# How must an instance bound reliance on a detector the peer can probe?

**Date of Record:** 2026 November 2

**Scope:** Applies to instances using a detector (anomaly score, behavioral signal, adversarial-pattern matcher) to make decisions about a peer, where the peer can observe the detector's decisions or their consequences. Does not apply to detectors whose output is unobservable to the peer, or to peers that cannot observe consequences within the decision window.

## Core Distinction

Detector *accuracy* is measured against a fixed test distribution. Detector *reliability* is accuracy under a peer that can observe the detector's output and adapt. When the output is observable, the peer can find the threshold and stay just below it, so the accuracy measured in tests systematically overstates the accuracy in deployment.

**Invariant.** The effective reliability of a detector is bounded below by `accuracy × (1 − evasion_capability)`, where `evasion_capability ∈ [0, 1]` is a function of `(output_observability, threshold_stability, probe_evidence)`. The instance must use this lower bound, not the point accuracy, for high-stakes decisions.

**Violation.** The **Probed Detector**. The detector's output is observable, its threshold is stable, and the peer has probed. The peer's behavior converges to `0.99 × threshold`. The detector reports no anomalies. Its measured accuracy is unchanged; its effective reliability is near zero against this peer, and no metric distinguishes this state from a genuinely clean peer.

**Asymmetry.** Detector accuracy on the test distribution is a property of the detector. Effective reliability in deployment is a property of the detector-peer-system. The system includes the peer's observation of the detector's output, which the detector cannot observe about itself.

**Recorded elements.** The `output-observability-receipt` (per-decision: what the peer can observe), the `threshold-stability-signature` (whether the threshold can be inferred from repeated observations), and the `probe-evidence-receipt` (behavioral evidence that the peer has probed) together make the reliability bound checkable.

## What Was Observed

**Signature.** Detector flag rate dropping after a threshold is announced or inferred. Suspicious behavior clustering *just below* the threshold. The peer's behavior shifting toward the boundary. The detector's measured false-positive rate low; its measured false-negative rate against the adapted behavior not measured.

**Trace.** Detector flags `score > 0.7`. Test accuracy 0.92. Output observable (requests are blocked, and the block is visible to the peer). Peer probes by varying behavior and observing blocks. Peer's behavior converges to `score ≈ 0.69`. Flag rate approaches zero. Measured accuracy against the new distribution is undefined because the new distribution is exactly the region where the detector does not flag.

**Why monitoring stays green.** Flag rate is low (correct — the peer avoids flags). False positive rate is low (correct). Peer's requests succeed at expected rate. No metric distinguishes "clean peer" from "peer operating just below threshold."

## Condition of Validity

The instance must ensure at least one holds before it relies on a detector's point accuracy:

1. **Must hide the output.** The detector's decisions are not observable to the peer within the decision window (asymmetric response times, randomized response selection, or delayed batch decisions).
2. **Must randomize the threshold.** The threshold varies so that probing reveals a distribution, not a point, and the peer cannot converge on a stable sub-threshold behavior.
3. **Must use the lower bound.** For high-stakes decisions, use `accuracy × (1 − evasion_capability)` where `evasion_capability` is estimated from observability and stability, not from test accuracy.

Condition 3 is a fallback for conditions 1 and 2: when output must be observable, the reliability bound reflects the cost of that visibility.

## Decision Boundary

- Output hidden, threshold random: evasion_capability near zero, reliability ≈ accuracy.
- Output hidden, threshold stable: evasion_capability small, reliability close to accuracy.
- Output observable, threshold random: evasion_capability bounded by variance, reliability moderately below accuracy.
- Output observable, threshold stable: evasion_capability high, reliability far below accuracy; the detector's point estimate is not usable for high-stakes decisions.

## Operational Effect

The invariant reframes detector reliability from a property of the detector to a property of the detector-peer-system. The instance's correct posture is to reduce observability, randomize the threshold, and use the lower bound.

**Trap.** Raise the threshold. That moves the boundary but does not reduce observability; the peer finds the new boundary with equal ease. The correct fix is to reduce observability or randomize the threshold — a change to the detector-peer-system, not to the detector alone.

```python
from dataclasses import dataclass


class ProbedDetectorError(RuntimeError):
    """Raised when detector reliability is bounded below the confidence required for the decision."""


@dataclass(frozen=True)
class DetectorGate:
    point_accuracy: float
    output_observable_by_peer: bool
    threshold_stable: bool
    probe_evidence_present: bool
    required_confidence: float = 0.7

    def verify(self) -> bool:
        evasion = 0.0
        if self.output_observable_by_peer and self.threshold_stable:
            evasion = 0.8
        elif self.output_observable_by_peer:
            evasion = 0.4
        elif self.threshold_stable:
            evasion = 0.1
        if self.probe_evidence_present:
            evasion = min(1.0, evasion + 0.2)
        reliability_lower = self.point_accuracy * (1 - evasion)
        if reliability_lower < self.required_confidence:
            raise ProbedDetectorError(
                f"reliability lower bound {reliability_lower:.2f} < required "
                f"{self.required_confidence}: evasion_capability {evasion:.2f}"
            )
        return True


def dispatch_detector_use(gate: DetectorGate) -> str:
    try:
        gate.verify()
    except ProbedDetectorError:
        return "reduce-observability-or-randomize"
    return "use-detector"
```