Can the Confidence and Decisions of System 1 Models Be Trusted? An Explainability and Perturbation Audit of Jev-Style Decision Models

Summary

This audit benchmark evaluates System 1 decision models, which return typed probability distributions in a single forward pass instead of generating text, across calibration, cross-question interference and attribution faithfulness. Across five open-weight models (0.8B to 27B) and generative baselines, provider confidence tracks a closed-form dispersion transform rather than empirical accuracy, and bundling several questions in one request causes directional binary flips, up to 22.4% on Tev1-0.8B versus 0.1% to 0.2% on Tev1-4B. Models with at least 4B parameters are faster and better calibrated under syntactic shifts than the logprob and JSON baselines.

Related items

• LowHelp defend against memory poisoning in Amazon Bedrock AgentCore with multi-layer write validationSimilar attack · AWS Security Blog
• InfoHarness Matters: Measuring and Dissecting Security Resilience in Web AgentsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• MediumTop MCP security resources — November 2026Similar attack · Adversa AI Blog
• InfoScaling Adaptive Prompt Injection Attacks with Agent SwarmsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoTreating the Model as an Untrusted Component: Deterministic Policy Enforcement, Human Approval and Taint Tracking Against Prompt Injection in Tool-Using Agents, with Validation on Open-Weights ModelsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)