Similarity Gates Approve Reversals: A Validity Audit of Embedding-Cosine Thresholds in Agent Systems

Agent frameworks ship quality gates that compare text blocks by embedding-cosine similarity and decide at a fixed cutoff. Deduplication filters, semantic caches, drift guards, and answer grader gates deploy to answer the question: “Does this text still mean the same thing?” But the score answers a different question: “How much did the wording change?” We audit this gate class as a measurement instrument. In the cases these gates exist to catch, the two can run in opposite ways. Many times, reversing an instruction is a single word edit, while agreement often rephrases a sentence. The consequence is a safety check that fires backwards. The production drift guard we audited caught 0 of 56 meaning-breaking mutations, and one approved item, “withhold the study drug” → “administer the study drug”, came in at cosine 0.9608. We observed five shipped operating points, and balanced accuracy across 90 configuration-threshold-task cells never exceeded 0.700 (median 0.525). The same confounder also corrupted evaluations. A naively built corpus inherits this confounder and can return an inverted verdict, with a decision AUROC exactly 0.000 in 13 of 18 configuration-task cells (at most 0.040 in all 18) against 0.440–0.815 for the same nine configurations under a balanced 2 × 2 design. Twice in the effort it captured our own headline claims. Obvious repairs fail: an encoder swap and an overlap-conditioned gate (0.750 in-sample, 0.533 held-out) land at chance on separately authored held-out data, and an NLI drop-in did no better. Embeddings do still bear hope here, as the strongest two of nine configurations separated reversal from paraphrase at matched overlap (AUROC 0.79–0.90), but only a matched-pair audit reveals the deployment regime. We release the corpus method, harness, and frozen results, and contend that scores gated this way measure the wrong thing. We believe a valid instrument is buildable.

Improvements to AI systems:

1. Replace fixed cosine-similarity thresholds with matched-pair audit protocols.

• The improved system will compare text pairs under controlled conditions (e.g., same semantic content vs. same wording) before deployment, ensuring the gate’s cutoff is calibrated to detect meaning changes, not just lexical drift.

• It will report balanced accuracy and AUROC on a 2×2 design (reversal vs. paraphrase × high/low overlap) instead of a single score, preventing false confidence.

2. Add an overlap-conditioned decision layer.

• The system will dynamically adjust its similarity threshold based on token overlap (e.g., Jaccard or edit distance) between the two texts.

• For low-overlap pairs (e.g., full rephrasing), it will require higher semantic similarity; for high-overlap pairs (e.g., single-word flips), it will flag even minor cosine drops. This prevents “administer” vs. “withhold” from passing at 0.96.

3. Use reversal-sensitive embedding features.

• The system will augment cosine similarity with directional or contrastive features (e.g., negation markers, antonym embeddings, or verb-argument structure) to distinguish “do X” from “do not do X” even when word overlap is high.

• This catches meaning-breaking mutations that current gates miss (0/56 in the audit) by explicitly modeling polarity and action changes.

4. Implement a held-out, separately authored evaluation corpus.

• The system will validate any gate on data written by different authors than the training set, avoiding the confounder where naive corpora inherit wording-overlap artifacts.

• This prevents the observed inverted verdicts (AUROC 0.000 in 13/18 cells) and ensures the gate’s performance is generalizable, not an artifact of a single writing style.

5. Add a fallback NLI-based verifier for high-stakes decisions.

• When cosine similarity is near the threshold or overlap is high, the system will invoke a natural language inference model to check entailment/contradiction between the original and modified text.

• This catches cases where embeddings fail (e.g., NLI drop-in matched chance in the audit) but provides a second opinion, reducing the risk of approving dangerous mutations like drug administration changes.

6. Expose calibration curves and confidence intervals at runtime.

• The system will output not just a pass/fail but a probability that the two texts are semantically equivalent, along with a confidence interval based on the matched-pair audit.

• Operators can then set risk tolerance (e.g., 95% confidence) rather than a fixed cutoff, making the gate’s behavior transparent and auditable.

What the improved AI system can do:

• Detect meaning-reversing edits (e.g., “withhold” → “administer”) with near-zero false negatives, even at high cosine similarity.

• Avoid false alarms on legitimate rephrasing (e.g., “stop the drug” → “discontinue the medication”) by conditioning on overlap.

• Provide trustworthy safety gates for production drift guards, semantic caches, and answer graders, with performance validated on independent data.

• Offer a calibration interface that lets engineers tune risk per task, not per global threshold, reducing both missed hazards and unnecessary blocking.