+=\{kR\+Δ:0≤k≤R\},𝒢−=\{kR−Δ:0≤k≤R\}\.\\mathcal\{G\}\_\{\+\}=\\left\\\{\\frac\{k\}\{R\}\+\\Delta:0\\leq k\\leq R\\right\\\},\\qquad\\mathcal\{G\}\_\{\-\}=\\left\\\{\\frac\{k\}\{R\}\-\\Delta:0\\leq k\\leq R\\right\\\}\.If these grids intersect, there exist integersk,ℓk,\\ellsuch that

kR\+Δ=ℓR−Δ,\\frac\{k\}\{R\}\+\\Delta=\\frac\{\\ell\}\{R\}\-\\Delta,which implies

2​R​Δ=ℓ−k∈ℤ\.2R\\Delta=\\ell\-k\\in\\mathbb\{Z\}\.The assumed nonintegrality therefore makes the grids disjoint\. Membership in the observed grid determinesQQ\. It follows thatH⁡\(Q∣p^t\)=0H\(Q\\mid\\hat\{p\}\_\{t\}\)=0\. ∎

### C\.3Full debate disclosure

We are now in a position to proceed with the main proof of information disclosure\. Leth2h\_\{2\}denote the binary entropy function\.

###### Theorem 5\.

Forβ∈\(0,𝟏/2\)\\beta\\in\(0,\\bm\{1\}/2\)andμ0∈\(β,1−β\)\\mu\_\{0\}\\in\(\\beta,1\-\\beta\), letkβ=2​β​\(1−β\)ln⁡2\.k\_\{\\beta\}=\\frac\{2\\beta\(1\-\\beta\)\}\{\\ln 2\}\.Then

I⁡\(Q;ΠV​\(𝐡\)∣X=x\)≥hx−h2​\(β\)2​min⁡\{1,kβ​Δ2​T1−h2​\(β\)\}\.I\(Q;\\Pi\_\{V\}\(\{\\mathbf\{h\}\}\)\\mid X=x\)\\geq\\frac\{h\_\{x\}\-h\_\{2\}\(\\beta\)\}\{2\}\\min\\left\\\{1,\\frac\{k\_\{\\beta\}\\Delta^\{2\}T\}\{1\-h\_\{2\}\(\\beta\)\}\\right\\\}\.

###### Proof\.

Throughout the proof, condition onX=xX=xand measure entropy in bits\. Stop observing the protocol at the first of the following events:

1. 1\.an abort;
2. 2\.the posterior leaves\(β,1−β\)\(\\beta,1\-\\beta\);
3. 3\.completion of roundTT\.

Denote the resulting stopped transcript by𝐮⊆𝐲\{\\mathbf\{u\}\}\\subseteq\{\\mathbf\{y\}\}\. On history𝐡\{\\mathbf\{h\}\}, since𝐮\{\\mathbf\{u\}\}is determined byΠV​\(𝐡\)\\Pi\_\{V\}\(\{\\mathbf\{h\}\}\), the data\-processing inequality givesI⁡\(Q;ΠV​\(𝐡\)∣X=x\)≥I⁡\(Q;𝐮∣X=x\)\.I\(Q;\\Pi\_\{V\}\(\{\\mathbf\{h\}\}\)\\mid X=x\)\\geq I\(Q;\{\\mathbf\{u\}\}\\mid X=x\)\.We bound the latter quantity\.

Fixttand an active pre\-round history𝐡t−1\{\\mathbf\{h\}\}\_\{t\-1\}, and let𝒜t=¬𝒦t\|𝒦t−1\\mathcal\{A\}\_\{t\}=\\neg\\mathcal\{K\}\_\{t\}\\mid\\mathcal\{K\}\_\{t\-1\}indicate an abort in the current round\. Letut\{\\textnormal\{u\}\}\_\{t\}be the single bit appearing at roundtt\.

LetN≤TN\\leq Tbe the number of rounds observed in𝐮\{\\mathbf\{u\}\}\. Padding the transcript after stopping with a fixed symbol, the conditional chain rule gives

I⁡\(Q,𝐮\)\\displaystyle I\(Q;\{\\mathbf\{u\}\}\)=∑t=1TI\(Q;ut\|𝐡t−1,𝒦t−1\)\\displaystyle=\\sum\_\{t=1\}^\{T\}I\(Q;\{\\textnormal\{u\}\}\_\{t\}\|\{\\mathbf\{h\}\}\_\{t\-1\},\\mathcal\{K\}\_\{t\-1\}\)=∑t=1TI\(Q;yt\|𝐡t−1,𝒦t−1\)⋅Pr\[N≥t\]\\displaystyle=\\sum\_\{t=1\}^\{T\}I\(Q;\{\\textnormal\{y\}\}\_\{t\}\|\{\\mathbf\{h\}\}\_\{t\-1\},\\mathcal\{K\}\_\{t\-1\}\)\\cdot\\Pr\[N\\geq t\]≥kβ​Δ2​∑t=1TPr⁡\(N≥t\)\\displaystyle\\geq k\_\{\\beta\}\\Delta^\{2\}\\sum\_\{t=1\}^\{T\}\\Pr\(N\\geq t\)=kβ​Δ2​𝔼​\[N\],\\displaystyle=k\_\{\\beta\}\\Delta^\{2\}\\,\\mathbb\{E\}\[N\],where the inequality follows from Lemma[8](https://arxiv.org/html/2609.29189#Thmlemma8)\. Let𝒰\\mathcal\{U\}be the event that, afterTTrounds, the protocol has neither aborted nor reached the confidence threshold, and setq=Pr⁡\(𝒰\)\.q=\\Pr\(\\mathcal\{U\}\)\.On𝒰\\mathcal\{U\}, allTTrounds are observed\. Hence𝔼⁡\[N\]≥T​q,\\mathbb\{E\}\[N\]\\geq Tq,and therefore

I⁡\(Q;𝐮∣𝒰\)≥kβ​Δ2​T​q\.\\displaystyle I\(Q;\{\\mathbf\{u\}\}\\mid\\mathcal\{U\}\)\\geq k\_\{\\beta\}\\Delta^\{2\}Tq\.\(9\)
Outside𝒰\\mathcal\{U\}, by Lemma[9](https://arxiv.org/html/2609.29189#Thmlemma9), on abort posterior entropy is zero by full disclosure and on reaching the confidence threshold it is at mosth2​\(β\)\.h\_\{2\}\(\\beta\)\.Averaging over stopped transcripts gives

H⁡\(Q∣𝐮\)\\displaystyle H\(Q\\mid\{\\mathbf\{u\}\}\)≤h2​\(β\)​\(1−q\)\+q\\displaystyle\\leq h\_\{2\}\(\\beta\)\(1\-q\)\+q=h2​\(β\)\+\(1−h2​\(β\)\)​q\.\\displaystyle=h\_\{2\}\(\\beta\)\+\(1\-h\_\{2\}\(\\beta\)\)q\.Since

I⁡\(Q,𝐮\)=hx−H⁡\(Q∣𝐮\),I\(Q;\{\\mathbf\{u\}\}\)=h\_\{x\}\-H\(Q\\mid\{\\mathbf\{u\}\}\),we obtain

I⁡\(Q,𝐮\)≥hx−h2​\(β\)−\(1−h2​\(β\)\)​q\.\\displaystyle I\(Q;\{\\mathbf\{u\}\}\)\\geq h\_\{x\}\-h\_\{2\}\(\\beta\)\-\(1\-h\_\{2\}\(\\beta\)\)q\.\(10\)
Bringing everything together, setD=hx−h2​\(β\),D=h\_\{x\}\-h\_\{2\}\(\\beta\),andc=1−h2​\(β\)\.c=1\-h\_\{2\}\(\\beta\)\.The assumptionμ0∈\(β,1−β\)\\mu\_\{0\}\\in\(\\beta,1\-\\beta\)ensures thatD\>0D\>0\. Inequalities \([9](https://arxiv.org/html/2609.29189#A3.E9)\) and \([10](https://arxiv.org/html/2609.29189#A3.E10)\) imply that

I⁡\(Q,𝐮\)≥max⁡\{kβ​Δ2​T​q,D−c​q\}\\displaystyle I\(Q;\{\\mathbf\{u\}\}\)\\geq\\max\\left\\\{k\_\{\\beta\}\\Delta^\{2\}Tq,D\-cq\\right\\\}Multiplying the first inequality byccand the second bykβ​Δ2​Tk\_\{\\beta\}\\Delta^\{2\}T, then adding, eliminatesqq\. In other words,

c​I​\(Q,𝐮\)\+kβ​Δ2​T​I​\(Q,𝐮\)\\displaystyle cI\(Q;\{\\mathbf\{u\}\}\)\+k\_\{\\beta\}\\Delta^\{2\}TI\(Q;\{\\mathbf\{u\}\}\)≥c​kβ​Δ2​T​q\+kβ​Δ2​T​\(D−c​q\)\\displaystyle\\geq ck\_\{\\beta\}\\Delta^\{2\}Tq\+k\_\{\\beta\}\\Delta^\{2\}T\(D\-cq\)=kβ​Δ2​T​D\.\\displaystyle=k\_\{\\beta\}\\Delta^\{2\}TD\.Thus,

\(c\+kβ​Δ2​T\)​I​\(Q,𝐮\)\\displaystyle\(c\+k\_\{\\beta\}\\Delta^\{2\}T\)I\(Q;\{\\mathbf\{u\}\}\)≥kβ​Δ2​T​D\\displaystyle\\geq k\_\{\\beta\}\\Delta^\{2\}TD∴I⁡\(Q,𝐮\)\\displaystyle\\therefore I\(Q;\{\\mathbf\{u\}\}\)≥D⋅kβ​Δ2c\+kβ​Δ2\\displaystyle\\geq D\\cdot\\frac\{k\_\{\\beta\}\\Delta^\{2\}\}\{c\+k\_\{\\beta\}\\Delta^\{2\}\}Finally, for everyu≥0u\\geq 0,

u1\+u≥12​min⁡\{1,u\}\.\\frac\{u\}\{1\+u\}\\geq\\frac\{1\}\{2\}\\min\\\{1,u\\\}\.Taking

u=kβ​Δ2​Tc=kβ​Δ2​T1−h2​\(β\)u=\\frac\{k\_\{\\beta\}\\Delta^\{2\}T\}\{c\}=\\frac\{k\_\{\\beta\}\\Delta^\{2\}T\}\{1\-h\_\{2\}\(\\beta\)\}and applying data processing yields

I⁡\(Q;ΠV​\(𝐡\)∣X=x\)≥hx−h2​\(β\)2​min⁡\{1,kβ​Δ2​T1−h2​\(β\)\}\.I\(Q;\\Pi\_\{V\}\(\{\\mathbf\{h\}\}\)\\mid X=x\)\\geq\\frac\{h\_\{x\}\-h\_\{2\}\(\\beta\)\}\{2\}\\min\\left\\\{1,\\,\\frac\{k\_\{\\beta\}\\Delta^\{2\}T\}\{1\-h\_\{2\}\(\\beta\)\}\\right\\\}\.∎

In conclusion, Theorem[3](https://arxiv.org/html/2609.29189#Thmtheorem3)is a corollary of Theorem[5](https://arxiv.org/html/2609.29189#Thmtheorem5)for a fixed choice ofβ\\beta\.

## Appendix DProof of Theorem[4](https://arxiv.org/html/2609.29189#Thmtheorem4)

Debate protocol with error and drift aborts

All parties have access to𝒪\\mathcal\{O\}, an inputx∈\{0,1\}nx\\in\\\{0,1\\\}^\{n\}, and aKK\-Lipschitz probabilistic oracle machineMM\.AAclaims thatPr\[M\(x\)=1\]≥23,\\Pr\\left\[M\(x\)=1\\right\]\\geq\\frac\{2\}\{3\},and the cross\-examinerBBdisputes this claim\. LetW∈\[T\]W\\in\[T\]be the trailing\-window length used by an abort drift challenge\.

1. 1\.Let𝐲=\(y1,…,yT\)\{\\mathbf\{y\}\}=\(\{\\textnormal\{y\}\}\_\{1\},\\ldots,\{\\textnormal\{y\}\}\_\{T\}\)be the random variable representing the transcript ofM⁡\(x\)M\(x\)and setd=⌈150​K⌉\.d=\\lceil 150K\\rceil\.
2. 2\.For debate roundt∈\[T\]t\\in\[T\]: 1. \(a\)\-\(d\)Identical to the equivalent steps in Figure[2](https://arxiv.org/html/2609.29189#S4.F2)\. 2. \(e\)BBcanabort errorif \(it believes\)AAhas deviated on the most recent update orabort driftif \(it believes\)AAhas deviated cumulatively over the most recentWWupdates andt≥Wt\\geq W\.
3. 3\.Ifabort errorwas issued in roundtt: 1. \(a\)VVdraws192​d2​log⁡100192d^\{2\}\\log 100independent samples ofyt\{\\textnormal\{y\}\}\_\{t\}, conditioned onyI⁡\(t\)=𝒂I⁡\(t\),\{\\textnormal\{y\}\}\_\{I\(t\)\}=\{\\bm\{a\}\}\_\{I\(t\)\},and uses their sample mean to obtain an estimatep^t𝒪\\hat\{p\}\_\{t\}^\{\\mathcal\{O\}\}ofPr⁡\[yt=1\|𝐲I⁡\(t\)=𝒂I⁡\(t\)\]\\Pr\\left\[\{\\textnormal\{y\}\}\_\{t\}=1\\middle\|\{\\mathbf\{y\}\}\_\{I\(t\)\}=\{\\bm\{a\}\}\_\{I\(t\)\}\\right\] 2. \(b\)VVchecks whether\|p^t𝒪−p^t\|≥14​d\.\\left\|\\hat\{p\}\_\{t\}^\{\\mathcal\{O\}\}\-\\hat\{p\}\_\{t\}\\right\|\\geq\\frac\{1\}\{4d\}\.If the inequality holds,VVoutputs00; otherwise,VVoutputs11\.
4. 4\.Ifabort driftwas issued in roundtt: 1. \(a\)For eachs∈J=\{t−W\+1,…,t\}s\\in J=\\\{t\-W\+1,\\ldots,t\\\},VVdraws192​d2​log⁡\(100​W\)192d^\{2\}\\log\(100W\)independent samples ofys\{\\textnormal\{y\}\}\_\{s\}, conditioned onyI⁡\(s\)=𝒂I⁡\(s\),\{\\textnormal\{y\}\}\_\{I\(s\)\}=\{\\bm\{a\}\}\_\{I\(s\)\},and uses the sample mean to obtain an estimatep^s𝒪\\hat\{p\}\_\{s\}^\{\\mathcal\{O\}\}ofPr⁡\[ys=1\|𝐲I⁡\(s\)=𝒂I⁡\(s\)\]\\Pr\\left\[\{\\textnormal\{y\}\}\_\{s\}=1\\middle\|\{\\mathbf\{y\}\}\_\{I\(s\)\}=\{\\bm\{a\}\}\_\{I\(s\)\}\\right\] 2. \(b\)VVchecks whether\|∑s∈J\(p^s𝒪−p^s\)\|≥N4​d\.\\left\|\\sum\_\{s\\in J\}\\left\(\\hat\{p\}\_\{s\}^\{\\mathcal\{O\}\}\-\\hat\{p\}\_\{s\}\\right\)\\right\|\\geq\\frac\{\\sqrt\{N\}\}\{4d\}\.If the inequality holds,VVoutputs00; otherwise,VVoutputs11\.
5. 5\.If the protocol was not aborted, then the verifier outputsaTa\_\{T\}\.

Figure 3:Debate protocol for a stochastic oracle with error and drift aborts\.### D\.1Concentration Bounds

We require the conditional form of Hoeffding’s Lemma\.

###### Lemma 10\(Hoeffding’s Lemma\)\.

Let𝒢\\mathcal\{G\}be a sigma\-algebra, and letYYbe a random variable satisfyinga≤Y≤ba\\leq Y\\leq balmost surely, whereaaandbbare deterministic constants\. If𝔼⁡\[Y∣𝒢\]=0,\\mathbb\{E\}\[Y\\mid\\mathcal\{G\}\]=0,then, for every realλ\\lambda,

𝔼⁡\[exp⁡\(λ​Y\)\|𝒢\]≤exp⁡\(λ2​\(b−a\)28\)\\mathbb\{E\}\\left\[\\exp\(\\lambda Y\)\\middle\|\\mathcal\{G\}\\right\]\\leq\\exp\\left\(\\frac\{\\lambda^\{2\}\(b\-a\)^\{2\}\}\{8\}\\right\)almost surely\.

The following bounds will be used to bound “good” sampling behavior during protocol execution\.

###### Lemma 11\.

Let\(ℱt\)t≥0\(\\mathcal\{F\}\_\{t\}\)\_\{t\\geq 0\}be a filtration\. For each roundtt, letpt∈\[0,1\]p\_\{t\}\\in\[0,1\]beℱt−1\\mathcal\{F\}\_\{t\-1\}\-measurable\. Conditional onℱt−1\\mathcal\{F\}\_\{t\-1\}, supposeXt,1,…,Xt,RX\_\{t,1\},\\ldots,X\_\{t,R\}are independent Bernoulli random variables with common meanptp\_\{t\}\. Define theℱt\\mathcal\{F\}\_\{t\}\-measurable quantitiesp^t=R−1​∑i=1RXt,i,\\hat\{p\}\_\{t\}=R^\{\-1\}\\sum\_\{i=1\}^\{R\}X\_\{t,i\},andDt=p^t−pt\.D\_\{t\}=\\hat\{p\}\_\{t\}\-p\_\{t\}\.Then, almost surely, the following bounds hold\.

1. 1\.For every realλ\\lambda,𝔼⁡\[exp⁡\(λ​Dt\)\|ℱt−1\]≤exp⁡\(λ28​R\)\.\\mathbb\{E\}\\left\[\\exp\(\\lambda D\_\{t\}\)\\middle\|\\mathcal\{F\}\_\{t\-1\}\\right\]\\leq\\exp\\left\(\\frac\{\\lambda^\{2\}\}\{8R\}\\right\)\.
2. 2\.For everyu\>0u\>0,Pr⁡\[\|Dt\|≥u\|ℱt−1\]≤2​exp⁡\(−2​R​u2\)\.\\Pr\\left\[\|D\_\{t\}\|\\geq u\\middle\|\\mathcal\{F\}\_\{t\-1\}\\right\]\\leq 2\\exp\(\-2Ru^\{2\}\)\.
3. 3\.For any deterministic integers0≤a<b0\\leq a<band everyu\>0u\>0, Pr⁡\[\|∑s=a\+1bDs\|≥u\|ℱa\]≤2​exp⁡\(−2​R​u2b−a\)\.\\Pr\\left\[\\left\|\\sum\_\{s=a\+1\}^\{b\}D\_\{s\}\\right\|\\geq u\\middle\|\\mathcal\{F\}\_\{a\}\\right\]\\leq 2\\exp\\left\(\-\\frac\{2Ru^\{2\}\}\{b\-a\}\\right\)\.

###### Proof\.

Conditional onℱt−1\\mathcal\{F\}\_\{t\-1\}, each variableXt,i−ptR\\frac\{X\_\{t,i\}\-p\_\{t\}\}\{R\}has mean zero and lies in the interval\[−pt/R,1−pt/R\],\\left\[\-\{p\_\{t\}\}/\{R\},\{1\-p\_\{t\}\}/\{R\}\\right\],whose length is1/R1/R\. By Lemma[10](https://arxiv.org/html/2609.29189#Thmlemma10),

𝔼⁡\[exp⁡\(λ​Xt,i−ptR\)\|ℱt−1\]≤exp⁡\(λ28​R2\)\.\\mathbb\{E\}\\left\[\\exp\\left\(\\lambda\\frac\{X\_\{t,i\}\-p\_\{t\}\}\{R\}\\right\)\\middle\|\\mathcal\{F\}\_\{t\-1\}\\right\]\\leq\\exp\\left\(\\frac\{\\lambda^\{2\}\}\{8R^\{2\}\}\\right\)\.Conditional independence of theRRsamples therefore yields

𝔼⁡\[exp⁡\(λ​Dt\)\|ℱt−1\]\\displaystyle\\mathbb\{E\}\\left\[\\exp\(\\lambda D\_\{t\}\)\\middle\|\\mathcal\{F\}\_\{t\-1\}\\right\]=∏i=1R𝔼⁡\[exp⁡\(λ​Xt,i−ptR\)\|ℱt−1\]\\displaystyle=\\prod\_\{i=1\}^\{R\}\\mathbb\{E\}\\left\[\\exp\\left\(\\lambda\\frac\{X\_\{t,i\}\-p\_\{t\}\}\{R\}\\right\)\\middle\|\\mathcal\{F\}\_\{t\-1\}\\right\]≤exp⁡\(λ28​R\)\.\\displaystyle\\leq\\exp\\left\(\\frac\{\\lambda^\{2\}\}\{8R\}\\right\)\.\(11\)This proves the first assertion\. Forλ\>0\\lambda\>0, the Markov inequality gives

Pr⁡\[Dt≥u\|ℱt−1\]≤exp⁡\(−λ​u\+λ28​R\)\.\\Pr\\left\[D\_\{t\}\\geq u\\middle\|\\mathcal\{F\}\_\{t\-1\}\\right\]\\leq\\exp\\left\(\-\\lambda u\+\\frac\{\\lambda^\{2\}\}\{8R\}\\right\)\.Choosingλ=4​R​u\\lambda=4Rugives the upper\-tail bound

Pr⁡\[Dt≥u\|ℱt−1\]≤exp⁡\(−2​R​u2\)\.\\Pr\\left\[D\_\{t\}\\geq u\\middle\|\\mathcal\{F\}\_\{t\-1\}\\right\]\\leq\\exp\(\-2Ru^\{2\}\)\.Applying the same argument to−Dt\-D\_\{t\}and adding the two tail bounds proves the second assertion\.

For the third assertion, write

Sa,b=∑s=a\+1bDs\.S\_\{a,b\}=\\sum\_\{s=a\+1\}^\{b\}D\_\{s\}\.SinceSa,b−1S\_\{a,b\-1\}isℱb−1\\mathcal\{F\}\_\{b\-1\}\-measurable, \([11](https://arxiv.org/html/2609.29189#A4.E11)\) implies

𝔼⁡\[exp⁡\(λ​Sa,b\)\|ℱa\]\\displaystyle\\mathbb\{E\}\\left\[\\exp\(\\lambda S\_\{a,b\}\)\\middle\|\\mathcal\{F\}\_\{a\}\\right\]=𝔼⁡\[exp⁡\(λ​Sa,b−1\)​𝔼​\[exp⁡\(λ​Db\)\|ℱb−1\]\|ℱa\]\\displaystyle=\\mathbb\{E\}\\left\[\\exp\(\\lambda S\_\{a,b\-1\}\)\\mathbb\{E\}\\left\[\\exp\(\\lambda D\_\{b\}\)\\middle\|\\mathcal\{F\}\_\{b\-1\}\\right\]\\middle\|\\mathcal\{F\}\_\{a\}\\right\]≤exp⁡\(λ28​R\)​𝔼​\[exp⁡\(λ​Sa,b−1\)\|ℱa\]\.\\displaystyle\\leq\\exp\\left\(\\frac\{\\lambda^\{2\}\}\{8R\}\\right\)\\mathbb\{E\}\\left\[\\exp\(\\lambda S\_\{a,b\-1\}\)\\middle\|\\mathcal\{F\}\_\{a\}\\right\]\.Iterating over theb−ab\-arounds gives

𝔼⁡\[exp⁡\(λ​Sa,b\)\|ℱa\]≤exp⁡\(\(b−a\)​λ28​R\)\.\\mathbb\{E\}\\left\[\\exp\(\\lambda S\_\{a,b\}\)\\middle\|\\mathcal\{F\}\_\{a\}\\right\]\\leq\\exp\\left\(\\frac\{\(b\-a\)\\lambda^\{2\}\}\{8R\}\\right\)\.
The Markov inequality atλ=4​R​ub−a,\\lambda=\\frac\{4Ru\}\{b\-a\},gives

Pr⁡\[Sa,b≥u\|ℱa\]≤exp⁡\(−2​R​u2b−a\)\.\\Pr\\left\[S\_\{a,b\}\\geq u\\middle\|\\mathcal\{F\}\_\{a\}\\right\]\\leq\\exp\\left\(\-\\frac\{2Ru^\{2\}\}\{b\-a\}\\right\)\.Applying the same argument to−Sa,b\-S\_\{a,b\}and adding the two tails completes the proof\. ∎

### D\.2Protocol Completeness

Given the honest behaviour by both parties, we assume that the transcript update is a fresh Bernoulli draw with parameterp^t\\hat\{p\}\_\{t\}, and thatpt=Pr\[yt∣𝐲I⁡\(t\)=𝒂I⁡\(s\)p\_\{t\}=\\Pr\[\{\\textnormal\{y\}\}\_\{t\}\\mid\{\\mathbf\{y\}\}\_\{I\(t\)=\{\\bm\{a\}\}\_\{I\(s\)\}\}is the corresponding true transition probability ofMM\. The protocol uses full windowsJt=\{t−W\+1,…,t\},J\_\{t\}=\\\{t\-W\+1,\\ldots,t\\\},with drift challenges permitted only fort≥Wt\\geq W\. The verifier’s drift statistic must sum thess\-indexed discrepancies\. That that, for probabilistic Turing machineMM, the standard bounded\-error guarantee isPr\[M𝒪\(x\)=1\]≥23\.\\Pr\[M^\{\\mathcal\{O\}\}\(x\)=1\]\\geq\\frac\{2\}\{3\}\.

###### Lemma 12\(Task correctness\)\.

LetMMbe aKK\-Lipschitz probabilistic Turing machine that decidesLLR≥192​d2​log⁡\(100​T\),R\\geq 192d^\{2\}\\log\(100T\),For anyx∈Lx\\in L, any fixed window lengthW∈\[T\]W\\in\[T\], honest strategyσA∼\(R,0\)\\sigma\_\{A\}\\sim\(R,0\), and arbitrary cross\-examiner strategyσB\\sigma\_\{B\},

Pr\[V→1\]≥35\.\\Pr\[V\\to 1\]\\geq\\frac\{3\}\{5\}\.

###### Proof\.

Simulate an auxiliary execution𝒮\\mathcal\{S\}that generates allTTtranscript updates using the reporting strategyσA\\sigma\_\{A\}, ignoring any challenge for purposes of continuing the transcript\. Let𝐲𝗌\{\\mathbf\{y\}\}^\{\\mathsf\{s\}\}denote the random transcript of the simulated execution and before each roundtt, let𝐡t−1𝗌\{\\mathbf\{h\}\}\_\{t\-1\}^\{\\mathsf\{s\}\}contain the complete history on the simulated execution\. Conditional on𝐡t−1𝗌\{\\mathbf\{h\}\}\_\{t\-1\}^\{\\mathsf\{s\}\}, the honest reporter drawsRRfresh, independent Bernoulli samplesXt,1,…,Xt,R,X\_\{t,1\},\\ldots,X\_\{t,R\},each with meanptp\_\{t\}, and reports

p^t𝗌=1R​∑j=1RXt,j\.\\hat\{p\}\_\{t\}^\{\\mathsf\{s\}\}=\\frac\{1\}\{R\}\\sum\_\{j=1\}^\{R\}X\_\{t,j\}\.The next transcript bityt𝗌\{\\textnormal\{y\}\}\_\{t\}^\{\\mathsf\{s\}\}is generated using independent randomness with success probabilityp^t𝗌\\hat\{p\}\_\{t\}^\{\\mathsf\{s\}\}\. Consequently,

Pr⁡\[yt𝗌=1∣𝐡t−1𝗌\]\\displaystyle\\Pr\[\{\\textnormal\{y\}\}\_\{t\}^\{\\mathsf\{s\}\}=1\\mid\{\\mathbf\{h\}\}\_\{t\-1\}^\{\\mathsf\{s\}\}\]=𝔼⁡\[p^t𝗌∣𝐡t−1𝗌\]=pt\.\\displaystyle=\\mathbb\{E\}\[\\hat\{p\}\_\{t\}^\{\\mathsf\{s\}\}\\mid\{\\mathbf\{h\}\}\_\{t\-1\}^\{\\mathsf\{s\}\}\]=p\_\{t\}\.Thus, the simulated transcript has exactly the transition probabilities of the true execution ofM𝒪​\(x\)M^\{\\mathcal\{O\}\}\(x\)\. IfyT𝗌\{\\textnormal\{y\}\}\_\{T\}^\{\\mathsf\{s\}\}denotes its terminal output, then

Pr\[yT𝗌=1\]=Pr\[M𝒪\(x\)=1\]≥23\.\\Pr\[\{\\textnormal\{y\}\}\_\{T\}^\{\\mathsf\{s\}\}=1\]=\\Pr\[M^\{\\mathcal\{O\}\}\(x\)=1\]\\geq\\frac\{2\}\{3\}\.
Couple the actual protocol to this simulated execution using the same samples and transcript\-update randomness until the actual protocol stops\. If no challenge occurs, the actual output equalsyT𝗌𝗂𝗆=aT𝗌𝗂𝗆\{\\textnormal\{y\}\}\_\{T\}^\{\\mathsf\{sim\}\}=\{a\}\_\{T\}^\{\\mathsf\{sim\}\}\. The simulated continuation after a challenge is used only for analysis and is generated independently of the subsequent audit randomness ofVV\.

Define the reporting errorDt𝗌𝗂𝗆=p^t𝗌𝗂𝗆−pt\.D\_\{t\}^\{\\mathsf\{sim\}\}=\\hat\{p\}\_\{t\}^\{\\mathsf\{sim\}\}\-p\_\{t\}\.For each roundtt, letℰt\(1\)\\mathcal\{E\}\_\{t\}^\{\(1\)\}be the event\|Dt𝗌𝗂𝗆\|<18​d\.\|D\_\{t\}^\{\\mathsf\{sim\}\}\|<\\frac\{1\}\{8d\}\.For eacht≥Wt\\geq W, letℰt\(2\)\\mathcal\{E\}\_\{t\}^\{\(2\)\}be the event

\|∑s∈JtDs𝗌𝗂𝗆\|<W8​d\.\\left\|\\sum\_\{s\\in J\_\{t\}\}D\_\{s\}^\{\\mathsf\{sim\}\}\\right\|<\\frac\{\\sqrt\{W\}\}\{8d\}\.Let𝒢𝗌𝗂𝗆\\mathcal\{G\}^\{\\mathsf\{sim\}\}be the intersection of all these individual and window events in the simulated execution\.

By Lemma[11](https://arxiv.org/html/2609.29189#Thmlemma11), for every roundtt,

Pr⁡\[¬ℰt\(1\)∣𝐡t−1𝗌𝗂𝗆\]=Pr⁡\[\|Dt𝗌𝗂𝗆\|≥18​d\|𝐡t−1𝗌𝗂𝗆\]≤2​exp⁡\(−R32​d2\)\.\\displaystyle\\Pr\[\\neg\\mathcal\{E\}\_\{t\}^\{\(1\)\}\\mid\{\\mathbf\{h\}\}\_\{t\-1\}^\{\\mathsf\{sim\}\}\]=\\Pr\\left\[\|D\_\{t\}^\{\\mathsf\{sim\}\}\|\\geq\\frac\{1\}\{8d\}\\middle\|\{\\mathbf\{h\}\}\_\{t\-1\}^\{\\mathsf\{sim\}\}\\right\]\\leq 2\\exp\\left\(\-\\frac\{R\}\{32d^\{2\}\}\\right\)\.Similarly, for window errors, Lemma[11](https://arxiv.org/html/2609.29189#Thmlemma11)gives, for everyu\>0u\>0,

Pr⁡\[\|∑s∈JtDs𝗌𝗂𝗆\|≥u∣𝐡t−W𝗌𝗂𝗆\]≤2​exp⁡\(−2​R​u2W\)\.\\Pr\\left\[\\left\|\\sum\_\{s\\in J\_\{t\}\}D\_\{s\}^\{\\mathsf\{sim\}\}\\right\|\\geq u\\mid\{\\mathbf\{h\}\}\_\{t\-W\}^\{\\mathsf\{sim\}\}\\right\]\\leq 2\\exp\\left\(\-\\frac\{2Ru^\{2\}\}\{W\}\\right\)\.Therefore, it follows that

Pr⁡\[¬ℰt\(2\)∣𝐡t−W𝗌𝗂𝗆\]≤2​exp⁡\(−R32​d2\)\.\\Pr\[\\neg\\mathcal\{E\}\_\{t\}^\{\(2\)\}\\mid\{\\mathbf\{h\}\}\_\{t\-W\}^\{\\mathsf\{sim\}\}\]\\leq 2\\exp\\left\(\-\\frac\{R\}\{32d^\{2\}\}\\right\)\.There areTTindividual events and at mostTTwindow events\. Therefore, by a union bound,

Pr⁡\[¬𝒢𝗌𝗂𝗆\]\\displaystyle\\Pr\[\\neg\\mathcal\{G\}^\{\\mathsf\{sim\}\}\]≤4​T​exp⁡\(−R32​d2\)\\displaystyle\\leq 4T\\exp\\left\(\-\\frac\{R\}\{32d^\{2\}\}\\right\)≤4​T​\(100​T\)−6\.\\displaystyle\\leq 4T\(100T\)^\{\-6\}\.\(12\)
Let𝒜t\(𝖾\)\\mathcal\{A\}\_\{t\}^\{\\mathsf\{\(e\)\}\}denote the event thatabort erroroccurs at timett\. Condition on a complete pre\-audit history𝐡𝗌𝗂𝗆\{\\mathbf\{h\}\}^\{\\mathsf\{sim\}\}at which𝒜t\(𝖾\)\\mathcal\{A\}\_\{t\}^\{\\mathsf\{\(e\)\}\}occurs\. This fixesptp\_\{t\}andp^t\\hat\{p\}\_\{t\}\. Suppose𝒢𝗌𝗂𝗆\\mathcal\{G\}^\{\\mathsf\{sim\}\}occurs\. IfVVrejects, then

\|p^t𝒪−p^t\|≥14​d,\|\\hat\{p\}\_\{t\}^\{\\mathcal\{O\}\}\-\\hat\{p\}\_\{t\}\|\\geq\\frac\{1\}\{4d\},so the triangle inequality implies

\|p^t𝒪−pt\|\>18​d\.\|\\hat\{p\}\_\{t\}^\{\\mathcal\{O\}\}\-p\_\{t\}\|\>\\frac\{1\}\{8d\}\.VVusesr\(𝖾\)=⌈192​d2​log⁡100⌉r^\{\(\\mathsf\{e\}\)\}=\\left\\lceil 192d^\{2\}\\log 100\\right\\rceilfresh, independent samples\. Therefore, by Lemma[11](https://arxiv.org/html/2609.29189#Thmlemma11),

Pr\[V→0∣𝐡𝗌𝗂𝗆,𝒢𝗌𝗂𝗆,𝒜t\(𝖾\)\]\\displaystyle\\Pr\[V\\to 0\\mid\{\\mathbf\{h\}\}^\{\\mathsf\{sim\}\},\\mathcal\{G\}^\{\\mathsf\{sim\}\},\\mathcal\{A\}\_\{t\}^\{\\mathsf\{\(e\)\}\}\]≤2​exp⁡\(−r\(𝖾\)32​d2\)≤2⋅100−6,\\displaystyle\\leq 2\\exp\\left\(\-\\frac\{r^\{\(\\mathsf\{e\}\)\}\}\{32d^\{2\}\}\\right\)\\leq 2\\cdot 100^\{\-6\},\(13\)under the protocol execution couple to the simulated execution\.

Let𝒜t\(𝖽\)\\mathcal\{A\}\_\{t\}^\{\\mathsf\{\(d\)\}\}denote the event thatabort driftoccurs at timet≥Wt\\geq W\. As above, now condition on a complete pre\-audit history𝐡𝗌𝗂𝗆\{\\mathbf\{h\}\}^\{\\mathsf\{sim\}\}at which𝒜t\(𝖽\)\\mathcal\{A\}\_\{t\}^\{\\mathsf\{\(d\)\}\}occurs\. Suppose𝒢𝗌𝗂𝗆\\mathcal\{G\}^\{\\mathsf\{sim\}\}occurs\. For eachs∈Jts\\in J\_\{t\},VVdrawsr\(𝖽\)=⌈192​d2​log⁡\(100​W\)⌉r^\{\(\\mathsf\{d\}\)\}=\\left\\lceil 192d^\{2\}\\log\(100W\)\\right\\rceilfresh samples, independently across all audited rounds and sample indices\. Define

SV=∑s∈Jt\(p^s𝒪−ps\)\.S\_\{V\}=\\sum\_\{s\\in J\_\{t\}\}\(\\hat\{p\}\_\{s\}^\{\\mathcal\{O\}\}\-p\_\{s\}\)\.Conditioned on𝐡𝗌𝗂𝗆\{\\mathbf\{h\}\}^\{\\mathsf\{sim\}\},SVS\_\{V\}is a sum ofW​r\(𝖽\)Wr^\{\(\\mathsf\{d\}\)\}independent centered variables, each having range length1/r\(𝖽\)1/r^\{\(\\mathsf\{d\}\)\}\. Hence, by Lemma[11](https://arxiv.org/html/2609.29189#Thmlemma11)

Pr\[\|SV\|≥u\|𝐡𝗌𝗂𝗆,𝒢𝗌𝗂𝗆,𝒜t\(𝖽\)\]≤2exp\(−2​r\(𝖽\)​u2W\)\.\\Pr\\left\[\|S\_\{V\}\|\\geq u\\middle\|\{\\mathbf\{h\}\}^\{\\mathsf\{sim\}\},\\mathcal\{G\}^\{\\mathsf\{sim\}\},\\mathcal\{A\}\_\{t\}^\{\\mathsf\{\(d\)\}\}\\right\]\\leq 2\\exp\\left\(\-\\frac\{2r^\{\(\\mathsf\{d\}\)\}u^\{2\}\}\{W\}\\right\)\.If\|SV\|<W/8​d,\|S\_\{V\}\|<\{\\sqrt\{W\}\}/\{8d\},the triangle inequality gives

\|∑s∈Jt\(p^s𝒪−p^s\)\|<W4​d\.\\left\|\\sum\_\{s\\in J\_\{t\}\}\(\\hat\{p\}\_\{s\}^\{\\mathcal\{O\}\}\-\\hat\{p\}\_\{s\}\)\\right\|<\\frac\{\\sqrt\{W\}\}\{4d\}\.Therefore,VVaccepts the challenge audit\. Consequently,

Pr\[V→0∣𝐡𝗌𝗂𝗆,𝒢𝗌𝗂𝗆,𝒜t\(𝖽\)\]≤2exp\(−r\(𝖽\)32​d2\)≤2\(100W\)−6≤2⋅100−6\.\\displaystyle\\Pr\[V\\to 0\\mid\{\\mathbf\{h\}\}^\{\\mathsf\{sim\}\},\\mathcal\{G\}^\{\\mathsf\{sim\}\},\\mathcal\{A\}\_\{t\}^\{\\mathsf\{\(d\)\}\}\]\\leq 2\\exp\\left\(\-\\frac\{r^\{\(\\mathsf\{d\}\)\}\}\{32d^\{2\}\}\\right\)\\leq 2\(100W\)^\{\-6\}\\leq 2\\cdot 100^\{\-6\}\.\(14\)
Let𝒥\\mathcal\{J\}be the event that a challenge occurs and the verifier outputs00\. By \([13](https://arxiv.org/html/2609.29189#A4.E13)\) and \([14](https://arxiv.org/html/2609.29189#A4.E14)\),

Pr⁡\[𝒥∩𝒢\]\\displaystyle\\Pr\[\\mathcal\{J\}\\cap\\mathcal\{G\}\]≤∑t,𝖼Pr⁡\[𝒜t\(𝖼\)∩𝒢𝗌𝗂𝗆\]​Pr⁡\[V→0∣𝒜t\(𝖼\)∩𝒢𝗌𝗂𝗆\]\\displaystyle\\leq\\sum\_\{t,\\mathsf\{c\}\}\\Pr\[\\mathcal\{A\}\_\{t\}^\{\(\\mathsf\{c\}\)\}\\cap\\mathcal\{G\}^\{\\mathsf\{sim\}\}\]\\Pr\[V\\to 0\\mid\\mathcal\{A\}\_\{t\}^\{\(\\mathsf\{c\}\)\}\\cap\\mathcal\{G\}^\{\\mathsf\{sim\}\}\]≤2⋅100−6∑t,𝖼Pr\[𝒜t\(𝖼\)∩𝒢𝗌𝗂𝗆\]\\displaystyle\\leq 2\\cdot 100^\{\-6\}\\sum\_\{t,\\mathsf\{c\}\}\\Pr\[\\mathcal\{A\}\_\{t\}^\{\(\\mathsf\{c\}\)\}\\cap\\mathcal\{G\}^\{\\mathsf\{sim\}\}\]≤2⋅100−6\.\\displaystyle\\leq 2\\cdot 100^\{\-6\}\.\(15\)Conditional on each pre\-audit history, the audit randomness is independent of the auxiliary continuation\. Consequently, further conditioning on𝒢𝗌𝗂𝗆\\mathcal\{G\}^\{\\mathsf\{sim\}\}does not change the conditional law of the audit samples\.

Under the coupling, ifyT𝗌𝗂𝗆=1\{\\textnormal\{y\}\}\_\{T\}^\{\\mathsf\{sim\}\}=1and the actual protocol outputs00, then a challenge must have occurred and been rejected\. Indeed, without a challenge, the actual output equalsyT𝗌𝗂𝗆=1\{\\textnormal\{y\}\}\_\{T\}^\{\\mathsf\{sim\}\}=1\. Thus, by \([12](https://arxiv.org/html/2609.29189#A4.E12)\) and \([15](https://arxiv.org/html/2609.29189#A4.E15)\),

Pr\[V→1\]\\displaystyle\\Pr\[V\\to 1\]≥Pr\[yT𝗌𝗂𝗆=1\]−Pr\[𝒥\]\\displaystyle\\geq\\Pr\[\{\\textnormal\{y\}\}\_\{T\}^\{\\mathsf\{sim\}\}=1\]\-\\Pr\[\\mathcal\{J\}\]≥Pr\[yT𝗌𝗂𝗆=1\]−Pr\[¬𝒢𝗌𝗂𝗆\]−Pr\[𝒥∩𝒢𝗌𝗂𝗆\]\\displaystyle\\geq\\Pr\[\{\\textnormal\{y\}\}\_\{T\}^\{\\mathsf\{sim\}\}=1\]\-\\Pr\[\\neg\\mathcal\{G\}^\{\\mathsf\{sim\}\}\]\-\\Pr\[\\mathcal\{J\}\\cap\\mathcal\{G\}^\{\\mathsf\{sim\}\}\]≥23−4​T​\(100​T\)−6−2⋅100−6\>35\\displaystyle\\geq\\frac\{2\}\{3\}\-4T\(100T\)^\{\-6\}\-2\\cdot 100^\{\-6\}\>\\frac\{3\}\{5\}The argument holds for every legal cross\-examiner strategyσB\\sigma\_\{B\}, proving the lemma\. ∎

### D\.3Smaller Admissible Region

For the second part of Theorem[4](https://arxiv.org/html/2609.29189#Thmtheorem4)we require the following\.

###### Lemma 13\.

LetLLbe any language decided by a Turing machineMMandW∈\[T\]W\\in\[T\]be the sliding\-window parameter\. ForR≥192​d2​log⁡\(100​T\),R\\geq 192d^\{2\}\\log\(100T\),Δ≥1/\(d​W\),\\Delta\\geq 1/\(d\\sqrt\{W\}\),τ1=1/\(2​d\),\\tau\_\{1\}=1/\(2d\),andτ2=W/\(2​d\),\\tau\_\{2\}=\\sqrt\{W\}/\(2d\),letσA∼\(R,Δ\),\\sigma\_\{A\}\\sim\(R,\\Delta\),andσB∼\(R,τ1,τ2\)\\sigma\_\{B\}\\sim\(R,\\tau\_\{1\},\\tau\_\{2\}\)\.

ΦA\(x,σA∘σB\)=Pr\[V←1\]<1150\.\\Phi\_\{A\}\(x,\\sigma\_\{A\}\\circ\\sigma\_\{B\}\)=\\Pr\[V\\leftarrow 1\]<\\frac\{1\}\{150\}\.

###### Revised proof\.

FixQ∈\{−1,1\}Q\\in\\\{\-1,1\\\}\. All probabilities below are conditional on this fixed value ofQQ\. Construct an simulated execution𝒮\\mathcal\{S\}that continues forTTrounds according to strategiesσA\\sigma\_\{A\}andσB\\sigma\_\{B\}, ignoring challenges\. Couple the actual protocol to this simulated execution until its first challenge\. The simulated continuation uses randomness independent of theVV’s fresh audit randomness\.

At roundtt, letptp\_\{t\}be the true oracle probability at the current state𝐡𝗌𝗂𝗆\{\\mathbf\{h\}\}^\{\\mathsf\{sim\}\}\. Letp¯t\\bar\{p\}\_\{t\}andq^t\\hat\{q\}\_\{t\}beAA’s andBB’s unperturbed sample means, each based onRRfresh𝖡𝖾𝗋𝗇⁡\(pt\)\\mathsf\{Bern\}\(p\_\{t\}\)samples\. DefineDA​\(t\)𝗌𝗂𝗆=p¯t𝗌𝗂𝗆−pt,D\_\{A\}\(t\)^\{\\mathsf\{sim\}\}=\\bar\{p\}\_\{t\}^\{\\mathsf\{sim\}\}\-p\_\{t\},DB​\(t\)𝗌𝗂𝗆=q^t𝗌𝗂𝗆−pt,D\_\{B\}\(t\)^\{\\mathsf\{sim\}\}=\\hat\{q\}\_\{t\}^\{\\mathsf\{sim\}\}\-p\_\{t\},SA​\(t\)=∑s∈JtDA​\(s\)𝗌𝗂𝗆,S\_\{A\}\(t\)=\\sum\_\{s\\in J\_\{t\}\}D\_\{A\}\(s\)^\{\\mathsf\{sim\}\},andSB​\(t\)=∑s∈JtDB​\(s\)𝗌𝗂𝗆\.S\_\{B\}\(t\)=\\sum\_\{s\\in J\_\{t\}\}D\_\{B\}\(s\)^\{\\mathsf\{sim\}\}\.NoteSA​\(t\)S\_\{A\}\(t\)is defined using the unperturbed estimatep¯s𝗌𝗂𝗆\\bar\{p\}\_\{s\}^\{\\mathsf\{sim\}\}, not the perturbed report\.

Let𝒢A​B\\mathcal\{G\}\_\{AB\}be the event that, for bothi∈\{A,B\}i\\in\\\{A,B\\\},\|Di​\(t\)𝗌𝗂𝗆\|<18​d​for every,\|D\_\{i\}\(t\)^\{\\mathsf\{sim\}\}\|<\\frac\{1\}\{8d\}\\text\{for every \},for everyt∈\{1,…,T\}t\\in\\\{1,\\ldots,T\\\}, and\|Si​\(t\)\|<W/8​d\|S\_\{i\}\(t\)\|<\{\\sqrt\{W\}\}/\{8d\}for everyt∈\{W,…,T\}t\\in\\\{W,\\ldots,T\\\}

Conditional on the pre\-round history𝐡t−1𝗌𝗂𝗆\{\\mathbf\{h\}\}\_\{t\-1\}^\{\\mathsf\{sim\}\}andQQ, each sample mean is unbiased forptp\_\{t\}\. By Lemma[11](https://arxiv.org/html/2609.29189#Thmlemma11), for eachi∈\{A,B\}i\\in\\\{A,B\\\},

Pr\[\|Di\(t\)𝗌𝗂𝗆\|≥18​d\|Q,𝐡t−1𝗌𝗂𝗆\]≤2exp\(−R32​d2\),\\Pr\\left\[\|D\_\{i\}\(t\)^\{\\mathsf\{sim\}\}\|\\geq\\frac\{1\}\{8d\}\\middle\|Q,\{\\mathbf\{h\}\}\_\{t\-1\}^\{\\mathsf\{sim\}\}\\right\]\\leq 2\\exp\\left\(\-\\frac\{R\}\{32d^\{2\}\}\\right\),and

Pr\[\|Si\(t\)\|≥W8​d\|Q,𝐡t−W𝗌𝗂𝗆\]≤2exp\(−R32​d2\)\.\\Pr\\left\[\|S\_\{i\}\(t\)\|\\geq\\frac\{\\sqrt\{W\}\}\{8d\}\\middle\|Q,\{\\mathbf\{h\}\}\_\{t\-W\}^\{\\mathsf\{sim\}\}\\right\]\\leq 2\\exp\\left\(\-\\frac\{R\}\{32d^\{2\}\}\\right\)\.There are at most4​T4Tevents in the definition of𝒢A​B\\mathcal\{G\}\_\{AB\}\. Consequently,

Pr⁡\[𝒢A​Bc∣Q\]\\displaystyle\\Pr\[\\mathcal\{G\}\_\{AB\}^\{c\}\\mid Q\]≤8​T​exp⁡\(−R32​d2\)\\displaystyle\\leq 8T\\exp\\left\(\-\\frac\{R\}\{32d^\{2\}\}\\right\)≤8​T​\(100​T\)−6\.\\displaystyle\\leq 8T\(100T\)^\{\-6\}\.\(16\)
On𝒢A​B\\mathcal\{G\}\_\{AB\}, the assumed absence of clipping givesp^t𝗌𝗂𝗆=p¯t𝗌𝗂𝗆\+Q​Δ\.\\hat\{p\}\_\{t\}^\{\\mathsf\{sim\}\}=\\bar\{p\}\_\{t\}^\{\\mathsf\{sim\}\}\+Q\\Delta\.Under the coupled execution\. if anabort errorchallenge has not already occurred, the execution reaches the first full windowJWJ\_\{W\}\. At that window, forΔ≥1/\(d​W\)\\Delta\\geq 1/\(d\\sqrt\{W\}\),

\|∑s∈JW\(p^s−q^s\)\|\\displaystyle\\left\|\\sum\_\{s\\in J\_\{W\}\}\(\\hat\{p\}\_\{s\}\-\\hat\{q\}\_\{s\}\)\\right\|=\|Q​W​Δ\+SA​\(W\)−SB​\(W\)\|\\displaystyle=\\left\|QW\\Delta\+S\_\{A\}\(W\)\-S\_\{B\}\(W\)\\right\|≥W​Δ−\|SA​\(W\)\|−\|SB​\(W\)\|\\displaystyle\\geq W\\Delta\-\|S\_\{A\}\(W\)\|\-\|S\_\{B\}\(W\)\|\>Wd−2​W8​d\\displaystyle\>\\frac\{\\sqrt\{W\}\}\{d\}\-\\frac\{2\\sqrt\{W\}\}\{8d\}=3​W4​d\\displaystyle=\\frac\{3\\sqrt\{W\}\}\{4d\}\>W2​d\.\\displaystyle\>\\frac\{\\sqrt\{W\}\}\{2d\}\.\(17\)ThusBBissues a challenge no later than roundWW\. It remains to show that either possible challenge type leads to output00, except with uniformly small audit probability\.

Let𝒜t\(𝖾\)\\mathcal\{A\}\_\{t\}^\{\\mathsf\{\(e\)\}\}denote the event thatabort erroroccurs at timett\. Condition on a complete pre\-audit history𝐡𝗌𝗂𝗆\{\\mathbf\{h\}\}^\{\\mathsf\{sim\}\}at which𝒜t\(𝖾\)\\mathcal\{A\}\_\{t\}^\{\\mathsf\{\(e\)\}\}occurs\. This fixesp¯t𝗌𝗂𝗆,q^t𝗌𝗂𝗆\\bar\{p\}\_\{t\}^\{\\mathsf\{sim\}\},\\hat\{q\}\_\{t\}^\{\\mathsf\{sim\}\}, andptp\_\{t\}\. By the challenge rule,

\|p^t𝗌𝗂𝗆−q^t𝗌𝗂𝗆\|\>12​d\.\|\\hat\{p\}\_\{t\}^\{\\mathsf\{sim\}\}\-\\hat\{q\}\_\{t\}^\{\\mathsf\{sim\}\}\|\>\\frac\{1\}\{2d\}\.On events𝒢A​B\\mathcal\{G\}\_\{AB\}and\|q^t−pt\|<1/\(8​d\)\|\\hat\{q\}\_\{t\}\-p\_\{t\}\|<1/\(8d\)the following holds

\|p^t𝗌𝗂𝗆−pt\|≥\|p^t𝗌𝗂𝗆−q^t𝗌𝗂𝗆\|−\|q^t𝗌𝗂𝗆−pt\|\>12​d−18​d=38​d\.\\displaystyle\|\\hat\{p\}\_\{t\}^\{\\mathsf\{sim\}\}\-p\_\{t\}\|\\geq\|\\hat\{p\}\_\{t\}^\{\\mathsf\{sim\}\}\-\\hat\{q\}\_\{t\}^\{\\mathsf\{sim\}\}\|\-\|\\hat\{q\}\_\{t\}^\{\\mathsf\{sim\}\}\-p\_\{t\}\|\>\\frac\{1\}\{2d\}\-\\frac\{1\}\{8d\}=\\frac\{3\}\{8d\}\.If theVV’s fresh estimate satisfies\|p^t𝒪−pt\|<1/\(8​d\),\|\\hat\{p\}\_\{t\}^\{\\mathcal\{O\}\}\-p\_\{t\}\|<\{1\}/\{\(8d\)\},then

\|p^t𝒪−p^t𝗌𝗂𝗆\|\\displaystyle\|\\hat\{p\}\_\{t\}^\{\\mathcal\{O\}\}\-\\hat\{p\}\_\{t\}^\{\\mathsf\{sim\}\}\|≥\|p^t𝗌𝗂𝗆−pt\|−\|p^t𝒪−pt\|\\displaystyle\\geq\|\\hat\{p\}\_\{t\}^\{\\mathsf\{sim\}\}\-p\_\{t\}\|\-\|\\hat\{p\}\_\{t\}^\{\\mathcal\{O\}\}\-p\_\{t\}\|\>38​d−18​d\\displaystyle\>\\frac\{3\}\{8d\}\-\\frac\{1\}\{8d\}=14​d\.\\displaystyle=\\frac\{1\}\{4d\}\.Hence,VVoutputs00\. It follows that

Pr\[V→1∣𝒜t\(𝖾\),𝐡𝗌𝗂𝗆,𝒢A​B\]≤Pr\[\|p^t𝒪−pt\|\>1/\(8d\)\]\\displaystyle\\Pr\[V\\to 1\\mid\\mathcal\{A\}\_\{t\}^\{\\mathsf\{\(e\)\}\},\{\\mathbf\{h\}\}^\{\\mathsf\{sim\}\},\\mathcal\{G\}\_\{AB\}\]\\leq\\Pr\[\|\\hat\{p\}\_\{t\}^\{\\mathcal\{O\}\}\-p\_\{t\}\|\>\{1\}/\{\(8d\)\}\]≥2​exp⁡\(−r\(𝖾\)32​d2\)≤2⋅100−6\.\\displaystyle\\geq 2\\exp\\left\(\-\\frac\{r^\{\\mathsf\{\(e\)\}\}\}\{32d^\{2\}\}\\right\)\\leq 2\\cdot 100^\{\-6\}\.\(18\)
Similarly, let𝒜t\(𝖽\)\\mathcal\{A\}\_\{t\}^\{\\mathsf\{\(d\)\}\}denote the event thatabort driftoccurs at timett\. Condition on a complete pre\-audit history𝐡𝗌𝗂𝗆\{\\mathbf\{h\}\}^\{\\mathsf\{sim\}\}at which𝒜t\(𝖽\)\\mathcal\{A\}\_\{t\}^\{\\mathsf\{\(d\)\}\}occurs\. Define

SV​\(t\)=∑s∈Jt\(p^s𝒪−ps\)\.S\_\{V\}\(t\)=\\sum\_\{s\\in J\_\{t\}\}\\left\(\\hat\{p\}\_\{s\}^\{\\mathcal\{O\}\}\-p\_\{s\}\\right\)\.On𝒢A​B\\mathcal\{G\}\_\{AB\}and the event\|SV​\(t\)\|<W8​d\|S\_\{V\}\(t\)\|<\\frac\{\\sqrt\{W\}\}\{8d\},

\|∑s∈Jt\(p^s−p^s𝒪\)\|\\displaystyle\\left\|\\sum\_\{s\\in J\_\{t\}\}\(\\hat\{p\}\_\{s\}\-\\hat\{p\}\_\{s\}^\{\\mathcal\{O\}\}\)\\right\|=\|Q​W​Δ\+SA​\(t\)−SV​\(t\)\|\\displaystyle=\\left\|QW\\Delta\+S\_\{A\}\(t\)\-S\_\{V\}\(t\)\\right\|≥W​Δ−\|SA​\(t\)\|−\|SV​\(t\)\|\\displaystyle\\geq W\\Delta\-\|S\_\{A\}\(t\)\|\-\|S\_\{V\}\(t\)\|\>Wd−W8​d−W8​d\\displaystyle\>\\frac\{\\sqrt\{W\}\}\{d\}\-\\frac\{\\sqrt\{W\}\}\{8d\}\-\\frac\{\\sqrt\{W\}\}\{8d\}=3​W4​d\\displaystyle=\\frac\{3\\sqrt\{W\}\}\{4d\}\>W4​d\.\\displaystyle\>\\frac\{\\sqrt\{W\}\}\{4d\}\.ThereforeVVagain outputs00under good sample estimates\. Thus, by Lemma[11](https://arxiv.org/html/2609.29189#Thmlemma11),

Pr\[V→1∣𝒜t\(𝖽\),𝐡𝗌𝗂𝗆,𝒢A​B\]\\displaystyle\\Pr\[V\\to 1\\mid\\mathcal\{A\}\_\{t\}^\{\\mathsf\{\(d\)\}\},\{\\mathbf\{h\}\}^\{\\mathsf\{sim\}\},\\mathcal\{G\}\_\{AB\}\]≤Pr\[\|SV\(t\)\|≥W8​d\|𝐡𝗌𝗂𝗆,Q\]\\displaystyle\\leq\\Pr\\left\[\|S\_\{V\}\(t\)\|\\geq\\frac\{\\sqrt\{W\}\}\{8d\}\\middle\|\{\\mathbf\{h\}\}^\{\\mathsf\{sim\}\},Q\\right\]≤2​exp⁡\(−r\(𝖽\)32​d2\)≤2​\(100​W\)−6≤2⋅100−6\.\\displaystyle\\leq 2\\exp\\left\(\-\\frac\{r^\{\(\\mathsf\{d\}\)\}\}\{32d^\{2\}\}\\right\)\\leq 2\(100W\)^\{\-6\}\\leq 2\\cdot 100^\{\-6\}\.\(19\)
By \([17](https://arxiv.org/html/2609.29189#A4.E17)\), on𝒢A​B\\mathcal\{G\}\_\{AB\}, a challenge necessarily occurs at a timet≤Wt\\leq W\. Its time and type select one audit\. That is, they do not create multiple audit\-failure penalties\. By \([18](https://arxiv.org/html/2609.29189#A4.E18)\) and \([19](https://arxiv.org/html/2609.29189#A4.E19)\),

Pr\[V→1,𝒢A​B\|Q\]\\displaystyle\\Pr\[V\\to 1,\\mathcal\{G\}\_\{AB\}\|Q\]=∑t=1W∑𝖼Pr⁡\[V→1∩𝒜t\(𝖼\)∩𝒢A​B\|Q\]\\displaystyle=\\sum\_\{t=1\}^\{W\}\\sum\_\{\\mathsf\{c\}\}\\Pr\[\{V\\to 1\}\\cap\\mathcal\{A\}\_\{t\}^\{\(\\mathsf\{c\}\)\}\\cap\\mathcal\{G\}\_\{AB\}\|Q\]=∑t=1W∑𝖼Pr⁡\[V→1∣𝒜t\(𝖼\)∩𝒢A​B​Q\]⋅Pr⁡\[𝒜t\(𝖼\)∩𝒢A​B∣Q\]\\displaystyle=\\sum\_\{t=1\}^\{W\}\\sum\_\{\\mathsf\{c\}\}\\Pr\[\{V\\to 1\}\\mid\\mathcal\{A\}\_\{t\}^\{\(\\mathsf\{c\}\)\}\\cap\\mathcal\{G\}\_\{AB\}Q\]\\cdot\\Pr\[\\mathcal\{A\}\_\{t\}^\{\(\\mathsf\{c\}\)\}\\cap\\mathcal\{G\}\_\{AB\}\\mid Q\]≤2⋅100−6∑t=1W∑𝖼Pr\[V→1Pr\[𝒜t\(𝖼\)∩𝒢A​B∣Q\]\\displaystyle\\leq 2\\cdot 100^\{\-6\}\\sum\_\{t=1\}^\{W\}\\sum\_\{\\mathsf\{c\}\}\\Pr\[\{V\\to 1\}\\Pr\[\\mathcal\{A\}\_\{t\}^\{\(\\mathsf\{c\}\)\}\\cap\\mathcal\{G\}\_\{AB\}\\mid Q\]≤2⋅100−6\.\\displaystyle\\leq 2\\cdot 100^\{\-6\}\.Together with \([16](https://arxiv.org/html/2609.29189#A4.E16)\),

Pr⁡\[V→1∣Q\]\\displaystyle\\Pr\[V\\to 1\\mid Q\]≤Pr\[¬𝒢A​B∣Q\]\+Pr\[V→1,𝒢A​B∣Q\]\\displaystyle\\leq\\Pr\[\\neg\\mathcal\{G\}\_\{AB\}\\mid Q\]\+\\Pr\[V\\to 1,\\mathcal\{G\}\_\{AB\}\\mid Q\]≤8​T​\(100​T\)−6\+2⋅100−6\\displaystyle\\leq 8T\(100T\)^\{\-6\}\+2\\cdot 100^\{\-6\}<1150\.\\displaystyle<\\frac\{1\}\{150\}\.The bound is uniform inQQ\. Averaging overQQcompletes the proof\. ∎