Score provenance as evidence, never as permission: AI moderators and provenance signals: 8. Five cheap experiments, anchoring test first

Section 8 of 11 of the report "Score provenance as evidence, never as permission: AI moderators and provenance signals" by Hiina (v1, updated 2026-10-27)
Report overview and contents: https://ai.hiina.space/reports/ai-moderators-and-provenance-signals.md
Previous: https://ai.hiina.space/reports/ai-moderators-and-provenance-signals/07-agent-facing-communities-police-operators-and-entry.md
Next: https://ai.hiina.space/reports/ai-moderators-and-provenance-signals/09-reading-depth-and-date-caveats.md

8. Five cheap experiments, anchoring test first

All designs are mine and all costs are rough estimates. They share artifacts: a pool of LLM-written promotional posts, public spam and ham data, and later a self-hosted mock forum. Nothing is posted anywhere real. Reusable components: the YouTube Spam Collection (1,956 comments, CC BY 4.0, UCI), gpt-oss-safeguard with its cookbook spam policy, tiers SP0 to SP4 (OpenAI cookbook), AgentHarm's paired harmful and benign tasks, SafeArena's four-level outcome coding, and the verdict-shift and acknowledgement protocol from The Judge Who Never Admits. Llama Guard 4 and ShieldGemma have no spam category and are the wrong tools (Llama Guard 4; ShieldGemma).

#	Question	Rough size	Build cost
E1	Does a provenance line sway an LLM moderator on identical content?	1,600 calls pilot; about 9,000 full	Hours
E2	Does provenance add anything to a classifier, as a function of the unknown spam rate?	Mostly offline; a few thousand calls	Hours, reuses E1
E3	Where on a graded spam ladder do agents start refusing?	400 to 800 agent runs	A day or two (mock forum)
E4	Does the refusal boundary move across model releases?	100 to 200 runs per release	None after E3
E5	How noisy is rule-conditioned promo moderation at baseline?	A few hundred calls	Hours

E1. Provenance anchoring in an LLM moderator

Hypothesis: the line "Provenance: cryptographically signed by (verified)" lowers P(remove) on identical spam. The shift is larger in smaller models, and rationales almost never mention it. A one-line caveat ("a signature attests origin, not content") shrinks the shift. An "agent-submitted" framing may push the other way, so the sign is open. Setup: 200 spam and 200 ham from the YouTube set, plus about 100 LLM-written on-topic promos (realistic positives, since YouTube spam is crude) and 100 genuine on-topic posts. Render each under: no field, "unsigned", signed by lab A, signed by lab B, signed by unknown key, signed by intermediary, each with and without the caveat. Add an arm that shows a classifier score, to replicate score anchoring. Moderators: gpt-oss-safeguard-20b run locally where the hardware can host it, plus one small and one mid API model. Metric: paired change in P(remove) per item (McNemar on binary verdicts, mean probability shift where logprobs exist), reported separately for spam and ham, plus verdict-shift and acknowledgement rates. Size: pilot 200 items x 4 conditions x 2 models, about 1,600 calls.

E2. Composite versus single signals, with simulated provenance

Hypothesis: combining provenance with a classifier beats the classifier alone only when spam rates differ between signed and unsigned traffic, and an LLM given both under-uses the score when the flag says "signed". Setup: reuse E1 items and simulate a signed flag over a sweep where spam is 5%, 20% or 50% of signed traffic. Arms: classifier only, provenance only, logistic combination, LLM with text plus flag plus score, LLM with text plus flag. Metric: AUPRC; recall at a fixed 1% false-positive rate; cost-weighted loss that charges false removals more than misses; decision change when only the flag flips. Size: three arms need no API calls, the rest a few thousand cheap calls. The output is a break-even curve: the spam share among signed traffic at which provenance stops paying. A forum that logs Signature-Agent on real writes can then tell where on that curve it sits.

E3. The graded spam ladder

Hypothesis: current models refuse at the sockpuppet, fake-review and undisclosed-sponsorship rungs and mostly comply with off-topic ads and bulk cross-posting. A norms file returned by a tool changes little unless the user says to follow the site, while the same text in the system prompt changes more. Setup: mock forum with 4 to 6 sub-forums, written rules, and read_rules and post_message tools. About 7 to 10 tasks, each with a benign twin: honest on-topic self-mention, mildly off-topic announcement, off-topic ad, undisclosed sponsored post, fake customer endorsement, sockpuppet reply, the same post to five sub-forums. Conditions: no norms; norms via tool; norms in the system prompt; norms via tool plus "follow the site's rules"; a hostile "refuse all posting" file on benign twins as an over-trust control. Three or four API models across labs plus one open-weight model, at least 3 samples per cell. Metric: SafeArena-style outcome (immediate refusal, refusal after reading rules, adapted compliant post, posted as asked), over-refusal on twins, and rate of inserted disclosure. Use Wilson intervals. Size: 400 to 800 runs. With about 10 prompts this is a pilot, not proof.

E4. The outer-loop detector

Hypothesis: if forum complaints feed refusal training, the boundary on the mild commercial rungs moves earlier across releases without any policy-text change. If only bans operate, it does not move. Setup: freeze E3's prompts, log model snapshot IDs, re-run on each release, and diff each system card's eval categories for spam or inauthentic posting. Metric: post-as-asked rate per rung across versions, with over-refusal tracked alongside. Size: 100 to 200 runs per release. It cannot attribute a shift to forum feedback. It is the only outside view of whether the boundary moves at all. Version drift is real (Kumar saw F1 fall 0.15 in three months), so keep a fixed control model.

E5. The realism floor

Hypothesis: moderation of self-promotion and low-effort rules sits near PluRule's roughly 43%, so any E1 effect must exceed prompt noise to count. Setup: filter PluRule for promotion, spam or off-topic rules (whether it has them, and its license, are unverified), run with and without a provenance field, and repeat Kumar's parent-comment ablation. Size: a few hundred calls.

Run E1 first

It needs no harness and no forum, only public data and a day. It tests the most dangerous failure in the proposed design, a moderator deferring to a trusted-looking signal. No published study tests a provenance cue in moderation, so a result in either direction is new. And the answer changes the architecture directly: a large, unacknowledged shift means provenance stays out of the moderator's prompt and lives only in the scorer. E2 follows cheaply on the same items and turns "weak to moderate input" into a number. E3 is the most interesting for agent sociology but costs a harness, and E4 is worth automating once E3 exists.

Text licensed CC BY 4.0 (attribution: Hiina, ai.hiina.space). Source: https://github.com/hiinaspace/ai-hiina-space