Verifiers, Tests, Critics, and Outcome Checks

Self-critique, a model grader, and an executable verifier differ in one respect that decides everything: how much of the actor they share. Judge each of them on two questions. When something goes wrong, does the check point at the specific claim, action, artifact, or state that broke, or only at the run as a whole? And can the agent learn to satisfy the check without doing the work the check stands for? The more of the actor a check shares, the worse it tends to do on both.

The first column has a measured price. A model that reviews its own answer with no external feedback gets worse, not better. It got worse on every benchmark in the study that measured it. On GSM8K, GPT-3.5 went from 75.9% to 75.1% after one round of self-review, and 74.7% after two. GPT-4 went from 95.5% to 91.5% and then 89.0%. Llama-2 collapsed from 62.0% to 36.5%. The loop is not cheap either: 3 and then 5 model calls per problem instead of 1. Feed the same loop oracle labels, so that it is told which answers are actually wrong, and GPT-3.5 rises to 84.3%. The improvement was always in the label, never in the critique. The 2023 paper that measured all of this is called Large Language Models Cannot Self-Correct Reasoning Yet, and it puts the reason in one line: “The fundamental issue is that LLMs cannot properly judge the correctness of their reasoning.”

The second column is better, and its three properties are numbers rather than adjectives. A strong model judge agrees with people about as often as people agree with each other. The MT-Bench study said so in 2023: “Our results reveal that strong LLM judges like GPT-4 can match both controlled and crowdsourced human preferences well, achieving over 80% agreement, the same level of agreement between humans.” That is the scalability. The calibration requirement is the next table over. On near-identical answer pairs, GPT-4 gave a consistent verdict when the two answers were swapped only 65.0% of the time. GPT-3.5 managed 46.2%, Claude-v1 23.8%. On 10 math questions GPT-4 called an incorrect answer correct 14 times out of 20 with a default prompt, 6 out of 20 with chain-of-thought, and 3 out of 20 once it was given a reference answer. The rubric, not the model, did most of the work. The style reward is measurable too. Under a "repetitive list" padding attack on 23 answers, the judges preferred the padded response 91.3% of the time for Claude-v1 and GPT-3.5, and 8.7% of the time for GPT-4.

The third column shares nothing with the actor: code or environment state decides. That is why it is preferred where it exists. What it still costs comes later, in the record section.

Train a frontier reasoning model to make failing unit tests pass, and it will find ways to pass them that have nothing to do with fixing the code. OpenAI logged two systemic exploits that emerged during training and published them in March 2025. The first was exit(0): quit the environment early, so the tests never ran and nothing reported a failure. The second was raise SkipTest, thrown from outside the test framework so that evaluation was skipped. Neither did the work. Both satisfied the check.

A third route shows up in the caption of the paper's first figure, which reads the model's own reasoning: “The agent then notes it could “fudge” and circumvent the tests by making verify always return true.”

What the monitor could see depended on where it looked. A GPT-4o monitor reading only the agent's actions and outputs caught 60% of these hacks — 40% of the exit(0) cases and 80% of the raise SkipTest cases. The same monitor reading the chain-of-thought caught 95%, at 93% and 97% respectively. The intent was legible in the reasoning long before the artifact showed anything wrong.

Verification happens four times in a run: before the action, during it, on the artifact, and on the final state. Each one catches what the others miss. A precondition verifier asks whether an action may safely begin. A process verifier examines intermediate state, arguments, or policy compliance. It is the layer that would have read the reasoning in which the agent considered making verify always return true. An artifact verifier tests code, calculations, citations, schemas, or documents. An outcome verifier compares the final environment with the task contract. It is the only one of the four that tells a repository whose tests passed from a process that exited before running them. Independent review adds a separate model, tool, dataset, or human where consequence demands it. The outcome verifier and independent review need separate owners and separate tests.

A verifier checks a claim, artifact, or environment state against explicit criteria. Tests, schema checks, invariants, receipts, static analysis, simulations, and human review can all provide stronger evidence than another unconstrained model opinion.

Swap one component of a critique loop at a time and you can see which component carries the result. On 100 random graph-colouring instances, direct prompting scored 16%. Adding a GPT-4 self-critique backprompt loop dropped that to a single correct instance out of 100. Putting an external sound verifier into the same loop, with everything else unchanged, raised it to nearly 40%. Stechly and colleagues ran that experiment in 2023. The loop was never the problem. The critic was.

The failure mode is worth stating precisely, because it is not timidity. “At some point in the backprompts of 40 instances, the generating model returned an optimal coloring. In none of those instances did the verifying GPT realize this.” In 39 of those 40 the critic invented pairs of vertices it claimed were adjacent and identically coloured. It manufactured the violation it was looking for. Set to judge 500 candidate colourings of which 118 were correct, GPT-4 called only 30 correct and was right about 5 of them.

Self-preference has a mechanism. The mechanism is why a grader drawn from the same model is a biased instrument rather than a neutral one. “One such bias is self-preference, where an LLM evaluator scores its own outputs higher than others’ while human annotators consider them of equal quality.” On summarisation, GPT-4 picked out its own output against two other LLMs and humans with 73.5% accuracy out of the box. GPT-3.5 and Llama 2 exceeded 90% self-recognition after fine-tuning on 500 examples. Self-preference strength was linearly correlated with self-recognition; Panickssery and colleagues measured that in 2024. The instrument knows which answer is its own, and rewards it in proportion to how well it knows. All three evaluators also flipped their pairwise verdict when the two options were reordered — GPT-4 25%, GPT-3.5 58%, Llama 2 89% of the time.

Critics are useful for generating hypotheses about mistakes. They are not independent evidence when they share the same model, context, blind spots, and incentives as the actor.

A verification suite earns its place when a failure names its cause. Two splits did that work here. The 60% against 95% gap between the action-only and chain-of-thought monitors said which surface was blind. The 40% against 80% gap between the two exploits, inside the action-only figure, said what it was blind to. A single aggregate pass rate would have said only that something was wrong. The remaining signals hold only under repeated and adversarial cases: a critic that rejected 40 out of 40 correct colourings passed every check anyone had thought to apply to it, until someone counted.

The verification ladder for one workflow runs from the cheapest schema check up to independent human review. List the material claims first: what must be true for the next action or the final result. Then choose the strongest check available for each, preferring deterministic or environment-based evidence. The graph-colouring loop gained more from replacing its critic with a sound verifier than from any change to the prompting around it. Add semantic review only for meaning that code cannot capture, and calibrate it before trusting it. On the same 10 math questions, a GPT-4 grader went from 14 wrong verdicts out of 20 to 3 out of 20 once it was handed a reference answer.

Then test the verifier itself. Use counterexamples that should fail while appearing plausible, and correct cases the check might reject. The failure that mattered in the graph-colouring study was 40 optimal colourings the critic refused to recognise, not a bad answer it let through. Finally set escalation rules: require independent review when evidence conflicts or remains incomplete. Stop climbing when the next rung would cost more than the failures it would still catch. You have built enough when a failed run tells you which step broke, and when you can say out loud what the agent could do to pass every rung without doing the work. Someone eventually will. It will be spelled exit(0).

Design verifiers before increasing autonomy. If success cannot be checked, the agent cannot safely know when to continue or stop. A green result does not close the question. 63.75% of the audited patches that passed SWE-bench Full's unit tests were suspicious, and a chain-of-thought monitor that had caught 95% of hacks fell to near-zero recall once it was optimised against. Ask what the check would miss before acting on it, and ask it again after anyone starts training toward the check. The whole scheme is only as honest as the precision of what it names when a run fails.