You must approve weights trained by a contractor whose run you cannot reproduce: what can you honestly claim about hidden conditionals?

## The situation Weights arrive from a party who trained them end to end. You cannot reproduce the run: you do not have the data, the pipeline, or the compute history. You have an acceptance report and a contract. Somebody has to decide whether this goes into production, and that somebody will be asked afterwards what they knew. ## Step one: write down the claim you can actually defend The common failure is to let a passing acceptance report stand in for an assurance claim it does not make. Force the two apart on paper: **Supported by evidence.** The model meets the accuracy contract on inputs drawn like the acceptance set. Per-slice results hold on the slices you cut. No gross defect is present. **Not supported, and not obtainable from this instrument.** That no conditional behaviour keyed to a pattern the trainer chose exists in these parameters. Behavioural evaluation on naturally sampled inputs is silent on that question, and stays silent no matter how much of it you buy, because the key is off-distribution by construction and the search asymmetry runs entirely against you. Writing both lines down is the senior move. It converts an implicit, unowned assumption into an explicit, owned risk. ## Step two: identify what would change the evidence class More behaviour gives more of the same claim. Only evidence about **how the model was made** changes what you can say. The strongest version is removing the opportunity: training on data and a pipeline you control, so the party who could have written a conditional in never had write access. Weaker but real versions move along the same axis — how much of the data provenance you can establish, how much of the training process you observe or constrain, whether you fine-tune extensively on your own data rather than deploying delivered weights as-is. Be careful about the direction of adjacent claims. A signature that verifies on the weight file tells you which file you have and who published it; it says nothing about how those weights behave. Contractual assurances shift liability, not risk. And note that this is not a call to distrust every supplier — it is a call to be precise about which of your controls bear on this specific failure mode and which merely feel adjacent to it. ## Step three: price the residual risk against consequence, not likelihood You cannot estimate the likelihood of a hidden conditional from anything you hold. So the lever you actually have is consequence. Ask what the model's output is authorised to do on its own. A model whose decision is one signal among several, reviewed or corroborated before anything irreversible happens, can absorb being wrong on inputs somebody chose. A model whose single output is the authorisation cannot, and that is a design question about the surrounding system, not about the model. This is also the frame that makes the conversation with an approver tractable. "We cannot test this away, so here is the exposure if it is real, and here is what the surrounding process does about it" is an answerable proposition. "We tested it thoroughly" is not a proposition at all; it is a sampling procedure being asked to carry a universal claim. ## Step four: keep the claim stable over time Two drifts to anticipate. First, the claim gets restated as it travels — the careful sentence you wrote becomes "it passed security review" three slides later. Restate the limitation wherever the model is described, not once at acceptance. Second, the exposure changes when the deployment changes: the same weights that were acceptable as one signal among several become unacceptable the day someone removes the corroborating step. Tie the acceptance to the deployment shape it was granted for. ## What a strong answer sounds like "I can say it meets contract on our acceptance distribution. I cannot say it carries no trained-in conditional, and no evaluation I can run will let me say that — the trainer chose the key and my search space is the input space. So the decision is about the supplier's write access and about what this model's output is allowed to do alone. If we need the stronger claim, we have to own or reproduce the training, not buy a bigger test set." That answer demonstrates the three things an interviewer is scoring: that you know what the instrument measures, that you know which class of evidence would move the claim, and that you can turn an untestable property into a decision somebody can actually make.