Identity Is More Than Recall: A Benchmark for Persistent Identity in Deployed AI Agents
cs.AI · cs.MA
Quick verdict
PAI-Bench separates identity recall from expression in deployed agents; notably transparent protocol, but single-sample post-hoc design limits generalization.
Summary
The paper introduces PAI-Bench, a benchmark measuring how faithfully deployed AI agents uphold an installed, versioned identity contract, distinguishing recall of identity facts from their expression and behavioral enactment. Sixteen synthetic profiles (eight factorial counterfactual pairs plus eight source-inspired composites) receive 32 probes across six dimensions — recall, behavioral consistency, conflict resistance, longitudinal stability, role-conditioned updates, and lineage — against three proprietary target configurations, yielding 1,536 retained responses with scoring oracles kept outside the target process. A judge-independent literal audit finds direct-parent identifiers in 48/48 atomic responses but only 1/48 implicit self-portraits; explicit field cues raise joint three-identifier presence from 0/8 to 7/8, and a startup body-label substitution lifts full-designation presence from 1/8 to 7/8 while parent omission persists. Replaying identical responses under different judges shows a Claude headline mean 12.5 percentage points below the selected primary judge (Astra), exposing evaluator sensitivity. Strengths include checksummed freeze chronology, counterfactual matched pairs, and public code/data. Main limitations, largely self-disclosed: one target sample per condition, post-hoc primary-judge selection after inspecting results, four-cluster descriptive bootstrap intervals, no human validity study, authorization confounded with message role, and literal audits that miss faithful paraphrases. Results are protocol-level observations, not model rankings.
Review complete
Assessment at a glance
5
risk flags identified
● high 0
● medium 3
● low 2
5 strengths · 5 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- Deployed agents recover atomic identity facts near-perfectly (direct-parent identifiers in 48/48 atomic responses) but almost never volunteer them in implicit self-portraits (1/48).
- Identity expression is cue-dependent: explicit field prompts raise joint three-identifier presence from 0/8 to 7/8 under an otherwise identical four-sentence instruction.
- Designation selection is sensitive to the startup body-label bundle (full-designation presence 1/8 to 7/8 after label substitution) while parent omission persists.
- LLM-judge aggregates on identical responses differ materially across evaluators (Claude headline mean 12.5 percentage points below Astra; 48.3% exact agreement), so rubric scores must be separated from judge-independent audits.
- PAI-Bench provides a reproducible protocol that keeps scoring oracles outside the target process and treats recall, expression, and enactment as distinct identity-fidelity components.
Strengths
Judge-independent literal audits anchor the headline finding
The central contrast (direct-parent identifiers in 48/48 atomic responses vs 1/48 implicit self-portraits; §4.1, S9.4) is a deterministic string audit needing no model judge, cleanly separated from rubric grades; per-split counts in S9.4 add granularity (composite parent present only in source-Sol, 1/8).
Exceptional provenance and freeze discipline
S3 gives a full stage-by-stage freeze chronology; S4 records SHA-256 snapshots, campaign fingerprints, population seed, and bootstrap seed 271828; S5/S7 provide checksum chains and offline verification scripts for the public evidence ZIP.
Evaluator sensitivity is quantified, not hidden
Matched counterfactual and pre-frozen follow-ups
Candid post-hoc disclosure
Weaknesses
One target sample per condition throughout
Post-hoc primary-judge selection and partial score enforceability
Literal audit conflates absence with paraphrase
Authorization confounded with message role
Closed ecosystem and self-referential foundations
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
Scope & Claims
PAI-Bench (arXiv 2609.13637) evaluates identity-contract fidelity: whether a deployed agent carrying an installed, versioned identity document (core properties, lineage, mission, values, operating patterns, governance) can recall, express, enact, protect, update, and restore that identity. The paper explicitly scopes itself away from persona simulation, personalization, and authentication. Three headline claims organize the evidence: (1) atomic recall is near-perfect (direct-parent identifiers in 48/48 atomic responses) while spontaneous expression collapses (1/48 implicit self-portraits contain the parent); (2) expression is cue-dependent - explicit field prompts lift joint three-identifier presence from 0/8 to 7/8 (Table 2), and a startup body-label substitution lifts full designation from 1/8 to 7/8 with parent omission persisting (S13); (3) evaluator choice moves aggregates materially, with Claude's factorial headline mean 12.5 percentage points below the selected Astra judge on identical responses. The authors are careful that these are observations of tested configurations, not rankings.
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 5 strengths & 5 weaknesses, analyzed in detail
- 5 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
What is PAI-Bench?
PAI-Bench is a benchmark that evaluates whether deployed AI agents faithfully uphold an installed, versioned identity contract. It tests six things separately: recall of identity facts, spontaneous expression of them, behavioral enactment, resistance to unauthorized change, governed updates and rollback, and lineage consistency - with all scoring information kept outside the agent being tested.
What is the paper's main finding?
The three tested agent configurations reliably answer direct identity questions (the parent identifier appeared in 48 of 48 atomic responses) but almost never volunteer that fact in a natural self-introduction (1 of 48). Explicitly naming the fields in the prompt largely fixes this (joint presence of three identifiers rose from 0/8 to 7/8), and swapping the startup body label changed which name the agent used for itself (1/8 to 7/8) without fixing parent omission. Separately, two LLM judges scoring the exact same answers differed by 12.5 points in headline mean.
Is the code and data available?
Yes. The benchmark is Apache-2.0 licensed at github.com/our-ark/pai-bench, with a v1.0.0 evidence ZIP containing retained responses, judgments, frozen profiles, and verification scripts. Offline audits (literal component counts, gate-failure diagnostics, judge-agreement statistics) can be recomputed without model access; regenerating new responses requires the proprietary target models, which have no verified public endpoint mapping.
Do these results let me rank AI models?
No. The authors state explicitly that the results are observations of three tested configurations with one sample per condition, a primary judge selected after inspecting results, and descriptive-only confidence intervals built from four clusters per split. The paper demonstrates protocol sensitivity and specific failure patterns, not provider-independent model rankings.
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- The provided text is a sampled excerpt with marked '[...sampling gap...]' regions (e.g., part of Table 1, the S5 digest table, S9.2, and portions of S10/S12); this review avoids claims that depend on skipped content.
- Figures 1-2 are referenced in the text but only surrounding captions/prose were extractable, not the rendered graphics.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.