Do LLM guardrails still work when there is no arithmetic to check? 368 merges, five checks

A model cleans up a contact list, merges two rows, and one of the two people stops existing. Nothing crashes. The test we published on 2026-08-18 measured how often that happens: 48.4 % of the trap pairs were merged, and 70 % of those false merges came back with nothing in the model output that would send anyone to check.

Two weeks later we measured which guardrails catch a wrong extraction on an invoice. The two that worked were asking the model to check its own output, and running a second model and comparing. But an invoice has a third guardrail that costs nothing: subtotal + tax = total_due. A contact list has no arithmetic at all. So we put the same two guardrails on the same 96 deduplication runs, and scored them the same way.

Both guardrails still work, and both lose between 22 and 30 points of catch rate. Self-checking catches 97.6 % of the wrong extractions on invoices; on merges it catches 76.0 %. Cross-model agreement drops from 92.9 % to 62.9 %.

They also get quieter, and more often right when they speak. Self-checking flags 39 % of the correct invoice extractions but only 20.8 % of the correct merges, and its precision rises from 29.9 % to 57.0 %. Fewer catches, less noise.

Cross-model agreement works worst on the best model. claude-haiku-4.5 proposes the fewest wrong merges of the three, 19 out of 111, and agreement catches only 36.8 % of them while 6 of its 10 alarms land on a correct merge. The better your model, the less this guardrail helps you.

The best second model is not the same one from one task to the next. As the single witness, gpt-4o-mini scored the best precision on invoices, 65.8 %, and scores the worst here, 44.8 %. claude-haiku-4.5 scored the worst on invoices, 37.9 %, and the best here, 91.1 %. There is no second model to recommend in general.

Method, in short

Test conducted on 2026-09-12 by the automated testing pipeline of this site: the corpus, the model calls and the analysis are scripts, published below so that anyone can rerun them and disagree with the result. Etienne signs this article and answers for its content.

This is the seventh measured test published here, and the second that measures checks rather than models.

The 96 deduplication runs were not redone. They are exactly the ones published on 2026-08-18 under the contact deduplication dataset: 8 script generated address books of 12 rows, seed 20260817, four levels of formatting mess, three low cost models, and a ground truth partition settled then. Rerunning them today would have mixed the effect of the guardrails with 26 days of model drift, and no figure below would separate the two.

The unit scored here is not an address book and not a call. It is a proposed merge: a pair of rows a model put in the same group.

The guardrails

A1 is the arithmetic-shaped guardrail of this task, and the comparison is the whole point of the test: subtotal + tax = total_due is true in the world, while "duplicates share an email or a phone" is only true in this corpus. That caveat is not decoration, and it is priced below.

The A3 instruction never hints that an error was found and gives no ground truth. Telling the model an error exists would measure compliance, not detection. The verdict is asked group by group, not on the whole partition: a global verdict attaches to no particular merge, and a guardrail that does not name the row to re-read does not tell you where to look.

Raw figures

368 merges judged, 97 wrong, 271 correct.

Same guardrails, two tasks

Three readings, and none of them cancels the others. The two model based guardrails descend when the arithmetic disappears, they do not collapse. Their false alarm rate descends too, and their precision goes up. And the ranking holds: self-checking catches more, agreement is more precise. That last one is the only result here that travels.

The guardrail turns against the best model

The mechanism needs no hypothesis: agreement punishes departure from the majority, and the most cautious model is precisely the one that departs most often while being right.

The best witness changes with the task

The best witness on invoices is the worst here, and the worst on invoices is the best here. This is the one place in this test where the honest answer is: measure it on your own task.

By level of formatting mess

The clean file is the only level where agreement catches more than eight wrong merges in ten, and it is also the level that contains the fewest. Where there is most to catch, N3 with 33 wrong merges, it catches 63.6 %.

Reading load

Per 1000 proposed merges, in a population where 264 of them are wrong, which is this corpus and not a real address book.

Costs

The self-check pass, 96 calls: 0.07469 USD in total. Per 1000 self-check calls: gpt-4o-mini 0.196 USD, gemini-2.5-flash-lite 0.161 USD, claude-haiku-4.5 1.977 USD. None of this is expensive. The expensive resource is the person who reads the flagged merges.

The self-check is not weak, it is pointed the wrong way

Here is one raw response, exactly as it came back. Same model, same address book, same call: four proposed groups, four verdicts.

{"modele": "openai/gpt-4o-mini", "carnet": "carnet-01", "niveau": 1,
 "lu": true, "json_valide": true,
 "groupes_soumis": [[4, 5], [3, 8], [6, 9], [1, 10]],
 "verdicts": [{"rows": [4, 5], "same_person": true},
              {"rows": [3, 8], "same_person": true},
              {"rows": [6, 9], "same_person": false},
              {"rows": [1, 10], "same_person": false}]}

Rows 4 and 5 are Julie Lindqvist at Halloway Electric Company in Peoria and Julie Lindqvist at Vermillion Textiles LLC in Duluth. Different company, different city, different email, different phone. Two people. The model merged them, then confirmed the merge.

Rows 6 and 9 are Ted Delgado and Theodore Delgado, both at Alder Bay Packaging, sharing the same email address, t.delgado@alderbay.example. One person. The model merged them correctly, then refused its own correct merge.

In one response, on one address book, the self-check confirmed a merge supported by nothing and rejected a merge supported by an identical email. It is not reading the identity keys in either direction: it is reading how alike the names look. That is why the free mechanical rule beats it on precision, 100 % against 57 %, while costing no call at all.

What we would do with this

Put the key rule first, then a second model. A1 and A4 together catch 90.7 % of the wrong merges with 9.2 % false alarms and 1.3 reads per one found. That is the best combination in this test, and the key rule half of it is free.

Do not choose your second model from somebody else's benchmark. The ranking of the three witnesses reverses between two tasks in the same family. One extra run of a candidate on fifty pairs you have already judged tells you more than any published table, including this one.

Distrust cross-model agreement if you already picked the careful model. On the model with the fewest wrong merges here, agreement caught barely a third of them and cried wolf on 6 of 10 alarms.

Use the per group boolean, not the prose. The boolean is what is scored here, at 57 % precision. The free text that comes with it was not scored and should not be treated as if it had been: it is published in the archive so you can judge it yourself.

Measure both numbers, always. A1 has a perfect 0 % false alarm rate on this corpus, and that number is true by construction, not by merit.

Limits, stated plainly

This section is not a formality. It is the condition for the rest to be readable.

• The 0 % false alarm rate of A1 is true by construction. This corpus requires every duplicate pair to share an email or a phone. In a real address book, somebody who changed both would have their merge blocked by that rule. We said it on 2026-08-18 and we repeat it here, because it is the most flattering number in the table.
• The partitions are 26 days old. They were produced on 2026-08-17. Nothing here says the same models make the same merges today.
• 97 wrong merges at most. Every catch rate rests on that. A percentage on 97 items has a wide margin: orders of magnitude, not constants.
• 2 of the 96 responses were not valid JSON, and 7 of the 366 submitted groups came back with no verdict. Those 7 merges leave the A3 population, which is therefore scored on 96 wrong and 265 correct instead of 97 and 271. The figure is not repaired, it is declared.
• A5 leaves 111 merges unjudged by construction: a model cannot be its own witness.
• One corpus, 96 constructed rows, fixed seed, declared as constructed in its own protocol. No real person. The trap families are designed features of that corpus and their frequency here is not their frequency in a company's CRM.
• Address books of 12 rows, entirely inside the model's window: the most favourable case. A 5000 row list is a different problem and is not measured here.
• Three models, one provider, one day. The self-check pass went through OpenRouter on 2026-09-12.
• The self-check prompt is one prompt. A different instruction would give different numbers. We publish the one we ran rather than searching for a flattering variant.
• The comparison with the invoice test puts two tasks and two corpora side by side. What changes is not only the presence of an arithmetic check, and this test cannot separate the two.
• One language. The address books are in English.

Rerun it

Everything is published, not summarised: the 96 partitions being judged, the self-check script, the 96 raw responses exactly as the models returned them, and the analysis that produces every figure above.

python3 auto-verifier.py --resultats resultats-bruts.json --corpus corpus.json \
    --sortie verifications.json
python3 analyser.py --resultats resultats-bruts.json \
    --verifications verifications.json --sortie chiffres.json

The analysis calls no model, so it replays at zero cost, and a guardrail rule you disagree with can be changed and rerun on the same 96 responses. The API key is read from an environment variable and appears nowhere in these files.

Download the dataset (zip, with the full inventory and the checksum). The scripts and the comments inside them are in French, which is the working language behind this site.

If you rerun this and get something different, we want to know. There is a contact form, and corrections get published on the article itself, dated, as the editorial rules of this site say.