AI safety gates fail audit: cosine similarity catches 0 of 56 reversals

Many agent frameworks rely on embedding-cosine similarity as a quality gate, answering "does this text still mean the same thing?" with a fixed cutoff. In a new arXiv paper (2608.10216), Scott E. Frias audits this gate class as a measurement instrument and finds it systematically measures the wrong question: "how much did the wording change?" For the exact use cases these gates are built to catch—reversals, contradictions, critical instruction edits—the two can run opposite. Reversing an instruction can be a single word edit, while semantically agreeing often rephrases the whole sentence.

The production drift guard audited caught 0 of 56 meaning-breaking mutations. Worse, one approved item, "withhold the study drug" → "administer the study drug", scored 0.9608 cosine similarity. Across 90 configuration-threshold-task cells, balanced accuracy never exceeded 0.700, with a median of 0.525. Frias also shows the evaluation itself can be confounded: a naively built corpus can return an inverted verdict, with AUROC exactly 0.000 in 13 of 18 configuration-task cells. Obvious repairs fail—an encoder swap and an overlap-conditioned gate land at chance on held-out data, and an NLI drop-in did no better. However, two of nine configurations separated reversal from paraphrase at matched overlap (AUROC 0.79–0.90), suggesting a valid instrument is buildable if the deployment regime is audited with matched-pair designs. The corpus method, harness, and frozen results are released openly.