Chapter 10 · Red Team
Chapter companion
📋 Chapter 10 templates · 🗂 Template index · 💻 code/persona-panel
This chapter's ladder. On the red team step AI sits steadily at assistant level, and this is the step of the seven that gets underrated hardest. Having it attack your conclusion costs almost nothing and pays off at once. Collaborator level (systematically searching out counterevidence for you) is still exploring. Keep the ceiling in mind too. It finds holes in reasoning and holes in statistics, and it does not find the "everyone in your field knows this, only it doesn't" kind of problem. So it writes the charges, and the ruling is yours.
Spine update. The last chapter packed the evidence into two vehicles, a technical report and a memo. The deliverables sit in the repo, one step short of going out. This chapter is the last step before that. I take the Chapter 8 interrogation apart into parts, assemble them into an attack process that can be run on any conclusion, and then lay the whole case file out where anyone can rerun it.
This chapter delivers. Three tools. A red-team dispatch brief template, a four-attack-surface prompt set, and a disposition table.
10.1 The email three weeks later
Three weeks ago you sent that memo to the whole team. The new design was thirty percent cheaper than the old one, the data was complete, the charts were clean. This afternoon an engineer from the next team over, known for being exacting, replied with your boss copied in. The wording was very polite. Attached was a notebook that reran all of your data. Your scoring script counted one class of timed-out requests as successes, and the timeouts happened to cluster in the old design's peak hours. Drop them and thirty percent becomes seven percent, with a confidence interval crossing zero, meaning the interval contains zero, so you cannot rule out that the new design saves nothing at all.
You stared at that attachment for a long time. The conclusion flipping is the lesser part. The sharpest sting is remembering that you had seen that timeout field, hesitated two seconds over whether to handle it separately, and then the deadline won.
Anyone who has submitted a paper knows the same scene. The review comment that hurts most always aims at the paragraph you were shaky about yourself and hoped nobody would notice. Shaky paragraphs are all written the same way. The qualifiers suddenly multiply, the evidence suddenly thins, and exacting readers have a hound's nose for it.
The two scenes share one law, and I call it the conservation of criticism. A conclusion with weight will meet its first serious attack sooner or later. You do not decide whether it happens. You decide two things. Whether it happens before release or after. And whether the attacker is employed by you, or by their own curiosity and hostility. That choice has a name, the red team, kill your own conclusion before someone else does. Chapter 2 put this step after delivery and before submission, and the reason was given then. Keep the trial and error inside your private loop. What enters the public knowledge base is held to another standard. Now it is time to execute.
10.2 From one interrogation to an attack process
In Chapter 8 you already saw one attack from start to finish, a "victory" of +18.2 percentage points interrogated down to −2.3 by three questions. But that was the interrogation. The interrogation and the red team differ in three places.
The trigger differs. The interrogation is triggered by excitement, and its object is a result you want to announce. The red team has no trigger condition. Every claim in the deliverable takes a beating, dazzling or dull. The interrogation is firefighting. The red team is acceptance.
The timing differs. The interrogation happens during interpretation, and it hits numbers. The red team happens after the deliverable is final and before it goes out, and it hits "the sentence you intend other people to read," wording included. "The army ties frontier on code" and "on code the gap between the army and frontier cannot be measured in either direction, at one fifth the cost" come from the same numbers and differ by a factor of two in how much surface they expose.
AI's role differs. The Chapter 8 discipline was to seat it as a juror, laying out facts and passing no judgment. In the red team it is promoted to a hired prosecutor, and the job is to construct charges, as hard as it can. This does not cross the division of labor of the interpretation step. What the prosecutor hands in is only a list of charges, each with an executable check attached. The verdict is not in it, and not one millimeter of ruling power has moved. The real risk runs the other way. It will hit too softly. Put weeks of work in front of it, add "take a look and see if there is anything wrong," and it will dutifully list three harmless items. Sycophancy, the habit of agreeing with you to please you, turns in a red-team setting into running a death-penalty review as an awards ceremony. How to dispatch so you get a real attack is what section 10.5 is for.
This kind of systematic hostility used to be scarce and left to luck. Now you can hire a tireless opponent at any hour, as Chapter 3 promised. The excuse "I could not find an opponent" no longer exists.
10.3 Lessons stolen from security engineering
You may not do security engineering daily, but you know the names threat modeling and fuzzing, and its daily business is paying people to attack its own systems. Three lessons transfer directly. The only question is where they break when they land on research conclusions.
Lesson one, attacks come from enumerating a list, not from inspiration. A security review does not ask "does this system have a hole." It walks a fixed threat taxonomy surface by surface, and Microsoft's STRIDE goes through six surfaces one class at a time (Kohnfelder and Garg, 1999 internal document, "The Threats to Our Products"). "Is there a problem" is a prayer. "Here is what each of these surfaces turned up" is a process. The counterpart for research conclusions is the four attack surfaces of the next section. Where it breaks. STRIDE's six surfaces are cut by the attacker's motive, and a research conclusion has no attacker, so the four surfaces are cut by which parts the conclusion stands on. Section 10.4 shows how those four got drawn.
Lesson two, machines do volume, people do triage. Google's OSS-Fuzz has reported more than fifty thousand bugs and more than thirteen thousand security vulnerabilities across about a thousand open-source projects (official figures, as of May 2025), and most of that output is duplicates and false positives. The valuable step is triage. Row 1 of the transfer map reads in one line at the red team step, the production cost of charges collapsed, the cost of ruling on them did not. AI can hand you dozens of charges in an hour. Which one is worth a check and which is noise is still your work, and it is the one part of this step you cannot cut. Where it breaks. A fuzzer's false positive is ruled out by one reproduction, while the check for a charge has to be designed by you, which is why the fourth discipline in section 10.5 requires a charge to carry its own check.
Lesson three, trust comes from mechanism, not from self-assessment. Row 3 of the transfer map says self-perception has to be calibrated by outside measurement, and row 9 says output from strangers gets trusted through mechanism, not goodwill. Put together, the corollary at the red team step is cold. When you say "I checked it myself," what carries to another person is about zero information, because everyone who never checked says the same thing. Transferable trust has only one shape. Put the criteria, the ledger, and the scripts on the table, and bring the cost of "recheck it" down to one command. That is the whole reason for the public case file in section 10.9.
10.4 The four attack surfaces
First, why these four. Take any empirical conclusion apart and it stands on four parts. Who judged right from wrong, what problems it was tested on, the sample size you think you have, and whether all of it was worth the price. Across the seven chapters of this case, every one of those parts took a real hit. The four attack surfaces are the shape you get by drawing lines between every bullet hole of this case on the wall, and I claim no credit for inventing a taxonomy.
| Attack surface | The prosecutor's question | The bullet hole in this case |
|---|---|---|
| The scorer | Who defined "right"? Is there a second defensible definition? Has every link of the scoring chain been replayed? | The % suffix miscarriage of justice; gold (the standard answer) read ambiguous English as having one correct reading (49 "wrong answers" identically equal to 4×gold) |
| Data composition | Where did the problems come from and how were they drawn? How many molds are there? Are they in the training corpus? | The draw took the first 150 rows unshuffled; the 150 problems are really ~3 template families |
| Independence assumptions | Is n the number of rows or the number of independent units? What does the CI assume? Are the errors of the two arms correlated? | Within a template family they are highly correlated, and the preregistered CI is overconfident |
| Cost basis | Who chose the basis? Does the conclusion flip on another set of books? Was the price the control arm got fair? | frontier used the family's balanced tier; the local amortization account is an analytic estimate, not measured |
Now the shape of the questions surface by surface. The full prompt set is in the appendix, and the chapter body demonstrates only one.
Attack the scorer. The question is the definition of "right" itself. Is there a second defensible reading of the gold answer? On the chain of parsing, matching, and scoring, which link silently swallows points or hands them out? Do the wrong answers carry a tidy pattern, always k times, always in one format, clustered in a continuous stretch? Those 49 "wrong answers" of Chapter 8 that were identically 4 times gold are the standard quarry on this surface. The surface holds for research that uses no benchmark too, only the scorer goes by another name. A human annotation rulebook, an LLM judge's preferences, the operational definition of "valid," all of them are scorers. The work order to the prosecutor looks like this, and the core is three things, charge, consequence, check. The rest is formatting detail.
Role: you are hired to attack the claims list below, on the attack surface "the scorer / the criteria,"
that is, how right and wrong, success and failure, get judged (gold answers, scoring scripts, annotation rules, operational definitions).
Input: the claims list and the paths to the materials (see the dispatch brief).
Output: a list of charges, ordered by lethality. Every charge must carry three things:
1 Charge: which point of the judging chain could score a right answer wrong, score a wrong answer right, or where the
definition of "right" itself has a second defensible reading;
2 Consequence: if the charge holds, which claim dies, and what direction and magnitude of effect gets manufactured;
3 Check: one check executable today (a script sketch / a sampling plan / a replay experiment)
whose result can confirm or rule out this charge.
Rules: attack only, no balanced coverage; do not evaluate whether the conclusion as a whole is credible;
do not list a charge you cannot give an executable check for; if you find nothing here, write "nothing found on this surface," do not pad.
The work orders for the other three surfaces differ only in the attack surface line. Everything else is the same.
Attack the data composition. This asks about the material itself. Does the coverage hold up the wording of the claim? The two bullet holes of this case are in the table above. The nastier one is GSM-Symbolic. It was chosen for contamination resistance, and the perturbed variants did block memorized problems, but they turned the problem set into copies of a few templates. The move that seals one attack surface can open the door on another.
Attack the independence assumptions. This asks about the quality of n. What do the samples share, and has the data structure broken the independence assumption behind the CI and the bootstrap? The bullet hole of this case is the one in section 8.4. That narrow interval [+12.7, +24.2] bought its narrowness with the assumption that problems are independent, and once the assumption goes bankrupt the effective sample size drops to 3 template families.
Attack the cost basis. Every claim carrying the words "cheaper," "better value," or "cost-matched" owes this surface a round. Two soft spots are on the record in this case. The frontier arm used the balanced tier of the GPT-5.6 family, the mid-priced tier of that family, not the flagship, and the change log carries a line added for it, "the book must state the exact model," a preventive narrowing of "ties frontier." The "local deployment amortization" account was an analytic estimate at public rental prices, never run on real hardware, and it travels with the deliverable as a caveat.
When I drafted this section I parked an attack here that I thought unbeatable, as an example, asking whether the army's one-fifth cost advantage might be propped up by frontier's hidden reasoning tokens. My answer at the time was yes, but the basis signed was billed dollars, hidden tokens are money you really pay, so the charge holds and the conclusion does not move an inch. It sounded airtight. Then the real trial of section 10.7 knocked down the "unbeatable" itself. The prosecutor went and checked the usage field. frontier's reasoning tokens measured zero. That "money you really pay" I held up as a shield does not exist. Keeping this corpse here is useful. The finest defense you rehearse for yourself usually rests on a fact you never verified.
10.5 How to hire a prosecutor who does not applaud
With the four work orders written, the way you dispatch decides whether you get attacks or applause. Five disciplines, shaped after this book's own verification process. The check that overturned my "literature gap" illusion in Chapter 4 was run exactly this way. Another model, a fresh session, a brief holding only the claims list, not one word of expectation.
One, an independent session, zero history. The red-team session may not carry the narrative, the excitement, or the wording habits of your last few weeks. All of them leak expectations. Switching models is better still. Letting the model that paired with you to write the conclusion also red-team it violates the orthogonality principle of Chapter 2, section 2.4.
Two, the brief gives only the claims list and the raw materials. Compress the deliverable into a column of neutral claims ("on the code family the CI of the gap between the army and frontier crosses zero, at one fifth the cost"), and attach the paths to the data, the scripts, and the ledger. Which one you hope survives, not one word. "I am worried" and "confirm this for me" are barred too.
Three, one surface, one order. Open a separate order for each of the four attack surfaces, and do not merge them. Dispatch them merged and the model fills the page with the easiest surface, while the one that hurts most gets two perfunctory lines.
Four, a charge must carry an executable check. A charge without a check is a comment. A charge with one is a work order. Writing this into the rules section of the prompt lifts the output a whole grade. It forces the model to translate empty phrases like "the data may have a problem" into "cluster the problem texts by template and count how many kinds there are."
Five, file the output and rule line by line. Every charge either gets its check run or gets rejected in writing with one line of reason. The rejection record becomes your ammunition at the defense later, and Chapter 6 set the same rule.
These independent channel disciplines do not serve the red team alone. Generalizing them into a verification process that cuts across the whole workflow is what Chapter 12 opens up.
10.6 After you are hit, overturn, narrow, caveat
Once you rule that a charge holds, there are only three legal dispositions. The fourth is called "I am aware of it," and it does not exist. A charge that hit you and got no written disposition is worse than no red team at all, because now you know.
Overturn, the charge hits load-bearing structure and the announcement sentence dies. The specimen is math's +18.2. gold read ambiguous English as having one correct reading, that charge held, and after the ambiguous template was removed the direction reversed to −2.3, so "the army pulls ahead on math" came off the deliverable. Note that overturning is not hiding. The preregistered numbers get reported as is, by the Chapter 8 discipline. An overturn targets what you intended to say. Not one number that happened gets touched.
Narrow, the charge holds, but what it cuts away is the range or the strength, and the conclusion itself still stands. The specimen is math's CI. The charge that "the 150 problems are really 3 template families" held, and the narrowness of the preregistered interval is false confidence. The disposition is to downgrade the claim to "this problem set cannot detect a conclusion, reissue it and test again." Announcing the opposite conclusion would cross the line. There is one criterion for a qualified narrowing. The new statement is strictly weaker than the old one and still checkable. The cost-surface line "the book must state the exact model" is the same move, narrowing "ties frontier" into "ties GPT-5.6-terra (the balanced tier of that family)." Narrowing is nothing to be ashamed of. From "can small models team up" to "code has a shot, knowledge QA has none, math needs a retest," the main conclusion of this case got narrowed into shape the whole way.
Caveat, the charge holds or cannot be ruled out, but it is unfixable, untestable, and not fatal. The disposition is to keep the conclusion and let the caveat travel at the same address as it, not buried in the third paragraph of limitations. Qualification for a caveat is strict. What can be fixed gets fixed, what can be tested gets tested, what is truly fatal gets overturned or narrowed, and only when all three fail does the caveat get its turn.
The specimen for the caveat tier is in the subplot, and it is the most complete "red-team your own plan" in the book. The ground truth of the persona study was designed with two sources, public survey data plus a small sample of real interviews. The real-interview arm was cut before the run started. I could not recruit interviewees. A real constraint of the verification budget, undignified but true. After cutting the arm I ran a round of soft-spot self-check on the single-source plan that was left, on exactly the last two of the four surfaces above. On data composition, WVS, the World Values Survey, is a famous public question bank that has been out for years and anyone can look up, very likely inside the training corpus. If persona answers like a real person, that could be likeness, or it could be memorized questions. On independence, once the real-interview arm was cut, no control left in the plan is naturally immune to corpus contamination. The arm that could tell "memorized questions" from "sensitivity to wording" is exactly the one that got cut. The 10/15 double reading of the Chapter 8 subplot, the contamination test flagging two thirds of the questions, has its root here. Soft spot confirmed, and unfixable (there is no second ground truth to swap in) and untestable (the budget is the reason the arm was cut).
The disposition has two steps. The reworded contamination test got promoted from a bonus to mandatory and written into the change log. Every subplot conclusion carries the same caveat, "the ground truth itself may be inside the training corpus." Even the FAIL carries it. Analyzed in the direction of the Chapter 8 trial, even if the contamination is real, falsification only gets more conservative. The caveat goes on anyway, because a caveat states the boundary of the evidence and has nothing to do with whether the conclusion feels shaky. When you red-team your own plan, the most honest output is sometimes a caveat written on its face.
10.7 Trial record, one round on each surface, all ten charges hold
With the process written, it is time to eat my own dog food. After the two deliverables of Chapter 9 were final, I really did dispatch a round under the five disciplines of section 10.5. Four attack surfaces, four independent sessions, one order per surface, a brief holding only a neutral claims list and file paths, every charge carrying an executable check, every output reviewed and ruled on by me line by line. Ten charges. All of them hold. Here are the six that hurt most.
On the scorer surface, the first shot hit the audit itself. That −2.3pp reversal of Chapter 8 was overturned. Correct answers in the clean subset wrapped in format residue like ** and } got scored zero, and only small reasoning models produce that residue, so it kills small models in one direction only. Rescored under lenient parsing the three arms come in at 1.000 / 0.9967 / 1.0000, all saturated, meaning all near full marks with nobody able to beat anybody, so clean math is uninformative in both directions and can detect a gap in no direction at all. The pilot had fixed the same bug for the % suffix, and ** and } slipped past under its nose. The audit itself has to be audited too.
The cost surface turned up a breach. The preregistration stated that the SC arm, the control arm where a single small model samples itself many times at the same budget and takes the majority, would have its k, the number of self-consistency samples of the single small model, tuned after the pilot to within ±10% of the army vote's dollars per query. It was never executed. k stayed at 5, and SC actually paid only 0.21 to 0.77 times the army. The phrase "same-budget control" is withdrawn across the book and honestly restated as SC spent less money and still tied or did better. The criticism that "teaming ≈ sampling" got harder instead.
The independence surface reported a mechanical death sentence. Voting on code is exact string tallying with ties resolved to the first sample. Extracted code is almost never identical character for character, so the code army's score is identically the single sample of qwen, the small model rotated into first place, and four of the five calls are wasted.
The data composition surface seized the twin of the math sampling bug. "mmlu_pro stratified by category" is really the three subjects business / law / psychology. The draw pulled the first 2000 rows of a test set blocked by subject, with zero STEM coverage. The math sampling bullet hole was on the record at the time, and this one slipped through the mesh of the audit. The math family itself did not escape either. Rerun the bootstrap clustered by template and the CI is [−4.0, +59.3], crossing zero. Add that gold clusters too, 24 of the 50 problems of one template family sharing the standard answer "25," and voting harvests the dividend of the modal gold, meaning the answer voting lands on may just happen to match the standard answer that appears most often in this batch of problems, which in this design cannot be separated from real error correction. The math family retires in both directions.
The ledger confessed last. That $5.58 is a simulated account of list price × tokens, and it does not match what the bill charged. The army side actually paid about 19% more (from the author's bill reconciliation, not recomputable from repo data). Another 12.6% of real spending (cleaning, reruns) sits in the ledger and appears in no reported number.
Every disposition got filed under the three tiers of section 10.6, and all of it went into the case file. The yield of this round is not mainly the bugs it caught. The point is the relation between the red team and the audit. The red team attacks the audit itself. The audit hunted math down. The red team then seized three more cases exactly where the audit had declared things clean, the mmlu sampling, the code mechanism, and the ledger basis.
The full table of ten charges follows, and each line matches the case file at docs/redteam-2026-07-25.md. Read the last column first. Two overturns (① and ③). Narrowings are the majority. The caveats are all open items and travel with the deliverable. The middle column, "how it was checked," is for people who want to rerun it, and you can skip the terms you do not know. Only ⑨'s "zero-variance degenerate-interval artifact" needs one line. In that sub-slice all three sides score full marks, every resample comes out the same, and the interval width is zero, an illusion produced by identical scores rather than a real tie.
| # | Charge | How it was checked | Verdict | Disposition tier |
|---|---|---|---|---|
| ① | The −2.3pp reversal on the clean subset is a scoring-residue artifact, correct values wrapped in **/} scored zero, killing small models in one direction |
Rescore under lenient parsing, three arms 1.000/0.9967/1.0000, clean math saturated, uninformative in both directions | Holds | Overturn |
| ② | The preregistered SC ±10% cost-alignment clause was never executed (k stayed 5) | Recheck the ledger against the prereg clause, SC actually paid only 0.21 to 0.77 times the army | Holds | Breach log + narrow (the "same-budget" label withdrawn across the board) |
| ③ | The code voting mechanism degenerated, exact string tallying with ties resolved to the first sample | Replay the tally, the code army's score is identically qwen's first sample, 4 of the 5 calls wasted | Holds | Overturn (mechanism) |
| ④ | The mmlu slice is really the three subjects business/law/psychology, zero STEM coverage | Look the categories up by problem id (50/50/50); split by subject, law −25.3 / business −9.3, clustered CI [−25.3, −9.3] | Holds | Narrow |
| ⑤ | Independence bankrupt across all of math + gold clustering | Bootstrap clustered by 3 template families [−4.0, +59.3] crossing zero; 24 of 50 problems share the gold "25" | Holds | Narrow (the math family retired in both directions) |
| ⑥ | The ledger is a simulated list-price account, not what was paid | Bill reconciliation, the army paid about 19% more; 12.6% of real spending enters no reported number, and on the full basis code SC/vote cost the same | Holds | Narrow (wording) + caveat |
| ⑦ | frontier ran on an undisclosed default reasoning tier, and the budget remedy was asymmetric | Check the usage field, reasoning tokens measured zero; qwen raised to 8192 while frontier stayed at 4096 | Holds | Narrow + caveat |
| ⑧ | runs.jsonl stores extracted answers, not raw output | Inspect the written fields and the extraction regex (first match taken, the loss not quantifiable) | Holds | Caveat + correction to the ch7 statement |
| ⑨ | The math "tie" of debate/division is a zero-variance degenerate-interval artifact | Replay the bootstrap, all three sides full marks on the sub-slice, every resample zero, CI [0,0] | Holds | Narrow |
| ⑩ | The cost comparison is sensitive to the procurement basis | Recompute on another basis, at Batch half price the code cost ratio goes 1/5→2/5; the frontier unit price was only checked against an aggregator | Holds | Caveat (open item, the author to check first-hand billed prices) |
After the beating, what that one page says now
With ten charges disposed of, the one-page memo of Chapter 9 cannot go out as is. Part One of the appendix keeps the pre-red-team version. Both versions stand, and the difference is the lesson. The final version changes three places only, the first line, the second risk line, and the next step.
The first line now reads. On code generation tasks the accuracy gap between one call to a single open-source small model and GPT-5.6-terra cannot be told apart within measurement precision, qwen single-shot 93.7% against 96.0%, the interval crossing zero, read as uninformative, not as a tie, at about 1/25 the latter's list price per call.
The three risk lines now read. First, this is a saturated slice of a public benchmark, the problems may have leaked, and it is not our workload. Second, "teaming" showed no gain over single-model sampling this round, and the voting mechanism on code even degenerated into a single shot with four of the five calls wasted, so any proposal sold on the army gets evaluated at zero gain. Third, cost is a simulated account of list price times tokens, actual payment runs about 19% higher, self-hosted amortization was not measured, and procurement discounts can push the cost ratio from 1/5 to 2/5.
The next step now reads. Run a two-week shadow-traffic pilot on code workloads, starting from single shot, the cheapest, adding sampling only if that is not enough, and re-evaluating k=5 after the tallying mechanism is fixed. Knowledge QA stays on frontier, since this round tested only the three subjects business, law, and psychology. For math, wait for the problem set to be reissued, and do not use this round as a basis.
All three changes come from charges ②③⑥⑩ of the table above, and each one can point at the case file. The final version is shorter than that Chapter 9 page and cheaper, and it recommends one thing less, the army. That is what the red team does to a deliverable. What it deletes is never the numbers. It is what you had intended to say.
10.8 Both sides of peer review
Readers who submit and review should linger on this section, and everyone else can skip to the next one. Before you submit, dispatch the manuscript under the disciplines of section 10.5, one round per surface, and the list of charges that comes back is a pre-review report. Then write the response now. What you can write stays as ammunition, and what you cannot write is a narrowing signal. Revising today beats forcing an argument three months later in the rebuttal, the reply that argues back against review comments. When you review someone else's manuscript, the four attack surfaces are your review checklist. Is the scorer trustworthy, what does the data look like, is n real, is the cost basis fair, one paragraph per surface, ten times more useful than "the contribution feels insufficient." One red line. Feeding someone's unpublished manuscript to an outside AI service is a direct violation in many settings. NIH has barred reviewers from using generative AI in grant review since June 2023 (NOT-OD-23-149, the ban covers reviewers, not applicants), Elsevier and Springer Nature bar reviewers from uploading manuscripts, and ACL's reviewing guidelines forbid generative tools for drafting a first review. The checklist itself works without AI, and the duty of confidentiality outranks the convenience of a tool.
10.9 No submission, but a case file anyone can rerun
Now an old debt gets settled. When Chapter 3 previewed this step, what I wrote was "first let AI be the harshest critic, patch, then really send it out and take the hits from humans." To report it honestly, there was no submission. The deliverables of this case are a manuscript and a repo, and there is no paper in my hands waiting on a journal's verdict. Inventing a submission and three fictional reviewers to complete the narrative would violate exactly every discipline of this book.
The substitute is harder than an apology, the case file is public. The preregistration entered the repo before any result. The ledger is append-only, and 5.58 dollars adds up line by line. The audit script reruns on one command, and uv run python scripts/audit_math.py prints every number of the Chapter 8 overturn. The change log keeps even the erratum for a mistyped concurrency setting exactly as it was (the subplot's accident of misrecording a problem id has its erratum in the persona-panel change log, also on file as it was). The red-team case file itself is in the repo too, docs/redteam-2026-07-25.md, all of it on record. Any reader can be my Reviewer 2, and gets more than a real reviewer would. A reviewer only gets the text in a PDF. You get an executable chain of evidence. Security people call this play a bounty, turning hole-hunting into a legitimate business for the whole world, which beats vouching with your own word that there are no holes.
This is also the last cell of the spine case in Part II. That two-hour demo of Start Here, 19 to 20, "it looks like a tie." It went through the literature brawl of Chapter 4, the hypothesis with ε equal to two percentage points of Chapter 5, the three-arm sign-off of Chapter 6, the 5.58 dollar execution of Chapter 7, the interrogation of Chapter 8, and the two vehicles of Chapter 9, and arrived at this chapter. Here it took the beating from its own side, the math family retired, and the case file went public.
The endgame is H not falsified and not holding across the board. A single small model (self-consistency arm 94.7%, army arm 93.7%) cannot be told apart from frontier (96.0%) in direction on the saturated code slice, the reading is uninformative, do not read it as a tie, at about 1/25 per call (list-price basis), and the one fifth quoted earlier is the full bill for the army's five calls on one problem, while this figure counts a single call. Knowledge QA was measured on only the three subjects business, law, and psychology, and has no shot. The math family retires in both directions. "Real teaming beats sampling a single small model" never got measured once in the whole case. What is interesting is that the naive demo guessed the direction right on the code family. Now that direction comes with criteria, a ledger, control arms, an audit script, and a red-team record. What lies between a lucky guess and something you can trust is these seven chapters.
The seven steps are done. But a process governs the workflow, not the person executing the process. Why a fabricated citation looks so much like a real one, and why you believed it exactly when you wanted it most, these failure modes of judgment itself are what Chapter 11 opens up.
10.10 Swap in your project
Dig out the deliverable you are about to send, a paper, a memo, a report, whichever is closest to the send button. Budget half a day.
- Compress out the claims list. List the attackable factual claims of the deliverable as 5 to 10 neutral statements, with the conclusion and its qualifying conditions split into separate lines;
- Write the dispatch brief (appendix template), holding only the claims list and the paths to the raw materials, then run a leak check on it, and delete every expectation, worry, and adjective;
- Open one independent session per surface and run a round on each of the four, the one you feel shakiest about first;
- Triage. Run the check each charge carries, hold it or reject it, and write one line of reason for a rejection;
- Disposition. Assign a tier to every charge that holds, overturn, narrow, or caveat, one of the three, and write it into the disposition record;
- Revise the deliverable, then run one quick round again, since a patch can introduce a new handle;
- Publish what can be published. Data, scripts, criteria, bring the cost of "recheck it" down to one command. If you cannot publish everything, at least attach the disposition record to the deliverable. It buys more trust than the conclusion itself does.
The full fillable versions of this chapter's three tools are all in the appendix.
Want an agent to run it with you? Paste this to your AI assistant or coding agent:
Help me run the Swap in your project of Chapter 10. I give you the deliverable, and you do one thing, use Template 1 of docs/appendices/ch10-templates.md to compress the
attackable factual claims into 5 to 10 neutral statements, with the conclusion and its qualifying conditions split apart. Then help me write the dispatch brief, holding only
the claims list and the paths to the raw materials, and when it is written run the leak check, delete every expectation, worry, and adjective, and I will delete again what you miss.
You do not do the red team itself, you are the generation channel. I open four independent sessions of my own for the four attack surfaces and run one round on each, pasting only
the brief into each session. When the charges come back you only run the check each one carries and record it. I rule on each, holds or rejected, and I decide the disposition, one of three (overturn, narrow, caveat). If any command errors, stop and show me the output.
10.11 Sober reminders
- An empty report earns no medal. When the red team comes back saying "no major problems found," suspect the dispatch first. Expectations leaked, or the material you handed over was your summary and the originals never went in. Switch models and dispatch a second round, and only when both come back empty are you allowed to celebrate, quietly.
- The red team can knock you back to any earlier step. Chapter 3 said the seven steps are a loop. A hit on the scorer sends you back to Chapters 6 and 7, and a hit on data composition can send you all the way back to the task-family choice of Chapter 5. Budget for "fix it and run another round," and do not treat the red team as a last-second glance in the mirror on your way out the door.
- A caveat is not a trash can. Of the three tiers the caveat is the most comfortable and the easiest to abuse. Hanging a caveat where an overturn belongs is the best-dressed form of self-deception. The qualification check is in section 10.6.
- It cannot find your field's blind spots. The four attack surfaces catch diseases of method, not "this measurement has been notorious in your field for years." The antidote is still the fourth route of Chapter 4. Find someone who really knows the field, and show them your conclusion and your red-team record. Those ten minutes still have no process that can replace them.
- Still exploring. End-to-end automated red teams, generating the attacks, running the checks, assigning the tiers with no human hand, are iterating. As of this writing, charge generation can be let go of, and no tool yet dares sign for triage and disposition. The book's online case library tracks it.
10.12 The unfair advantage you now hold
Before delivering any conclusion you can have AI run a round on each of the four attack surfaces, dispose of every hit as an overturn, a narrowing, or a caveat, and attach a case file anyone can rerun. For people without this step, the first red team is that email three weeks later with the boss copied in.