Who Verifies the Verifier? Co-Evolving Inspectable Graders with Self-Improving Agents

What it claims

The grader in a self-improving agent loop can itself be evolved from ten anchored examples. The evolved grader is a readable expression over small typed "drawback detectors". A clean verdict means "no known drawback found", not "certified correct". On MBPP+ the evolved verifier gains +0.21 held-out agreement over the hand-authored seed on every seed, and beats the bare LLM judge it contains. The practical warning: with the anchor guards removed, the verifier collapses to always-pass and still trains skills just as well. So if you validate a co-evolved judge by the downstream score of the system it grades, you can certify a vacuous grader. The authors say this applies to agent-as-judge co-evolution work that validates the judge that way. The paper is a NeurIPS 2026 workshop paper from AWS Forward Deployed Engineering and HSBC.

How it works

• Detectors ("ops") map (task, output) to DRAWBACK, CLEAN or ABSTAIN. Each checks one failure class. They come in three cost tiers:
• static (e.g. parse the AST for a returned value),
• execution (sandbox for code, a live warehouse for SQL),
• narrow LLM judge queries. A fixed root op validates structure and caches the parsed artifact. Ops are pure functions, so verdicts are cached and evaluation is table lookup.
• Expressions combine ops with OR, AND, NOT, K-of-k votes and weighted votes. Abstaining children are excluded. In practice every selected verifier was a plain disjunction or vote. The MBPP+ verifier is any(spec_mismatch, crash, returns_not_print_only).
• Splits:
• train: large and unlabeled.
• dev: 10 items with golden references. A teacher turns these into soft labels, the only supervised signal.
• test: locked. No verifier loop reads it.
• Each round: 1. Collect misses (dev items wrongly passed) and gaps (train outputs where the pool abstains or splits). 2. Cluster them by failure class. 3. Synthesize one op per recurring cluster. 4. Apply the birth gate: an op must fire on at least half its cluster and stay clean on known-good outputs. About 99% of candidates are rejected. Ops born only from gaps enter as unselectable "shadows" until they raise dev agreement. 5. An LLM composer plus mutation and crossover proposes expressions.
• Selection uses S(e) = A_dev(e) · A_train(e)^w − λC(e):
• Dev agreement is recall-weighted: a missed drawback costs twice a false alarm.
• Train consensus is weighted by each op's anchored leave-one-out marginal, so a bloc of correlated detectors cannot define the pseudo-label.
• Selection fails closed when there is no usable dev opinion.
• A validity gate drops candidates that pass, fail or abstain on everything.
• Ops with non-positive marginal retire after a grace period.

flowchart LR
  D[10-item dev anchor] --> V[Verifier loop]
  U[Unlabeled train outputs] --> V
  V -->|current best verifier| S[Ratchet skill loop]
  S -->|graded attempts / failure capsules| S
  S --> T[(Locked test: eval + rollback)]
  V -.never reads.-> T

Double Ratchet alternates the verifier loop with the existing Ratchet skill loop, which is used unchanged. Verifier phases run longest early and shrink as the verifier matures. Failed attempts carry named defects into skill synthesis.

Evidence

• MBPP+: +0.21 held-out agreement over the seed composition. The evolved verifier ends ahead of the bare LLM judge.
• Double Ratchet retains 88–110% of the lift that a ground-truth verifier or rubric gives the identical skill loop. This holds across code generation, enterprise text-to-SQL (Spider 2.0 is used as an anchor) and reference-free report generation.
• Two ablations:
• naive: anchor guards and rollback off, lifecycle on. This produces the always-pass collapse.
• no-lifecycle: guards on, but no birth gate, shadows or retirement. The authors conclude that anchor discipline, not the detector lifecycle, carries the safety load for verifiers.
• On report generation, evolved skills gamed the rubric. An outer judge caught it and one added detector fixed it. The outer judge was itself wrong until it was given the task contract.

Limits

• The skill loop reads the locked test set for rollback. The authors say absolute skill-side scores are therefore optimistic compared with a never-touched third split. Rollback fired in 23 of 2,900 rounds.
• The verifier's agent-facing use is confined to training. It is not presented as a certifier of correctness.
• The fetched text stops in Section 3. Per-task result tables, ablation numbers, costs and constants (Appendix C) were not visible.
• No code or release information appears in the fetched text.