synodic-ai RESEARCH
Research Desk · AI Governance

Access, Measurement, Attribution: Three Governance Levers That Outlast the Release Decision

2026-10-16

Three papers posted to arXiv on 2026-10-14 each take on a different blind spot in how capable AI systems are governed: who may obtain a given capability, how capability is measured once benchmarks stop telling models apart, and how a piece of text is traced back to the model that produced it. Read together, they argue that the release decision is only the first of several controls, and that every later control depends on evidence the field is only starting to collect.

The release decision is really two decisions

Chai K. Toh and Vasu Raj Jain start from a complaint about framing. Most debate about releasing capable AI systems treats the choice as binary: keep the model behind an API, or publish the weights. The authors argue that this runs together two separate decisions. One is how capable a system may become. The other is who may obtain a given capability, and on what terms. Their Multi-Tiered AI Accessibility Model (MAIAM) addresses the second, sorting access by purpose, safety and capability instead of by release artifact.

The model has three tiers. Tier 1, AI for Learning, is broadly accessible and deliberately capability-bounded. Tier 2, AI for Exploration, serves research and development under registration, identity and usage controls that tighten as capability rises. Tier 3, Full-Scale Frontier AI, is available only through structured, recorded and accountable access. The organizing principle is that accessibility should be proportional to capability, safety and risk. Systems are assigned to a tier using criteria along four axes: capability, autonomy, domain consequence, and usage and safety.

The paper then pairs MAIAM with the SAFE AI Operating Point to form a two-part framework. A Capability Boundary fixes the safety limits that are not to be crossed; an Accessibility Boundary fixes who may obtain a capability below that limit. The authors' conclusion is direct: capability limits alone do not make AI safe, and a tiered access regime administered by regulating bodies is also needed.

Why published weights end the conversation

The sharpest argument in the MAIAM paper concerns open weights. The authors set out why publishing frontier-class weights forfeits every safety lever a developer has after release. They also cite evidence that safety fine-tuning can be stripped from open weights for a few hundred dollars, and draw the consequence for evaluation: an evaluation of the base model says little about its derivatives.

That point matters beyond the open-versus-closed debate. Any governance regime that certifies a model by testing it once is certifying an artifact that may not be the one in use. If derivatives can shed the safety behavior that was measured, the evaluation has to follow the derivative, or the access terms have to prevent the derivative from being made. MAIAM's answer is the second: control who obtains the capability in the first place.

Measuring capability after the ceiling

Tiering by capability presumes that capability can be measured. Morio Hamada, Jehyeok Yeon, Matteo Migliarini, Justin Olive and Magda Dubois examine what happens when it cannot be measured by scores alone. Once several models approach perfect scores on a benchmark, it loses its power to tell them apart, and with it its usefulness for AI safety cases and frontier policies. Yet each benchmark item produces far more than a score: a full transcript of how the model solved the task.

The authors simulate saturation retrospectively, using historical benchmark and model releases, and test whether protocols that see only correctly solved transcripts from saturated benchmarks can predict capabilities measured on held-out, unsaturated items. They compare pairwise judging, single-transcript absolute scoring, and predictions from deterministic transcript features or embeddings. Saturated transcripts retain capability information beyond benchmark accuracy. Pairwise judging performs best, cutting prediction error by a factor of 5.3 compared with a baseline that uses only the saturated scores. The useful signal is spread across transcript sections but concentrated in particular channels, notably reasoning and tool calls.

The limitation is as important as the result. The protocols' predictive power does not always generalize across distribution shifts; the authors give the example of underestimating the capabilities of the first reasoning models introduced in early 2025. Their conclusion is that saturated benchmarks still carry capability-predicting signal in their transcripts, but extending a benchmark's life requires methods built to extract that signal robustly.

Tracing text back to its source model

The third paper, by Minseok Ko, Hyunseok Lee, Woomin Song, Beomjun Kim, Jinwoo Shin and Kunwoong Kim, addresses the after-the-fact question: which model wrote this text? The authors tie model authorship attribution (MAA) to misuse involving academic misconduct, model distillation and cyberattacks. In practice an attribution system meets text from unseen domains and writing settings, and from future versions of model families that did not exist when it was trained, and existing MAA methods often degrade substantially under those shifts.

Their method, Authorship Tracing via Likelihood-based Attribution of Sources (ATLAS), frames MAA as source-conditioned text modeling rather than direct source prediction. ATLAS learns how text from each source family is generated and attributes a given text by comparing its likelihood under each learned source condition, aggregating the evidence token by token with clipping so that no single token dominates. The authors also introduce MAABench, a benchmark for practical out-of-distribution settings such as domain and version shift.

ATLAS outperforms existing baselines on MAABench and on OpenTuringBench. When both the generation domain and the model version change on MAABench, it reaches 74.27% accuracy, 9.00 percentage points above the strongest baseline. The method extends to distillation: by measuring which source model a target model most closely resembles, ATLAS recovered the known teacher of every distilled model the authors evaluated.

How the three levers interlock

Each paper stands alone, but the dependencies between them are the useful part for anyone designing controls. A tiered access regime needs a capability measurement to assign tiers, and the saturation paper shows that measurement weakening exactly where it matters most, at the frontier, unless transcripts are kept and analyzed. Its failure case, underestimating a new class of reasoning models, is a warning that capability measures can lag a change of paradigm, which is the moment a tier assignment is most likely to be wrong.

Attribution closes a different gap. MAIAM's concern about derivatives, and its evidence that safety tuning can be removed cheaply, describes capability moving away from the terms under which it was granted. Distillation is one such path, and ATLAS's teacher recovery is an after-the-fact way to see it. It is evidence, not proof: at 74.27% accuracy under combined domain and version shift, roughly one attribution in four is still wrong in the hardest setting the authors test.

What governance and evaluation owners can do now

None of these papers is a deployed regime, and each reports results on its own benchmarks. They still point to concrete changes in practice.

Sources