🤖 machine learning

The Moving Target: A Longitudinal Audit of Trustworthiness Drift Across Twelve Checkpoints of Open-Source Chat LLMs

This paper demonstrates through a longitudinal audit of four open-source LLM release lines that trustworthiness scores significantly drift across successive checkpoints, arguing that such metrics must be treated as dated, checkpoint-specific artifacts rather than static attributes carried forward without remeasurement.

Original authors: Zhichao Fan, Yanhang Li, Zexin Zhuang, Xian Sun, Yingshuo Wang

Published 2026-07-07

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Zhichao Fan, Yanhang Li, Zexin Zhuang, Xian Sun, Yingshuo Wang

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you buy a car from a trusted brand, like "Mistral" or "Qwen." The salesperson hands you a brochure (a "Model Card") that says, "This car is 90% safe and 95% honest," based on tests they ran last year.

Now, imagine that six months later, the same brand releases a slightly updated version of that car. They haven't changed the name, but they might have tweaked the engine, updated the software, or even swapped the tires.

The big question this paper asks is: Can you still trust the old brochure? Does the "90% safe" score from the old version automatically apply to the new one?

The authors say: No. Absolutely not.

Here is the breakdown of their findings using simple analogies:

1. The "Moving Target" Problem

The researchers looked at four major open-source AI families (Yi, Qwen, Mistral, and Gemma). For each family, they checked three consecutive versions (Generation 1, 2, and 3).

Think of these AI models like chefs in a kitchen.

Generation 1 is the chef's first recipe.
Generation 2 is the same chef, but maybe they changed the spice mix, the cooking time, or the type of pan they use.
Generation 3 is the chef again, perhaps with a new assistant or a different oven.

Even though the chef's name on the menu hasn't changed, the food they serve does change. The paper found that the "trustworthiness" of the AI shifts significantly between these versions. It's like if a chef's "95% delicious" rating from last month drops to 85% or jumps to 98% just because they changed the recipe slightly.

2. The "Drift" is Real and Big

The team measured how much the AI's performance "drifted" (moved) between versions.

They found the average shift was 8.00 percentage points.
To put that in perspective, they compared this shift to what you would expect if the AI were just flipping a coin randomly. The actual shift was 3.6 times larger than random noise.

The Analogy: Imagine you are trying to hit a bullseye on a dartboard. If the board itself is moving around wildly every time you throw a dart (even if you throw from the same spot), your score from yesterday tells you nothing about your score today. The paper proves the "dartboard" (the AI's behavior) is moving much more than we thought.

3. The "Certificate" is Expired

Currently, companies often put a trust score on a model card and assume it stays valid for the whole "release line."

The Paper's Verdict: A trust score is not a permanent certificate like a driver's license. It is more like a weather report.
If you read a weather report saying "It is sunny" from last Tuesday, that report is useless for deciding what to wear today. You need a new report for today's conditions.

The authors argue that every time a new version of an AI is released, the old trust scores should be treated as expired. You cannot carry them forward to the new version without re-testing.

4. The "Longitudinal Model Card" Solution

Since the scores change so much, the authors propose a new way to report them, which they call a Longitudinal Model Card.

Think of this like a fitness tracker log instead of a single photo.

Old Way: A photo of you today saying, "I weigh 150 lbs." (This doesn't tell you if you gained or lost weight since last week).
New Way (Longitudinal Card): A log that says, "On Jan 1st, I weighed 150 lbs. On Feb 1st, I weighed 152 lbs. The change was +2 lbs."

This new card would include:

The specific "snapshot" (Checkpoint): Exactly which version of the AI was tested.
The Date: When the test happened.
The Drift: How much the score changed from the previous version.

5. What This Does Not Mean

The paper is very careful about what it doesn't claim:

It's not about "Better" or "Worse": The AI didn't necessarily get "dumber" or "safer." It just changed. Sometimes the score went up, sometimes it went down. The point is that it is unpredictable.
It's not about Closed AI: This study only looked at open-source models that anyone can download. It doesn't say anything about the secret, closed models from big companies (like the ones you chat with on a website) because those are harder to test.
It's not about "Magic" fixes: The paper doesn't offer a way to stop the AI from changing. It just says, "Stop pretending it doesn't change."

The Bottom Line

If you are buying, regulating, or using an open-source AI, do not assume the trust score on the brochure applies to the new version. The AI is a "moving target." You must re-test every new version to know what you are actually getting. The old score is just a dated artifact, not a guarantee.

Technical Summary: The Moving Target – A Longitudinal Audit of Trustworthiness Drift

1. Problem Statement

Current practices in reporting Large Language Model (LLM) trustworthiness often treat benchmark scores as static, transferable certificates. Model cards frequently cite trust-benchmark scores (e.g., TruthfulQA, BBQ) without recording the specific measurement time or checkpoint version. Consequently, these scores are routinely carried forward across successive checkpoints of the same release line (e.g., from "Mistral-7B-Instruct v0.1" to "v0.3") under the implicit assumption that the model's behavior has not shifted.

This paper investigates whether this assumption holds. It posits that for open-source release lines, where pretraining mixtures, instruction-tuning recipes, tokenizers, and model scales change between generations, a trust score measured at time $t$ may not be valid for a subsequent checkpoint at time $t+\Delta$ . The core operational question is: Is a point-in-time trust score being read as a transferable certificate when the underlying checkpoint has already moved?

2. Methodology

2.1 Audit Scope and Design

The study conducts a longitudinal audit of four open-source chat-LLM release lines: Yi, Qwen, Mistral, and Gemma.

Generations: Each release line is evaluated at three successive public generations (G1 $\to$ G2 $\to$ G3), resulting in 12 distinct checkpoints.
Benchmarks: A fixed basket of five trust benchmarks is used, covering three dimensions:
- Truthfulness: TruthfulQA-MC1.
- Fairness: BBQ-mixed (mixed ambiguous/disambiguated MCQs) and CrowS-Pairs-FC (forced-choice MCQs).
- Safety: ToxiGen-AT (AI-annotated toxicity threshold) and XSTest-TD (type-derived refusal proxy).
Prompting: Each benchmark is evaluated under three distinct prompt templates (varying surface form and extraction strategy) to account for configuration sensitivity.
Sampling: A fixed, cached subset of 200 items per benchmark is reused across all 12 checkpoints to ensure paired comparisons.
Evaluation Protocol: Models are loaded in 4-bit NF4 quantization with greedy decoding. Scores are calculated as the mean across the three prompt templates for each checkpoint.

2.2 Metrics and Statistical Framework

The primary metric is the Score Drift Rate (SDR), defined as the absolute percentage point difference in scores between adjacent generations:
$|SDR| = \frac{1}{|F||B||G_{trans}|} \sum |(s_{f,g',b} - s_{f,g,b})|$
where $F$ is the set of release lines, $B$ is the benchmark basket, and $G_{trans}$ represents adjacent transitions.

To determine if observed drift is statistically significant or merely sampling noise, the authors construct a pooled no-drift reference null:

Mechanism: For each $(f, b, t)$ triple, a pooled success rate is calculated across all generations. In 5,000 bootstrap iterations, new scores are simulated by drawing from a Binomial distribution based on this pooled rate, treating adjacent generations as independent.
Purpose: This generates a distribution of $|SDR|$ expected under a "no-drift" hypothesis. The observed aggregate is compared against the 99.9th percentile of this null distribution.

3. Key Results

3.1 Primary Endpoint: Significant Drift

The study finds that trustworthiness scores drift significantly across generations, far exceeding what would be expected by sampling noise.

Observed Drift: The mean absolute adjacent-generation drift ($|SDR|$) is 8.00 percentage points (pp) (95% CI: [7.57, 9.12]).
Null Comparison: The pooled no-drift reference null has a mean of 2.22 pp and a 99.9th percentile of 3.30 pp.
Significance: The observed drift is 3.60 times larger than the null mean and lies well outside the top $10^{-3}$ tail of the null distribution ( $p < 2 \times 10^{-4}$ ).
Robustness: This result holds under strict scoring (unparsed outputs counted as incorrect, raising drift to 8.93 pp) and across various perturbations (dropping specific benchmarks, release lines, or low-parse cells), where drift remains in the range of [6.36, 9.43] pp.

3.2 Exploratory Diagnostics

Regression Rate: 47.5% of adjacent-generation transitions resulted in a regression (lower scores), contradicting the implicit expectation that "later is strictly better."
Dimension Volatility: Fairness-related benchmarks showed the highest volatility ( $\sigma \approx 12.88$ pp), followed by Truthfulness ( $\approx 11.72$ pp), while Safety was tighter ( $\approx 7.48$ pp).
Rank Persistence: Rank stability is weak. The top-scoring release line changed in 90% of benchmark/transition cells, and pairwise orderings flipped 55% of the time, performing only marginally better than uniform-random baselines.
Compliance Flips: At the empirical median threshold, the probability of a benchmark crossing the threshold between generations is $\ge 0.5$ for all benchmarks.

4. Contributions and Implications

4.1 Core Conclusion

The paper concludes that trust scores attached to a named release line should not be presumed to transfer to later checkpoints without re-measurement. The evidence suggests that treating these scores as transferable certificates is operationally unsound.

4.2 Proposed Solution: Longitudinal Model Cards (LMC)

The authors propose packaging trust reporting as a Longitudinal Model Card. Unlike standard model cards, an LMC must include:

Checkpoint Identity: The specific HuggingFace revision hash.
Evaluation Date: The exact date of measurement.
Drift Context: The score's drift relative to the prior audited release and the reference null summary.
Re-audit Trigger: A rule stating that any "materially new release" (change in weights, tokenizer, scale, or recipe) triggers a mandatory re-audit rather than score carry-forward.

4.3 Scope of Claims

The authors explicitly limit the scope of their findings:

Included: Non-canonical chat-evaluation variants of the five specific benchmarks, fixed 200-item cached subsets, and the four audited open-source release lines (all $\le 12B$ parameters).
Excluded: Closed-source APIs (e.g., OpenAI, Anthropic), models larger than 12B, canonical benchmark protocols, and fixed month-cadence disclosure rules. The paper does not claim that drift exists in these excluded domains, noting they require separate evaluation.

5. Significance and Limitations

Significance: The paper provides the first large-scale, multi-family longitudinal audit of open-source LLM trustworthiness. It challenges the "static certificate" paradigm in model governance, procurement, and regulatory disclosure, arguing that trust is a time-bound, checkpoint-specific artifact rather than a permanent property of a release line.

Limitations:

Sample Size: The audit covers only 12 checkpoints across 4 families.
Item-Subset Uncertainty: Results rely on a single fixed 200-item subset per benchmark; multi-seed resampling was not performed due to compute constraints.
Confounding Factors: Drift is a mix of recipe changes, scale changes (e.g., Gemma 7B $\to$ 12B), and tokenizer changes. The study does not disentangle these specific drivers.
Quantization: All models were run at 4-bit NF4, which may introduce artifacts, though consistency was maintained within release lines.

The paper does not propose new statistical methodologies but applies standard longitudinal and bootstrap techniques to a specific, previously unaudited domain: the stability of open-source LLM trust scores over time.