Three verifiers, one blind spot

In brief

Running AI work past more AI reviewers looks like defense in depth, but checks that share a model family, prompts, or framing share failure modes, so three of them can miss the same thing at once. A 1986 experiment on independently written software found exactly this: separate teams produced correlated faults. Real assurance requires at least one check that does not share the system's view of the world, an execution, a ground-truth lookup, or a human with different incentives.

Picture a refund agent that made a mistake in March, so the team added a reviewer model to check its work. In May they added a second reviewer, a different prompt, stricter instructions. The dashboard now shows three green ticks per case, and the operations report calls it defense in depth. In August the incident happens anyway, and the postmortem finds all three models made the same call, for the same reason, from the same misreading of the same policy. That sequence is illustrative rather than a case we can cite, and the rest of this piece is the measured version of why it is the expected outcome.

Nobody did anything unusual. Adding checkers is what careful teams do, and it works in the physical world, where a second inspector really does have different eyes. The failure is in the assumption that carried over: that two checks are twice the checking.

The 1986 result

Software engineering ran this experiment formally almost forty years ago. N-version programming was the aviation-era hope that if several teams wrote the same program independently, their bugs would be independent too, so a majority vote of three versions would be astronomically reliable. Knight and Leveson tested the assumption: twenty-seven versions of the same program, each written by a separate programmer from the same specification at two universities, run against a million test cases. The versions were individually extremely reliable. Their faults were not independent: the number of tests in which more than one version failed was substantially higher than an independence model predicts, because the programmers faced the same hard parts of the problem with the same human habits of thought.

The lesson was never that redundancy is useless. It was that redundancy only buys what the failure correlations leave on the table, and that teams systematically overestimate independence because the versions look different from the outside.

The 2024 version

Model-based review recreates the experiment daily, with the correlations turned up. Reviewer models share training data, share architectures, often share a base model, and are steered by prompts written by the same team that built the thing under review. That is not a hypothetical arrangement: Anthropic's own Claude Sonnet 4.5 system card records using Claude Opus 4.1 models as its auditing agents and graders, and describes building an external variant averaging over other labs' models specifically to reduce the resulting bias.

The overlap has now been measured. Work on model similarity and AI oversight finds that judges score models similar to themselves more highly, and that model mistakes are becoming more similar as capability rises. On top of that comes an active bias: evaluator models recognize and favor their own generations, with GPT-4 and Llama 2 scoring text higher when they produced it. A judge that leans toward work resembling its own is not a second opinion. It is the first opinion with better manners.

Auditing solved this problem before software existed, and its rule is blunt: the reviewer must not report to the author. Not because auditors are smarter than accountants, but because assurance comes from the difference in position, incentives, and frame, and vanishes with it. Three checks that inherit the same assumption are one check wearing three badges.

Verifiers that share a blind spot vote as one.

What independence actually costs

The uncomfortable part is that independence is not a setting you enable. It is a budget line. Past the correlation floor, adding critics improves the evidence dashboard and changes nothing about the correct decision, so the money spent on the fourth model reviewer is spent on appearances. Buying actual independence means buying at least one check that does not share the system's view of the world, and each kind has a price:

• Execution. Run the thing. A test that executes the refund in a sandbox does not care what any model believes about the policy.
• Ground truth. Check the claim against the record system, the ledger, the world. Retrieval beats opinion wherever a fact exists.
• A differently placed human. Not another approver in the loop, but someone whose incentives run against the author's, the way an auditor's do.
• A different frame. If a model must be the checker, the least you can buy is a different family, a different context, and a scoring target the generator was not optimized against.

The four structural limits put it as a rule: verifier multiplicity is not verifier independence. Where the fourth reviewer stops buying anything depends on how correlated your stack already is, and nobody has measured that floor for a production judge stack, including us. The measurable version of this claim is a study we would like to run: error correlation across judge configurations, varying family, prompt and frame, on one real task.

The postmortem's real finding was not that the reviewers failed. It is that the operation was measuring agreement and calling it verification. Agreement is cheap. The question that costs something, and is worth it, is: what would notice if all of them were wrong the same way?

Implementation note

Superalignment builds commercial software on this argument. Our harness treats verifier independence as an explicit, budgeted property of the evidence rather than a headcount of critics. That is a design commitment rather than a measured result, and our editorial policy covers the commercial interest.

Sources

• Knight and Leveson, An Experimental Evaluation of the Assumption of Independence in Multiversion Programming, IEEE Transactions on Software Engineering SE-12(1), 1986.
• Panickssery, Bowman and Feng, LLM Evaluators Recognize and Favor Their Own Generations, arXiv, 2024.
• Goel et al., Great Models Think Alike and this Undermines AI Oversight, arXiv, 2025.
• Anthropic, Claude Sonnet 4.5 System Card, 2025.
• PCAOB, Rule 3520, Auditor Independence.