Parent: recursive-harness · Prereq: gates-with-margins, coordinator-not-arbiter, interface-p-belief
The counterintuitive production pattern (Anthropic's hook auditor in Claude Code runs on a small model): the auditor watching a strong actor is deliberately weaker than the actor. Six reasons, and they are the harness thesis in miniature — an auditor's strength comes from its position in the structure, not its intelligence.
-
Hot-path economics. The auditor runs on every tool call, synchronously. The actor's cost amortizes per task; the auditor's multiplies per step. A check that fires two orders of magnitude more often must be two orders of magnitude cheaper — high-frequency checks must be cheap; expensive judgment belongs only at low-frequency escalation points (the gate-economics equilibrium).
-
The task is narrowed into the weak-strong equivalence zone. The auditor never answers "is this safe?" (open-ended, intelligence-bound). It answers "does this input match this rubric?" — closed classification, short context, fixed output schema. On narrow classification, small ≈ large. Weak capability is compensated by strong task design.
-
Tripwire, not wall. The auditor is one layer in depth: below it sit deterministic permissions, OS sandboxes, human confirmation. Its job is to raise an alarm cheaply; the guarantees live in the deterministic layers. Pulling a fire alarm does not require genius. (It is a coordinator-side mechanical part, never the arbiter.)
-
Intelligence is attack surface. The auditor's context contains attacker-controlled content — the tool inputs it audits may carry injection. More intelligence = more capacity to be persuaded. You want a rigid rules-cop, not a philosopher open to eloquence. Robustness comes from structure (what it sees, what it can affect, schema-locked output), barely from IQ; and small + short-context + no-tools = minimal surface.
-
Decorrelation. Actor and auditor on the same strong model share blind spots — the rationalization that convinced the actor convinces the same-family auditor (correlated failure). A different small model buys partial decorrelation, and it is the cheapest diversity available.
-
Calibrated suspicion suffices. The auditor's output action is escalate, not execute/veto — it needs calibrated belief, not correct verdicts (interface-p-belief). Slight over-triggering with a human backstop, at 1/20 the price, wins the precision-economics trade.
Consequence for the harness: when placing LLM judges in a recursive harness, budget them like this — mechanical gates first, weak-but-rigid classifiers at high frequency, strong judgment only at sparse escalation nodes, and never let the judge's context ingest ungated content from the thing it judges.